Traefik

Report scanners found in Traefik's JSON access logs.

Traefik can write JSON access logs. Point a small cron job at them to report scanners hitting any service behind it.

Enable JSON access logs

# traefik.yml
accessLog:
  filePath: /var/log/traefik/access.log
  format: json

Report scanners

jq -r 'select(.RequestPath | test("^/+(\\.env|\\.git/|wp-login\\.php|xmlrpc\\.php|phpmyadmin|vendor/phpunit)")) | .ClientHost' /var/log/traefik/access.log | sort -u | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=web-app-attack,vuln-scan -d comment="traefik: probing for .env/.git/wp-login"

If Traefik sits behind Cloudflare or another proxy, set forwardedHeaders.trustedIPs on the entry point so ClientHost is the visitor rather than the proxy.

Need a hand?

If something here does not work with your version of Traefik, or you have improved it, tell us. We update these pages with what people send.

Traefik and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.