secret-probe Free

Requests for .git, .env, credentials, database dumps, wp-config — a search for secrets to break in with; one and out

Category

web

Threshold

1/10m

Ban policy

exploit

Report

secret-probe

Parsers

http-secret-probe http-secret-file wp-config-probe

Why it is written this way

The rule file View raw

# Probing for what no visitor ever asks for: the repository metadata
# (/.git/config, /.svn, /.hg), the environment and credentials files
# (.env and its backups, .aws, .ssh, .npmrc, .netrc, id_rsa and
# friends, credentials.json, terraform.tfstate, *.key / *.pem), database
# dumps (*.sql, *.sql.gz), wp-config.php and its backups. No browser
# follows a link to these; a site never serves them. ONE such request
# and the address is banned on every port, climbing on a return: there
# is no legitimate first try, and the second-hit tolerance only let the
# scattered one-shot probes through (2026-09-07). Stricter than
# http-scan, which needs four of its wider list in a minute: secrets
# scanning is not tolerated at all (Robin, 2026-08-19: "ça ferait du
# ménage"). Apple's .DS_Store is not in the list at all: a WebDAV client
# asks for it as a matter of course. (It was counted and then cancelled
# by a −1 parser until 2026-08-22 — which made the rule non-monotone and
# held every verdict five minutes: an .env hunter on one machine was convicted
# by tech-probe first and by this rule only at 14:45 for a 14:40 scan.
# Monotone now: one hit and out, at once.)
rule: secret-probe
description: "Requests for .git, .env, credentials, database dumps, wp-config — a search for secrets to break in with; one and out"
about:
  purpose: >-
    Ban whoever comes looking for the files that would hand them your site: .git, .env, credentials, database dumps, wp-config backups.
  blocks: >-
    ONE such request, whatever the server answered. A 200 on /db.sql.gz is not a page view, it is an exfiltration that worked.
  applies_to: >-
    Any web server. The list is of names no site serves on purpose and no browser ever asks for.
  requires:
    - >-
      The site's access log in combined format, declared as `log: http`.
  beware:
    - >-
      Not on a Nextcloud or a webmail: their clients ask for .bak, .sql and .env files as a matter of course, and the rule excepts those hostnames by name. Check the exception fits your own naming.
category: web
parsers:
  - http-secret-probe
  - http-secret-file
  - wp-config-probe
threshold: 1/10m
# Not on the Nextcloud and webmail instances (the target is the site's
# log file): their clients ask many URLs that 404 or 200 as a matter of
# course — deleted-file previews, uploads of .bak/.sql/.env, inline
# parts — which this rule would read as an attack (the CrowdSec
# whitelists by vhost, 2026-08-19).
except_targets: [cloud.*, nextcloud.*, webmail.*]
ban: exploit
report: secret-probe