diff --git a/backend/gestion/handlers/update_profile.go b/backend/gestion/handlers/update_profile.go index 879bc72b..02d059a1 100644 --- a/backend/gestion/handlers/update_profile.go +++ b/backend/gestion/handlers/update_profile.go @@ -139,6 +139,23 @@ func UpdateMyProfile(c *gin.Context) { }) } +// GetMyProfile retourne le profil du client connecté +// GET /api/v1/profile +func GetMyProfile(c *gin.Context) { + database := c.MustGet("database").(*db.Database) + username, exists := c.Get("username") + if !exists { + c.JSON(http.StatusUnauthorized, gin.H{"error": "Non authentifié"}) + return + } + client, err := database.GetClientByUsername(username.(string)) + if err != nil || client == nil { + c.JSON(http.StatusNotFound, gin.H{"error": "Client non trouvé"}) + return + } + c.JSON(http.StatusOK, gin.H{"success": true, "client": sanitizeClient(client)}) +} + // ============================================ // MODIFICATION PROFIL CLIENT (PAR ADMIN) // ============================================ diff --git a/backend/gestion/routes/routes.go b/backend/gestion/routes/routes.go index a093ecbb..7392c8cd 100644 --- a/backend/gestion/routes/routes.go +++ b/backend/gestion/routes/routes.go @@ -101,8 +101,9 @@ func SetupRoutes(router *gin.Engine, database *db.Database, geoService *services cartGroupV1.POST("/push-token", handlers.RegisterPushToken) cartGroupV1.DELETE("/push-token", handlers.UnregisterPushToken) - // 👤 PROFIL CLIENT - MODIFICATION PAR LE CLIENT - cartGroupV1.PUT("/profile/update", handlers.UpdateMyProfile) // ✅ Modifier mon profil + // 👤 PROFIL CLIENT + cartGroupV1.GET("/profile", handlers.GetMyProfile) // ✅ Récupérer mon profil + cartGroupV1.PUT("/profile/update", handlers.UpdateMyProfile) // ✅ Modifier mon profil // 🎁 PARRAINAGE CLIENT cartGroupV1.GET("/referral/balance", handlers.GetMyReferralBalance) diff --git a/docker/backend/Dockerfile b/docker/backend/Dockerfile index c3edc50f..0fad5e1d 100644 --- a/docker/backend/Dockerfile +++ b/docker/backend/Dockerfile @@ -5,7 +5,7 @@ WORKDIR /app RUN apk add --no-cache git ca-certificates tzdata gcc musl-dev # Copier go mod files -COPY backend/backend/gestion/go.mod backend/backend/gestion/go.sum ./ +COPY backend/gestion/go.mod backend/gestion/go.sum ./ # Configurer Go et télécharger les dépendances ENV GOPROXY=https://proxy.golang.org,direct @@ -16,7 +16,7 @@ ENV CGO_ENABLED=0 RUN go mod download # Copier tout le code source -COPY backend/backend/gestion/ . +COPY backend/gestion/ . # Build le binaire RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \ @@ -26,7 +26,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \ # ========================================================= # Stage 2: Runtime # ========================================================= -FROM alpine:latest +FROM alpine:latest AS runtime # Installer les dépendances runtime RUN apk --no-cache add ca-certificates tzdata wget @@ -55,3 +55,30 @@ USER app EXPOSE 8080 ENTRYPOINT ["./entrypoint.sh"] + +# ========================================================= +# Stage 3: WAF (Nginx + ModSecurity) +# ========================================================= +FROM owasp/modsecurity-crs:nginx-alpine AS waf + +USER root + +# Logs ModSecurity +RUN mkdir -p /var/log/modsec && chown -R nginx:nginx /var/log/modsec + +# Certificats SSL +RUN mkdir -p /etc/nginx/certs +COPY docker/backend/certs/cert.pem /etc/nginx/certs/cert.pem +COPY docker/backend/certs/key.pem /etc/nginx/certs/key.pem +RUN chown -R nginx:nginx /etc/nginx/certs && chmod 640 /etc/nginx/certs/key.pem + +COPY docker/backend/nginx.conf /etc/nginx/conf.d/app.conf +COPY docker/backend/custom-rules.conf /etc/nginx/modsec/custom-rules.conf +RUN echo "Include /etc/nginx/modsec/custom-rules.conf" > /etc/nginx/modsec/custom-includes.conf + +RUN rm -f /etc/nginx/templates/conf.d/default.conf.template || true +RUN chown -R nginx:nginx /usr/share/nginx/html + +USER nginx +EXPOSE 80 443 +CMD ["nginx", "-g", "daemon off;"] diff --git a/docker/frontend/custom-rules.conf b/docker/backend/custom-rules.conf similarity index 100% rename from docker/frontend/custom-rules.conf rename to docker/backend/custom-rules.conf diff --git a/docker/backend/nginx.conf b/docker/backend/nginx.conf new file mode 100644 index 00000000..500ddbb8 --- /dev/null +++ b/docker/backend/nginx.conf @@ -0,0 +1,90 @@ +# ========================================================= +# Request ID for correlation +# ========================================================= +map $http_x_request_id $req_id { + default $http_x_request_id; + "" $request_id; +} + +# ========================================================= +# Backend interne (réseau Docker) +# ========================================================= +upstream backend { + server backend:8080; + keepalive 32; +} + +# ========================================================= +# HTTP → HTTPS redirect +# ========================================================= +server { + listen 80; + listen [::]:80; + server_name 5.181.0.112.nip.io; + return 301 https://$host$request_uri; +} + +# ========================================================= +# HTTPS Server (WAF) +# ========================================================= +server { + listen 443 ssl; + listen [::]:443 ssl; + server_name 5.181.0.112.nip.io; + + ssl_certificate /etc/nginx/certs/cert.pem; + ssl_certificate_key /etc/nginx/certs/key.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + + client_max_body_size 10M; + + modsecurity on; + modsecurity_rules_file /etc/nginx/modsec/custom-rules.conf; + + location / { + limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; } + + if ($request_method = 'OPTIONS') { + add_header 'Access-Control-Allow-Origin' "$http_origin" always; + add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Request-ID' always; + add_header 'Access-Control-Allow-Credentials' 'true' always; + add_header 'Access-Control-Max-Age' 86400 always; + add_header 'Content-Length' 0; + add_header 'Content-Type' 'text/plain charset=UTF-8'; + return 204; + } + + proxy_pass http://backend; + proxy_http_version 1.1; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Request-ID $req_id; + proxy_set_header Connection ""; + + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + + location ~ /\. { + deny all; + access_log off; + log_not_found off; + } + + location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ { + deny all; + access_log off; + log_not_found off; + } +} diff --git a/docker/docker-compose-prod.yml b/docker/docker-compose-prod.yml index 4926b921..150e2bfd 100644 --- a/docker/docker-compose-prod.yml +++ b/docker/docker-compose-prod.yml @@ -6,6 +6,7 @@ services: build: context: .. dockerfile: docker/backend/Dockerfile + target: runtime container_name: gestion-backend restart: unless-stopped environment: @@ -26,8 +27,7 @@ services: - TOMTOM_API_KEY=${TOMTOM_API_KEY} - API_PORT=${API_PORT:-8080} volumes: - # ✅ Volume partagé pour les uploads (même volume que le frontend) - - frontend_uploads:/app/uploads + - backend_uploads:/app/uploads networks: - gestion-network depends_on: @@ -37,28 +37,29 @@ services: condition: service_healthy # ========================================================= - # Frontend Nginx + ModSecurity + # WAF (Nginx + ModSecurity) # ========================================================= - frontend: + waf: build: context: .. - dockerfile: docker/frontend/Dockerfile - container_name: gestion-frontend + dockerfile: docker/backend/Dockerfile + target: waf + container_name: gestion-waf restart: unless-stopped environment: - DISABLE_MODSEC_ENV_SUBST=true - PARANOIA=2 - ANOMALY_INBOUND=5 - ANOMALY_OUTBOUND=4 - - BACKEND_HOST=backend - - BACKEND_PORT=${API_PORT:-8080} ports: - "80:80" + - "443:443" volumes: - # ✅ Volume partagé pour les uploads (accessible via nginx) - - frontend_uploads:/usr/share/nginx/html/uploads + - backend_uploads:/usr/share/nginx/html/uploads:ro networks: - gestion-network + depends_on: + - backend # ========================================================= # PostgreSQL @@ -132,6 +133,5 @@ volumes: driver: local redis_data: driver: local - # ✅ Volume partagé entre backend et frontend - frontend_uploads: + backend_uploads: driver: local diff --git a/docker/frontend/Dockerfile b/docker/frontend/Dockerfile deleted file mode 100644 index 220ad67c..00000000 --- a/docker/frontend/Dockerfile +++ /dev/null @@ -1,48 +0,0 @@ -# ========================================================= -# Stage 1: Build Frontend -# ========================================================= -FROM node:20-alpine AS builder - -WORKDIR /build - -# Copier package files depuis frontend-prep -COPY frontend/frontend-prep/package*.json ./ - -# Installer les dépendances -RUN npm ci - -# Copier le code source -COPY frontend/frontend-prep/ . - -# Build -RUN npm run build - -# ========================================================= -# Stage 2: Nginx + ModSecurity -# ========================================================= -FROM owasp/modsecurity-crs:nginx-alpine - -USER root - -# Copier build frontend -COPY --from=builder /build/dist /usr/share/nginx/html - -#COPY docker/frontend/cert/cert.pem /etc/nginx/certs/cert.pem -#COPY docker/frontend/cert/key.pem /etc/nginx/certs/key.pem -#RUN chown root:nginx /etc/nginx/certs/cert.pem /etc/nginx/certs/key.pem && \ -# chmod 644 /etc/nginx/certs/cert.pem && \ -# chmod 640 /etc/nginx/certs/key.pem - -# Logs ModSecurity -RUN mkdir -p /var/log/modsec && chown -R nginx:nginx /var/log/modsec - -COPY docker/frontend/nginx.conf /etc/nginx/conf.d/app.conf -COPY docker/frontend/custom-rules.conf /etc/nginx/modsec/custom-rules.conf -RUN echo "Include /etc/nginx/modsec/custom-rules.conf" > /etc/nginx/modsec/custom-includes.conf - -RUN rm -f /etc/nginx/templates/conf.d/default.conf.template || true -RUN chown -R nginx:nginx /usr/share/nginx/html - -USER nginx -EXPOSE 80 -CMD ["nginx", "-g", "daemon off;"] diff --git a/docker/frontend/cert/cert.pem b/docker/frontend/cert/cert.pem deleted file mode 100644 index c9f8a1a5..00000000 --- a/docker/frontend/cert/cert.pem +++ /dev/null @@ -1,24 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIECjCCAnKgAwIBAgIQQesYDZxq7zMlKT1zztYmUDANBgkqhkiG9w0BAQsFADBh -MR4wHAYDVQQKExVta2NlcnQgZGV2ZWxvcG1lbnQgQ0ExGzAZBgNVBAsMEnhvcl9m -YWtlcnNAQXN1c1hvcjEiMCAGA1UEAwwZbWtjZXJ0IHhvcl9mYWtlcnNAQXN1c1hv -cjAeFw0yNjAxMjAwODQxNDhaFw0yODA0MjAwNzQxNDhaMEYxJzAlBgNVBAoTHm1r -Y2VydCBkZXZlbG9wbWVudCBjZXJ0aWZpY2F0ZTEbMBkGA1UECwwSeG9yX2Zha2Vy -c0BBc3VzWG9yMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4gjHuXBb -eRVHf29Lsn1JlFSHpSTsImMrjLHnUh0jCR+1i2xQ3GQVFJY8YLWvwJv64SnsDZBE -JBbSdsocfmJJl8mnW8INYgLqFBe/Cr/DFZqJcAcANVuxzjVpmWBqvLA3fYPKJHB3 -66Lot6QZoObbvuOJpar+PubAiNVH6F/0ehy4O5daegfUlGxdZOTRsVhV8uwjH9+H -V8wL9ZyK8h6kl9VjQifP/FTdpaGhtkSoVHod/uynmVzF/PscTcUVwh+uQcqWj3fd -Itzcinj8K46xZLiFp/QHoz1kX/mDLtwbxbDAD9kGxf28J366VqyxJQzDjdvv/VYZ -QoEThibA34msTQIDAQABo1kwVzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYI -KwYBBQUHAwEwHwYDVR0jBBgwFoAUyPQyLZZ7Al7A1Dvf/5xLRLY9aDYwDwYDVR0R -BAgwBocErBSn7TANBgkqhkiG9w0BAQsFAAOCAYEAWVgf0e/30255rHo8Z3/35YBE -Hrauwf8ef+aGVB+cLk2p1+UiYOgzvXKOeRP+9AVaASPg/mB7yA17DVrClWW7QjpU -iBkVCP6AsOlMVTPfKrKUucrWtac337TTleAMgtSjeApfdHbd3D4imilc16GLzVOG -9CKuvx6hJam4Bo4BfsO8TWh6F2hWxJL1dtY0d65ceBC40FXfowdJARgD85XCbJnY -4i/Twu80Hgrhok+CVDdH49DgMvUifckdsFCKqigZpJPRhGfbzfT61ysVcCXXsmj/ -yFPo71zE5bq4T2ig+zGDbt64C+tP6a0P643SEnzyfEiUVTCWfIcrE17bSapzl5oa -PYSDkbC/OKoXsvvfVwDljNY0qXHTVjoTw6/8cXSAomZAaTAWZGkAWYBZEFpyEYu/ -aBRDw5T/qo2N2xOt3NrmmWmkU8cFF8oESk5GJDoFFO/yp9MEvANWq6OQ4PZVEsdN -VtqzP07AD88B7kkD6qn8pSp8yZBYoL+Qk4d93HPg ------END CERTIFICATE----- diff --git a/docker/frontend/cert/key.pem b/docker/frontend/cert/key.pem deleted file mode 100644 index 1e42b8be..00000000 --- a/docker/frontend/cert/key.pem +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDiCMe5cFt5FUd/ -b0uyfUmUVIelJOwiYyuMsedSHSMJH7WLbFDcZBUUljxgta/Am/rhKewNkEQkFtJ2 -yhx+YkmXyadbwg1iAuoUF78Kv8MVmolwBwA1W7HONWmZYGq8sDd9g8okcHfroui3 -pBmg5tu+44mlqv4+5sCI1UfoX/R6HLg7l1p6B9SUbF1k5NGxWFXy7CMf34dXzAv1 -nIryHqSX1WNCJ8/8VN2loaG2RKhUeh3+7KeZXMX8+xxNxRXCH65BypaPd90i3NyK -ePwrjrFkuIWn9AejPWRf+YMu3BvFsMAP2QbF/bwnfrpWrLElDMON2+/9VhlCgROG -JsDfiaxNAgMBAAECggEAB2kzyTH0odPvh+9Ze0Tt1mnuF51OC7OWMDL+C1xus2Qh -gux+ezdh1I63dJFIbad/koXaGji+bzN7W481X3RwBsTDErhaUXoYfCeqKRtP9WOf -eXeVS2qR+hmYuIFnhn+9lgUt6cNxPx3UhP7hozumfUv/DZo9Y0kUC3h4ttb8kEtU -ePfv0RledHKOEM35zvhvVTpyF4LfvnMyu/E+hJp2kIptPZ5DEsvXT3CsLCNGOWmt -HZlvVihQ0dtUp1FjDQsiwB8zSErQkZDTv8L0OvBvVyFqhhP/KReZi2pCTsBSYcYU -MGmZanqg1mLCqVDVPnaquCcuo39DCfETXNS4OFK4qQKBgQD8tsmwXtU0ai4ryVne -SOOJiCQFsGfZgxuSJ7XPWj8BnLSs0pi3ddEdJQvkj7z43iZ4AaW2VX9abQkZhlNv -v1Y80+MBTwCSM6CZLzCYWMnzRNY1hUR6bwQa/x5JyXU0sbx3B/GCH9hvhjWn9Dit -uphoPgC8ryKy26de7E5FKIfzFQKBgQDk+S7oUoQFXZ7YAIIXXVjp4nQVdU8zb7nW -B+yxyE5L+q6afgi2w9Jmm7DrQAg5GuY+3xlhICol/oxLb6nWkX5C2FTYTFaqSi5B -rZVqD6D/WGosNzwbcgai4TjmiJ81ssVwMuizQLksOPexuVYDUikofaWsF1G/E5af -rGRJbuACWQKBgQCwMNCVgsiq7oyaQpvBepgJPz2+Kat93wbN85myo3ziJttg0sNe -xWmyJC4SgJSD/n5blOpwIVPVO8foX9q0QnZhmmjedLI1PIFvy5LZ5K2ISin+zpdb -tSLrn4sCbs6kmnaHlqYuzv0bZDrsij0qArpXk0L4SjKq+LHMYHyBgyylsQKBgBHI -kK4Wio5oIQghsfjilR9FKULpY4dZLBPFdcqxBfO8uobhNwgK2XKCsRD0Xi8hObS0 -WyJB/0QIKxlIyOYTUr0aVCygcTK0pDcRpkMgh56NXWGlwJNZHc7Uszikb8kZ41+9 -dHlHk5otqn8xJ88GOJAeghmFjiHLAa3RE9DoPZmxAoGAC2sRi0M7pr6TV7Pz1f8S -DUy+iout42FNKCt00J2C7TxoTsKsWH4UKL0mqqanOr7vb0Wkow6nH7xT8u4DUGsA -oXfJqcGShNaG/XYFo5TaVC4k7rZY87+P12429J42uXVtGgjCR3lE53CdS3bY0tl5 -OG0lgtOwXaXbU53BuLCbndU= ------END PRIVATE KEY----- diff --git a/docker/frontend/logs/audit.log b/docker/frontend/logs/audit.log deleted file mode 100644 index b17114e5..00000000 --- a/docker/frontend/logs/audit.log +++ /dev/null @@ -1,3162 +0,0 @@ ----IrHNKUDO---A-- -[16/Jun/2025:05:36:08 +0000] 175005216849.844682 172.19.0.1 45454 172.19.0.2 443 ----IrHNKUDO---B-- -GET / HTTP/1.1 -Host: localhost:8443 -User-Agent: curl/7.81.0 -Accept: */* - ----IrHNKUDO---D-- - ----IrHNKUDO---F-- -HTTP/1.1 403 - ----IrHNKUDO---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Contains' with parameter `curl' against variable `REQUEST_HEADERS:User-Agent' (Value: `curl/7.81.0' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "1"] [id "999001"] [rev ""] [msg "Blocked curl request"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005216849.844682"] [ref "o0,4v48,11"] - ----IrHNKUDO---I-- - ----IrHNKUDO---J-- - ----IrHNKUDO---Z-- - ----cI5in2Az---A-- -[16/Jun/2025:05:46:05 +0000] 175005276597.127114 103.250.147.78 60510 172.19.0.2 443 ----cI5in2Az---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----cI5in2Az---D-- - ----cI5in2Az---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----cI5in2Az---F-- -HTTP/1.1 200 -Server: nginx/1.24.0 -Date: Mon, 16 Jun 2025 05:46:05 GMT -Content-Length: 615 -Content-Type: text/html -Last-Modified: Mon, 16 Jun 2025 05:35:31 GMT -Connection: keep-alive -ETag: "684fad23-267" - ----cI5in2Az---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005276597.127114"] [ref "o0,18o0,13o13,5v21,18"] - ----cI5in2Az---I-- - ----cI5in2Az---J-- - ----cI5in2Az---Z-- - ----wx0FSLeF---A-- -[16/Jun/2025:05:46:05 +0000] 175005276587.546540 103.250.147.78 60510 172.19.0.2 443 ----wx0FSLeF---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/ -Sec-Fetch-Site: same-origin - ----wx0FSLeF---D-- - ----wx0FSLeF---E-- -\x0d\x0a404 Not Found\x0d\x0a\x0d\x0a

