# SPDX-License-Identifier: AGPL-3.0-only
# The DFind scanner's calling card: it asks every server it meets for
# /w00tw00t.at.ISC.SANS.DFind:). Nothing else ever requests a path
# containing that string. Translated from ltsich/http-w00tw00t.
parser: http-w00tw00t
log: http
prefilter: "w00tw00t"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*w00tw00t[^ "?]*)(?:\?[^ "]*)? [^"]*"'
time_field: time
time_format: nginx
