# ═══════════════════════════════════════════════════════════
# fail2ban 过滤规则 · 路径扫描检测
# ═══════════════════════════════════════════════════════════
#
# 编号: ZY-SVR-F2B-006-FILTER
# 部署路径: /etc/fail2ban/filter.d/novel-scan.conf
# 守护: 铸渊 · ICE-GL-ZY001
#
# 检测以下扫描行为:
#   - 爬取常见后台路径 (/admin /wp-admin /phpmyadmin 等)
#   - 爬取常见框架路径 (.env /config /.git 等)
#   - 端口扫描工具特征路径
#   - 漏洞扫描工具特征 (sqlmap nuclei 等)
#
# ═══════════════════════════════════════════════════════════

[Definition]
failregex = ^<HOST> .* "(GET|POST|HEAD) /(admin|administrator|wp-admin|wp-login|phpmyadmin|pma|mysql|db|database|panel|cpanel|webadmin|manager|console|dashboard|login|signin|auth|wp-content|wp-includes|xmlrpc|cgi-bin|\.env|\.git|\.svn|config|setup|install|backup|shell|cmd|exec|\.php|actuator|metrics|swagger|api-docs|v1/|v2/) HTTP" (400|403|404|405) .*$
            ^<HOST> .* "(GET|POST|HEAD) .*\.(sql|bak|backup|old|orig|tar|gz|zip|rar|log|cfg|conf|config|ini|yml|yaml|json|xml|key|pem|p12|pfx) HTTP" (200|400|403|404) .*$
            ^<HOST> .* "(GET|POST|HEAD) /.*(\.\./|%2e%2e|%252e|%c0%ae) HTTP" .* $
            ^<HOST> .* ".*sqlmap.*" .*$
            ^<HOST> .* ".*nikto.*" .*$
            ^<HOST> .* ".*nmap.*" .*$
            ^<HOST> .* ".*masscan.*" .*$
            ^<HOST> .* ".*zgrab.*" .*$
            ^<HOST> .* ".*nuclei.*" .*$
            ^<HOST> .* "-" (400|408) "-" "-"$

ignoreregex =
