==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release):  1.8.7 downloadable
- Linux/BSD distribution name and version:     Ubuntu 2024.04.4 LTS
- Store mail accounts in which backend:       MySQL MariaDB
- Web server (Apache or Nginx):         NGINX
====

Logwatch daily log shows that warning.

A total of 456 possible successful probes were detected (the following URLs  contain strings that match one or more of a listing of strings that  indicate a possible exploit):

    /?path=../../../../../.env.development&_=4L7Jw2Td HTTP Response 200
    /?doc=../../../../../web.config&_=IeglGrJV HTTP Response 200
    /?doc=../../../../../etc/passwd&_=sejwYysz HTTP Response 200
[...]

It is a bot searching for info, already checked that none of those requests were answered with valid data.   

How to block this kind of attacks?

Thank you.