# SPDX-License-Identifier: AGPL-3.0-only
# A POST to xmlrpc.php, at any path depth (/xmlrpc.php, //xmlrpc.php,
# /wp/xmlrpc.php — all seen in one afternoon of real traffic).
#
# XML-RPC is WordPress's old remote interface. It is how password
# brute-force gets amplified — system.multicall tries hundreds of
# passwords in one request — and it is disabled or unused on most sites
# now. A site that DOES use it (Jetpack, the mobile app, a
# publish-by-mail workflow) will produce these legitimately from a small
# set of addresses: exempt those, or leave this parser out of the rules
# there.
parser: wp-xmlrpc-post
log: http
prefilter: "xmlrpc.php"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "POST (?P<path>[^ "?]*/xmlrpc\.php)(?:\?[^ "]*)? [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx
