## Our own additions to the technology-probing list — merged into the
## http-tech-probe parser by bin/gen-http-lists.py after CrowdSec's list
## (data/technology_probing.json, replaced whole by bin/update-data.sh;
## this file is ours and survives an update). Same shape, one JSON
## object per line: {"tag", "pattern", "type": equals|contains}. The
## parser fires on a 404 or 403 only — a path that answered 200 is the
## operator's own application, never a probe.

## Enumerating an API's databases by number — /api/v1/database/1 … /10,
## ten 404s in three seconds from an AWS address, the same list on every
## site (2026-09-08).
{"tag": "api-database-enum-probing", "pattern": "/api/v1/database/", "type": "contains"}

## A four-path scan in one second — install.php, util/login.aspx,
## magento_version — from Google Cloud, a browser User-Agent of 2017;
## four refusals never reach ten in two minutes (2026-09-08).
{"tag": "installer-probing", "pattern": "/install.php", "type": "equals"}
{"tag": "magento-version-probing", "pattern": "/magento_version", "type": "equals"}
{"tag": "aspx-util-login-probing", "pattern": "/util/login.aspx", "type": "equals"}

## Keycloak's admin console and OpenID endpoints on a site that has no
## Keycloak — one request, from AWS, on the default vhost (2026-09-08).
{"tag": "keycloak-probing", "pattern": "/realms/master/", "type": "contains"}
{"tag": "keycloak-admin-probing", "pattern": "/auth/admin/", "type": "contains"}


## AVideo's endpoints, asked for with a base64 parameter that decodes to
## a shell command (`id > wmyiu.txt`) — remote code execution attempts,
## from Amazon addresses in Ireland, four requests each (2026-09-08).
{"tag": "avideo-rce-probing", "pattern": "/objects/getImage.php", "type": "equals"}
{"tag": "avideo-rce-probing", "pattern": "/objects/getImageMP4.php", "type": "equals"}
{"tag": "avideo-rce-probing", "pattern": "/objects/getSpiritsFromVideo.php", "type": "equals"}

## A web file manager and a PrestaShop module's ajax endpoint, walked by
## a scanner that changes its User-Agent at every request: /file-manager/
## with its backend calls (makefile, text, permissions), and
## /modules/appagebuilder/apajax.php with a random parameter, from Amazon
## addresses in Ireland (2026-09-08). A site that runs either answers and
## is untouched.
{"tag": "file-manager-probing", "pattern": "/file-manager/", "type": "contains"}
{"tag": "prestashop-appagebuilder-probing", "pattern": "/modules/appagebuilder/", "type": "contains"}

## The endpoints most asked for across the fleet that belong to nothing
## we host, counted on the live hits (2026-09-08): 80 addresses asking
## for /application/default, 77 for /api/app:getInfo, 77 for
## /auth/failure, 77 for /admin/login, 73 for /api/status, 34 for
## /mailer/sendgrid, 11 for /bonita/loginservice, 10 for /./RestAPI,
## 9 for /help/admin-guide. Each fires on a refusal only: a site that
## really serves one of them answers and is never touched.
{"tag": "zend-application-probing", "pattern": "/application/default", "type": "contains"}
{"tag": "appliance-api-probing", "pattern": "/api/app:getInfo", "type": "contains"}
{"tag": "auth-failure-probing", "pattern": "/auth/failure", "type": "equals"}
{"tag": "admin-login-probing", "pattern": "/admin/login", "type": "equals"}
{"tag": "api-status-probing", "pattern": "/api/status", "type": "equals"}
{"tag": "sendgrid-callback-probing", "pattern": "/mailer/sendgrid", "type": "contains"}
{"tag": "bonita-probing", "pattern": "/bonita/loginservice", "type": "contains"}
{"tag": "dot-restapi-probing", "pattern": "/./RestAPI", "type": "contains"}
{"tag": "admin-guide-probing", "pattern": "/help/admin-guide", "type": "contains"}

## Zimbra: the mailbox-import endpoint of CVE-2022-27925, asked with
## account-name=admin, and the .jsp webshell a successful run would have
## dropped under /zimbraAdmin/ — the exploit and the check for its own
## shell, one after the other from Amazon Ireland (2026-09-08).
{"tag": "zimbra-mboximport-probing", "pattern": "/service/extension/backup/mboximport", "type": "contains"}
{"tag": "zimbra-admin-shell-probing", "pattern": "/zimbraAdmin/", "type": "contains"}

## "/ip" — the what-is-my-address endpoint a proxy pool calls to test an
## exit node. Measured on two machines (2026-09-08): 162 requests from
## 158 addresses, ONE each, asking for nothing else, ever. A site that
## really serves /ip answers and is untouched.
{"tag": "exit-node-ip-check", "pattern": "/ip", "type": "equals"}

## WordPress's own directories asked for BARE, as a listing: a browser
## asks for /wp-admin/css/login.min.css, never for the folder. Refused
## 403, over and over, with "binance.com" as a referer — a hostname, not
## a URL, which no browser sends (2026-09-08).
{"tag": "wp-directory-listing-probing", "pattern": "/wp-admin/css/", "type": "equals"}
{"tag": "wp-directory-listing-probing", "pattern": "/wp-admin/js/", "type": "equals"}
{"tag": "wp-directory-listing-probing", "pattern": "/wp-admin/images/", "type": "equals"}
{"tag": "wp-directory-listing-probing", "pattern": "/wp-includes/js/", "type": "equals"}
{"tag": "wp-directory-listing-probing", "pattern": "/wp-content/uploads/", "type": "equals"}

## Three more the fleet is asked for and hosts nowhere: Struts's
## /index.action, MLflow's experiment API (its create call is a known
## remote-execution route), and the bare /app of a dozen frameworks.
{"tag": "struts-probing", "pattern": "/index.action", "type": "equals"}
{"tag": "mlflow-probing", "pattern": "/ajax-api/2.0/mlflow/", "type": "contains"}
{"tag": "bare-app-probing", "pattern": "/app", "type": "equals"}

## The one-shot exploit probes of the Amazon Ireland pool: a different
## address for each path, one or two requests each, so no count ever
## fills (Robin, 2026-09-08). Every one of them is a product this fleet
## does not run, and a refusal on it is the whole proof.
{"tag": "solarwinds-reporting-probing", "pattern": "/ReportingWebService/", "type": "contains"}
{"tag": "tika-probing", "pattern": "/tika", "type": "equals"}
{"tag": "whatsup-gold-probing", "pattern": "/NmConsole/", "type": "contains"}
{"tag": "angular-base64-upload-probing", "pattern": "/angular-base64-upload/", "type": "contains"}
{"tag": "dtale-upload-probing", "pattern": "/dtale/", "type": "contains"}
{"tag": "xwiki-register-probing", "pattern": "/bin/register/XWiki/", "type": "contains"}
{"tag": "xwiki-probing", "pattern": "/xwiki/bin/", "type": "contains"}
{"tag": "learnpress-api-probing", "pattern": "/wp-json/learnpress/", "type": "contains"}

## VMware's appliances, asked for on a shared-hosting vhost. Seen on
## castel.fr from an Amazon address in Ireland: "GET /vcac/" then
## "GET /vcac/?original_uri=https://www.castel.fr%2Fvcac" — vRealize
## Automation's login, and the redirect parameter its open-redirect and
## SSRF flaws are reached through. Two requests, so http-probing (ten in
## two minutes) never fires and the prober walks (Robin, 2026-09-09).
## Nothing on shared hosting serves any of these: the path is the verdict.
{"tag": "vmware-vrealize-probing", "pattern": "/vcac/", "type": "contains"}
{"tag": "vmware-vcenter-sso-probing", "pattern": "/websso/SAML2/", "type": "contains"}
{"tag": "vmware-vsphere-client-probing", "pattern": "/vsphere-client/", "type": "contains"}
{"tag": "vmware-vrops-plugin-probing", "pattern": "/ui/vropspluginui/rest/services/", "type": "contains"}

## A backdoor by name. Nothing serves /webshell; asking for it is asking
## whether someone else's shell is already installed. Seen from Palo
## Alto's Cortex Xpanse scanner, which announces itself in the User-Agent
## and scans the whole internet (2026-09-09) — the path convicts on its
## own, whoever asks.
{"tag": "webshell-probing", "pattern": "/webshell", "type": "contains"}

## WSO2, the two halves of one attack (CVE-2022-29464). The Carbon
## fileupload servlet takes an arbitrary file without asking who is
## sending it — a JSP web shell — and the shell then answers under the
## identity server's authentication endpoint, which is why the second
## path is asked for with a random name: the attacker is calling back
## what they hope they dropped. Seen from Amazon Ireland, one POST and
## one GET, seconds apart, on a machine that has never run WSO2 (Robin,
## 2026-09-09). Nothing on shared hosting serves either.
{"tag": "wso2-fileupload-rce", "pattern": "/fileupload/toolsAny", "type": "contains"}
{"tag": "wso2-authendpoint-shell", "pattern": "/authenticationendpoint/", "type": "contains"}

## Drupal's installer under its modern path. /install.php is already
## here; a site that has been installed answers neither (2026-09-09).
{"tag": "drupal-installer-probing", "pattern": "/core/install.php", "type": "equals"}