# SPDX-License-Identifier: AGPL-3.0-only
# A request for /core/skin/login.aspx — an appliance login page nothing
# here serves; scanners sweep for it (the other half of the hub's
# w00tw00t scenario). Any status: asking is the offence.
parser: http-aspx-panel-scan
log: http
prefilter: "/core/skin/"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>(?i:/core/skin/login\.aspx))(?:\?[^ "]*)? [^"]*"'
time_field: time
time_format: nginx
