web Premium

Web sites behind nginx or Apache: scanners, probes, crawlers, WordPress and shop floods.

Rules (26)

• wp-login Free WordPress password guessing — five failures in a minute, or eight in twelve hours 5/1m, 8/12h
• backdoor-probe A scan asking for known web shells by name, whatever the answer
• bad-bot A self-identified bad bot
• conn-flood More than forty simultaneous connections to :443 from one address
• facet-flood A shop's faceted search requested with no referer, from abroad
• facet-flood-home A shop's faceted search requested with no referer, from home — twenty times
• facet-headless A faceted-search page loaded with no stylesheet, script or image behind it
• facet-headless-home Faceted-search pages loaded with nothing rendered behind them, from home — five times
• http-attack A request with no legitimate reading — exploit path, secrets file, scanner identity
• http-crawl Crawling dynamic pages faster than any browser or polite bot
• http-probing Enumerating paths that are not there — many refusals, fast
• http-scan Working through a scanner's list — backdoors, secrets, traversal, XSS, admin consoles
• open-proxy A request to relay a foreign site's URL — the open-proxy probe
• php-injection PHP code injected in the query string — a webshell drop or an RCE probe
• php-probe Guessing at PHP scripts that are not there — five and out
• prestashop-login-loop The PrestaShop login-in-its-own-back= recursion
• query-flood Cache-busting query flood on the site's root
• redirect-crawler Hammering redirects, following none — a scanner blind behind the https redirect
• secret-probe Probing for .git, .env, credentials, dumps, wp-config — two and out
• sqli Working through SQL-injection payloads in the query string
• tech-probe Fingerprinting a technology by its own paths
• wp-admin-scan Knocking on /wp-admin across sites without ever logging in
• wp-login-flood Hammering the WordPress login page
• wp-user-enum WordPress REST user enumeration that the WAF let through
• wp-xmlrpc Credential stuffing through xmlrpc.php
• wp-xmlrpc-blocked Insisting on a blocked xmlrpc.php