http-nginx Gratuit

# One request that succeeded. Exists only as exculpating evidence for
# srv00-redirect-crawler: a client that follows its redirects produces
# these within the second, and one forgives ten redirects. Matching
# every 200 — statics included — is deliberately MORE forgiving than
# CrowdSec's version, which is the right direction for a rule that
# bans.
parser: http-200-ok
log: http
prefilter: '" 200 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?[^ "]*)? [^"]*" 200 '
time_field: time
time_format: nginx

# The same 301 lines, when the client identifies itself: a crawler
# linking its documentation (+http://), Google, a prefetch proxy, a
# mail client loading remote content. CrowdSec expressed this as a
# negative UA filter; RE2 has no negative match, so the exclusion is a
# parser matching the BENIGN case with weight -1 in the rule — the
# http-static-miss trick again. A self-identified crawler collecting
# redirects nets to zero; whoever hides does not.
# Uptime monitors (Uptime-Kuma, UptimeRobot, Pingdom, StatusCake…) poll
# an http:// URL every minute and never follow the 301: thirty in half an
# hour, the redirect-crawler's exact shape — a customer's own monitor
# banned (seen 2026-08-19). Named here so they weigh nothing.
parser: http-301-bot
log: http
prefilter: '" 301 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?[^ "]*)? [^"]*" 301 \d+ "[^"]*" "(?P<ua>[^"]*(?i:\+https?://|google|prefetch proxy|outlook|thunderbird|uptime|monitor|pingdom|statuscake|site24x7|hetrixtools|freshping|updown\.io|checkly|zabbix|nagios|icinga|betterstack|cron-job|solarwinds|observability|datadog|newrelic|synthetic)[^"]*)"$'
time_field: time
time_format: nginx

# One redirect served. Meaningless alone — the whole port-80 web is
# 301s to https — this only exists to be COUNTED against the two
# parsers that argue it back down (http-301-bot, http-200-ok) in
# srv00-redirect-crawler. A browser follows its redirects, so a human
# nets to nothing within a second; a scanner hammering http:// paths
# and never following is the one thing that accumulates.
parser: http-301
log: http
prefilter: '" 301 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?[^ "]*)? [^"]*" 301 '
time_field: time
time_format: nginx

# A request the server could not make sense of. Rare from a browser,
# common from something speaking the wrong protocol at port 443.
parser: http-400
log: http
prefilter: '" 400 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?(?P<query>[^ "]*))? [^"]*" 400 \d+ "(?P<referer>[^"]*)" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx

# A request refused. Weaker evidence than a 404: a web application
# firewall, a bot-trap plugin or a rate limiter answers 403 to plenty of
# traffic that is merely unwelcome — on the machine this was written
# for, search-engine crawlers collect them all day on perfectly real
# article URLs. Rules should score it below a 404, or window it tightly
# enough that a crawler's slow drip never accumulates.
parser: http-403
log: http
prefilter: '" 403 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?(?P<query>[^ "]*))? [^"]*" 403 \d+ "(?P<referer>[^"]*)" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx

# A 404 on a PAGE — a path with no extension, or .php/.html/.json and the
# like — never on an asset: a broken page makes a browser miss images and
# scripts by the dozen, a scanner asks for pages that are not there. This
# is the positive half of what http-404 + http-static-miss (negative
# weight) expressed; as a parser it keeps a rule monotone, so its verdict
# is instant instead of held for the lateness allowance (five minutes —
# the whole of a flood, for a rule meant to stop one).
parser: http-404-page
log: http
prefilter: '" 404 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>(?:/[^ "?/]*)*/(?:[^ "?/.]*|[^ "?/]*\.(?i:php|phtml|html?|aspx?|jsp|cgi|pl|do|action|json)))(?:\?(?P<query>[^ "]*))? [^"]*" 404 '
time_field: time
time_format: nginx

# A request for something that is not there. The literal prefilter is
# the status field itself, quote and spaces included — `" 404 ` appears
# in every combined-format line with that status and in almost nothing
# else, so the pattern runs on the handful of lines that can match
# rather than on all of them.
#
# nginx escapes a quote inside the request as \x22, so `[^ "]*` cannot
# be walked out of. A request containing a raw space simply does not
# match, and nothing is counted — the safe direction.
parser: http-404
log: http
prefilter: '" 404 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?(?P<query>[^ "]*))? [^"]*" 404 \d+ "(?P<referer>[^"]*)" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx

# Looking for an administration interface that is not there: phpMyAdmin,
# a Solr console, a Sitecore login, an appliance's remote-access page.
# CrowdSec's admin_interfaces list, minus two entries — see below.
#
# Gated on a 4xx, which is both the condition and the cheap literal: a
# request that SUCCEEDED at one of these is not a probe, it is your own
# administrator, and the prefilter keeps the alternation off the
# traffic that worked.
#
# WHAT IS DELIBERATELY NOT HERE: /wp-admin and /wp-login, which the
# upstream list carries and which are right on a host that runs no
# WordPress. On one that does they are the busiest paths on the machine,
# and a 404 under /wp-admin is a missing stylesheet, not a probe. Run
# against a real WordPress host's logs, the upstream list matched
# /wp-admin/js/, /wp-admin/css/ and /wp-admin/network/ — an instant ban
# for a logged-in administrator whose browser asked for an asset that
# had moved. WordPress paths are covered by the wp-* parsers, which know
# what a real login looks like.
#
# /admin and /manager, the two bare names, match the WHOLE path only
# (/admin, /admin/): followed by anything they matched
# /wp-admin/admin-ajax.php — the endpoint every WordPress theme calls
# from the visitor's browser — and a site answering 403 there (a nonce
# refused, a plugin) banned its own visitors four requests at a time
# (Free residential IPv6, 2026-08-22). The rest of the list is specific
# enough to keep its continuation (/phpmyadmin/index.php is a probe).
parser: http-admin-probe
log: http
prefilter: '" 4'
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*(?i:/sitefinity/authenticate/swt|/sitecore/login/default\.aspx|/commandcenter/restservlet/|/sitecore/admin/login\.aspx|/sitecore/admin/cache\.aspx|/scriptcase/prod/lib/php/|/scriptcase/devel/iface/|/sphider/admin/admin\.php|/dms/out/out\.login\.php|/web/database/manager|/kcfinder/upload\.php|/admin/login_uid\.php|/remote/login|/repeater\.php|/rsso/admin/|/phpmyadmin|/sfmc/login|/dana\-na/|/\+cscoe\+/|/boaform/|/phpinfo|/solr/|/pma|/manager/html)[^ "?]*|(?i:/admin|/manager)/?)(?:\?[^ "]*)? [^"]*" (?:404|403) '
time_field: time
time_format: nginx

# A request for /core/skin/login.aspx — an appliance login page nothing
# here serves; scanners sweep for it (the other half of the hub's
# w00tw00t scenario). Any status: asking is the offence.
parser: http-aspx-panel-scan
log: http
prefilter: "/core/skin/"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>(?i:/core/skin/login\.aspx))(?:\?[^ "]*)? [^"]*"'
time_field: time
time_format: nginx

# Asking for a web shell by name — c99.php, alfa-rex.php, cmd.jsp and
# two hundred others. CrowdSec's backdoors list, matched on the FILENAME
# rather than anywhere in the path, so a directory that happens to
# contain one of these words does not count.
#
# Nobody arrives at these by accident and nobody links to them. A single
# request is a verdict: whoever sent it already believes this machine is
# compromised, and is checking whether their shell is still there.
# Counted on 404 and 403 AND on 301/302 (Robin, 2026-08-20): a scan
# walking the http:// side gets a redirect for every name and never
# follows it — the redirect is the same confession. 200 is left out:
# a few of the short names (css.php, log.php, password.php) exist as
# real files on real sites.
parser: http-backdoor-probe
log: http
prefilter_any: [".php", ".asp", ".jsp", ".pl"]
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*/(?i:this_is_a_new_hello_world\.php|hellopress/wp_filemanager\.php|wp_filemanager\.php|wp\-configs\.php|wp\-is\.php|Ajax_PHP_Command_Shell\.php|obfuscated\-punknopass\.php|Mackers_Private_Shell\.php|NetworkFileManagerPHP\.php|PerlWebShellbyRST\-GHC\.pl|Simple_PHP_backdoor\.php|configkillerionkros\.php|filesystembrowser\.aspx|STNC_WebShell_v0\.8\.php|Loaderz_WEB_Shell\.php|Worse_Linux_Shell\.php|cpg_143_incl_xpl\.php|Php_Backdoor\.txt\.php|Non\-alphanumeric\.php|Moroccan_Spamers\.php|Safe_Mode_Bypass\.php|Rootshell\.v\.1\.0\.php|Small_Web_Shell\.php|c99\-shadows\-mod\.php|SnIpEr_SA\ Shell\.php|simple\-backdoor\.php|Gamma_Web_Shell\.php|JspWebshell\ 1\.2\.jsp|JspWebshell_1\.2\.php|itsecteam_shell\.php|KA_uShell_0\.1\.6\.php|Antichat_Shell\.php|soldierofallah\.php|FaTaLisTiCz_Fx\.php|g00nshell\-v1\.3\.php|aZRaiLPhp_v1\.0\.php|Safe0ver_Shell\.php|PHPRemoteView\.php|CWShellDumper\.php|Private\-i3lue\.php|NTDaddy_v1\.9\.php|ru24_post_sh\.php|c99\-Ultimate\.php|toolaspshell\.asp|bdotw44shell\.php|php\-backdoor\.php|CrystalShell\.php|GRP_WebShell\.php|c99unlimited\.php|dC3_Security\.php|qsd\-backdoor\.php|connect\-back\.php|cihshell_fix\.php|Ayyildiz_Tim\.php|c99_locus7s\.php|ZyklonShell\.php|fileupload\.aspx|xleet\-shell\.php|punk\-nopass\.php|simattacker\.php|c99_w4cking\.php|elmaliseker\.asp|c99madshell\.php|simple_cmd\.php|aspxshell\.aspx|Sincap_1\.0\.php|WinX_Shell\.php|c99_PSych0\.php|alfa\-rex\.php56|cybershell\.php|eval\-stdin\.php|bloodsecv4\.php|Dive_Shell\.php|c99_madnet\.php|backupsql\.php|iskorpitx\.php|PHANTASMA\.php|Ani\-Shell\.php|cmd_win32\.jsp|DTool_Pro\.php|punkholic\.php|s72_Shell\.php|NCC\-Shell\.php|ironshell\.php|CasuS\-1\.5\.php|cgitelnet\.php|zacosmall\.php|PHPJackal\.php|PHP_Shell\.php|Predator\.php|cmdexec\.aspx|filesman\.php|jspShell\.jsp|upl0ader\.php|c99shell\.php|alfa\-rex\.php|wso2\.8\.5\.php|jspshell\.jsp|safe0ver\.php|antichat\.php|cbfphpsh\.php|cgitelnet\.pl|ex0shell\.php|spyshell\.php|up_win32\.jsp|password\.php|SimShell\.php|lolipop\.php|g00nv13\.php|spexec\.aspx|browser\.jsp|zehir4\.aspx|spygrup\.php|liz0zim\.php|wp\-term\.php|MyShell\.php|aspydrv\.php|ntdaddy\.asp|megabor\.php|weevely\.php|aspydrv\.asp|Locus7s\.php|Crystal\.php|indosec\.php|sosyete\.php|bypass\.php|RemExp\.asp|hacker\.php|zehir4\.asp|matamu\.php|lostDC\.php|upfile\.php|lifkaS\.php|ctt_sh\.php|zehir\.aspx|Ekin0x\.php|sniper\.php|PHVayv\.php|andela\.php|pHpINJ\.php|zehir4\.php|sh3llx\.php|PHPSPY\.php|PhpSpy\.php|hkrkoz\.php|aspxSH\.asp|tryag\.php|c99v2\.php|angel\.php|locus\.php|stres\.php|jspbd\.jsp|smevk\.php|shell\.php|AK\-74\.php|c99ud\.php|zehir\.asp|3fexe\.asp|alfa3\.php|xleet\.php|kral\.php|acid\.php|ASpy\.asp|EFSO\.asp|erne\.php|cmd\.aspx|list\.jsp|1337\.php|tool\.asp|r00t\.php|ddos\.php|sql\.aspx|c100\.php|isko\.php|root\.php|css\.php|c37\.php|b37\.php|pws\.php|egy\.php|r58\.php|list\.pl|wewo\.pl|log\.php|NGH\.php|dra\.php|mma\.php|cmd\.asp|bug\.php|c66\.php|cmd\.jsp|cmd\.php|150\.php|r57\.php|upl\.php|udp\.php|c99\.php|co\.php|xx\.php|cmd\.pl|ee\.php|G5\.php|dq\.php|Dx\.php|up\.asp|ws\.php|up\.jsp|pws\.pl|irc\.pl|1\.php|dc\.pl|c\.php|up\.pl|t4))(?:\?(?P<query>[^ "]*))? [^"]*" (?:30[12]|40[34]) \S+ "[^"]*" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx

