Signatures
Request patterns the network blocks on: a closed form on the request path (prefix / suffix / token / file) or a User-Agent token — never a free regex. A signature is only activated after it has been watched for 3 days (1 day for a CVE that CISA lists as exploited in the wild), has matched attacks on at least 3 independent servers in 2 networks, and has not touched legitimate traffic anywhere. 88 active; 11719 more are being evaluated.
| Form | Category | times matched | servers | blocking since |
|---|---|---|---|---|
| ua Mozlila | bad-bot | 1379 | 3 | 45 d ago |
| ua openai | bad-bot | 1117 | 3 | 45 d ago |
| ua openai.com | bad-bot | 1117 | 3 | 45 d ago |
| ua ClaudeBot | bad-bot | 1095 | 3 | 45 d ago |
| token /hellopress/wp_filemanager.php | webshell | 694 | 3 | 34 d ago |
| file this_is_a_new_hello_world.php | scanner | 675 | 3 | 34 d ago |
| prefix /1.php | secret-file | 521 | 3 | 44 d ago |
| file file.php | webshell | 493 | 3 | 34 d ago |
| token PJcpMFsD8B.php | scanner | 473 | 3 | 34 d ago |
| prefix /file.php | exploit | 410 | 3 | 34 d ago |
| file adminfuns.php | webshell | 397 | 3 | 34 d ago |
| prefix /chosen.php | webshell | 379 | 3 | 38 d ago |
| file BDKR28WP.php | scanner | 359 | 3 | 34 d ago |
| file alfa.php | webshell | 316 | 3 | 34 d ago |
| file aaa.php | webshell | 311 | 3 | 34 d ago |
| prefix /0.php | secret-file | 311 | 3 | 36 d ago |
| file 222.php | webshell | 309 | 3 | 34 d ago |
| prefix /.gitlab | secret-file | 308 | 3 | 20 d ago |
| ua CensysInspect | bad-bot | 301 | 3 | 42 d ago |
| file wp_blog_footer.php | webshell | 294 | 3 | 39 d ago |
| ua GPTBot | bad-bot | 282 | 3 | 45 d ago |
| file opsh.php | webshell | 278 | 3 | 34 d ago |
| file ccc.php | webshell | 274 | 3 | 34 d ago |
| ua l9scan | bad-bot | 274 | 3 | 34 d ago |
| ua leakix | bad-bot | 274 | 3 | 34 d ago |
| file dex.php | webshell | 273 | 3 | 34 d ago |
| ua ChatGPT-User | bad-bot | 271 | 3 | 31 d ago |
| file a.php | webshell | 270 | 3 | 39 d ago |
| file b8.php | webshell | 267 | 3 | 34 d ago |
| ua CCBot | bad-bot | 263 | 3 | 43 d ago |
| prefix /.gitlab-ci.yml | secret-file | 262 | 3 | 20 d ago |
| file k.php | webshell | 258 | 3 | 34 d ago |
| file mac.php | webshell | 254 | 3 | 34 d ago |
| prefix /go.php | cve | 254 | 3 | 41 d ago |
| file f35.php | webshell | 249 | 3 | 34 d ago |
| file av.php | webshell | 249 | 3 | 34 d ago |
| suffix /.env~ | secret-file | 244 | 3 | 20 d ago |
| ua cohere-ai | bad-bot | 244 | 3 | 36 d ago |
| file ops.php | webshell | 241 | 3 | 34 d ago |
| prefix /wp.php | secret-file | 230 | 3 | 36 d ago |
| prefix /8.php | secret-file | 225 | 3 | 35 d ago |
| file bnmtp.php | webshell | 222 | 3 | 36 d ago |
| file w.php | webshell | 212 | 3 | 34 d ago |
| prefix /.env.php | secret-file | 183 | 3 | 34 d ago |
| prefix /2.php | secret-file | 169 | 3 | 36 d ago |
| token /wp-content/admin.php | webshell | 166 | 3 | 26 d ago |
| file flamini.php | webshell | 160 | 3 | 36 d ago |
| file sallu.php | webshell | 153 | 3 | 34 d ago |
| prefix /.git/logs/refs | secret-file | 152 | 3 | 27 d ago |
| token /.github/workflows/ | secret-file | 151 | 3 | 18 d ago |
| prefix /.gitmodules | secret-file | 136 | 3 | 27 d ago |
| prefix /php.php | secret-file | 136 | 3 | 33 d ago |
| file ab.php | webshell | 123 | 3 | 34 d ago |
| file z60.php | webshell | 122 | 3 | 39 d ago |
| file wsd.php | webshell | 119 | 3 | 39 d ago |
| prefix /.ssh/id_ed25519 | secret-file | 106 | 3 | 26 d ago |
| prefix /simple.php | webshell | 104 | 3 | 5 d ago |
| file wmore1.php | webshell | 103 | 3 | 39 d ago |
| file cae.php | webshell | 100 | 3 | 39 d ago |
| prefix /ws.php | cve | 97 | 3 | 20 d ago |
| prefix //.env | cve | 96 | 3 | 23 d ago |
| prefix /edit.php | exploit | 86 | 3 | 20 h ago |
| prefix /dev.php | secret-file | 81 | 3 | 42 d ago |
| prefix /x.php | secret-file | 79 | 3 | 34 d ago |
| file blacks.php | webshell | 79 | 3 | 34 d ago |
| file mini.php | webshell | 78 | 3 | 42 d ago |
| prefix /mini.php | exploit | 72 | 3 | 42 d ago |
| file 24.php | webshell | 65 | 3 | 34 d ago |
| ua fasthttp | bad-bot | 56 | 3 | 35 d ago |
| prefix /wp-links-opml.php | secret-file | 53 | 3 | 31 d ago |
| prefix /wp-trackback.php | cve | 52 | 3 | 41 d ago |
| prefix /great.php | webshell | 51 | 3 | 38 d ago |
| file ba.php | webshell | 51 | 3 | 39 d ago |
| ua InternetMeasurement | bad-bot | 51 | 3 | 45 d ago |
| prefix /WSO.php | secret-file | 49 | 3 | 39 d ago |
| prefix /member | secret-file | 45 | 3 | 39 d ago |
| prefix /admin_ | secret-file | 44 | 3 | 39 d ago |
| file php_info.php | scanner | 42 | 3 | 5 d ago |
| prefix /wp-signup.php | scanner | 39 | 3 | 42 d ago |
| file robot.php | webshell | 39 | 3 | 43 d ago |
| file tiny.php | webshell | 33 | 3 | 42 d ago |
| prefix /run.php | admin-probe | 32 | 3 | 43 d ago |
| prefix /init.php | exploit | 27 | 3 | 39 d ago |
| ua Semrush | bad-bot | 26 | 3 | 42 d ago |
| ua SemrushBot | bad-bot | 26 | 3 | 42 d ago |
| prefix /r.php | secret-file | 16 | 3 | 29 d ago |
| ua BuiltWith | bad-bot | 12 | 3 | 36 d ago |
| prefix /Modules.php | cve | 10 | 3 | 42 d ago |