# SPDX-License-Identifier: AGPL-3.0-only
# A scanner or an exploit tool that does not bother hiding what it is.
# Only tools whose name means one thing are listed: a user agent is
# trivially forged, so this catches the lazy and never the careful, and
# the value is that what it catches needs no second opinion.
#
# prefilter_any gates the regex on the tool names themselves (the
# multi-literal automaton, under a microsecond a line); the regex then
# requires the name inside the user-agent field, so a URL containing the
# word does not count. Names: sqlmap, masscan, nmap, zmap (the classic
# scanners; zgrab and nuclei have parsers of their own), wp2shell (the
# REST-batch WordPress exploit tool of 2026-08 — the same name is on the
# bad-bots list at two hits; here it is one).
parser: http-scanner-ua
log: http
prefilter_any: [sqlmap, masscan, nmap, zmap, wp2shell]
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "[A-Z]+ [^ "]* [^"]*" (?P<status>\d{3}) \d+ "[^"]*" "(?P<ua>[^"]*(?:sqlmap|masscan|nmap|zmap|wp2shell)[^"]*)"$'
time_field: time
time_format: nginx