# GENERATED by bin/gen-bad-ua.py from data/bad_user_agents.regex.txt —
# edit the list and regenerate, never this file.
#
# A request whose User-Agent names a known-bad client: scrapers,
# vulnerability scanners, spam harvesters, SEO crawlers that ignore
# robots.txt. The status does not matter — the client convicts itself
# in its own words, whatever it was served.
#
# The list is Mitchell Krogza's bad-user-agents list (MIT licence, in
# the data file's header), from
# https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker —
# the same list the CrowdSec hub ships for its http-bad-user-agent
# scenario, which is the behaviour this parser translates. 681 entries,
# plus 0 of our own from data/bad_user_agents.local.txt.
#
# prefilter_any gates the pattern on the tokens themselves — the
# multi-literal automaton answers "does the line contain any of these"
# in under a microsecond, and only gated lines pay for the alternation
# (~920µs measured when this ran ungated on every line).
parser: http-bad-ua
log: http
prefilter_any:
  - "1h4x.com"
  - "360Spider"
  - "404checker"
  - "404enemy"
  - "80legs"
  - "ADmantX"
  - "AIBOT"
  - "AIWebIndex"
  - "ALittle Client"
  - "ASPSeek"
  - "Abonti"
  - "Aboundex"
  - "Aboundexbot"
  - "Acunetix"
  - "AdsTxtCrawlerTP"
  - "AfD-Verbotsverfahren"
  - "AhrefsBot"
  - "AiHitBot"
  - "Aipbot"
  - "Alexibot"
  - "Aliyun"
  - "AliyunSecBot"
  - "AllSubmitter"
  - "Alligator"
  - "AlphaBot"
  - "Anarchie"
  - "Anarchy"
  - "Anarchy99"
  - "Ankit"
  - "Anthill"
  - "Apexoo"
  - "Aspiegel"
  - "Asterias"
  - "Atomseobot"
  - "Attach"
  - "AwarioBot"
  - "AwarioRssBot"
  - "AwarioSmartBot"
  - "BBBike"
  - "BDCbot"
  - "BDFetch"
  - "BLEXBot"
  - "BackDoorBot"
  - "BackStreet"
  - "BackWeb"
  - "Backlink-Ceck"
  - "BacklinkCrawler"
  - "BacklinksExtendedBot"
  - "Badass"
  - "Bandit"
  - "Barkrowler"
  - "BatchFTP"
  - "Battleztar Bazinga"
  - "BetaBot"
  - "Bigfoot"
  - "Bitacle"
  - "BlackWidow"
  - "Black Hole"
  - "Blackboard"
  - "Blow"
  - "BlowFish"
  - "Boardreader"
  - "Bolt"
  - "BotALot"
  - "Brandprotect"
  - "Brandwatch"
  - "Buck"
  - "Buddy"
  - "BuiltBotTough"
  - "BuiltWith"
  - "Bullseye"
  - "BunnySlippers"
  - "BuzzSumo"
  - "CATExplorador"
  - "CODE87"
  - "CSHttp"
  - "Calculon"
  - "CazoodleBot"
  - "Cegbfeieh"
  - "CensysInspect"
  - "CheTeam"
  - "CheeseBot"
  - "CherryPicker"
  - "ChinaClaw"
  - "Chlooe"
  - "Citoid"
  - "Claritybot"
  - "Cliqzbot"
  - "Cloud mapping"
  - "Cocolyzebot"
  - "Cogentbot"
  - "Collector"
  - "Copier"
  - "CopyRightCheck"
  - "Copyscape"
  - "Cosmos"
  - "Craftbot"
  - "Crawling at Home Project"
  - "CrazyWebCrawler"
  - "Crescent"
  - "CrunchBot"
  - "Curious"
  - "Custo"
  - "CyotekWebCopy"
  - "DBLBot"
  - "DIIbot"
  - "DSearch"
  - "DTS Agent"
  - "DataCha0s"
  - "DatabaseDriverMysqli"
  - "Demon"
  - "Deusu"
  - "Devil"
  - "Digincore"
  - "DigitalPebble"
  - "Dirbuster"
  - "Disco"
  - "Discobot"
  - "Discoverybot"
  - "Dispatch"
  - "DittoSpyder"
  - "DnBCrawler-Analytics"
  - "DnyzBot"
  - "DomCopBot"
  - "DomainAppender"
  - "DomainCrawler"
  - "DomainSigmaCrawler"
  - "DomainStatsBot"
  - "Domains Project"
  - "Dotbot"
  - "Download Wonder"
  - "Dragonfly"
  - "Drip"
  - "ECCP"
  - "EMail Siphon"
  - "EMail Wolf"
  - "EasyDL"
  - "Ebingbong"
  - "Ecxi"
  - "EirGrabber"
  - "EroCrawler"
  - "Evil"
  - "Exabot"
  - "Express WebPictures"
  - "ExtLinksBot"
  - "Extractor"
  - "ExtractorPro"
  - "Extreme Picture Finder"
  - "EyeNetIE"
  - "Ezooms"
  - "FDM"
  - "FHscan"
  - "FemtosearchBot"
  - "Fimap"
  - "Firefox/7.0"
  - "FlashGet"
  - "Flunky"
  - "Foobot"
  - "Freeuploader"
  - "FrontPage"
  - "Fuzz"
  - "FyberSpider"
  - "Fyrebot"
  - "G-i-g-a-b-o-t"
  - "GT::WWW"
  - "GalaxyBot"
  - "GeedoProductSearch"
  - "Genieo"
  - "GenomeCrawlerd"
  - "GermCrawler"
  - "GetRight"
  - "GetWeb"
  - "Getintent"
  - "Gigabot"
  - "Go!Zilla"
  - "Go-Ahead-Got-It"
  - "GoZilla"
  - "Gotit"
  - "GrabNet"
  - "Grabber"
  - "Grafula"
  - "GrapeFX"
  - "GrapeshotCrawler"
  - "GridBot"
  - "HEADMasterSEO"
  - "HMView"
  - "HTMLparser"
  - "HTTP::Lite"
  - "HTTrack"
  - "Haansoft"
  - "HaosouSpider"
  - "Harvest"
  - "Havij"
  - "Heritrix"
  - "Hloader"
  - "HonoluluBot"
  - "Humanlinks"
  - "HybridBot"
  - "IDBTE4M"
  - "IDBot"
  - "IRLbot"
  - "Iblog"
  - "Id-search"
  - "IlseBot"
  - "Image Fetch"
  - "Image Sucker"
  - "IndeedBot"
  - "Indy Library"
  - "InfoNaviRobot"
  - "InfoTekies"
  - "Information Security Team InfraSec Scanner"
  - "InfraSec Scanner"
  - "Intelliseek"
  - "InterGET"
  - "InternetMeasurement"
  - "InternetSeer"
  - "Internet Ninja"
  - "Iria"
  - "Iskanie"
  - "IstellaBot"
  - "JOC Web Spider"
  - "JamesBOT"
  - "Jbrofuzz"
  - "JennyBot"
  - "JetCar"
  - "Jetty"
  - "JikeSpider"
  - "Joomla"
  - "Jorgee"
  - "JustView"
  - "Jyxobot"
  - "Kenjin Spider"
  - "Keybot Translation-Search-Machine"
  - "Keyword Density"
  - "Kinza"
  - "Kozmosbot"
  - "LNSpiderguy"
  - "LWP::Simple"
  - "Lanshanbot"
  - "Larbin"
  - "Leap"
  - "LeechFTP"
  - "LeechGet"
  - "LexiBot"
  - "Lftp"
  - "LibWeb"
  - "Libwhisker"
  - "LieBaoFast"
  - "Lightspeedsystems"
  - "Likse"
  - "LinkScan"
  - "LinkWalker"
  - "Linkbot"
  - "LinkextractorPro"
  - "LinkpadBot"
  - "LinksManager"
  - "LinqiaMetadataDownloaderBot"
  - "LinqiaRSSBot"
  - "LinqiaScrapeBot"
  - "Lipperhey"
  - "Lipperhey Spider"
  - "Litemage_walker"
  - "Lmspider"
  - "Ltx71"
  - "MFC_Tear_Sample"
  - "MIDown tool"
  - "MIIxpc"
  - "MJ12bot"
  - "MQQBrowser"
  - "MSFrontPage"
  - "MSIECrawler"
  - "MTRobot"
  - "Mag-Net"
  - "Magnet"
  - "Mail.RU_Bot"
  - "Majestic-SEO"
  - "Majestic12"
  - "Majestic SEO"
  - "MarkMonitor"
  - "MarkWatch"
  - "Mass Downloader"
  - "Masscan"
  - "Mata Hari"
  - "MauiBot"
  - "Mb2345Browser"
  - "MeanPath Bot"
  - "Meanpathbot"
  - "Mediatoolkitbot"
  - "MegaIndex.ru"
  - "Metauri"
  - "MicroMessenger"
  - "Microsoft Data Access"
  - "Microsoft URL Control"
  - "Minefield"
  - "Mister PiX"
  - "Moblie Safari"
  - "Mojeek"
  - "Mojolicious"
  - "MolokaiBot"
  - "Morfeus Fucking Scanner"
  - "Mozlila"
  - "Mr.4x3"
  - "Msrabot"
  - "Musobot"
  - "NICErsPRO"
  - "NPbot"
  - "Name Intelligence"
  - "Nameprotect"
  - "Navroad"
  - "NearSite"
  - "Needle"
  - "Nessus"
  - "NetAnts"
  - "NetLyzer"
  - "NetMechanic"
  - "NetSpider"
  - "NetZIP"
  - "Net Vampire"
  - "Netcraft"
  - "Nettrack"
  - "Netvibes"
  - "NextGenSearchBot"
  - "Nibbler"
  - "Niki-bot"
  - "Nikto"
  - "NimbleCrawler"
  - "Nimbostratus"
  - "Ninja"
  - "Nmap"
  - "Nuclei"
  - "Nutch"
  - "Octopus"
  - "Odin"
  - "Offline Explorer"
  - "Offline Navigator"
  - "OnCrawl"
  - "OpenLinkProfiler"
  - "OpenVAS"
  - "Openfind"
  - "Openvas"
  - "OrangeBot"
  - "OrangeSpider"
  - "OutclicksBot"
  - "OutfoxBot"
  - "PECL::HTTP"
  - "PHPCrawl"
  - "POE-Component-Client-HTTP"
  - "PageAnalyzer"
  - "PageGrabber"
  - "PageScorer"
  - "PageThing.com"
  - "Page Analyzer"
  - "Pandalytics"
  - "Panscient"
  - "Papa Foto"
  - "Pavuk"
  - "PeoplePal"
  - "Petalbot"
  - "Pi-Monster"
  - "Picscout"
  - "Picsearch"
  - "PictureFinder"
  - "Piepmatz"
  - "Pimonster"
  - "Pixray"
  - "PleaseCrawl"
  - "Pockey"
  - "ProPowerBot"
  - "ProWebWalker"
  - "Probethenet"
  - "Proximic"
  - "Psbot"
  - "Pu_iN"
  - "Pump"
  - "PxBroker"
  - "PyCurl"
  - "QueryN Metasearch"
  - "Quick-Crawler"
  - "RSSingBot"
  - "Rainbot"
  - "RankActive"
  - "RankActiveLinkBot"
  - "RankFlex"
  - "RankingBot"
  - "RankingBot2"
  - "Rankivabot"
  - "RankurBot"
  - "Re-re"
  - "ReGet"
  - "RealDownload"
  - "Reaper"
  - "RebelMouse"
  - "Recorder"
  - "RedesScrapy"
  - "RepoMonkey"
  - "Ripper"
  - "RocketCrawler"
  - "Rogerbot"
  - "SBIder"
  - "SEBot-WA"
  - "SEOkicks"
  - "SEOkicks-Robot"
  - "SEOlyt"
  - "SEOlyticsCrawler"
  - "SEOprofiler"
  - "SEOstats"
  - "SISTRIX"
  - "SMARTSEO-checker"
  - "SMTBot"
  - "SalesIntelligent"
  - "ScanAlert"
  - "Scanbot"
  - "ScoutJet"
  - "Scrapy"
  - "Screaming"
  - "ScreenerBot"
  - "ScrepyBot"
  - "Searchestate"
  - "SearchmetricsBot"
  - "Seekport"
  - "SeekportBot"
  - "SemanticJuice"
  - "Semrush"
  - "SemrushBot"
  - "SemrushBot-BA"
  - "SemrushBot-FT"
  - "SemrushBot-OCOB"
  - "SemrushBot-SI"
  - "SemrushBot-SWA"
  - "SentiBot"
  - "SenutoBot"
  - "SeoCherryBot"
  - "SeoSiteCheckup"
  - "SeobilityBot"
  - "Seomoz"
  - "Shodan"
  - "Siphon"
  - "SiteAuditBot"
  - "SiteCheckerBotCrawler"
  - "SiteExplorer"
  - "SiteLockSpider"
  - "SiteSnagger"
  - "SiteSucker"
  - "Site Sucker"
  - "Sitebeam"
  - "Siteimprove"
  - "Sitevigil"
  - "SlySearch"
  - "SmartDownload"
  - "Snake"
  - "Snapbot"
  - "Snoopy"
  - "SocialRankIOBot"
  - "Sociscraper"
  - "Sogou web spider"
  - "Sosospider"
  - "Sottopop"
  - "SpaceBison"
  - "Spammen"
  - "SpankBot"
  - "Spanner"
  - "Spbot"
  - "Spider_Bot"
  - "Spinn3r"
  - "SplitSignalBot"
  - "SputnikBot"
  - "Sqlmap"
  - "Sqlworm"
  - "Sqworm"
  - "Steeler"
  - "Stripper"
  - "Sucker"
  - "Sucuri"
  - "SuperBot"
  - "SuperHTTP"
  - "Surfbot"
  - "SurveyBot"
  - "Suzuran"
  - "Swiftbot"
  - "Szukacz"
  - "T0PHackTeam"
  - "T8Abot"
  - "TLM-Audit-Scanner"
  - "TMP"
  - "Teleport"
  - "TeleportPro"
  - "Telesoft"
  - "Telesphoreo"
  - "Telesphorep"
  - "TheNomad"
  - "The Intraformant"
  - "Thumbor"
  - "TightTwatBot"
  - "TinyTestBot"
  - "Toata"
  - "Toweyabot"
  - "Tracemyfile"
  - "Trendiction"
  - "Trendictionbot"
  - "True_Robot"
  - "Turingos"
  - "Turnitin"
  - "TurnitinBot"
  - "TwengaBot"
  - "Twice"
  - "Typhoeus"
  - "URLy.Warning"
  - "URLy Warning"
  - "UnisterBot"
  - "Upflow"
  - "V-BOT"
  - "VB Project"
  - "VCI"
  - "Vacuum"
  - "Vagabondo"
  - "VelenPublicWebCrawler"
  - "VeriCiteCrawler"
  - "VidibleScraper"
  - "Virusdie"
  - "VoidEYE"
  - "Voil"
  - "Voltron"
  - "WASALive-Bot"
  - "WBSearchBot"
  - "WEBDAV"
  - "WISENutbot"
  - "WPScan"
  - "WWW-Collector-E"
  - "WWW-Mechanize"
  - "WWW::Mechanize"
  - "WWWOFFLE"
  - "Wallpapers"
  - "WallpapersHD"
  - "WeSEE"
  - "WebAuto"
  - "WebBandit"
  - "WebCollage"
  - "WebCopier"
  - "WebEnhancer"
  - "WebFetch"
  - "WebFuck"
  - "WebGo IS"
  - "WebImageCollector"
  - "WebLeacher"
  - "WebPix"
  - "WebReaper"
  - "WebSauger"
  - "WebStripper"
  - "WebSucker"
  - "WebWhacker"
  - "WebZIP"
  - "Web Auto"
  - "Web Collage"
  - "Web Enhancer"
  - "Web Fetch"
  - "Web Fuck"
  - "Web Pix"
  - "Web Sauger"
  - "Web Sucker"
  - "Webalta"
  - "WebmasterWorldForumBot"
  - "Webshag"
  - "WebsiteExtractor"
  - "WebsiteQuester"
  - "Website Quester"
  - "Webster"
  - "Whack"
  - "Whacker"
  - "Whatweb"
  - "Who.is Bot"
  - "Widow"
  - "WinHTTrack"
  - "WiseGuys Robot"
  - "Wonderbot"
  - "Woobot"
  - "Wotbox"
  - "Wprecon"
  - "Xaldon WebSpider"
  - "Xaldon_WebSpider"
  - "Xenu"
  - "YaK"
  - "YoudaoBot"
  - "Zade"
  - "Zauba"
  - "Zermelo"
  - "Zeus"
  - "Zitebot"
  - "ZmEu"
  - "ZoomBot"
  - "ZoominfoBot"
  - "ZumBot"
  - "ZyBorg"
  - "adscanner"
  - "archive.org_bot"
  - "aria2"
  - "arquivo-web-crawler"
  - "arquivo.pt"
  - "autoemailspider"
  - "awario.com"
  - "backlink-check"
  - "cah.io.community"
  - "check1.exe"
  - "clark-crawler"
  - "coccocbot"
  - "cognitiveseo"
  - "com.plumanalytics"
  - "crawl.sogou.com"
  - "crawler4j"
  - "crawler.feedback"
  - "dataforseo.com"
  - "dataforseobot"
  - "dataprovider"
  - "demandbase-bot"
  - "domainsproject.org"
  - "eCatch"
  - "evc-batch"
  - "everyfeed-spider"
  - "facebookscraper"
  - "fasthttp"
  - "gopher"
  - "heritrix"
  - "instabid"
  - "internetVista monitor"
  - "ips-agent"
  - "isitwp.com"
  - "iubenda-radar"
  - "l9scan"
  - "leakix"
  - "libredtail-http"
  - "linkdexbot"
  - "linkfluence"
  - "litellm-recon"
  - "lwp-request"
  - "lwp-trivial"
  - "magpie-crawler"
  - "meanpathbot"
  - "mediawords"
  - "muhstik-scan"
  - "netEstate NE Crawler"
  - "oBot"
  - "opendirme-credhunt"
  - "page scorer"
  - "pcBrowser"
  - "plumanalytics"
  - "polaris version"
  - "probe-image-size"
  - "ripz"
  - "s1z.ru"
  - "satoristudio.net"
  - "scalaj-http"
  - "scan.lol"
  - "seobility"
  - "seocompany.store"
  - "seoscanners"
  - "seostar"
  - "serpstatbot"
  - "sexsearcher"
  - "sitechecker.pro"
  - "siteripz"
  - "smart-seo-tools.sbs"
  - "sogouspider"
  - "sp_auditbot"
  - "spy4x-domain-scanner"
  - "spyfu"
  - "sysscan"
  - "tAkeOut"
  - "terrabot-owned-you"
  - "trafilatura"
  - "trendiction.com"
  - "trendiction.de"
  - "ubermetrics-technologies.com"
  - "voyagerx.com"
  - "webgains-bot"
  - "webmeup-crawler"
  - "webpros.com"
  - "webprosbot"
  - "wp2shell"
  - "x09Mozilla"
  - "xpymep1.exe"
  - "zauba.io"
  - "zgrab"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?[^ "]*)? [^"]*" \d{3} \d+ "[^"]*" "(?P<ua>[^"]*(?:\b1h4x\.com\b|\b360Spider\b|\b404checker\b|\b404enemy\b|\b80legs\b|\bADmantX\b|\bAIBOT\b|\bAIWebIndex\b|\bALittle\ Client\b|\bASPSeek\b|\bAbonti\b|\bAboundex\b|\bAboundexbot\b|\bAcunetix\b|\bAdsTxtCrawlerTP\b|\bAfD\-Verbotsverfahren\b|\bAhrefsBot\b|\bAiHitBot\b|\bAipbot\b|\bAlexibot\b|\bAliyun\b|\bAliyunSecBot\b|\bAllSubmitter\b|\bAlligator\b|\bAlphaBot\b|\bAnarchie\b|\bAnarchy\b|\bAnarchy99\b|\bAnkit\b|\bAnthill\b|\bApexoo\b|\bAspiegel\b|\bAsterias\b|\bAtomseobot\b|\bAttach\b|\bAwarioBot\b|\bAwarioRssBot\b|\bAwarioSmartBot\b|\bBBBike\b|\bBDCbot\b|\bBDFetch\b|\bBLEXBot\b|\bBackDoorBot\b|\bBackStreet\b|\bBackWeb\b|\bBacklink\-Ceck\b|\bBacklinkCrawler\b|\bBacklinksExtendedBot\b|\bBadass\b|\bBandit\b|\bBarkrowler\b|\bBatchFTP\b|\bBattleztar\ Bazinga\b|\bBetaBot\b|\bBigfoot\b|\bBitacle\b|\bBlackWidow\b|\bBlack\ Hole\b|\bBlackboard\b|\bBlow\b|\bBlowFish\b|\bBoardreader\b|\bBolt\b|\bBotALot\b|\bBrandprotect\b|\bBrandwatch\b|\bBuck\b|\bBuddy\b|\bBuiltBotTough\b|\bBuiltWith\b|\bBullseye\b|\bBunnySlippers\b|\bBuzzSumo\b|\bCATExplorador\b|\bCODE87\b|\bCSHttp\b|\bCalculon\b|\bCazoodleBot\b|\bCegbfeieh\b|\bCensysInspect\b|\bCheTeam\b|\bCheeseBot\b|\bCherryPicker\b|\bChinaClaw\b|\bChlooe\b|\bCitoid\b|\bClaritybot\b|\bCliqzbot\b|\bCloud\ mapping\b|\bCocolyzebot\b|\bCogentbot\b|\bCollector\b|\bCopier\b|\bCopyRightCheck\b|\bCopyscape\b|\bCosmos\b|\bCraftbot\b|\bCrawling\ at\ Home\ Project\b|\bCrazyWebCrawler\b|\bCrescent\b|\bCrunchBot\b|\bCurious\b|\bCusto\b|\bCyotekWebCopy\b|\bDBLBot\b|\bDIIbot\b|\bDSearch\b|\bDTS\ Agent\b|\bDataCha0s\b|\bDatabaseDriverMysqli\b|\bDemon\b|\bDeusu\b|\bDevil\b|\bDigincore\b|\bDigitalPebble\b|\bDirbuster\b|\bDisco\b|\bDiscobot\b|\bDiscoverybot\b|\bDispatch\b|\bDittoSpyder\b|\bDnBCrawler\-Analytics\b|\bDnyzBot\b|\bDomCopBot\b|\bDomainAppender\b|\bDomainCrawler\b|\bDomainSigmaCrawler\b|\bDomainStatsBot\b|\bDomains\ Project\b|\bDotbot\b|\bDownload\ Wonder\b|\bDragonfly\b|\bDrip\b|\bECCP\b|\bEMail\ Siphon\b|\bEMail\ Wolf\b|\bEasyDL\b|\bEbingbong\b|\bEcxi\b|\bEirGrabber\b|\bEroCrawler\b|\bEvil\b|\bExabot\b|\bExpress\ WebPictures\b|\bExtLinksBot\b|\bExtractor\b|\bExtractorPro\b|\bExtreme\ Picture\ Finder\b|\bEyeNetIE\b|\bEzooms\b|\bFDM\b|\bFHscan\b|\bFemtosearchBot\b|\bFimap\b|\bFirefox/7\.0\b|\bFlashGet\b|\bFlunky\b|\bFoobot\b|\bFreeuploader\b|\bFrontPage\b|\bFuzz\b|\bFyberSpider\b|\bFyrebot\b|\bG\-i\-g\-a\-b\-o\-t\b|\bGT::WWW\b|\bGalaxyBot\b|\bGeedoProductSearch\b|\bGenieo\b|\bGenomeCrawlerd\b|\bGermCrawler\b|\bGetRight\b|\bGetWeb\b|\bGetintent\b|\bGigabot\b|\bGo!Zilla\b|\bGo\-Ahead\-Got\-It\b|\bGoZilla\b|\bGotit\b|\bGrabNet\b|\bGrabber\b|\bGrafula\b|\bGrapeFX\b|\bGrapeshotCrawler\b|\bGridBot\b|\bHEADMasterSEO\b|\bHMView\b|\bHTMLparser\b|\bHTTP::Lite\b|\bHTTrack\b|\bHaansoft\b|\bHaosouSpider\b|\bHarvest\b|\bHavij\b|\bHeritrix\b|\bHloader\b|\bHonoluluBot\b|\bHumanlinks\b|\bHybridBot\b|\bIDBTE4M\b|\bIDBot\b|\bIRLbot\b|\bIblog\b|\bId\-search\b|\bIlseBot\b|\bImage\ Fetch\b|\bImage\ Sucker\b|\bIndeedBot\b|\bIndy\ Library\b|\bInfoNaviRobot\b|\bInfoTekies\b|\bInformation\ Security\ Team\ InfraSec\ Scanner\b|\bInfraSec\ Scanner\b|\bIntelliseek\b|\bInterGET\b|\bInternetMeasurement\b|\bInternetSeer\b|\bInternet\ Ninja\b|\bIria\b|\bIskanie\b|\bIstellaBot\b|\bJOC\ Web\ Spider\b|\bJamesBOT\b|\bJbrofuzz\b|\bJennyBot\b|\bJetCar\b|\bJetty\b|\bJikeSpider\b|\bJoomla\b|\bJorgee\b|\bJustView\b|\bJyxobot\b|\bKenjin\ Spider\b|\bKeybot\ Translation\-Search\-Machine\b|\bKeyword\ Density\b|\bKinza\b|\bKozmosbot\b|\bLNSpiderguy\b|\bLWP::Simple\b|\bLanshanbot\b|\bLarbin\b|\bLeap\b|\bLeechFTP\b|\bLeechGet\b|\bLexiBot\b|\bLftp\b|\bLibWeb\b|\bLibwhisker\b|\bLieBaoFast\b|\bLightspeedsystems\b|\bLikse\b|\bLinkScan\b|\bLinkWalker\b|\bLinkbot\b|\bLinkextractorPro\b|\bLinkpadBot\b|\bLinksManager\b|\bLinqiaMetadataDownloaderBot\b|\bLinqiaRSSBot\b|\bLinqiaScrapeBot\b|\bLipperhey\b|\bLipperhey\ Spider\b|\bLitemage_walker\b|\bLmspider\b|\bLtx71\b|\bMFC_Tear_Sample\b|\bMIDown\ tool\b|\bMIIxpc\b|\bMJ12bot\b|\bMQQBrowser\b|\bMSFrontPage\b|\bMSIECrawler\b|\bMTRobot\b|\bMag\-Net\b|\bMagnet\b|\bMail\.RU_Bot\b|\bMajestic\-SEO\b|\bMajestic12\b|\bMajestic\ SEO\b|\bMarkMonitor\b|\bMarkWatch\b|\bMass\ Downloader\b|\bMasscan\b|\bMata\ Hari\b|\bMauiBot\b|\bMb2345Browser\b|\bMeanPath\ Bot\b|\bMeanpathbot\b|\bMediatoolkitbot\b|\bMegaIndex\.ru\b|\bMetauri\b|\bMicroMessenger\b|\bMicrosoft\ Data\ Access\b|\bMicrosoft\ URL\ Control\b|\bMinefield\b|\bMister\ PiX\b|\bMoblie\ Safari\b|\bMojeek\b|\bMojolicious\b|\bMolokaiBot\b|\bMorfeus\ Fucking\ Scanner\b|\bMozlila\b|\bMr\.4x3\b|\bMsrabot\b|\bMusobot\b|\bNICErsPRO\b|\bNPbot\b|\bName\ Intelligence\b|\bNameprotect\b|\bNavroad\b|\bNearSite\b|\bNeedle\b|\bNessus\b|\bNetAnts\b|\bNetLyzer\b|\bNetMechanic\b|\bNetSpider\b|\bNetZIP\b|\bNet\ Vampire\b|\bNetcraft\b|\bNettrack\b|\bNetvibes\b|\bNextGenSearchBot\b|\bNibbler\b|\bNiki\-bot\b|\bNikto\b|\bNimbleCrawler\b|\bNimbostratus\b|\bNinja\b|\bNmap\b|\bNuclei\b|\bNutch\b|\bOctopus\b|\bOdin\b|\bOffline\ Explorer\b|\bOffline\ Navigator\b|\bOnCrawl\b|\bOpenLinkProfiler\b|\bOpenVAS\b|\bOpenfind\b|\bOpenvas\b|\bOrangeBot\b|\bOrangeSpider\b|\bOutclicksBot\b|\bOutfoxBot\b|\bPECL::HTTP\b|\bPHPCrawl\b|\bPOE\-Component\-Client\-HTTP\b|\bPageAnalyzer\b|\bPageGrabber\b|\bPageScorer\b|\bPageThing\.com\b|\bPage\ Analyzer\b|\bPandalytics\b|\bPanscient\b|\bPapa\ Foto\b|\bPavuk\b|\bPeoplePal\b|\bPetalbot\b|\bPi\-Monster\b|\bPicscout\b|\bPicsearch\b|\bPictureFinder\b|\bPiepmatz\b|\bPimonster\b|\bPixray\b|\bPleaseCrawl\b|\bPockey\b|\bProPowerBot\b|\bProWebWalker\b|\bProbethenet\b|\bProximic\b|\bPsbot\b|\bPu_iN\b|\bPump\b|\bPxBroker\b|\bPyCurl\b|\bQueryN\ Metasearch\b|\bQuick\-Crawler\b|\bRSSingBot\b|\bRainbot\b|\bRankActive\b|\bRankActiveLinkBot\b|\bRankFlex\b|\bRankingBot\b|\bRankingBot2\b|\bRankivabot\b|\bRankurBot\b|\bRe\-re\b|\bReGet\b|\bRealDownload\b|\bReaper\b|\bRebelMouse\b|\bRecorder\b|\bRedesScrapy\b|\bRepoMonkey\b|\bRipper\b|\bRocketCrawler\b|\bRogerbot\b|\bSBIder\b|\bSEBot\-WA\b|\bSEOkicks\b|\bSEOkicks\-Robot\b|\bSEOlyt\b|\bSEOlyticsCrawler\b|\bSEOprofiler\b|\bSEOstats\b|\bSISTRIX\b|\bSMARTSEO\-checker\b|\bSMTBot\b|\bSalesIntelligent\b|\bScanAlert\b|\bScanbot\b|\bScoutJet\b|\bScrapy\b|\bScreaming\b|\bScreenerBot\b|\bScrepyBot\b|\bSearchestate\b|\bSearchmetricsBot\b|\bSeekport\b|\bSeekportBot\b|\bSemanticJuice\b|\bSemrush\b|\bSemrushBot\b|\bSemrushBot\-BA\b|\bSemrushBot\-FT\b|\bSemrushBot\-OCOB\b|\bSemrushBot\-SI\b|\bSemrushBot\-SWA\b|\bSentiBot\b|\bSenutoBot\b|\bSeoCherryBot\b|\bSeoSiteCheckup\b|\bSeobilityBot\b|\bSeomoz\b|\bShodan\b|\bSiphon\b|\bSiteAuditBot\b|\bSiteCheckerBotCrawler\b|\bSiteExplorer\b|\bSiteLockSpider\b|\bSiteSnagger\b|\bSiteSucker\b|\bSite\ Sucker\b|\bSitebeam\b|\bSiteimprove\b|\bSitevigil\b|\bSlySearch\b|\bSmartDownload\b|\bSnake\b|\bSnapbot\b|\bSnoopy\b|\bSocialRankIOBot\b|\bSociscraper\b|\bSogou\ web\ spider\b|\bSosospider\b|\bSottopop\b|\bSpaceBison\b|\bSpammen\b|\bSpankBot\b|\bSpanner\b|\bSpbot\b|\bSpider_Bot\b|\bSpinn3r\b|\bSplitSignalBot\b|\bSputnikBot\b|\bSqlmap\b|\bSqlworm\b|\bSqworm\b|\bSteeler\b|\bStripper\b|\bSucker\b|\bSucuri\b|\bSuperBot\b|\bSuperHTTP\b|\bSurfbot\b|\bSurveyBot\b|\bSuzuran\b|\bSwiftbot\b|\bSzukacz\b|\bT0PHackTeam\b|\bT8Abot\b|\bTLM\-Audit\-Scanner\b|\bTMP\b|\bTeleport\b|\bTeleportPro\b|\bTelesoft\b|\bTelesphoreo\b|\bTelesphorep\b|\bTheNomad\b|\bThe\ Intraformant\b|\bThumbor\b|\bTightTwatBot\b|\bTinyTestBot\b|\bToata\b|\bToweyabot\b|\bTracemyfile\b|\bTrendiction\b|\bTrendictionbot\b|\bTrue_Robot\b|\bTuringos\b|\bTurnitin\b|\bTurnitinBot\b|\bTwengaBot\b|\bTwice\b|\bTyphoeus\b|\bURLy\.Warning\b|\bURLy\ Warning\b|\bUnisterBot\b|\bUpflow\b|\bV\-BOT\b|\bVB\ Project\b|\bVCI\b|\bVacuum\b|\bVagabondo\b|\bVelenPublicWebCrawler\b|\bVeriCiteCrawler\b|\bVidibleScraper\b|\bVirusdie\b|\bVoidEYE\b|\bVoil\b|\bVoltron\b|\bWASALive\-Bot\b|\bWBSearchBot\b|\bWEBDAV\b|\bWISENutbot\b|\bWPScan\b|\bWWW\-Collector\-E\b|\bWWW\-Mechanize\b|\bWWW::Mechanize\b|\bWWWOFFLE\b|\bWallpapers\b|\bWallpapersHD\b|\bWeSEE\b|\bWebAuto\b|\bWebBandit\b|\bWebCollage\b|\bWebCopier\b|\bWebEnhancer\b|\bWebFetch\b|\bWebFuck\b|\bWebGo\ IS\b|\bWebImageCollector\b|\bWebLeacher\b|\bWebPix\b|\bWebReaper\b|\bWebSauger\b|\bWebStripper\b|\bWebSucker\b|\bWebWhacker\b|\bWebZIP\b|\bWeb\ Auto\b|\bWeb\ Collage\b|\bWeb\ Enhancer\b|\bWeb\ Fetch\b|\bWeb\ Fuck\b|\bWeb\ Pix\b|\bWeb\ Sauger\b|\bWeb\ Sucker\b|\bWebalta\b|\bWebmasterWorldForumBot\b|\bWebshag\b|\bWebsiteExtractor\b|\bWebsiteQuester\b|\bWebsite\ Quester\b|\bWebster\b|\bWhack\b|\bWhacker\b|\bWhatweb\b|\bWho\.is\ Bot\b|\bWidow\b|\bWinHTTrack\b|\bWiseGuys\ Robot\b|\bWonderbot\b|\bWoobot\b|\bWotbox\b|\bWprecon\b|\bXaldon\ WebSpider\b|\bXaldon_WebSpider\b|\bXenu\b|\bYaK\b|\bYoudaoBot\b|\bZade\b|\bZauba\b|\bZermelo\b|\bZeus\b|\bZitebot\b|\bZmEu\b|\bZoomBot\b|\bZoominfoBot\b|\bZumBot\b|\bZyBorg\b|\badscanner\b|\barchive\.org_bot\b|\baria2\b|\barquivo\-web\-crawler\b|\barquivo\.pt\b|\bautoemailspider\b|\bawario\.com\b|\bbacklink\-check\b|\bcah\.io\.community\b|\bcheck1\.exe\b|\bclark\-crawler\b|\bcoccocbot\b|\bcognitiveseo\b|\bcom\.plumanalytics\b|\bcrawl\.sogou\.com\b|\bcrawler4j\b|\bcrawler\.feedback\b|\bdataforseo\.com\b|\bdataforseobot\b|\bdataprovider\b|\bdemandbase\-bot\b|\bdomainsproject\.org\b|\beCatch\b|\bevc\-batch\b|\beveryfeed\-spider\b|\bfacebookscraper\b|\bfasthttp\b|\bgopher\b|\bheritrix\b|\binstabid\b|\binternetVista\ monitor\b|\bips\-agent\b|\bisitwp\.com\b|\biubenda\-radar\b|\bl9scan\b|\bleakix\b|\blibredtail\-http\b|\blinkdexbot\b|\blinkfluence\b|\blitellm\-recon\b|\blwp\-request\b|\blwp\-trivial\b|\bmagpie\-crawler\b|\bmeanpathbot\b|\bmediawords\b|\bmuhstik\-scan\b|\bnetEstate\ NE\ Crawler\b|\boBot\b|\bopendirme\-credhunt\b|\bpage\ scorer\b|\bpcBrowser\b|\bplumanalytics\b|\bpolaris\ version\b|\bprobe\-image\-size\b|\bripz\b|\bs1z\.ru\b|\bsatoristudio\.net\b|\bscalaj\-http\b|\bscan\.lol\b|\bseobility\b|\bseocompany\.store\b|\bseoscanners\b|\bseostar\b|\bserpstatbot\b|\bsexsearcher\b|\bsitechecker\.pro\b|\bsiteripz\b|\bsmart\-seo\-tools\.sbs\b|\bsogouspider\b|\bsp_auditbot\b|\bspy4x\-domain\-scanner\b|\bspyfu\b|\bsysscan\b|\btAkeOut\b|\bterrabot\-owned\-you\b|\btrafilatura\b|\btrendiction\.com\b|\btrendiction\.de\b|\bubermetrics\-technologies\.com\b|\bvoyagerx\.com\b|\bwebgains\-bot\b|\bwebmeup\-crawler\b|\bwebpros\.com\b|\bwebprosbot\b|\bwp2shell\b|\bx09Mozilla\b|\bxpymep1\.exe\b|\bzauba\.io\b|\bzgrab\b)[^"]*)"$'
time_field: time
time_format: nginx

