# SPDX-License-Identifier: AGPL-3.0-only
# Looking for an administration interface that is not there: phpMyAdmin,
# a Solr console, a Sitecore login, an appliance's remote-access page.
# CrowdSec's admin_interfaces list, minus two entries — see below.
#
# Gated on a 4xx, which is both the condition and the cheap literal: a
# request that SUCCEEDED at one of these is not a probe, it is your own
# administrator, and the prefilter keeps the alternation off the
# traffic that worked.
#
# WHAT IS DELIBERATELY NOT HERE: /wp-admin and /wp-login, which the
# upstream list carries and which are right on a host that runs no
# WordPress. On one that does they are the busiest paths on the machine,
# and a 404 under /wp-admin is a missing stylesheet, not a probe. Run
# against a real WordPress host's logs, the upstream list matched
# /wp-admin/js/, /wp-admin/css/ and /wp-admin/network/ — an instant ban
# for a logged-in administrator whose browser asked for an asset that
# had moved. WordPress paths are covered by the wp-* parsers, which know
# what a real login looks like.
#
# /admin and /manager, the two bare names, match the WHOLE path only
# (/admin, /admin/): followed by anything they matched
# /wp-admin/admin-ajax.php — the endpoint every WordPress theme calls
# from the visitor's browser — and a site answering 403 there (a nonce
# refused, a plugin) banned its own visitors four requests at a time
# (Free residential IPv6, 2026-08-22). The rest of the list is specific
# enough to keep its continuation (/phpmyadmin/index.php is a probe).
parser: http-admin-probe
log: http
prefilter: '" 4'
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*(?i:/sitefinity/authenticate/swt|/sitecore/login/default\.aspx|/commandcenter/restservlet/|/sitecore/admin/login\.aspx|/sitecore/admin/cache\.aspx|/scriptcase/prod/lib/php/|/scriptcase/devel/iface/|/sphider/admin/admin\.php|/dms/out/out\.login\.php|/web/database/manager|/kcfinder/upload\.php|/admin/login_uid\.php|/remote/login|/repeater\.php|/rsso/admin/|/phpmyadmin|/sfmc/login|/dana\-na/|/\+cscoe\+/|/boaform/|/phpinfo|/solr/|/pma|/manager/html)[^ "?]*|(?i:/admin|/manager)/?)(?:\?[^ "]*)? [^"]*" (?:404|403) '
time_field: time
time_format: nginx
