web Premium

Sites web derrière nginx ou Apache : scanners, sondes, crawlers, WordPress et floods de boutiques.

Règles (40)

• backdoor-probe Gratuit Requests asking for known web shells and backdoors by name (c99, r57, wso, shell.php…), whatever the answer — a search for a way in; one and out 1/10m
• php-injection Gratuit PHP code injected in the query string — a web-shell drop or a remote-code-execution probe; one and out 1/10m
• secret-probe Gratuit Requests for .git, .env, credentials, database dumps, wp-config — a search for secrets to break in with; one and out 1/10m
• sqli Gratuit SQL-injection payloads worked through in the query string — an attack on the databases behind the sites; one and out 3/10m
• tech-probe Gratuit Fingerprinting a technology by its tell-tale paths (consoles, version files, vendor directories) the site does not have — reconnaissance for an exploit 1/10m
• wp-login Gratuit WordPress password guessing — three refused logins in a minute, or five in a day; the way sites get hijacked 3/1m, 5/24h
• bad-bot A crawler declaring a User-Agent on the known-bad list, or a placeholder identity no real software uses — scrapers and harvesters
• comment-spam Comments and form posts the site refuses as spam, again and again — automated comment spam
• conn-flood More than forty simultaneous connections to :443 from one address, dropped by the server — connection exhaustion, a broken tool or a DoS
• crawler-defiant A declared crawler that keeps asking after being refused (403/429) and told to stop by robots.txt — a crawler that costs and ignores the rules
• default-vhost-probe Requests to the machine's bare address or to names it does not serve, asking for what is not there — a scanner sweeping IP ranges, not a visitor
• facet-flood The distributed shop flood: a faceted-search page (q=, order=, resultsPerPage) requested with no referer, from abroad — one request convicts, because every address of the flood sends exactly that
• facet-flood-home The distributed shop flood (facet search, no referer) seen from home networks (FR, MA, BE, CH…) — twenty such requests before conviction, so a real customer's odd click never counts
• facet-headless A faceted-search page loaded with no stylesheet, script or image after it — no browser rendered it; a headless client in the shop flood
• facet-headless-home Faceted-search pages loaded with nothing rendered behind them (no stylesheet, script or image), from home networks — five times before conviction
• http-504-flood Ten gateway timeouts in a minute from one address — the overload it causes the application is the evidence of the flood
• http-attack A request with no legitimate reading — a known exploit path, a secrets file, traversal, a scanner's own identity — blocked on sight
• http-crawl Dynamic pages crawled faster than any browser or polite bot — an aggressive crawler loading the application for nothing
• http-page-flood Dynamic pages hammered with no referer — twenty in twenty seconds, or sixty in two minutes — an application-level flood
• http-probing Paths that are not there, asked for one after another — many refusals, fast: vulnerability scanning
• http-scan Working through a scanner's list — backdoors, secrets, traversal, XSS, admin consoles — the whole wordlist of an attack tool
• link-replay Tracked links (?_gl=…) replayed into redirects it never follows, with no referer — a URL harvester dressed as a browser
• mcp-probe Sweeping sites for an MCP (AI tool) endpoint they do not have — a scanner looking for exposed AI back ends
• open-proxy A request to fetch a foreign site's URL through this server — the open-proxy probe of a scanner looking for relays to abuse
• path-sweep A list of pages that are not there walked in seconds — a scanner's wordlist at full speed
• php-probe Guessing at PHP scripts that are not there (known vulnerable ones, uploaders, shells) — five and out
• plugin-probe A plugin's endpoint asked for on sites that do not run it — mapping vulnerable plugins before exploiting them
• prestashop-login-loop The PrestaShop login page requested with a faceted page in its own back= parameter, recursively — the shop flood's newer shape
• query-flood Cache-busting query strings hammered on the site's root — each request forced through the application; the shop flood aimed at the front page
• redirect-crawler Plain-http requests answered with a redirect it never follows, over and over — a scanner blind behind the https redirect
• waf-refused Requests refused by the site's own web application firewall, again and again — attack payloads an attack tool keeps sending
• wp-admin-scan Knocking on /wp-admin across sites without ever logging in — a bot mapping WordPress installs before attacking them
• wp-endpoint-missing A WordPress endpoint asked for on a site that does not serve it — an attack tool's call, blocked on sight
• wp-login-flood The WordPress login page hammered with automated requests — an application-level flood on the most expensive page
• wp-login-headless A WordPress password tried without a browser — a POST with no Referer, twice in a day; credential stuffing from a script
• wp-login-probe WordPress login pages loaded across four sites, linked from nowhere — a bot mapping targets, not a person signing in
• wp-login-spray WordPress passwords tried across three different sites in a day — password spraying across our hosting, not a forgotten password
• wp-user-enum WordPress REST user enumeration (?author=, /wp-json/wp/v2/users) that the WAF let through — collecting account names to attack
• wp-xmlrpc Credential stuffing through xmlrpc.php — five answered POSTs in a day, the endpoint bots use to try passwords in bulk
• wp-xmlrpc-blocked xmlrpc.php refused (anything but a 200) — nothing legitimate calls a blocked xmlrpc, so one refusal is the proof