# GENERATED by bin/gen-http-lists.py — edit the data file and
# regenerate, never this file.
#
# A refused request for a path only an exploit asks for — the
# hub's list of URIs from actively-probed CVEs (33 of
# them).
# Data from the CrowdSec hub (MIT), matched the way its scenario
# matches: on a 404 or 403 only. What answered 200 is the operator's
# own service, not a probe.
parser: http-cve-probe
log: http
prefilter: '" 4'
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*(?:/_ignition/execute\-solution|/_layouts/15/toolpane\.aspx|/api/fabric/device/status|/api/v2\.0/cmdb/system/admin%3f/\.\./\.\./\.\./\.\./\.\./cgi\-bin/fwbcgi|/cgi/networkdiag\.cgi|/cgi\-bin/nas_sharing\.cgi|/clients/mycrl|/developmentserver/metadatauploader|/global\-protect/login\.esp|/goanywhere/images/\.\.|/goanywhere/lic/accept|/gsb/datetime\.php|/guestaccess\.aspx|/hedwig\.cgi|/helpdesk/WebObjects/Helpdesk\.woa/ajax/2\.0\.7\.1\.1\.1|/helpdesk/WebObjects/Helpdesk\.woa/ajax/9\.7\.43\.0\.0\.0\.4\.3\.7\.0\.7\.1\.1\.1|/helpdesk/WebObjects/Helpdesk\.woa/wo/|/hnap1/|/mdm/checkin|/nf/auth/startwebview\.do|/p/u/doauthentication\.do|/remote/saml/login|/reports/data/opt/data/containers/config/data\-collection\-agent/\.dca|/rpc2_login|/server/node_upgrade_srv\.js|/setup\.cgi|/sitecore/api/ssc/auth/login|/unauth/%252e%252e/php/|/webinterface/|/webinterface/login\.html|/wp\-json/batch/v1|\?%ad|index\.php%3f\.php/)[^ "?]*)(?:\?[^ "]*)? [^"]*" (?:404|403) '
time_field: time
time_format: nginx

# A crawler whose User-Agent gives a reserved example.com/net/org URL
# as its identity page. Real crawlers link their real documentation;
# only a tool that filled the template with the placeholder does this,
# and it did so to look legitimate. Whatever it fetched, the claim
# itself is the offence.
parser: http-fake-bot-ua
log: http
prefilter: "example."
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?[^ "]*)? [^"]*" \d{3} \d+ "[^"]*" "(?P<ua>[^"]*\+(?i:https?)://(?:www\.)?(?i:example)\.(?:com|net|org)[^"]*)"$'
time_field: time
time_format: nginx

# Someone testing whether this server will relay their traffic:
#   "GET http://example.com/ HTTP/1.1"
#   "CONNECT example.com:443 HTTP/1.1"
#
# A browser sends an absolute URL only to a configured proxy. Arriving
# at a web server for a host we do not serve it means one thing, and
# the people who send it are looking for somewhere to launder an
# attack from. (The requested URL is captured as `path`, NEVER as
# `target`: target is the reserved field for the site a hit is about,
# and the open-proxy rule leans on its absence.)
parser: http-open-proxy
log: http
prefilter: "://"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[a-zA-Z][a-zA-Z0-9+.-]*://[^ "]*) [^"]*" (?P<status>\d{3}) \S+ "[^"]*" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx

# A request for a PHP file that is not there — a 404 on a path ending in
# .php (query or not). Real traffic serves its PHP; a 404 on one means the
# client guessed at a script: a shell left by a previous intrusion
# (/wp-content/uploads/x.php), an installer, a panel, a plugin that is
# not installed. WordPress's own endpoints and paths under /wp- are the
# business of wp-scan-paths and the WordPress rules; this one reads
# everything else, and the php-probe rule counts it.
parser: http-php-missing
log: http
prefilter: '.php'
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>/[^ "?]*\.(?i:php[0-9]?|phtml|phar))(?:\?(?P<query>[^ "]*))? [^"]*" 404 \d+ "(?P<referer>[^"]*)" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx

# Nuclei: a vulnerability scanner. Legitimate against your own estate,
# and it is not your own estate that it points at from a stranger's
# address.
parser: http-scanner-ua-nuclei
log: http
prefilter: "uclei"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "[A-Z]+ [^ "]* [^"]*" (?P<status>\d{3}) \d+ "[^"]*" "(?P<ua>[^"]*[Nn]uclei[^"]*)"$'
time_field: time
time_format: nginx

# The internet-wide survey scanners, which announce themselves and are
# gated by their own literal. zgrab is the crawler behind most of the
# "researcher" traffic that fingerprints every open port on the planet.
parser: http-scanner-ua-zgrab
log: http
prefilter: "zgrab"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "[A-Z]+ [^ "]* [^"]*" (?P<status>\d{3}) \d+ "[^"]*" "(?P<ua>[^"]*zgrab[^"]*)"$'
time_field: time
time_format: nginx

# A scanner or an exploit tool that does not bother hiding what it is.
# Only tools whose name means one thing are listed: a user agent is
# trivially forged, so this catches the lazy and never the careful, and
# the value is that what it catches needs no second opinion.
#
# prefilter_any gates the regex on the tool names themselves (the
# multi-literal automaton, under a microsecond a line); the regex then
# requires the name inside the user-agent field, so a URL containing the
# word does not count. Names: sqlmap, masscan, nmap, zmap (the classic
# scanners; zgrab and nuclei have parsers of their own), wp2shell (the
# REST-batch WordPress exploit tool of 2026-08 — the same name is on the
# bad-bots list at two hits; here it is one).
parser: http-scanner-ua
log: http
prefilter_any: [sqlmap, masscan, nmap, zmap, wp2shell]
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "[A-Z]+ [^ "]* [^"]*" (?P<status>\d{3}) \d+ "[^"]*" "(?P<ua>[^"]*(?:sqlmap|masscan|nmap|zmap|wp2shell)[^"]*)"$'
time_field: time
time_format: nginx

# A request for a credentials or secrets file that does NOT start with
# a slash-dot — those are http-secret-probe's, from the pack. This is
# the rest of the list: SQL dumps, private keys, cloud and deploy
# credentials, config backups. WHATEVER the status: a 200 on /db.sql.gz
# is not a page view, it is an exfiltration that worked.
#
# Sources: this host's own CrowdSec secret-file-probe scenario plus the
# hub's sensitive_data list, pruned to what cannot name a legitimate
# file on this machine's sites.
#
# No single literal is shared by these names, so the gate is the
# multi-literal prefilter: the pattern runs only on lines carrying one
# of these fragments.
parser: http-secret-file
log: http
prefilter_any:
  - ".sql"
  - "id_rsa"
  - "id_dsa"
  - "id_ecdsa"
  - "id_ed25519"
  - "rclone.conf"
  - "docker-compose"
  - "terraform.tfstate"
  - "serverless.y"
  - "sftp-config.json"
  - "credentials.json"
  - "secrets.y"
  - "secrets.json"
  - "wp-config.php."
  - ".pem"
  - ".key"
  - "env.bak"
  - "env.backup"
  - "/@fs/"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*(?i:\.sql(?:\.(?:gz|tar|bz2|bzip2|zip|rar|7z))?|id_(?:rsa|dsa|ecdsa|ed25519)|rclone\.conf|docker-compose\.ya?ml|terraform\.tfstate|serverless\.ya?ml|sftp-config\.json|application_default_credentials\.json|gcp-credentials\.json|credentials\.json|secrets\.(?:ya?ml|json)|wp-config\.php\.(?:bak|old|save|txt)|(?:server|host|localhost|private|privatekey|privkey|key)\.(?:key|pem)|env\.(?:bak|backup)|/@fs/)[^ "?]*)(?:\?[^ "]*)? [^"]*" \d{3} '
time_field: time
time_format: nginx

# A request for a file that is only interesting to someone who should
# not have it: version-control metadata, environment files, private
# keys, shell history, credentials. Whatever the answer was — a 200 here
# is worse than a 404, not better — so the status is not part of it.
#
# The prefilter is `/.`, a dot immediately after a slash, which is rare
# in ordinary traffic. The one common exception is /.well-known, which
# the alternation simply does not list.
# .DS_Store is not here: WebDAV clients ask for it as a matter of course
# (it left the list on 2026-08-22, with the −1 parser that cancelled it).
parser: http-secret-probe
log: http
prefilter: "/."
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*/\.(?:env|git|svn|hg|bzr|aws|ssh|docker|vscode|npmrc|netrc|htpasswd|htaccess|bash_history|sh_history|mysql_history|s3cfg|msmtprc|config|cvs|subversion|passwd|pwd|rhosts|profile|bashrc|travis\.yml|gitlab-ci)\b[^ "?]*)(?:\?[^ "]*)? [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx

# GENERATED by bin/gen-http-lists.py — edit the data file and
# regenerate, never this file.
#
# A SQL-injection probe in the query string ('union select',
# sleep(), information_schema…).
# Data from the CrowdSec hub (MIT). Matched in the query string only,
# case-insensitively, whatever the status: a request that SUCCEEDED
# with one of these in it is the worst case, not the innocent one.
parser: http-sqli-probe
log: http
prefilter_any:
  - "%40%40version"
  - "..xp_cmdshell"
  - "information_schema.tables"
  - "%20union%20all%20select%20"
  - "%20union%20select%20"
  - "%2cnull%2cnull"
  - "benchmark%28"
  - "load_file%28"
  - "substr%28"
  - "substring%28"
  - "selectchar%28"
  - "%7c%7cchr%28"
  - "distinct%28"
  - "pg_sleep%28"
  - "sleep%28"
  - "upper%28"
  - "hex%28"
  - "md5%28"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)\?(?P<query>[^ "]*(?i:%40%40version|\.\.xp_cmdshell|information_schema\.tables|%20union%20all%20select%20|%20union%20select%20|%2cnull%2cnull|benchmark%28|load_file%28|substr%28|substring%28|selectchar%28|%7c%7cchr%28|distinct%28|pg_sleep%28|sleep%28|upper%28|hex%28|md5%28)[^ "]*) [^"]*" \d{3} \d+ "[^"]*" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx

# A MISSING image, stylesheet, font or media file. It matches the same
# lines as http-404 and exists so a rule can give it a negative weight
# and cancel them out.
#
# 404 only, deliberately. A 403 on an image is not a missing asset, it
# is something refusing to serve one — a hotlink guard, a firewall — and
# cancelling those would be cancelling a refusal.
#
# That is how "count the probes, ignore the broken assets" is expressed
# here: a page referencing four images that were deleted produces four
# 404s and four of these, and nets to nothing, while four requests for
# /wp-config.php.bak net to four. A scanner does not ask for .woff2.
#
# The extension list is the point of the parser; anything not on it
# counts as a real request. Keep it to things a browser fetches without
# being asked.
# json/webmanifest/xml/txt joined the list on 2026-08-22: a site whose
# /manifest.json, sitemap.xml or robots.txt is missing makes every
# visitor "probe" it on every page — a Bouygues reader of ush-centre.org
# was banned on them. Scanners' .txt/.xml probes under plugin paths are
# wp-scan-paths's; the REST ones are the enumeration rules'.
parser: http-static-miss
log: http
prefilter: '" 404 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?:GET|HEAD) (?P<path>[^ "?]*\.(?:png|jpe?g|gif|webp|avif|svg|ico|bmp|css|js|mjs|map|woff2?|ttf|otf|eot|mp4|webm|ogg|mp3|wav|pdf|json|webmanifest|xml|txt))(?:\?[^ "]*)? [^"]*" 404 \d+ "(?P<referer>[^"]*)" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx

# GENERATED by bin/gen-http-lists.py — edit the data file and
# regenerate, never this file.
#
# A refused request for a technology's own path — admin panels,
# consoles, appliance endpoints (300 exact paths,
# 96 fragments). The vendor path is the verdict:
# nothing here serves these, so whoever asks is fingerprinting.
# Data from the CrowdSec hub (MIT), matched the way its scenario
# matches: on a 404 or 403 only. What answered 200 is the operator's
# own service, not a probe.
parser: http-tech-probe
log: http
prefilter: '" 4'
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>(?:/ampps\-admin/index\.php|/ampps/index\.php|/akuiteo/login\.html/|/akuiteo\.collabs/login/login\.html|/portal/portalhelp/en/|/arcgis/rest/services|/archibus/login\.axvw|/archibus/schema/ab\-core/views/sign\-in/ab\-sign\-in\.jsp|/api/portal/v1\.4/appinfo|/html/skin/ric/c/config/default\.config\.json|/bitrix/admin/|/bitrix/components/bitrix/map\.yandex\.view/settings/settings\.php|/calendar/admin/cal_login\.php|/calendarix/admin/cal_login\.php|/cxrestapi/help/system/version|/cxrestapi/auth/identity/\.well\-known/openid\-configuration|/cxwebclient/login\.aspx|/admin_ui/mas/ent/login\.html|/logon/logonpoint/custom\.html|/logon/logonpoint/index\.html|/logon/logonpoint/tmindex\.html|/commandcenter/login/presso\.jsp|/events/eventrsvp\.aspx|/gdshost/default\.aspx|/manager/login\.aspx|/mgmt/shared/authn/login|/mrcgi/mrentrancepage\.pl|/mrcgi/mrlogin\.pl|/pem/login/pages/login\.jsf|/druid/index\.html|/autodiscover/autodiscover\.json|/webclient/login\.xhtml|/goanywhere/[^ "?]*|/dbconsole/|/h2\-console/|/h2\-console/login\.jsp|/sm/ess\.do|/sm935/index\.do|/horde/login\.php|/horde/imp/login\.php|/imp/login\.php|/hmc/hybris|/hybris/hmc/hybris|/mediation/authenticate|/mediation/domains|/dana\-na/auth/url_default/welcome\.cgi|/dana\-na/auth/url_2/welcome\.cgi|/dana\-na/auth/url_3/welcome\.cgi|/dana\-cached/hc/hostcheckerinstaller\.osx|/dana\-na/nc/nc_gina_ver\.txt|/mics/login\.jsp|/mifs/c/d/android\.html|/mifs/login\.jsp|/mifs/user/login\.jsp|/jbpm\-console/app/tasks\.jsf|/jmx\-console/|/juddi/|/kfm/admin/|/kfm/index\.php|/wfc/portal|/wfc/logon|/lam/templates/login\.php|/templates/login\.php|/login/home/login\.view|/labkey/home/login\-login\.view|/api/jsonws/invoke|/api/jsonws|/lucee/admin/server\.cfm|/lucee/admin/web\.cfm|/_login_server_|/nds|/ews/exchange\.asmx|/owa/auth/logon\.aspx|/owa/service\.svc|/server\-common/cgi\-bin/login|/npm\-admin/showloginpage\.do|/qsa/login\.aspx|/api/external/getprivacy|/mt\.cgi|/mt/admin|/mylittleadmin/|/mylittlebackup/|/mlb/|/web/database/manager|/web/database/selector/|/web/login|/op/generate\.aspx|/op/wrongfiletype\.htm|/authenticationform/jsp/logonweb\.jsp|/authenticationform/login|/em/console/ias/oc4j/home|/em/console/logon/logon|/sslmgr|/cgi\-bin/qmailadmin|/cgi\-bin/qmailadmin/qmailadmin|/cgi\-ssl/qmailadmin/qmailadmin|/qmailadmin/qmailadmin\.cgi|/rdweb/|/rdweb/pages/en\-us/login\.aspx|/arsys/shared/login\.jsp|/rsso/admin/|/run\.php|/reportico/run\.php|/fileman/asp_net/main\.ashx|/fileman/php/fileslist\.php|/fileman/index\.html|/fiori|/nwa|/sf/start|/irj/portal/fiori|/irj/portal|/sap/bc/ui5_ui5/ui2/ushell/shells/abap/fiorilaunchpad\.html|/sap/hana/xs/formlogin/login\.html|/magicinfo/login|/sws/index\.html|/secenrol/|/secadmin/|/securenvoy/|/rdweb|/dms/out/out\.login\.php|/out/out\.login\.php|/orion/login\.aspx|/dlpcenter/images/favicon\.ico|/dlpcenter/loginform\.sms|/search/admin/admin\.php|/sphider/admin/admin\.php|/admin/spider\.php|/cgi\-bin/webmail|/cgi\-bin/sqwebmail|/admin/auth/login|/admin/plugins/users\-permissions/auth/login|/protectmanager/logon|/b/l\.e|/iam/immanage/login\.jsp|/vkd/getwelcomescreen\.event|/jasperserver\-pro/login\.html|/jasperserver/login\.html|/login/login\.jsp|/cfcc/login/login\.jsp|/spotfire/login\.html|/responsiveui/webmail/folder\.xhtml|/responsiveui/|/umbraco/login|/umbraco|/versa/login|/versa/login\.html|/wabam/favicon\.ico|/wabam|/server/apps/login\.php|/studioserver/server/apps/login\.php|/xxl\-job\-admin/tologin|/tologin|/authorization\.do|/servlet/getproductversion|/iam/login|/exchange/index\.html|/pki/images/keymanager_title\.ico|/apiclient/index\.jsp|/apiclient/ember/login\.jsp|/ovirt\-engine/userportal/|/ovirt\-engine/webadmin/|/cgi\-bin/videoconfiguration\.cgi|/adfinity/login|/concerto/login|/alfresco/api/\-default\-/public/cmis/versions/1\.1/atom|/ossim/session/login\.php|/anaqua/public/login\.aspx|/apimanui/api\-manager|/appsuite/|/_db/_system/_admin/aardvark/index\.html|/aims/ps/|/bolt/login|/bonita/login\.jsp|/cacti/|/cas/login|/cassia/login|/centreon/index\.php|/chronos\.wsc/asparamlogin\.html|/fmi/webd/|/tips/tipslogin\.action|/contao/login|/contentcentral/login\.aspx/|/cgi\-bin/ck/domenu\.cgi|/covenantuser/login|/login/nuilogin\.aspx|/cxcum/|/ccm\-web/|/deltaweb/hmi_login\.asp|/dex/auth|/docuware/identity/account/login|/dotadmin/|/dc2/admin/auth\.php|/druid/login\.html|/dxplanning/webbooking/version|/emswebclient/login\.aspx|/episerver/cms|/presentation/epsonconnect|/era/webconsole/|/wfc/|/fpui/jsp/login\.jsp|/ipa/ui/|/fuel/login|/gespage/webapp/login\.xhtml|/glpi/|/go/auth/login|/hm/login\.action|/iclock/accounts/login/|/ilias/login\.php|/cp/shares|/sess\-bin/login_session\.cgi|/front/privatelogin\.jsp|/kenesto/account/logon|/cmspages/logon\.aspx|/app/kibana|/clusters/local|/wcc2/|/site_admin/user/login|/cgi\-bin/luci|/lui/|/\.magnolia/admincentral|/mbilling/|/mailscanner/login\.php|/plugins/corehome/images/favicon\.png|/users/new|/minio/login|/monitorix\-cgi/monitorix\.cgi|/nagiosxi/login\.php|/nagvis/frontend/nagvis\-js/index\.php|/neos/login|/nuxeo/login\.jsp|/sfiler/login\.action|/opencats/|/ocpu/|/opennms/login\.jsp|/locales/en/translation\.json|/opensis/index\.php|/cgi\-bin/luci/|/openvpn\-monitor/|/admin/folder\.do|/otobo/index\.pl|/servicecenter/login\.aspx|/pagespeed\-global\-admin/|/pandora_console/mobile/|/rashtml5gateway/|/prweb/prauth/app/default/|/pentaho/login|/cgi\-bin/manga/index\.cgi|/library/login|/phpldapadmin|/polarion/|/processwire/|/euweb/login|/qlikview/formlogin\.htm|/cgi\-bin/webcm|/cgi\-bin/wwwctrl\.cgi|/web/guest/en/websys/webarch/header\.cgi|/royal_event/|/console\-selfservice/selfservice\.do|/selfenrollment/enrollment\.aspx|/secmail/login\.jsp|/login/sls/auth|/systemmanager/account/signin|/\~sicom/mgrng/loginform\.php|/sitefinity/authenticate/swt|/sfmc/login|/sphinxauth/account/login|/sqlbuddy/|/dcim/|/directory/login/login\.aspx|/pureweb/server/login\.jsp|/sws/index\.sws|/synnefoclient/|/webapi/ping|/servlet/browserservlet|/typo3/|/static/console\-utm\-webui/js/preinit\.js|/veracore/home/|/opscenter/|/virtualems/login\.aspx|/portal/weblogin\.aspx|/plc/webvisu\.htm|/vsaas/v2/login|/app/login|/thinclient/wtm/public/index\.html|/webalizer/|/webmin/|/webmodule\-ee/login\.seam|/webshell4/login\.php|/enginemanager/ftu/welcome\.htm|/carbon/admin/login\.jsp|/zdm/login_xdm_uc\.jsp|/cgi\-bin/luci/web|/xphoneconnect/admin/login\.aspx|/cgi\-bin/xweb500\.cgi|/yunohost/admin|/admin/index/login\.html|/zb_system/login\.php|/zenario/admin/welcome\.php|/zentao/index\.php|/zipkin/)|[^ "?]*(?:/ampps/|/libs/livecycle/|/libs/granite/|/system/sling/|/crx/packmgr/|/cfide/|/host\-manager/|/manager/html|/desktop/container/|/cache/sdesktop/|/pages/sdcall/|/ccmadmin/|/cuadmin/|/\ cscoe\ /|/webacs/|/logon/logonpoint/|/scripts/wpnbr\.dll|/commandcenter/restservlet/|/commandcenter/api/|/tmui/tmui/login/welcome\.jsp|/tmui/login\.jsp|/mgmt/shared/|/my\.policy|/tmui/|/remote/login|/wlm/login|/phoenix/|/ecp/current/exporttool/microsoft\.exchange\.ediscovery\.exporttool\.application|/actuator/gateway/routes|/actuator/health|/dwr/index\.html|/info\.php|/teamserver/faces/|/decisioncenter/|/openadmin/|/maximo/|/ibmmq/|/wps/|/dana\-na/auth/|/api/v1/totp/|/dana\-cached/|/api/v1/cav/|/dana\-na/nc/|/apps/zxtm/|/dana\-na/|/dana/|/mics/|/mifs/|/nps/servlet/|/qcbin/|/filr/|/ssf/|/ews/|/owa/|/console/login/|/uddiexplorer/|/em/console/|/operalogin/|/oa_html/|/saw\.dll|/ipages/|/oam/|/atg/|/global\-protect/|/webdynpro/dispatcher/|/rep/start/|/irj/|/sap/|/sitecore\.version\.xml|/sitecore/admin/|/sitecore/login/|/services/messagebroker/|/helpdesk/webobjects/|/informationservice/|/solarwinds/|/orion/|/sonicui/|/sgms/|/hybridity/|/airwatch/|/airflow/|/solr/|/\ \.\./web\-inf/|/main/inc/ajax/extra_field\.ajax\.php\?a=search_options_from_tags|/weaver/weaver\.file\.filedownloadforoutdoc|/process/aprocess\.php|/videoseyret\.php|/webservices/webjobupload\.asmx|/servicedesk/customer/|/kiali/|/vnc\.html|/agentboard\.xgi|/officescan/|/api/v1/serverinfo|/config/fillbacksettingedit\.php|/zimbra)[^ "?]*)(?:\?[^ "]*)? [^"]*" (?:404|403) \S+ "[^"]*" "(?P<ua>[^"]*)"'
time_field: time
time_format: nginx

