# SPDX-License-Identifier: AGPL-3.0-only
# GENERATED by bin/gen-http-lists.py — edit the data file and
# regenerate, never this file.
#
# A refused request for a technology's own path — admin panels,
# consoles, appliance endpoints (300 exact paths,
# 96 fragments). The vendor path is the verdict:
# nothing here serves these, so whoever asks is fingerprinting.
# Data from the CrowdSec hub (MIT), matched the way its scenario
# matches: on a 404 or 403 only. What answered 200 is the operator's
# own service, not a probe.
parser: http-tech-probe
log: http
prefilter: '" 4'
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>(?:/ampps\-admin/index\.php|/ampps/index\.php|/akuiteo/login\.html/|/akuiteo\.collabs/login/login\.html|/portal/portalhelp/en/|/arcgis/rest/services|/archibus/login\.axvw|/archibus/schema/ab\-core/views/sign\-in/ab\-sign\-in\.jsp|/api/portal/v1\.4/appinfo|/html/skin/ric/c/config/default\.config\.json|/bitrix/admin/|/bitrix/components/bitrix/map\.yandex\.view/settings/settings\.php|/calendar/admin/cal_login\.php|/calendarix/admin/cal_login\.php|/cxrestapi/help/system/version|/cxrestapi/auth/identity/\.well\-known/openid\-configuration|/cxwebclient/login\.aspx|/admin_ui/mas/ent/login\.html|/logon/logonpoint/custom\.html|/logon/logonpoint/index\.html|/logon/logonpoint/tmindex\.html|/commandcenter/login/presso\.jsp|/events/eventrsvp\.aspx|/gdshost/default\.aspx|/manager/login\.aspx|/mgmt/shared/authn/login|/mrcgi/mrentrancepage\.pl|/mrcgi/mrlogin\.pl|/pem/login/pages/login\.jsf|/druid/index\.html|/autodiscover/autodiscover\.json|/webclient/login\.xhtml|/goanywhere/[^ "?]*|/dbconsole/|/h2\-console/|/h2\-console/login\.jsp|/sm/ess\.do|/sm935/index\.do|/horde/login\.php|/horde/imp/login\.php|/imp/login\.php|/hmc/hybris|/hybris/hmc/hybris|/mediation/authenticate|/mediation/domains|/dana\-na/auth/url_default/welcome\.cgi|/dana\-na/auth/url_2/welcome\.cgi|/dana\-na/auth/url_3/welcome\.cgi|/dana\-cached/hc/hostcheckerinstaller\.osx|/dana\-na/nc/nc_gina_ver\.txt|/mics/login\.jsp|/mifs/c/d/android\.html|/mifs/login\.jsp|/mifs/user/login\.jsp|/jbpm\-console/app/tasks\.jsf|/jmx\-console/|/juddi/|/kfm/admin/|/kfm/index\.php|/wfc/portal|/wfc/logon|/lam/templates/login\.php|/templates/login\.php|/login/home/login\.view|/labkey/home/login\-login\.view|/api/jsonws/invoke|/api/jsonws|/lucee/admin/server\.cfm|/lucee/admin/web\.cfm|/_login_server_|/nds|/ews/exchange\.asmx|/owa/auth/logon\.aspx|/owa/service\.svc|/server\-common/cgi\-bin/login|/npm\-admin/showloginpage\.do|/qsa/login\.aspx|/api/external/getprivacy|/mt\.cgi|/mt/admin|/mylittleadmin/|/mylittlebackup/|/mlb/|/web/database/manager|/web/database/selector/|/web/login|/op/generate\.aspx|/op/wrongfiletype\.htm|/authenticationform/jsp/logonweb\.jsp|/authenticationform/login|/em/console/ias/oc4j/home|/em/console/logon/logon|/sslmgr|/cgi\-bin/qmailadmin|/cgi\-bin/qmailadmin/qmailadmin|/cgi\-ssl/qmailadmin/qmailadmin|/qmailadmin/qmailadmin\.cgi|/rdweb/|/rdweb/pages/en\-us/login\.aspx|/arsys/shared/login\.jsp|/rsso/admin/|/run\.php|/reportico/run\.php|/fileman/asp_net/main\.ashx|/fileman/php/fileslist\.php|/fileman/index\.html|/fiori|/nwa|/sf/start|/irj/portal/fiori|/irj/portal|/sap/bc/ui5_ui5/ui2/ushell/shells/abap/fiorilaunchpad\.html|/sap/hana/xs/formlogin/login\.html|/magicinfo/login|/sws/index\.html|/secenrol/|/secadmin/|/securenvoy/|/rdweb|/dms/out/out\.login\.php|/out/out\.login\.php|/orion/login\.aspx|/dlpcenter/images/favicon\.ico|/dlpcenter/loginform\.sms|/search/admin/admin\.php|/sphider/admin/admin\.php|/admin/spider\.php|/cgi\-bin/webmail|/cgi\-bin/sqwebmail|/admin/auth/login|/admin/plugins/users\-permissions/auth/login|/protectmanager/logon|/b/l\.e|/iam/immanage/login\.jsp|/vkd/getwelcomescreen\.event|/jasperserver\-pro/login\.html|/jasperserver/login\.html|/login/login\.jsp|/cfcc/login/login\.jsp|/spotfire/login\.html|/responsiveui/webmail/folder\.xhtml|/responsiveui/|/umbraco/login|/umbraco|/versa/login|/versa/login\.html|/wabam/favicon\.ico|/wabam|/server/apps/login\.php|/studioserver/server/apps/login\.php|/xxl\-job\-admin/tologin|/tologin|/authorization\.do|/servlet/getproductversion|/iam/login|/exchange/index\.html|/pki/images/keymanager_title\.ico|/apiclient/index\.jsp|/apiclient/ember/login\.jsp|/ovirt\-engine/userportal/|/ovirt\-engine/webadmin/|/cgi\-bin/videoconfiguration\.cgi|/adfinity/login|/concerto/login|/alfresco/api/\-default\-/public/cmis/versions/1\.1/atom|/ossim/session/login\.php|/anaqua/public/login\.aspx|/apimanui/api\-manager|/appsuite/|/_db/_system/_admin/aardvark/index\.html|/aims/ps/|/bolt/login|/bonita/login\.jsp|/cacti/|/cas/login|/cassia/login|/centreon/index\.php|/chronos\.wsc/asparamlogin\.html|/fmi/webd/|/tips/tipslogin\.action|/contao/login|/contentcentral/login\.aspx/|/cgi\-bin/ck/domenu\.cgi|/covenantuser/login|/login/nuilogin\.aspx|/cxcum/|/ccm\-web/|/deltaweb/hmi_login\.asp|/dex/auth|/docuware/identity/account/login|/dotadmin/|/dc2/admin/auth\.php|/druid/login\.html|/dxplanning/webbooking/version|/emswebclient/login\.aspx|/episerver/cms|/presentation/epsonconnect|/era/webconsole/|/wfc/|/fpui/jsp/login\.jsp|/ipa/ui/|/fuel/login|/gespage/webapp/login\.xhtml|/glpi/|/go/auth/login|/hm/login\.action|/iclock/accounts/login/|/ilias/login\.php|/cp/shares|/sess\-bin/login_session\.cgi|/front/privatelogin\.jsp|/kenesto/account/logon|/cmspages/logon\.aspx|/app/kibana|/clusters/local|/wcc2/|/site_admin/user/login|/cgi\-bin/luci|/lui/|/\.magnolia/admincentral|/mbilling/|/mailscanner/login\.php|/plugins/corehome/images/favicon\.png|/users/new|/minio/login|/monitorix\-cgi/monitorix\.cgi|/nagiosxi/login\.php|/nagvis/frontend/nagvis\-js/index\.php|/neos/login|/nuxeo/login\.jsp|/sfiler/login\.action|/opencats/|/ocpu/|/opennms/login\.jsp|/locales/en/translation\.json|/opensis/index\.php|/cgi\-bin/luci/|/openvpn\-monitor/|/admin/folder\.do|/otobo/index\.pl|/servicecenter/login\.aspx|/pagespeed\-global\-admin/|/pandora_console/mobile/|/rashtml5gateway/|/prweb/prauth/app/default/|/pentaho/login|/cgi\-bin/manga/index\.cgi|/library/login|/phpldapadmin|/polarion/|/processwire/|/euweb/login|/qlikview/formlogin\.htm|/cgi\-bin/webcm|/cgi\-bin/wwwctrl\.cgi|/web/guest/en/websys/webarch/header\.cgi|/royal_event/|/console\-selfservice/selfservice\.do|/selfenrollment/enrollment\.aspx|/secmail/login\.jsp|/login/sls/auth|/systemmanager/account/signin|/\~sicom/mgrng/loginform\.php|/sitefinity/authenticate/swt|/sfmc/login|/sphinxauth/account/login|/sqlbuddy/|/dcim/|/directory/login/login\.aspx|/pureweb/server/login\.jsp|/sws/index\.sws|/synnefoclient/|/webapi/ping|/servlet/browserservlet|/typo3/|/static/console\-utm\-webui/js/preinit\.js|/veracore/home/|/opscenter/|/virtualems/login\.aspx|/portal/weblogin\.aspx|/plc/webvisu\.htm|/vsaas/v2/login|/app/login|/thinclient/wtm/public/index\.html|/webalizer/|/webmin/|/webmodule\-ee/login\.seam|/webshell4/login\.php|/enginemanager/ftu/welcome\.htm|/carbon/admin/login\.jsp|/zdm/login_xdm_uc\.jsp|/cgi\-bin/luci/web|/xphoneconnect/admin/login\.aspx|/cgi\-bin/xweb500\.cgi|/yunohost/admin|/admin/index/login\.html|/zb_system/login\.php|/zenario/admin/welcome\.php|/zentao/index\.php|/zipkin/)|[^ "?]*(?:/ampps/|/libs/livecycle/|/libs/granite/|/system/sling/|/crx/packmgr/|/cfide/|/host\-manager/|/manager/html|/desktop/container/|/cache/sdesktop/|/pages/sdcall/|/ccmadmin/|/cuadmin/|/\ cscoe\ /|/webacs/|/logon/logonpoint/|/scripts/wpnbr\.dll|/commandcenter/restservlet/|/commandcenter/api/|/tmui/tmui/login/welcome\.jsp|/tmui/login\.jsp|/mgmt/shared/|/my\.policy|/tmui/|/remote/login|/wlm/login|/phoenix/|/ecp/current/exporttool/microsoft\.exchange\.ediscovery\.exporttool\.application|/actuator/gateway/routes|/actuator/health|/dwr/index\.html|/info\.php|/teamserver/faces/|/decisioncenter/|/openadmin/|/maximo/|/ibmmq/|/wps/|/dana\-na/auth/|/api/v1/totp/|/dana\-cached/|/api/v1/cav/|/dana\-na/nc/|/apps/zxtm/|/dana\-na/|/dana/|/mics/|/mifs/|/nps/servlet/|/qcbin/|/filr/|/ssf/|/ews/|/owa/|/console/login/|/uddiexplorer/|/em/console/|/operalogin/|/oa_html/|/saw\.dll|/ipages/|/oam/|/atg/|/global\-protect/|/webdynpro/dispatcher/|/rep/start/|/irj/|/sap/|/sitecore\.version\.xml|/sitecore/admin/|/sitecore/login/|/services/messagebroker/|/helpdesk/webobjects/|/informationservice/|/solarwinds/|/orion/|/sonicui/|/sgms/|/hybridity/|/airwatch/|/airflow/|/solr/|/\ \.\./web\-inf/|/main/inc/ajax/extra_field\.ajax\.php\?a=search_options_from_tags|/weaver/weaver\.file\.filedownloadforoutdoc|/process/aprocess\.php|/videoseyret\.php|/webservices/webjobupload\.asmx|/servicedesk/customer/|/kiali/|/vnc\.html|/agentboard\.xgi|/officescan/|/api/v1/serverinfo|/config/fillbacksettingedit\.php|/zimbra)[^ "?]*)(?:\?[^ "]*)? [^"]*" (?:404|403) \S+ "[^"]*" "(?P<ua>[^"]*)"'
time_field: time
time_format: nginx