404 Not Found

\x0d\x0a
nginx/1.24.0
\x0d\x0a\x0d\x0a\x0d\x0a - ----wx0FSLeF---F-- -HTTP/1.1 404 -Server: nginx/1.24.0 -Date: Mon, 16 Jun 2025 05:46:05 GMT -Content-Length: 153 -Content-Type: text/html -Connection: keep-alive - ----wx0FSLeF---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005276587.546540"] [ref "o0,18o0,13o13,5v32,18"] - ----wx0FSLeF---I-- - ----wx0FSLeF---J-- - ----wx0FSLeF---Z-- - ----YKWidTE4---A-- -[16/Jun/2025:05:46:12 +0000] 175005277285.130394 172.19.0.1 41534 172.19.0.2 443 ----YKWidTE4---B-- -GET / HTTP/1.1 -Host: localhost:8443 -User-Agent: curl/7.81.0 -Accept: */* - ----YKWidTE4---D-- - ----YKWidTE4---F-- -HTTP/1.1 403 - ----YKWidTE4---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Contains' with parameter `curl' against variable `REQUEST_HEADERS:User-Agent' (Value: `curl/7.81.0' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "1"] [id "999001"] [rev ""] [msg "Blocked curl request"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005277285.130394"] [ref "o0,4v48,11"] - ----YKWidTE4---I-- - ----YKWidTE4---J-- - ----YKWidTE4---Z-- - ----wIbLZyjL---A-- -[16/Jun/2025:05:46:17 +0000] 175005277734.297664 103.250.147.78 60510 172.19.0.2 443 ----wIbLZyjL---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: "684fad23-267" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -If-Modified-Since: Mon, 16 Jun 2025 05:35:31 GMT -Priority: u=0, i - ----wIbLZyjL---D-- - ----wIbLZyjL---F-- -HTTP/1.1 304 -Server: nginx/1.24.0 -Date: Mon, 16 Jun 2025 05:46:17 GMT -Last-Modified: Mon, 16 Jun 2025 05:35:31 GMT -Connection: keep-alive -ETag: "684fad23-267" - ----wIbLZyjL---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005277734.297664"] [ref "o0,18o0,13o13,5v21,18"] - ----wIbLZyjL---I-- - ----wIbLZyjL---J-- - ----wIbLZyjL---Z-- - ----ZAQJALK7---A-- -[16/Jun/2025:05:47:17 +0000] 175005283786.473028 103.250.147.78 60510 172.19.0.2 443 ----ZAQJALK7---B-- -GET /?testparam=test%22 HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----ZAQJALK7---D-- - ----ZAQJALK7---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx/1.24.0
\x0d\x0a\x0d\x0a\x0d\x0a - ----ZAQJALK7---F-- -HTTP/1.1 403 -Server: nginx/1.24.0 -Date: Mon, 16 Jun 2025 05:47:17 GMT -Content-Length: 153 -Content-Type: text/html -Connection: keep-alive - ----ZAQJALK7---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005283786.473028"] [ref "o0,18o0,13o13,5v39,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Contains' with parameter `test' against variable `ARGS:testparam' (Value: `test"' ) [file "/usr/local/nginx/conf/modsec/modsecurity.conf"] [line "9"] [id "12345"] [rev ""] [msg "Test param blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005283786.473028"] [ref "o0,4v16,5"] - ----ZAQJALK7---I-- - ----ZAQJALK7---J-- - ----ZAQJALK7---Z-- - ----qfKUWrM8---A-- -[16/Jun/2025:05:47:34 +0000] 175005285435.440299 103.250.147.78 60510 172.19.0.2 443 ----qfKUWrM8---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: "684fad23-267" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -If-Modified-Since: Mon, 16 Jun 2025 05:35:31 GMT -Priority: u=0, i - ----qfKUWrM8---D-- - ----qfKUWrM8---F-- -HTTP/1.1 304 -Server: nginx/1.24.0 -Date: Mon, 16 Jun 2025 05:47:34 GMT -Last-Modified: Mon, 16 Jun 2025 05:35:31 GMT -Connection: keep-alive -ETag: "684fad23-267" - ----qfKUWrM8---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005285435.440299"] [ref "o0,18o0,13o13,5v21,18"] - ----qfKUWrM8---I-- - ----qfKUWrM8---J-- - ----qfKUWrM8---Z-- - ----dwstAwc3---A-- -[16/Jun/2025:05:57:26 +0000] 175005344675.143932 103.250.147.78 60537 172.19.0.2 443 ----dwstAwc3---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: "684fad23-267" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -If-Modified-Since: Mon, 16 Jun 2025 05:35:31 GMT -Priority: u=0, i - ----dwstAwc3---D-- - ----dwstAwc3---F-- -HTTP/1.1 403 - ----dwstAwc3---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005344675.143932"] [ref "o0,1v4,1"] - ----dwstAwc3---I-- - ----dwstAwc3---J-- - ----dwstAwc3---Z-- - ----GjBMH9Bo---A-- -[16/Jun/2025:05:57:26 +0000] 175005344660.625979 103.250.147.78 60537 172.19.0.2 443 ----GjBMH9Bo---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/ -Sec-Fetch-Site: same-origin - ----GjBMH9Bo---D-- - ----GjBMH9Bo---F-- -HTTP/1.1 403 - ----GjBMH9Bo---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005344660.625979"] [ref "o0,12v4,12"] - ----GjBMH9Bo---I-- - ----GjBMH9Bo---J-- - ----GjBMH9Bo---Z-- - ----cRwGs9XN---A-- -[16/Jun/2025:05:57:28 +0000] 175005344819.769882 103.250.147.78 60538 172.19.0.2 443 ----cRwGs9XN---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----cRwGs9XN---D-- - ----cRwGs9XN---F-- -HTTP/1.1 403 - ----cRwGs9XN---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005344819.769882"] [ref "o0,1v4,1"] - ----cRwGs9XN---I-- - ----cRwGs9XN---J-- - ----cRwGs9XN---Z-- - ----5AKcdHS3---A-- -[16/Jun/2025:05:57:28 +0000] 175005344826.350732 103.250.147.78 60538 172.19.0.2 443 ----5AKcdHS3---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/ -Sec-Fetch-Site: same-origin - ----5AKcdHS3---D-- - ----5AKcdHS3---F-- -HTTP/1.1 403 - ----5AKcdHS3---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005344826.350732"] [ref "o0,12v4,12"] - ----5AKcdHS3---I-- - ----5AKcdHS3---J-- - ----5AKcdHS3---Z-- - ----YuaDsIPQ---A-- -[16/Jun/2025:05:57:31 +0000] 175005345168.922966 103.250.147.78 60543 172.19.0.2 443 ----YuaDsIPQ---B-- -GET //api HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----YuaDsIPQ---D-- - ----YuaDsIPQ---F-- -HTTP/1.1 403 - ----YuaDsIPQ---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `//api' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "//api"] [unique_id "175005345168.922966"] [ref "o0,5v4,5"] - ----YuaDsIPQ---I-- - ----YuaDsIPQ---J-- - ----YuaDsIPQ---Z-- - ----cqS9zAPC---A-- -[16/Jun/2025:05:57:50 +0000] 175005347049.210812 103.250.147.78 60543 172.19.0.2 443 ----cqS9zAPC---B-- -GET /api HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----cqS9zAPC---D-- - ----cqS9zAPC---F-- -HTTP/1.1 403 - ----cqS9zAPC---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/api' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/api"] [unique_id "175005347049.210812"] [ref "o0,4v4,4"] - ----cqS9zAPC---I-- - ----cqS9zAPC---J-- - ----cqS9zAPC---Z-- - ----1nR7DrxW---A-- -[16/Jun/2025:05:57:50 +0000] 175005347052.600884 103.250.147.78 60543 172.19.0.2 443 ----1nR7DrxW---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/api -Sec-Fetch-Site: same-origin - ----1nR7DrxW---D-- - ----1nR7DrxW---F-- -HTTP/1.1 403 - ----1nR7DrxW---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005347052.600884"] [ref "o0,12v4,12"] - ----1nR7DrxW---I-- - ----1nR7DrxW---J-- - ----1nR7DrxW---Z-- - ----LDYUnbRg---A-- -[16/Jun/2025:05:58:34 +0000] 175005351476.885429 103.250.147.78 60544 172.19.0.2 443 ----LDYUnbRg---B-- -GET /api HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----LDYUnbRg---D-- - ----LDYUnbRg---F-- -HTTP/1.1 403 - ----LDYUnbRg---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/api' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/api"] [unique_id "175005351476.885429"] [ref "o0,4v4,4"] - ----LDYUnbRg---I-- - ----LDYUnbRg---J-- - ----LDYUnbRg---Z-- - ----mYsIFw3m---A-- -[16/Jun/2025:05:58:34 +0000] 175005351417.182151 103.250.147.78 60544 172.19.0.2 443 ----mYsIFw3m---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/api -Sec-Fetch-Site: same-origin - ----mYsIFw3m---D-- - ----mYsIFw3m---F-- -HTTP/1.1 403 - ----mYsIFw3m---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005351417.182151"] [ref "o0,12v4,12"] - ----mYsIFw3m---I-- - ----mYsIFw3m---J-- - ----mYsIFw3m---Z-- - ----tGQHhJXh---A-- -[16/Jun/2025:06:02:33 +0000] 175005375350.206712 103.250.147.78 60559 172.19.0.2 443 ----tGQHhJXh---B-- -GET /api HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----tGQHhJXh---D-- - ----tGQHhJXh---F-- -HTTP/1.1 403 - ----tGQHhJXh---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/api' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/api"] [unique_id "175005375350.206712"] [ref "o0,4v4,4"] - ----tGQHhJXh---I-- - ----tGQHhJXh---J-- - ----tGQHhJXh---Z-- - ----mQwOS2x7---A-- -[16/Jun/2025:06:02:33 +0000] 175005375393.658231 103.250.147.78 60559 172.19.0.2 443 ----mQwOS2x7---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/api -Sec-Fetch-Site: same-origin - ----mQwOS2x7---D-- - ----mQwOS2x7---F-- -HTTP/1.1 403 - ----mQwOS2x7---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005375393.658231"] [ref "o0,12v4,12"] - ----mQwOS2x7---I-- - ----mQwOS2x7---J-- - ----mQwOS2x7---Z-- - ----UKxiGDuu---A-- -[16/Jun/2025:06:02:36 +0000] 175005375672.427890 103.250.147.78 60560 172.19.0.2 443 ----UKxiGDuu---B-- -GET /api HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----UKxiGDuu---D-- - ----UKxiGDuu---F-- -HTTP/1.1 403 - ----UKxiGDuu---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/api' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/api"] [unique_id "175005375672.427890"] [ref "o0,4v4,4"] - ----UKxiGDuu---I-- - ----UKxiGDuu---J-- - ----UKxiGDuu---Z-- - ----rI1260HD---A-- -[16/Jun/2025:06:02:36 +0000] 175005375680.813462 103.250.147.78 60560 172.19.0.2 443 ----rI1260HD---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/api -Sec-Fetch-Site: same-origin - ----rI1260HD---D-- - ----rI1260HD---F-- -HTTP/1.1 403 - ----rI1260HD---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005375680.813462"] [ref "o0,12v4,12"] - ----rI1260HD---I-- - ----rI1260HD---J-- - ----rI1260HD---Z-- - ----vs2KCaUG---A-- -[16/Jun/2025:06:02:37 +0000] 175005375729.579352 103.250.147.78 60561 172.19.0.2 443 ----vs2KCaUG---B-- -GET /api HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----vs2KCaUG---D-- - ----vs2KCaUG---F-- -HTTP/1.1 403 - ----vs2KCaUG---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/api' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/api"] [unique_id "175005375729.579352"] [ref "o0,4v4,4"] - ----vs2KCaUG---I-- - ----vs2KCaUG---J-- - ----vs2KCaUG---Z-- - ----EOB3zrfP---A-- -[16/Jun/2025:06:03:03 +0000] 175005378386.469966 103.250.147.78 60561 172.19.0.2 443 ----EOB3zrfP---B-- -GET /api HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----EOB3zrfP---D-- - ----EOB3zrfP---F-- -HTTP/1.1 403 - ----EOB3zrfP---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/api' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/api"] [unique_id "175005378386.469966"] [ref "o0,4v4,4"] - ----EOB3zrfP---I-- - ----EOB3zrfP---J-- - ----EOB3zrfP---Z-- - ----GXyRP1Ka---A-- -[16/Jun/2025:06:03:04 +0000] 17500537844.310570 103.250.147.78 60561 172.19.0.2 443 ----GXyRP1Ka---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/api -Sec-Fetch-Site: same-origin - ----GXyRP1Ka---D-- - ----GXyRP1Ka---F-- -HTTP/1.1 403 - ----GXyRP1Ka---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "17500537844.310570"] [ref "o0,12v4,12"] - ----GXyRP1Ka---I-- - ----GXyRP1Ka---J-- - ----GXyRP1Ka---Z-- - ----XVwNpWtx---A-- -[16/Jun/2025:06:03:07 +0000] 175005378756.114459 103.250.147.78 60564 172.19.0.2 443 ----XVwNpWtx---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----XVwNpWtx---D-- - ----XVwNpWtx---F-- -HTTP/1.1 403 - ----XVwNpWtx---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005378756.114459"] [ref "o0,1v4,1"] - ----XVwNpWtx---I-- - ----XVwNpWtx---J-- - ----XVwNpWtx---Z-- - ----upsrDxyp---A-- -[16/Jun/2025:06:03:15 +0000] 175005379574.344754 103.250.147.78 60564 172.19.0.2 443 ----upsrDxyp---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----upsrDxyp---D-- - ----upsrDxyp---F-- -HTTP/1.1 403 - ----upsrDxyp---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005379574.344754"] [ref "o0,1v4,1"] - ----upsrDxyp---I-- - ----upsrDxyp---J-- - ----upsrDxyp---Z-- - ----EReEFZl8---A-- -[16/Jun/2025:06:03:15 +0000] 175005379590.829467 103.250.147.78 60564 172.19.0.2 443 ----EReEFZl8---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/ -Sec-Fetch-Site: same-origin - ----EReEFZl8---D-- - ----EReEFZl8---F-- -HTTP/1.1 403 - ----EReEFZl8---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005379590.829467"] [ref "o0,12v4,12"] - ----EReEFZl8---I-- - ----EReEFZl8---J-- - ----EReEFZl8---Z-- - ----QniNy1Bm---A-- -[16/Jun/2025:06:03:52 +0000] 175005383255.337068 103.250.147.78 60567 172.19.0.2 443 ----QniNy1Bm---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----QniNy1Bm---D-- - ----QniNy1Bm---F-- -HTTP/1.1 403 - ----QniNy1Bm---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005383255.337068"] [ref "o0,1v4,1"] - ----QniNy1Bm---I-- - ----QniNy1Bm---J-- - ----QniNy1Bm---Z-- - ----IWiMqXPv---A-- -[16/Jun/2025:06:03:53 +0000] 175005383372.517662 103.250.147.78 60567 172.19.0.2 443 ----IWiMqXPv---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/ -Sec-Fetch-Site: same-origin - ----IWiMqXPv---D-- - ----IWiMqXPv---F-- -HTTP/1.1 403 - ----IWiMqXPv---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005383372.517662"] [ref "o0,12v4,12"] - ----IWiMqXPv---I-- - ----IWiMqXPv---J-- - ----IWiMqXPv---Z-- - ----WbBdunxr---A-- -[16/Jun/2025:06:03:54 +0000] 175005383457.283759 103.250.147.78 60568 172.19.0.2 443 ----WbBdunxr---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----WbBdunxr---D-- - ----WbBdunxr---F-- -HTTP/1.1 403 - ----WbBdunxr---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005383457.283759"] [ref "o0,1v4,1"] - ----WbBdunxr---I-- - ----WbBdunxr---J-- - ----WbBdunxr---Z-- - ----3AugNZM5---A-- -[16/Jun/2025:06:03:54 +0000] 175005383429.928904 103.250.147.78 60568 172.19.0.2 443 ----3AugNZM5---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/ -Sec-Fetch-Site: same-origin - ----3AugNZM5---D-- - ----3AugNZM5---F-- -HTTP/1.1 403 - ----3AugNZM5---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005383429.928904"] [ref "o0,12v4,12"] - ----3AugNZM5---I-- - ----3AugNZM5---J-- - ----3AugNZM5---Z-- - ----VCDFO8WC---A-- -[16/Jun/2025:06:04:23 +0000] 175005386322.040565 103.250.147.78 60569 172.19.0.2 443 ----VCDFO8WC---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----VCDFO8WC---D-- - ----VCDFO8WC---F-- -HTTP/1.1 403 - ----VCDFO8WC---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005386322.040565"] [ref "o0,1v4,1"] - ----VCDFO8WC---I-- - ----VCDFO8WC---J-- - ----VCDFO8WC---Z-- - ----Lncxbews---A-- -[16/Jun/2025:06:04:23 +0000] 175005386312.139663 103.250.147.78 60569 172.19.0.2 443 ----Lncxbews---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/ -Sec-Fetch-Site: same-origin - ----Lncxbews---D-- - ----Lncxbews---F-- -HTTP/1.1 403 - ----Lncxbews---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005386312.139663"] [ref "o0,12v4,12"] - ----Lncxbews---I-- - ----Lncxbews---J-- - ----Lncxbews---Z-- - ----037wAVWE---A-- -[16/Jun/2025:06:04:25 +0000] 175005386582.899222 103.250.147.78 60570 172.19.0.2 443 ----037wAVWE---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----037wAVWE---D-- - ----037wAVWE---F-- -HTTP/1.1 403 - ----037wAVWE---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005386582.899222"] [ref "o0,1v4,1"] - ----037wAVWE---I-- - ----037wAVWE---J-- - ----037wAVWE---Z-- - ----MD9qGsLZ---A-- -[16/Jun/2025:06:04:25 +0000] 175005386586.947902 103.250.147.78 60570 172.19.0.2 443 ----MD9qGsLZ---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/ -Sec-Fetch-Site: same-origin - ----MD9qGsLZ---D-- - ----MD9qGsLZ---F-- -HTTP/1.1 403 - ----MD9qGsLZ---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005386586.947902"] [ref "o0,12v4,12"] - ----MD9qGsLZ---I-- - ----MD9qGsLZ---J-- - ----MD9qGsLZ---Z-- - ----51n19TYZ---A-- -[16/Jun/2025:06:04:27 +0000] 175005386720.310769 103.250.147.78 60572 172.19.0.2 443 ----51n19TYZ---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----51n19TYZ---D-- - ----51n19TYZ---F-- -HTTP/1.1 403 - ----51n19TYZ---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005386720.310769"] [ref "o0,1v4,1"] - ----51n19TYZ---I-- - ----51n19TYZ---J-- - ----51n19TYZ---Z-- - ----kUB2Va0e---A-- -[16/Jun/2025:06:04:33 +0000] 175005387325.714459 103.250.147.78 60572 172.19.0.2 443 ----kUB2Va0e---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----kUB2Va0e---D-- - ----kUB2Va0e---F-- -HTTP/1.1 403 - ----kUB2Va0e---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005387325.714459"] [ref "o0,1v4,1"] - ----kUB2Va0e---I-- - ----kUB2Va0e---J-- - ----kUB2Va0e---Z-- - ----RJlm0Mpg---A-- -[16/Jun/2025:06:08:22 +0000] 175005410282.280721 103.250.147.78 60588 172.19.0.2 443 ----RJlm0Mpg---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----RJlm0Mpg---D-- - ----RJlm0Mpg---F-- -HTTP/1.1 403 - ----RJlm0Mpg---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005410282.280721"] [ref "o0,1v4,1"] - ----RJlm0Mpg---I-- - ----RJlm0Mpg---J-- - ----RJlm0Mpg---Z-- - ----TVntCo6j---A-- -[16/Jun/2025:06:08:22 +0000] 175005410253.580301 103.250.147.78 60588 172.19.0.2 443 ----TVntCo6j---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/ -Sec-Fetch-Site: same-origin - ----TVntCo6j---D-- - ----TVntCo6j---F-- -HTTP/1.1 403 - ----TVntCo6j---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005410253.580301"] [ref "o0,12v4,12"] - ----TVntCo6j---I-- - ----TVntCo6j---J-- - ----TVntCo6j---Z-- - ----1zQAjgA3---A-- -[16/Jun/2025:06:08:23 +0000] 175005410341.332747 103.250.147.78 60589 172.19.0.2 443 ----1zQAjgA3---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Cache-Control: no-cache -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i -Pragma: no-cache - ----1zQAjgA3---D-- - ----1zQAjgA3---F-- -HTTP/1.1 403 - ----1zQAjgA3---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005410341.332747"] [ref "o0,1v4,1"] - ----1zQAjgA3---I-- - ----1zQAjgA3---J-- - ----1zQAjgA3---Z-- - ----zaDxDoTJ---A-- -[16/Jun/2025:06:08:23 +0000] 175005410375.277233 103.250.147.78 60589 172.19.0.2 443 ----zaDxDoTJ---B-- -GET /favicon.ico HTTP/1.1 -Sec-Fetch-Site: same-origin -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Referer: https://13.234.29.148:8443/ -Pragma: no-cache -Connection: keep-alive -Sec-Fetch-Mode: no-cors -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Cache-Control: no-cache -Priority: u=6 -Sec-Fetch-Dest: image -Host: 13.234.29.148:8443 - ----zaDxDoTJ---D-- - ----zaDxDoTJ---F-- -HTTP/1.1 403 - ----zaDxDoTJ---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/favicon.ico' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005410375.277233"] [ref "o0,12v4,12"] - ----zaDxDoTJ---I-- - ----zaDxDoTJ---J-- - ----zaDxDoTJ---Z-- - ----XwAgOsFJ---A-- -[16/Jun/2025:06:08:37 +0000] 175005411768.545581 103.250.147.78 60589 172.19.0.2 443 ----XwAgOsFJ---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----XwAgOsFJ---D-- - ----XwAgOsFJ---F-- -HTTP/1.1 403 - ----XwAgOsFJ---H-- -ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `^/(?!healthz|api/).*' against variable `REQUEST_URI' (Value: `/' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "9"] [id "900003"] [rev ""] [msg "Restricted access to non-API route"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005411768.545581"] [ref "o0,1v4,1"] - ----XwAgOsFJ---I-- - ----XwAgOsFJ---J-- - ----XwAgOsFJ---Z-- - ----LidL9aTf---A-- -[16/Jun/2025:06:13:04 +0000] 175005438418.830628 103.250.147.78 60613 172.19.0.2 443 ----LidL9aTf---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----LidL9aTf---D-- - ----LidL9aTf---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----LidL9aTf---F-- -HTTP/1.1 200 -Server: nginx/1.24.0 -Date: Mon, 16 Jun 2025 06:13:04 GMT -Content-Length: 615 -Content-Type: text/html -Last-Modified: Mon, 16 Jun 2025 05:57:07 GMT -Connection: keep-alive -ETag: "684fb233-267" - ----LidL9aTf---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005438418.830628"] [ref "o0,18o0,13o13,5v21,18"] - ----LidL9aTf---I-- - ----LidL9aTf---J-- - ----LidL9aTf---Z-- - ----pXmAhebe---A-- -[16/Jun/2025:06:13:04 +0000] 175005438453.245246 103.250.147.78 60613 172.19.0.2 443 ----pXmAhebe---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Connection: keep-alive -Referer: https://13.234.29.148:8443/ -Sec-Fetch-Site: same-origin - ----pXmAhebe---D-- - ----pXmAhebe---E-- -\x0d\x0a404 Not Found\x0d\x0a\x0d\x0a