# The upper-case half of http-traversal-encoded. A prefilter is a
# literal, and `%2E` is not `%2e`.
parser: http-traversal-encoded-upper
log: http
prefilter: "%2E"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "]*%(?:25)?2E%(?:25)?2E[^ "]*) [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx

# The same walk, percent-encoded once or twice (%2e%2e%2f, %252e...),
# or a request naming a system file outright (/etc/passwd, win.ini,
# php:// and file:// wrappers).
#
# Two parsers rather than one because the prefilter is a literal and
# `%2e` and `%2E` are different literals; this one takes the lower-case
# form, which is what tooling emits. The upper-case form is caught by
# the sibling parser.
parser: http-traversal-encoded
log: http
prefilter: "%2e"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "]*%(?:25)?2e%(?:25)?2e[^ "]*) [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx

# An attempt to walk out of the document root with a literal `../`.
# There is no legitimate request containing one: a browser resolves the
# path before sending it.
parser: http-traversal
log: http
prefilter: "../"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "]*\.\./[^ "]*) [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx

# The DFind scanner's calling card: it asks every server it meets for
# /w00tw00t.at.ISC.SANS.DFind:). Nothing else ever requests a path
# containing that string. Translated from ltsich/http-w00tw00t.
parser: http-w00tw00t
log: http
prefilter: "w00tw00t"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*w00tw00t[^ "?]*)(?:\?[^ "]*)? [^"]*"'
time_field: time
time_format: nginx

# GENERATED by bin/gen-http-lists.py — edit the data file and
# regenerate, never this file.
#
# An XSS probe in the query string (raw tags, javascript:,
# alert()…).
# Data from the CrowdSec hub (MIT). Matched in the query string only,
# case-insensitively, whatever the status: a request that SUCCEEDED
# with one of these in it is the worst case, not the innocent one.
parser: http-xss-probe
log: http
prefilter_any:
  - "<img"
  - "<svg"
  - "<script"
  - "<div"
  - "<a"
  - "<embed"
  - "<style"
  - "javascript:"
  - "alert("
  - "prompt("
  - "<br"
  - "<input"
  - "<table"
  - "<object"
  - "<body"
  - "<p"
  - "<meta"
  - "<frameset"
  - "%3Cimg"
  - "%3Cscript"
  - "%3Cdiv"
  - "%3Ca"
  - "%3Cembed"
  - "%3Cstyle"
  - "javascript%3A"
  - "alert%28"
  - "prompt%28"
  - "%3Cbr"
  - "%3Cinput"
  - "%3Ctable"
  - "%3Cobject"
  - "%3Cbody"
  - "%3Cp"
  - "%3Cmeta"
  - "%3Cframeset"
  - "%3Csvg"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)\?(?P<query>[^ "]*(?i:<img|<svg|<script|<div|<a|<embed|<style|javascript:|alert\(|prompt\(|<br|<input|<table|<object|<body|<p|<meta|<frameset|%3Cimg|%3Cscript|%3Cdiv|%3Ca|%3Cembed|%3Cstyle|javascript%3A|alert%28|prompt%28|%3Cbr|%3Cinput|%3Ctable|%3Cobject|%3Cbody|%3Cp|%3Cmeta|%3Cframeset|%3Csvg)[^ "]*) [^"]*" \d{3} \d+ "[^"]*" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx

# A browser working INSIDE a site's wp-admin: whatever the request and
# whatever the answer, its referer names a /wp-admin/ page. Gutenberg
# fires twenty REST calls in a second (a town hall's secretary crossed
# http-crawl's 20/20s, 2026-08-20), a plugin's endpoint may 403 on
# every call (WPML, same day, banned by http-probing) — the admin's own
# activity should argue FOR them. Meant as a NEGATIVE weight in rules
# that count rates or refusals; a scanner requesting /wp-admin/ paths
# sends no such referer and is untouched. A forged referer escapes
# those rules — the accepted residual (wp-scan-paths precedent): the
# content rules and the WAF-blocked instants still stand behind.
parser: wp-admin-referer
log: http
prefilter: "/wp-admin"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?[^ "]*)? [^"]*" \d{3} \S+ "[^"]*/wp-admin/[^"]*" '
time_field: time
time_format: nginx

# A request for wp-config.php or one of the names a careless backup
# leaves beside it (wp-config.php.bak, wp-config.php~, wp-config.txt).
# The file holds the database credentials. Nothing legitimate asks the
# web server for it — PHP includes it, it is never fetched.
parser: wp-config-probe
log: http
prefilter: "wp-config"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*wp-config[^ "?]*)(?:\?[^ "]*)? [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx

# A WordPress login that did not work. WordPress answers a successful
# login with a 302 to the dashboard and a failed one by re-rendering the
# form, which is a 200 — so the status is the whole distinction, and it
# is the same one every fail2ban and CrowdSec rule for this uses.
#
# This is the one HTTP parser whose matches include real people. A
# customer mistyping their password produces exactly this line. Score it
# on a rule with a progressive ban, never a first-strike one, unless
# nobody but you can log in.
parser: wp-login-fail
log: http
prefilter: "/wp-login.php"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "POST (?P<path>[^ "?]*/wp-login\.php)(?:\?[^ "]*)? [^"]*" 200 '
time_field: time
time_format: nginx

# WordPress path scanning: a REFUSED request for a WordPress PHP file
# or a plugin's readme. Real WordPress traffic serves these paths; a
# 404 or 403 on them means the scanner guessed at an installation, or
# at a plugin, that is not there. Translated from CrowdSec's
# http-wordpress-scan, in its instant-ban variant.
#
# Anchored at the END of the path: /wp-content/uploads/x.png does not
# match, /wp-admin/setup-config.php does. The plugin part matches only
# .txt and .md — the readme/changelog files scanners use to fingerprint
# plugin versions.
#
# A 403 counts only WITHOUT a referer: a site whose security plugin
# refuses admin-ajax.php POSTs from logged-out visitors 403s its own
# readers as they browse (seen 2026-08-19: a person on a product page,
# four 403s in ten seconds, banned as a scanner). A scanner sends no
# referer; a browser navigating a site sends its page. A 404 counts as
# before: nothing real is served at a WordPress path that is not there.
parser: wp-scan-paths
log: http
prefilter: "/wp-"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*(?i:/wp-[^ "?]*\.php|/wp-content/plugins/[^ "?]*\.(?:txt|md)))(?:\?[^ "]*)? [^"]*" (?:404 \S+ "[^"]*"|403 \S+ "-") '
time_field: time
time_format: nginx

# WordPress REST-API author enumeration that the WAF refused: a 403 on
# /wp-json/wp/v2/users is CVE-2017-5487 probing, and the refusal proves
# the WAF classified it that way too. The stock ?author= form is caught
# by wp-user-enum from the pack; this is the REST form.
parser: wp-user-enum-blocked
log: http
prefilter: "/wp-json/wp/"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*/wp-json/wp/v\d+/users[^ "?]*)(?:\?[^ "]*)? [^"]*" 403 '
time_field: time
time_format: nginx

# WordPress REST-API user enumeration, WHATEVER the answer: the WAF
# catches most (wp-user-enum-blocked insta-bans the 403s), this one is
# for a site where the endpoint answers — repeated harvesting of
# /wp-json/wp/v2/users is CVE-2017-5487 probing however it ends.
# Belongs in the THRESHOLD rule srv00-wp-user-enum, not an instant one:
# a site's own javascript may legitimately touch the endpoint once.
#
# Only the shapes an enumeration walks: the bare list, or /users/<id>
# by number. NEVER /users/me — that is the logged-in user asking about
# themselves, and a WordPress admin's own dashboard (Gutenberg,
# Elementor, W3TC…) polls it constantly (seen 2026-08-20: an operator
# in wp-admin, eleven polls in five minutes, banned as a harvester).
# And only WITHOUT a referer, like wp-scan-paths: harvesting tools send
# none; a browser in the site — wp-admin included — always names its
# page. A forged referer escapes this parser; the blocked form
# (wp-user-enum-blocked) and http-attack still stand behind it.
parser: wp-user-enum-rest
log: http
prefilter: "/wp-json/wp/"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*/wp-json/wp/v\d+/users(?:/\d+)?)(?:\?(?P<query>[^ "]*))? [^"]*" \d{3} \d+ "-" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx

# Walking WordPress's author archives to collect usernames:
#   /?author=1, /?author=2, ...
# WordPress redirects /?author=N to that user's posts, revealing the
# login name. It is the reconnaissance step before a password attack.
#
# Only the query string is examined, so a page whose PATH contains the
# word does not count.
parser: wp-user-enum
log: http
prefilter: "author="
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)\?(?P<query>[^ "]*[Aa]uthor=\d[^ "]*) [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx

# A request for xmlrpc.php that the WAF refused. On this machine
# nothing uses XML-RPC, and the WAF answers 403: whoever asked was
# probing. Complements wp-xmlrpc-post, which catches the POSTs that get
# through to a host where the endpoint is not defended.
parser: wp-xmlrpc-blocked
log: http
prefilter: "xmlrpc.php"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*(?i:/xmlrpc\.php))(?:\?(?P<query>[^ "]*))? [^"]*" 403 \S+ "[^"]*" "(?P<ua>[^"]*)"'
time_field: time
time_format: nginx

# A POST to xmlrpc.php, at any path depth (/xmlrpc.php, //xmlrpc.php,
# /wp/xmlrpc.php — all seen in one afternoon of real traffic).
#
# XML-RPC is WordPress's old remote interface. It is how password
# brute-force gets amplified — system.multicall tries hundreds of
# passwords in one request — and it is disabled or unused on most sites
# now. A site that DOES use it (Jetpack, the mobile app, a
# publish-by-mail workflow) will produce these legitimately from a small
# set of addresses: exempt those, or leave this parser out of the rules
# there.
parser: wp-xmlrpc-post
log: http
prefilter: "xmlrpc.php"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "POST (?P<path>[^ "?]*/xmlrpc\.php)(?:\?[^ "]*)? [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx