All requests targeted sensitive configuration files and triggered critical LFI-ANOMALY and reputation-based WAF deny rules.