404 Not Found

\x0d\x0a
nginx/1.24.0
\x0d\x0a\x0d\x0a\x0d\x0a - ----pXmAhebe---F-- -HTTP/1.1 404 -Server: nginx/1.24.0 -Date: Mon, 16 Jun 2025 06:13:04 GMT -Content-Length: 153 -Content-Type: text/html -Connection: keep-alive - ----pXmAhebe---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005438453.245246"] [ref "o0,18o0,13o13,5v32,18"] - ----pXmAhebe---I-- - ----pXmAhebe---J-- - ----pXmAhebe---Z-- - ----WmxhDwPg---A-- -[16/Jun/2025:06:14:42 +0000] 175005448270.247321 103.250.147.78 60616 172.19.0.2 443 ----WmxhDwPg---B-- -GET //?q=select+*+from+users HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----WmxhDwPg---D-- - ----WmxhDwPg---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx/1.24.0
\x0d\x0a\x0d\x0a\x0d\x0a - ----WmxhDwPg---F-- -HTTP/1.1 403 -Server: nginx/1.24.0 -Date: Mon, 16 Jun 2025 06:14:42 GMT -Content-Length: 153 -Content-Type: text/html -Connection: keep-alive - ----WmxhDwPg---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "//"] [unique_id "175005448270.247321"] [ref "o0,18o0,13o13,5v44,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Rx' with parameter `(?i)(union(.*?)select|select.+from)' against variable `ARGS:q' (Value: `select * from users' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "10"] [id "10003"] [rev ""] [msg "SQLi pattern blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "//"] [unique_id "175005448270.247321"] [ref "o0,13o0,13v9,19"] - ----WmxhDwPg---I-- - ----WmxhDwPg---J-- - ----WmxhDwPg---Z-- - ----7ILerWwr---A-- -[16/Jun/2025:06:55:19 +0000] 175005691988.041943 103.250.147.78 60856 172.19.0.2 443 ----7ILerWwr---B-- -GET //?q=select+*+from+users HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----7ILerWwr---D-- - ----7ILerWwr---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----7ILerWwr---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 06:55:19 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----7ILerWwr---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "//"] [unique_id "175005691988.041943"] [ref "o0,18o0,13o13,5v44,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Rx' with parameter `(?i)(union(.*?)select|select.+from)' against variable `ARGS:q' (Value: `select * from users' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "10"] [id "10003"] [rev ""] [msg "SQLi pattern blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "//"] [unique_id "175005691988.041943"] [ref "o0,13o0,13v9,19"] - ----7ILerWwr---I-- - ----7ILerWwr---J-- - ----7ILerWwr---Z-- - ----NbD6c6Q6---A-- -[16/Jun/2025:06:55:19 +0000] 175005691960.866057 103.250.147.78 60856 172.19.0.2 443 ----NbD6c6Q6---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Referer: https://13.234.29.148:8443//?q=select+*+from+users -Connection: keep-alive -Sec-Fetch-Site: same-origin - ----NbD6c6Q6---D-- - ----NbD6c6Q6---E-- -\x0d\x0a404 Not Found\x0d\x0a\x0d\x0a

404 Not Found

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----NbD6c6Q6---F-- -HTTP/1.1 404 -Server: nginx -Date: Mon, 16 Jun 2025 06:55:19 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----NbD6c6Q6---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005691960.866057"] [ref "o0,18o0,13o13,5v32,18"] - ----NbD6c6Q6---I-- - ----NbD6c6Q6---J-- - ----NbD6c6Q6---Z-- - ----7ILerWwr---A-- -[16/Jun/2025:06:55:23 +0000] 175005692350.965818 103.250.147.78 60857 172.19.0.2 443 ----7ILerWwr---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----7ILerWwr---D-- - ----7ILerWwr---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----7ILerWwr---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: "684fb233-267" -Last-Modified: Mon, 16 Jun 2025 05:57:07 GMT -X-XSS-Protection: 1; mode=block -Connection: keep-alive -X-Content-Type-Options: nosniff -Content-Type: text/html -Content-Length: 615 -Date: Mon, 16 Jun 2025 06:55:23 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----7ILerWwr---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005692350.965818"] [ref "o0,18o0,13o13,5v21,18"] - ----7ILerWwr---I-- - ----7ILerWwr---J-- - ----7ILerWwr---Z-- - ----NbD6c6Q6---A-- -[16/Jun/2025:06:55:23 +0000] 17500569233.611857 103.250.147.78 60857 172.19.0.2 443 ----NbD6c6Q6---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Referer: https://13.234.29.148:8443/ -Connection: keep-alive -Sec-Fetch-Site: same-origin - ----NbD6c6Q6---D-- - ----NbD6c6Q6---E-- -\x0d\x0a404 Not Found\x0d\x0a\x0d\x0a

404 Not Found

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----NbD6c6Q6---F-- -HTTP/1.1 404 -Server: nginx -Date: Mon, 16 Jun 2025 06:55:23 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----NbD6c6Q6---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "17500569233.611857"] [ref "o0,18o0,13o13,5v32,18"] - ----NbD6c6Q6---I-- - ----NbD6c6Q6---J-- - ----NbD6c6Q6---Z-- - ----7ILerWwr---A-- -[16/Jun/2025:07:05:30 +0000] 175005753018.981812 195.184.76.235 53569 172.19.0.2 443 ----7ILerWwr---B-- -GET / HTTP/1.1 -Host: 13.234.29.148:8443 -Connection: close -User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Accept-Language: en-US,en;q=0.5 - ----7ILerWwr---D-- - ----7ILerWwr---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----7ILerWwr---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: "684fb233-267" -Last-Modified: Mon, 16 Jun 2025 05:57:07 GMT -X-XSS-Protection: 1; mode=block -Connection: close -X-Content-Type-Options: nosniff -Content-Type: text/html -Content-Length: 615 -Date: Mon, 16 Jun 2025 07:05:30 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----7ILerWwr---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005753018.981812"] [ref "o0,18o0,13o13,5v21,18"] - ----7ILerWwr---I-- - ----7ILerWwr---J-- - ----7ILerWwr---Z-- - ----NbD6c6Q6---A-- -[16/Jun/2025:07:05:32 +0000] 175005753282.159031 54.242.155.61 13138 172.19.0.2 443 ----NbD6c6Q6---B-- -GET / HTTP/1.1 -Host: 13.234.29.148:8443 -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 -Accept: */* -Accept-Encoding: gzip - ----NbD6c6Q6---D-- - ----NbD6c6Q6---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----NbD6c6Q6---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: "684fb233-267" -Last-Modified: Mon, 16 Jun 2025 05:57:07 GMT -X-XSS-Protection: 1; mode=block -Connection: keep-alive -X-Content-Type-Options: nosniff -Content-Type: text/html -Content-Length: 615 -Date: Mon, 16 Jun 2025 07:05:32 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----NbD6c6Q6---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005753282.159031"] [ref "o0,18o0,13o13,5v21,18"] - ----NbD6c6Q6---I-- - ----NbD6c6Q6---J-- - ----NbD6c6Q6---Z-- - ----mVTXJ4su---A-- -[16/Jun/2025:07:06:27 +0000] 175005758725.484606 103.250.147.78 60897 172.19.0.2 443 ----mVTXJ4su---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: "684fb233-267" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -If-Modified-Since: Mon, 16 Jun 2025 05:57:07 GMT -Priority: u=0, i - ----mVTXJ4su---D-- - ----mVTXJ4su---F-- -HTTP/1.1 304 -Server: nginx -Date: Mon, 16 Jun 2025 07:06:27 GMT -Last-Modified: Mon, 16 Jun 2025 05:57:07 GMT -Connection: keep-alive -X-XSS-Protection: 1; mode=block -ETag: "684fb233-267" -Permissions-Policy: geolocation=(), microphone=() -X-Content-Type-Options: nosniff -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin - ----mVTXJ4su---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005758725.484606"] [ref "o0,18o0,13o13,5v21,18"] - ----mVTXJ4su---I-- - ----mVTXJ4su---J-- - ----mVTXJ4su---Z-- - ----mVTXJ4su---A-- -[16/Jun/2025:07:08:00 +0000] 175005768064.581437 103.250.147.78 60905 172.19.0.2 443 ----mVTXJ4su---B-- -GET /? HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----mVTXJ4su---D-- - ----mVTXJ4su---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----mVTXJ4su---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: "684fb233-267" -Last-Modified: Mon, 16 Jun 2025 05:57:07 GMT -X-XSS-Protection: 1; mode=block -Connection: keep-alive -X-Content-Type-Options: nosniff -Content-Type: text/html -Content-Length: 615 -Date: Mon, 16 Jun 2025 07:08:00 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----mVTXJ4su---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005768064.581437"] [ref "o0,18o0,13o13,5v22,18"] - ----mVTXJ4su---I-- - ----mVTXJ4su---J-- - ----mVTXJ4su---Z-- - ----oLSvWVQJ---A-- -[16/Jun/2025:07:08:36 +0000] 175005771696.400463 103.250.147.78 60905 172.19.0.2 443 ----oLSvWVQJ---B-- -GET /?q=select+*+from+users HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----oLSvWVQJ---D-- - ----oLSvWVQJ---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----oLSvWVQJ---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 07:08:36 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----oLSvWVQJ---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005771696.400463"] [ref "o0,18o0,13o13,5v43,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Rx' with parameter `(?i)(union(.*?)select|select.+from)' against variable `ARGS:q' (Value: `select * from users' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "10"] [id "10003"] [rev ""] [msg "SQLi pattern blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005771696.400463"] [ref "o0,13o0,13v8,19"] - ----oLSvWVQJ---I-- - ----oLSvWVQJ---J-- - ----oLSvWVQJ---Z-- - ----mVTXJ4su---A-- -[16/Jun/2025:07:19:16 +0000] 175005835698.734447 195.184.76.110 50065 172.19.0.2 443 ----mVTXJ4su---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Connection: close -User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Accept-Language: en-US,en;q=0.5 - ----mVTXJ4su---D-- - ----mVTXJ4su---E-- -\x0d\x0a404 Not Found\x0d\x0a\x0d\x0a

404 Not Found

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----mVTXJ4su---F-- -HTTP/1.1 404 -Server: nginx -Date: Mon, 16 Jun 2025 07:19:16 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: close -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----mVTXJ4su---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005835698.734447"] [ref "o0,18o0,13o13,5v32,18"] - ----mVTXJ4su---I-- - ----mVTXJ4su---J-- - ----mVTXJ4su---Z-- - ----mVTXJ4su---A-- -[16/Jun/2025:07:38:23 +0000] 175005950363.966255 103.250.147.78 61052 172.19.0.2 443 ----mVTXJ4su---B-- -GET /?q=select+*+from+users HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----mVTXJ4su---D-- - ----mVTXJ4su---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----mVTXJ4su---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 07:38:23 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----mVTXJ4su---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005950363.966255"] [ref "o0,18o0,13o13,5v43,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Rx' with parameter `(?i)(union(.*?)select|select.+from)' against variable `ARGS:q' (Value: `select * from users' ) [file "/usr/local/nginx/conf/modsec/custom-rules.conf"] [line "10"] [id "10003"] [rev ""] [msg "SQLi pattern blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.2"] [uri "/"] [unique_id "175005950363.966255"] [ref "o0,13o0,13v8,19"] - ----mVTXJ4su---I-- - ----mVTXJ4su---J-- - ----mVTXJ4su---Z-- - ----oLSvWVQJ---A-- -[16/Jun/2025:07:38:23 +0000] 175005950336.171960 103.250.147.78 61052 172.19.0.2 443 ----oLSvWVQJ---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Referer: https://13.234.29.148:8443/?q=select+*+from+users -Connection: keep-alive -Sec-Fetch-Site: same-origin - ----oLSvWVQJ---D-- - ----oLSvWVQJ---E-- -\x0d\x0a404 Not Found\x0d\x0a\x0d\x0a

404 Not Found

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----oLSvWVQJ---F-- -HTTP/1.1 404 -Server: nginx -Date: Mon, 16 Jun 2025 07:38:23 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----oLSvWVQJ---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.2"] [uri "/favicon.ico"] [unique_id "175005950336.171960"] [ref "o0,18o0,13o13,5v32,18"] - ----oLSvWVQJ---I-- - ----oLSvWVQJ---J-- - ----oLSvWVQJ---Z-- - ----k66rYemC---A-- -[16/Jun/2025:08:13:30 +0000] 175006161076.395399 103.250.147.78 61243 172.19.0.3 443 ----k66rYemC---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: "684fb233-267" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -If-Modified-Since: Mon, 16 Jun 2025 05:57:07 GMT -Priority: u=0, i - ----k66rYemC---D-- - ----k66rYemC---F-- -HTTP/1.1 304 -Server: nginx -Date: Mon, 16 Jun 2025 08:13:30 GMT -Last-Modified: Mon, 16 Jun 2025 05:57:07 GMT -Connection: keep-alive -X-XSS-Protection: 1; mode=block -ETag: "684fb233-267" -Permissions-Policy: geolocation=(), microphone=() -X-Content-Type-Options: nosniff -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin - ----k66rYemC---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.3"] [uri "/"] [unique_id "175006161076.395399"] [ref "o0,18o0,13o13,5v21,18"] - ----k66rYemC---I-- - ----k66rYemC---J-- - ----k66rYemC---Z-- - ----QXk20x69---A-- -[16/Jun/2025:08:16:31 +0000] 17500617910.704362 103.250.147.78 61255 172.19.0.3 443 ----QXk20x69---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----QXk20x69---D-- - ----QXk20x69---E-- -Hello from Node app! - ----QXk20x69---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: W/"14-xrFyu1/zI7D6Ig0zrxUGsRvZ+Ng" -X-Powered-By: Express -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Content-Type-Options: nosniff -Content-Type: text/html; charset=utf-8 -Content-Length: 20 -Date: Mon, 16 Jun 2025 08:16:31 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----QXk20x69---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.3"] [uri "/"] [unique_id "17500617910.704362"] [ref "o0,18o0,13o13,5v21,18"] - ----QXk20x69---I-- - ----QXk20x69---J-- - ----QXk20x69---Z-- - ----fUYsnVzE---A-- -[16/Jun/2025:08:16:31 +0000] 175006179119.060509 103.250.147.78 61255 172.19.0.3 443 ----fUYsnVzE---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Referer: https://13.234.29.148:8443/ -Connection: keep-alive -Sec-Fetch-Site: same-origin - ----fUYsnVzE---D-- - ----fUYsnVzE---F-- -HTTP/1.1 200 - ----fUYsnVzE---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.3"] [uri "/favicon.ico"] [unique_id "175006179119.060509"] [ref "o0,18o0,13o13,5v32,18"] - ----fUYsnVzE---I-- - ----fUYsnVzE---J-- - ----fUYsnVzE---Z-- - ----QXk20x69---A-- -[16/Jun/2025:08:16:33 +0000] 175006179335.751150 103.250.147.78 61256 172.19.0.3 443 ----QXk20x69---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: W/"14-xrFyu1/zI7D6Ig0zrxUGsRvZ+Ng" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----QXk20x69---D-- - ----QXk20x69---F-- -HTTP/1.1 304 -Server: nginx -Date: Mon, 16 Jun 2025 08:16:33 GMT -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Powered-By: Express -ETag: W/"14-xrFyu1/zI7D6Ig0zrxUGsRvZ+Ng" -Permissions-Policy: geolocation=(), microphone=() -X-Content-Type-Options: nosniff -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin - ----QXk20x69---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.3"] [uri "/"] [unique_id "175006179335.751150"] [ref "o0,18o0,13o13,5v21,18"] - ----QXk20x69---I-- - ----QXk20x69---J-- - ----QXk20x69---Z-- - ----fUYsnVzE---A-- -[16/Jun/2025:08:16:46 +0000] 175006180685.730669 103.250.147.78 61256 172.19.0.3 443 ----fUYsnVzE---B-- -GET /?testparam=test HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----fUYsnVzE---D-- - ----fUYsnVzE---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----fUYsnVzE---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 08:16:46 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----fUYsnVzE---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.3"] [uri "/"] [unique_id "175006180685.730669"] [ref "o0,18o0,13o13,5v36,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Contains' with parameter `test' against variable `ARGS:testparam' (Value: `test' ) [file "/usr/local/nginx/conf/modsec/modsecurity.conf"] [line "9"] [id "12345"] [rev ""] [msg "Test param blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.3"] [uri "/"] [unique_id "175006180685.730669"] [ref "o0,4v16,4"] - ----fUYsnVzE---I-- - ----fUYsnVzE---J-- - ----fUYsnVzE---Z-- - ----XF97TaRT---A-- -[16/Jun/2025:08:16:48 +0000] 175006180836.554790 103.250.147.78 61256 172.19.0.3 443 ----XF97TaRT---B-- -GET /?testparam=test HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----XF97TaRT---D-- - ----XF97TaRT---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----XF97TaRT---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 08:16:48 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----XF97TaRT---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.3"] [uri "/"] [unique_id "175006180836.554790"] [ref "o0,18o0,13o13,5v36,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Contains' with parameter `test' against variable `ARGS:testparam' (Value: `test' ) [file "/usr/local/nginx/conf/modsec/modsecurity.conf"] [line "9"] [id "12345"] [rev ""] [msg "Test param blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.3"] [uri "/"] [unique_id "175006180836.554790"] [ref "o0,4v16,4"] - ----XF97TaRT---I-- - ----XF97TaRT---J-- - ----XF97TaRT---Z-- - ----jPAO39jZ---A-- -[16/Jun/2025:08:16:48 +0000] 175006180832.792278 103.250.147.78 61256 172.19.0.3 443 ----jPAO39jZ---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Referer: https://13.234.29.148:8443/?testparam=test -Connection: keep-alive -Sec-Fetch-Site: same-origin - ----jPAO39jZ---D-- - ----jPAO39jZ---F-- -HTTP/1.1 200 - ----jPAO39jZ---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.3"] [uri "/favicon.ico"] [unique_id "175006180832.792278"] [ref "o0,18o0,13o13,5v32,18"] - ----jPAO39jZ---I-- - ----jPAO39jZ---J-- - ----jPAO39jZ---Z-- - ----QXk20x69---A-- -[16/Jun/2025:08:18:24 +0000] 17500619045.336015 103.250.147.78 61263 172.19.0.3 443 ----QXk20x69---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: W/"14-xrFyu1/zI7D6Ig0zrxUGsRvZ+Ng" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----QXk20x69---D-- - ----QXk20x69---F-- -HTTP/1.1 304 -Server: nginx -Date: Mon, 16 Jun 2025 08:18:24 GMT -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Powered-By: Express -ETag: W/"14-xrFyu1/zI7D6Ig0zrxUGsRvZ+Ng" -Permissions-Policy: geolocation=(), microphone=() -X-Content-Type-Options: nosniff -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin - ----QXk20x69---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.3"] [uri "/"] [unique_id "17500619045.336015"] [ref "o0,18o0,13o13,5v21,18"] - ----QXk20x69---I-- - ----QXk20x69---J-- - ----QXk20x69---Z-- - ----fUYsnVzE---A-- -[16/Jun/2025:08:18:54 +0000] 175006193482.248188 103.250.147.78 61263 172.19.0.3 443 ----fUYsnVzE---B-- -GET /?testparam=test HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----fUYsnVzE---D-- - ----fUYsnVzE---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----fUYsnVzE---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 08:18:54 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----fUYsnVzE---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.19.0.3"] [uri "/"] [unique_id "175006193482.248188"] [ref "o0,18o0,13o13,5v36,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Contains' with parameter `test' against variable `ARGS:testparam' (Value: `test' ) [file "/usr/local/nginx/conf/modsec/modsecurity.conf"] [line "9"] [id "12345"] [rev ""] [msg "Test param blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.19.0.3"] [uri "/"] [unique_id "175006193482.248188"] [ref "o0,4v16,4"] - ----fUYsnVzE---I-- - ----fUYsnVzE---J-- - ----fUYsnVzE---Z-- - ----AKjDQbPC---A-- -[16/Jun/2025:09:20:40 +0000] 175006564052.605740 103.250.147.78 61563 172.18.0.3 443 ----AKjDQbPC---B-- -GET /?testparam=test HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----AKjDQbPC---D-- - ----AKjDQbPC---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----AKjDQbPC---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 09:20:40 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----AKjDQbPC---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.3"] [uri "/"] [unique_id "175006564052.605740"] [ref "o0,18o0,13o13,5v36,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Contains' with parameter `test' against variable `ARGS:testparam' (Value: `test' ) [file "/usr/local/nginx/conf/modsec/modsecurity.conf"] [line "9"] [id "12345"] [rev ""] [msg "Test param blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.18.0.3"] [uri "/"] [unique_id "175006564052.605740"] [ref "o0,4v16,4"] - ----AKjDQbPC---I-- - ----AKjDQbPC---J-- - ----AKjDQbPC---Z-- - ----RXCEiyo6---A-- -[16/Jun/2025:09:20:40 +0000] 175006564032.405538 103.250.147.78 61563 172.18.0.3 443 ----RXCEiyo6---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Referer: https://13.234.29.148:8443/?testparam=test -Connection: keep-alive -Sec-Fetch-Site: same-origin - ----RXCEiyo6---D-- - ----RXCEiyo6---E-- -\x0d\x0a404 Not Found\x0d\x0a\x0d\x0a

404 Not Found

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----RXCEiyo6---F-- -HTTP/1.1 404 -Server: nginx -Date: Mon, 16 Jun 2025 09:20:40 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----RXCEiyo6---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.3"] [uri "/favicon.ico"] [unique_id "175006564032.405538"] [ref "o0,18o0,13o13,5v32,18"] - ----RXCEiyo6---I-- - ----RXCEiyo6---J-- - ----RXCEiyo6---Z-- - ----AKjDQbPC---A-- -[16/Jun/2025:09:20:43 +0000] 175006564373.676724 103.250.147.78 61564 172.18.0.3 443 ----AKjDQbPC---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----AKjDQbPC---D-- - ----AKjDQbPC---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----AKjDQbPC---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: "684fe187-267" -Last-Modified: Mon, 16 Jun 2025 09:19:03 GMT -X-XSS-Protection: 1; mode=block -Connection: keep-alive -X-Content-Type-Options: nosniff -Content-Type: text/html -Content-Length: 615 -Date: Mon, 16 Jun 2025 09:20:43 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----AKjDQbPC---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.3"] [uri "/"] [unique_id "175006564373.676724"] [ref "o0,18o0,13o13,5v21,18"] - ----AKjDQbPC---I-- - ----AKjDQbPC---J-- - ----AKjDQbPC---Z-- - ----5x2Yyt1q---A-- -[16/Jun/2025:09:32:05 +0000] 175006632526.029717 103.250.147.78 61607 172.18.0.2 443 ----5x2Yyt1q---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: "684fe187-267" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -If-Modified-Since: Mon, 16 Jun 2025 09:19:03 GMT -Priority: u=0, i - ----5x2Yyt1q---D-- - ----5x2Yyt1q---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----5x2Yyt1q---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: "684fe47f-267" -Last-Modified: Mon, 16 Jun 2025 09:31:43 GMT -X-XSS-Protection: 1; mode=block -Connection: keep-alive -X-Content-Type-Options: nosniff -Content-Type: text/html -Content-Length: 615 -Date: Mon, 16 Jun 2025 09:32:05 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----5x2Yyt1q---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006632526.029717"] [ref "o0,18o0,13o13,5v21,18"] - ----5x2Yyt1q---I-- - ----5x2Yyt1q---J-- - ----5x2Yyt1q---Z-- - ----V05faCtQ---A-- -[16/Jun/2025:09:32:18 +0000] 175006633890.249503 103.250.147.78 61607 172.18.0.2 443 ----V05faCtQ---B-- -GET /?testpatame=ueu HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----V05faCtQ---D-- - ----V05faCtQ---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----V05faCtQ---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: "684fe47f-267" -Last-Modified: Mon, 16 Jun 2025 09:31:43 GMT -X-XSS-Protection: 1; mode=block -Connection: keep-alive -X-Content-Type-Options: nosniff -Content-Type: text/html -Content-Length: 615 -Date: Mon, 16 Jun 2025 09:32:18 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----V05faCtQ---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006633890.249503"] [ref "o0,18o0,13o13,5v36,18"] - ----V05faCtQ---I-- - ----V05faCtQ---J-- - ----V05faCtQ---Z-- - ----934L8GZM---A-- -[16/Jun/2025:09:32:22 +0000] 175006634238.801111 103.250.147.78 61607 172.18.0.2 443 ----934L8GZM---B-- -GET /?testpatame=ueu HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: "684fe47f-267" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -If-Modified-Since: Mon, 16 Jun 2025 09:31:43 GMT -Priority: u=0, i - ----934L8GZM---D-- - ----934L8GZM---F-- -HTTP/1.1 304 -Server: nginx -Date: Mon, 16 Jun 2025 09:32:22 GMT -Last-Modified: Mon, 16 Jun 2025 09:31:43 GMT -Connection: keep-alive -X-XSS-Protection: 1; mode=block -ETag: "684fe47f-267" -Permissions-Policy: geolocation=(), microphone=() -X-Content-Type-Options: nosniff -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin - ----934L8GZM---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006634238.801111"] [ref "o0,18o0,13o13,5v36,18"] - ----934L8GZM---I-- - ----934L8GZM---J-- - ----934L8GZM---Z-- - ----5x2Yyt1q---A-- -[16/Jun/2025:09:33:45 +0000] 175006642599.080701 103.250.147.78 61614 172.18.0.2 443 ----5x2Yyt1q---B-- -GET /?testparam=test HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----5x2Yyt1q---D-- - ----5x2Yyt1q---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----5x2Yyt1q---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 09:33:45 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----5x2Yyt1q---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006642599.080701"] [ref "o0,18o0,13o13,5v36,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Contains' with parameter `test' against variable `ARGS:testparam' (Value: `test' ) [file "/usr/local/nginx/conf/modsec/modsecurity.conf"] [line "9"] [id "12345"] [rev ""] [msg "Test param blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006642599.080701"] [ref "o0,4v16,4"] - ----5x2Yyt1q---I-- - ----5x2Yyt1q---J-- - ----5x2Yyt1q---Z-- - ----V05faCtQ---A-- -[16/Jun/2025:09:33:45 +0000] 175006642562.751932 103.250.147.78 61614 172.18.0.2 443 ----V05faCtQ---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Referer: https://13.234.29.148:8443/?testparam=test -Connection: keep-alive -Sec-Fetch-Site: same-origin - ----V05faCtQ---D-- - ----V05faCtQ---E-- -\x0d\x0a404 Not Found\x0d\x0a\x0d\x0a

404 Not Found

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----V05faCtQ---F-- -HTTP/1.1 404 -Server: nginx -Date: Mon, 16 Jun 2025 09:33:45 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----V05faCtQ---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/favicon.ico"] [unique_id "175006642562.751932"] [ref "o0,18o0,13o13,5v32,18"] - ----V05faCtQ---I-- - ----V05faCtQ---J-- - ----V05faCtQ---Z-- - ----5x2Yyt1q---A-- -[16/Jun/2025:09:33:46 +0000] 175006642621.993886 103.250.147.78 61615 172.18.0.2 443 ----5x2Yyt1q---B-- -GET /?testparam=test HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----5x2Yyt1q---D-- - ----5x2Yyt1q---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----5x2Yyt1q---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 09:33:46 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----5x2Yyt1q---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006642621.993886"] [ref "o0,18o0,13o13,5v36,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Contains' with parameter `test' against variable `ARGS:testparam' (Value: `test' ) [file "/usr/local/nginx/conf/modsec/modsecurity.conf"] [line "9"] [id "12345"] [rev ""] [msg "Test param blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006642621.993886"] [ref "o0,4v16,4"] - ----5x2Yyt1q---I-- - ----5x2Yyt1q---J-- - ----5x2Yyt1q---Z-- - ----bLbQ0wQW---A-- -[16/Jun/2025:10:01:24 +0000] 175006808472.334869 103.250.147.78 61803 172.18.0.2 443 ----bLbQ0wQW---B-- -GET /?testparam=test HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----bLbQ0wQW---D-- - ----bLbQ0wQW---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----bLbQ0wQW---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 10:01:24 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----bLbQ0wQW---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006808472.334869"] [ref "o0,18o0,13o13,5v36,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Contains' with parameter `test' against variable `ARGS:testparam' (Value: `test' ) [file "/usr/local/nginx/conf/modsec/modsecurity.conf"] [line "9"] [id "12345"] [rev ""] [msg "Test param blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006808472.334869"] [ref "o0,4v16,4"] - ----bLbQ0wQW---I-- - ----bLbQ0wQW---J-- - ----bLbQ0wQW---Z-- - ----XX1IPPwE---A-- -[16/Jun/2025:10:01:24 +0000] 17500680847.096073 103.250.147.78 61803 172.18.0.2 443 ----XX1IPPwE---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -Sec-Fetch-Dest: image -Sec-Fetch-Mode: no-cors -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Priority: u=6 -Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 -Accept-Language: en-US,en;q=0.5 -Accept-Encoding: gzip, deflate, br, zstd -Referer: https://13.234.29.148:8443/?testparam=test -Connection: keep-alive -Sec-Fetch-Site: same-origin - ----XX1IPPwE---D-- - ----XX1IPPwE---E-- -\x0d\x0a404 Not Found\x0d\x0a\x0d\x0a

404 Not Found

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----XX1IPPwE---F-- -HTTP/1.1 404 -Server: nginx -Date: Mon, 16 Jun 2025 10:01:24 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----XX1IPPwE---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/favicon.ico"] [unique_id "17500680847.096073"] [ref "o0,18o0,13o13,5v32,18"] - ----XX1IPPwE---I-- - ----XX1IPPwE---J-- - ----XX1IPPwE---Z-- - ----bLbQ0wQW---A-- -[16/Jun/2025:10:01:27 +0000] 175006808768.284849 103.250.147.78 61806 172.18.0.2 443 ----bLbQ0wQW---B-- -GET /?testparam=test HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----bLbQ0wQW---D-- - ----bLbQ0wQW---E-- -\x0d\x0a403 Forbidden\x0d\x0a\x0d\x0a

403 Forbidden

\x0d\x0a
nginx
\x0d\x0a\x0d\x0a\x0d\x0a - ----bLbQ0wQW---F-- -HTTP/1.1 403 -Server: nginx -Date: Mon, 16 Jun 2025 10:01:27 GMT -Content-Length: 146 -Content-Type: text/html -X-Content-Type-Options: nosniff -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----bLbQ0wQW---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006808768.284849"] [ref "o0,18o0,13o13,5v36,18"] -ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Contains' with parameter `test' against variable `ARGS:testparam' (Value: `test' ) [file "/usr/local/nginx/conf/modsec/modsecurity.conf"] [line "9"] [id "12345"] [rev ""] [msg "Test param blocked"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006808768.284849"] [ref "o0,4v16,4"] - ----bLbQ0wQW---I-- - ----bLbQ0wQW---J-- - ----bLbQ0wQW---Z-- - ----XX1IPPwE---A-- -[16/Jun/2025:10:01:29 +0000] 17500680892.173512 103.250.147.78 61806 172.18.0.2 443 ----XX1IPPwE---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: "684fe47f-267" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -If-Modified-Since: Mon, 16 Jun 2025 09:31:43 GMT -Priority: u=0, i - ----XX1IPPwE---D-- - ----XX1IPPwE---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----XX1IPPwE---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: "684fe6fd-267" -Last-Modified: Mon, 16 Jun 2025 09:42:21 GMT -X-XSS-Protection: 1; mode=block -Connection: keep-alive -X-Content-Type-Options: nosniff -Content-Type: text/html -Content-Length: 615 -Date: Mon, 16 Jun 2025 10:01:29 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----XX1IPPwE---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "17500680892.173512"] [ref "o0,18o0,13o13,5v21,18"] - ----XX1IPPwE---I-- - ----XX1IPPwE---J-- - ----XX1IPPwE---Z-- - ----soPrO2hG---A-- -[16/Jun/2025:10:01:32 +0000] 175006809250.776575 103.250.147.78 61806 172.18.0.2 443 ----soPrO2hG---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: "684fe6fd-267" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -If-Modified-Since: Mon, 16 Jun 2025 09:42:21 GMT -Priority: u=0, i - ----soPrO2hG---D-- - ----soPrO2hG---F-- -HTTP/1.1 304 -Server: nginx -Date: Mon, 16 Jun 2025 10:01:32 GMT -Last-Modified: Mon, 16 Jun 2025 09:42:21 GMT -Connection: keep-alive -X-XSS-Protection: 1; mode=block -ETag: "684fe6fd-267" -Permissions-Policy: geolocation=(), microphone=() -X-Content-Type-Options: nosniff -X-Frame-Options: SAMEORIGIN -Referrer-Policy: strict-origin-when-cross-origin - ----soPrO2hG---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006809250.776575"] [ref "o0,18o0,13o13,5v21,18"] - ----soPrO2hG---I-- - ----soPrO2hG---J-- - ----soPrO2hG---Z-- - ----bLbQ0wQW---A-- -[16/Jun/2025:10:02:22 +0000] 175006814273.728575 64.62.197.76 19773 172.18.0.2 443 ----bLbQ0wQW---B-- -GET / HTTP/1.1 -Host: 13.234.29.148:8443 -User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 -Accept: */* -Accept-Encoding: gzip - ----bLbQ0wQW---D-- - ----bLbQ0wQW---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----bLbQ0wQW---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: "684fe6fd-267" -Last-Modified: Mon, 16 Jun 2025 09:42:21 GMT -X-XSS-Protection: 1; mode=block -Connection: keep-alive -X-Content-Type-Options: nosniff -Content-Type: text/html -Content-Length: 615 -Date: Mon, 16 Jun 2025 10:02:22 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----bLbQ0wQW---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006814273.728575"] [ref "o0,18o0,13o13,5v21,18"] - ----bLbQ0wQW---I-- - ----bLbQ0wQW---J-- - ----bLbQ0wQW---Z-- - ----eXpssPo1---A-- -[16/Jun/2025:10:03:34 +0000] 175006821419.624479 64.62.197.74 35427 172.18.0.3 443 ----eXpssPo1---B-- -GET /webui/ HTTP/1.1 -Host: 13.234.29.148:8443 -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0 -Accept: */* -Accept-Encoding: gzip - ----eXpssPo1---D-- - ----eXpssPo1---E-- -\x0a\x0a\x0a\x0aError\x0a\x0a\x0a
Cannot GET /webui/
\x0a\x0a\x0a - ----eXpssPo1---F-- -HTTP/1.1 404 -X-Frame-Options: SAMEORIGIN -Content-Security-Policy: default-src 'none' -X-Powered-By: Express -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Content-Type-Options: nosniff -X-Content-Type-Options: nosniff -Content-Type: text/html; charset=utf-8 -Content-Length: 145 -Date: Mon, 16 Jun 2025 10:03:34 GMT -Server: nginx -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----eXpssPo1---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.3"] [uri "/webui/"] [unique_id "175006821419.624479"] [ref "o0,18o0,13o13,5v27,18"] - ----eXpssPo1---I-- - ----eXpssPo1---J-- - ----eXpssPo1---Z-- - ----eXpssPo1---A-- -[16/Jun/2025:10:03:37 +0000] 17500682176.927329 103.250.147.78 61819 172.18.0.3 443 ----eXpssPo1---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: "684fe6fd-267" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -If-Modified-Since: Mon, 16 Jun 2025 09:42:21 GMT -Priority: u=0, i - ----eXpssPo1---D-- - ----eXpssPo1---E-- -Hello from Node app! - ----eXpssPo1---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: W/"14-xrFyu1/zI7D6Ig0zrxUGsRvZ+Ng" -X-Powered-By: Express -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Content-Type-Options: nosniff -Content-Type: text/html; charset=utf-8 -Content-Length: 20 -Date: Mon, 16 Jun 2025 10:03:37 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----eXpssPo1---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.3"] [uri "/"] [unique_id "17500682176.927329"] [ref "o0,18o0,13o13,5v21,18"] - ----eXpssPo1---I-- - ----eXpssPo1---J-- - ----eXpssPo1---Z-- - ----eXpssPo1---A-- -[16/Jun/2025:10:04:29 +0000] 175006826953.087700 64.62.197.74 11339 172.18.0.3 443 ----eXpssPo1---B-- -GET /favicon.ico HTTP/1.1 -Host: 13.234.29.148:8443 -User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 -Accept: */* -Accept-Encoding: gzip - ----eXpssPo1---D-- - ----eXpssPo1---E-- -\x0a\x0a\x0a\x0aError\x0a\x0a\x0a
Cannot GET /favicon.ico
\x0a\x0a\x0a - ----eXpssPo1---F-- -HTTP/1.1 404 -X-Frame-Options: SAMEORIGIN -Content-Security-Policy: default-src 'none' -X-Powered-By: Express -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Content-Type-Options: nosniff -X-Content-Type-Options: nosniff -Content-Type: text/html; charset=utf-8 -Content-Length: 150 -Date: Mon, 16 Jun 2025 10:04:29 GMT -Server: nginx -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=() - ----eXpssPo1---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.3"] [uri "/favicon.ico"] [unique_id "175006826953.087700"] [ref "o0,18o0,13o13,5v32,18"] - ----eXpssPo1---I-- - ----eXpssPo1---J-- - ----eXpssPo1---Z-- - ----eXpssPo1---A-- -[16/Jun/2025:10:04:57 +0000] 175006829763.378876 64.62.197.73 21975 172.18.0.3 443 ----eXpssPo1---B-- -GET / HTTP/1.1 -Host: 13.234.29.148:8443 -User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 -Accept: */* -Accept-Encoding: gzip - ----eXpssPo1---D-- - ----eXpssPo1---E-- -Hello from Node app! - ----eXpssPo1---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: W/"14-xrFyu1/zI7D6Ig0zrxUGsRvZ+Ng" -X-Powered-By: Express -Connection: keep-alive -X-XSS-Protection: 1; mode=block -X-Content-Type-Options: nosniff -Content-Type: text/html; charset=utf-8 -Content-Length: 20 -Date: Mon, 16 Jun 2025 10:04:57 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----eXpssPo1---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.3"] [uri "/"] [unique_id "175006829763.378876"] [ref "o0,18o0,13o13,5v21,18"] - ----eXpssPo1---I-- - ----eXpssPo1---J-- - ----eXpssPo1---Z-- - ----f3O8zEa9---A-- -[16/Jun/2025:10:23:51 +0000] 175006943161.070633 103.250.147.78 62084 172.18.0.2 443 ----f3O8zEa9---B-- -GET / HTTP/1.1 -Sec-Fetch-User: ?1 -Sec-Fetch-Site: none -User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 -Upgrade-Insecure-Requests: 1 -If-None-Match: W/"14-xrFyu1/zI7D6Ig0zrxUGsRvZ+Ng" -Connection: keep-alive -Sec-Fetch-Mode: navigate -Accept-Encoding: gzip, deflate, br, zstd -Accept-Language: en-US,en;q=0.5 -Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -Sec-Fetch-Dest: document -Host: 13.234.29.148:8443 -Priority: u=0, i - ----f3O8zEa9---D-- - ----f3O8zEa9---E-- -\x0a\x0a\x0aWelcome to nginx!\x0a\x0a\x0a\x0a

Welcome to nginx!

\x0a

If you see this page, the nginx web server is successfully installed and\x0aworking. Further configuration is required.

\x0a\x0a

For online documentation and support please refer to\x0anginx.org.
\x0aCommercial support is available at\x0anginx.com.

\x0a\x0a

Thank you for using nginx.

\x0a\x0a\x0a - ----f3O8zEa9---F-- -HTTP/1.1 200 -Referrer-Policy: strict-origin-when-cross-origin -X-Frame-Options: SAMEORIGIN -ETag: "684fe6fd-267" -Last-Modified: Mon, 16 Jun 2025 09:42:21 GMT -X-XSS-Protection: 1; mode=block -Connection: keep-alive -X-Content-Type-Options: nosniff -Content-Type: text/html -Content-Length: 615 -Date: Mon, 16 Jun 2025 10:23:51 GMT -Server: nginx -Permissions-Policy: geolocation=(), microphone=() - ----f3O8zEa9---H-- -ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `13.234.29.148:8443' ) [file "/usr/local/nginx/conf/modsec/crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "712"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "13.234.29.148:8443"] [severity "4"] [ver "OWASP_CRS/4.16.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "172.18.0.2"] [uri "/"] [unique_id "175006943161.070633"] [ref "o0,18o0,13o13,5v21,18"] - ----f3O8zEa9---I-- - ----f3O8zEa9---J-- - ----f3O8zEa9---Z-- - diff --git a/docker/frontend/nginx.conf b/docker/frontend/nginx.conf deleted file mode 100644 index eee96a2e..00000000 --- a/docker/frontend/nginx.conf +++ /dev/null @@ -1,156 +0,0 @@ -# ========================================================= -# Request ID for correlation -# ========================================================= -map $http_x_request_id $req_id { - default $http_x_request_id; - "" $request_id; -} - -# ========================================================= -# Backend distant -# ========================================================= -upstream backend { - server uber-stup.club:443; - keepalive 32; -} - -# ========================================================= -# HTTP Server (MAIN) -# ========================================================= -server { - listen 80; - listen [::]:80; - server_name _; - - root /usr/share/nginx/html; - index index.html; - client_max_body_size 10M; - - modsecurity on; - modsecurity_rules_file /etc/nginx/modsec/custom-rules.conf; - location /api/ { - limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; } - - if ($request_method = 'OPTIONS') { - add_header 'Access-Control-Allow-Origin' "$http_origin" always; - add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always; - add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Request-ID' always; - add_header 'Access-Control-Allow-Credentials' 'true' always; - add_header 'Access-Control-Max-Age' 86400 always; - add_header 'Content-Length' 0; - add_header 'Content-Type' 'text/plain charset=UTF-8'; - return 204; - } - - proxy_pass https://backend; - proxy_http_version 1.1; - - proxy_ssl_server_name on; - proxy_ssl_name uber-stup.club; - - proxy_set_header Host uber-stup.club; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Request-ID $req_id; - proxy_set_header Connection ""; - - proxy_connect_timeout 60s; - proxy_send_timeout 60s; - proxy_read_timeout 60s; - } - - location / { - try_files $uri $uri/ /index.html; - add_header Cache-Control "no-cache, no-store, must-revalidate" always; - add_header Pragma "no-cache" always; - add_header Expires "0" always; - } - location /uploads/ { - # ✅ IMPORTANT : alias doit se terminer par / ET le chemin aussi - alias /usr/share/nginx/html/uploads/; - - # ✅ Désactiver ModSecurity pour les uploads - modsecurity off; - - # Cache headers - expires 30d; - add_header Cache-Control "public, immutable"; - } - location ^~ /uploads/images/ { - alias /usr/share/nginx/html/uploads/images/; - - # ✅ Désactiver ModSecurity - modsecurity off; - - # ✅ CORS pour images publiques - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always; - - # Cache agressif - expires 30d; - add_header Cache-Control "public, immutable" always; - - # Types MIME - types { - image/jpeg jpg jpeg; - image/png png; - image/gif gif; - image/webp webp; - image/svg+xml svg; - } - default_type image/jpeg; - } - - # ========================================================= - # ✅ UPLOADS VIDEOS (priorité maximale avec ^~) - # ========================================================= - location ^~ /uploads/videos/ { - alias /usr/share/nginx/html/uploads/videos/; - - # ✅ Désactiver ModSecurity - modsecurity off; - - # ✅ CORS pour vidéos publiques - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always; - - # Cache agressif - expires 30d; - add_header Cache-Control "public, immutable" always; - - # Types MIME pour vidéos - types { - video/mp4 mp4; - video/webm webm; - video/ogg ogv; - } - default_type video/mp4; - } - - - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-Content-Type-Options "nosniff" always; - add_header X-XSS-Protection "1; mode=block" always; - add_header Referrer-Policy "strict-origin-when-cross-origin" always; - add_header Content-Security-Policy " - default-src 'self'; - script-src 'self' 'unsafe-inline' 'unsafe-eval'; - style-src 'self' 'unsafe-inline'; - img-src 'self' data: https:; - font-src 'self' data:; - connect-src 'self' https://api.tomtom.com https://uber-stup.club; - " always; - - location ~ /\. { - deny all; - access_log off; - log_not_found off; - } - - location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ { - deny all; - access_log off; - log_not_found off; - } -} diff --git a/frontend-admin/src/api/api_admin.ts b/frontend-admin/src/api/api_admin.ts index 5baf55e2..e20085f8 100644 --- a/frontend-admin/src/api/api_admin.ts +++ b/frontend-admin/src/api/api_admin.ts @@ -9,8 +9,8 @@ import type { Alert, } from "./types"; -const V2 = "http://5.181.0.112/api/v2"; -const CABINE_URL = "http://5.181.0.112/api/v1/cabine"; +const V2 = "https://5.181.0.112.nip.io/api/v2"; +const CABINE_URL = "https://5.181.0.112.nip.io/api/v1/cabine"; // ============================================ // AUTH @@ -622,7 +622,7 @@ export const getCommandCountByStatus = async ( // CATÉGORIES // ============================================ -const V1_PUBLIC = "http://5.181.0.112/api/v1"; +const V1_PUBLIC = "https://5.181.0.112.nip.io/api/v1"; export interface Category { id: number; diff --git a/frontend-admin/src/api/api_cabine.ts b/frontend-admin/src/api/api_cabine.ts index 20b48968..b89b8105 100644 --- a/frontend-admin/src/api/api_cabine.ts +++ b/frontend-admin/src/api/api_cabine.ts @@ -6,8 +6,8 @@ import type { Alert, } from "./types"; -const API = "http://5.181.0.112/api/v1/cabine"; -const V2 = "http://5.181.0.112/api/v2"; +const API = "https://5.181.0.112.nip.io/api/v1/cabine"; +const V2 = "https://5.181.0.112.nip.io/api/v2"; // ============================================ // ITEMS @@ -395,7 +395,7 @@ export const markCabineNotificationsRead = async (): Promise => { export const getPublicSettings = async (): Promise => { try { const { data } = await apiClient.get( - `http://5.181.0.112/api/v1/app-settings`, + `https://5.181.0.112.nip.io/api/v1/app-settings`, ); return { penalties_enabled: data.penalties_enabled ?? true, diff --git a/frontend-admin/src/api/api_delivery.ts b/frontend-admin/src/api/api_delivery.ts index 009f08dc..b9136571 100644 --- a/frontend-admin/src/api/api_delivery.ts +++ b/frontend-admin/src/api/api_delivery.ts @@ -7,7 +7,7 @@ import type { Alert, } from "./types"; -const API = "http://5.181.0.112/api/v1/livreur"; +const API = "https://5.181.0.112.nip.io/api/v1/livreur"; // ============================================ // STATUT diff --git a/frontend-admin/src/api/client.ts b/frontend-admin/src/api/client.ts index 4961112e..83438956 100644 --- a/frontend-admin/src/api/client.ts +++ b/frontend-admin/src/api/client.ts @@ -2,7 +2,7 @@ import axios from "axios"; import { getToken, getAdminToken } from "../auth/tokenStorage"; // Change this to your server IP/domain -export const API_BASE_URL = "http://5.181.0.112"; +export const API_BASE_URL = "https://5.181.0.112.nip.io"; const apiClient = axios.create({ baseURL: API_BASE_URL, diff --git a/frontend-admin/src/screens/admin/OrdersScreen.tsx b/frontend-admin/src/screens/admin/OrdersScreen.tsx index 182edfa8..39fe4d6b 100644 --- a/frontend-admin/src/screens/admin/OrdersScreen.tsx +++ b/frontend-admin/src/screens/admin/OrdersScreen.tsx @@ -37,24 +37,12 @@ import { useAlert } from "../../hooks/useAlert"; type Nav = NativeStackNavigationProp; -const STATUS_FILTERS = [ - "all", - "pending", - "assigned", - "en_route", - "arrived", - "livre", - "approved", - "cancelled", -]; - export default function OrdersScreen() { const { colors } = useTheme(); const navigation = useNavigation