A network security analyst reviews Zeek http.log and notices that a web server is receiving requests where the referrer field is blank but the URI contains deeply nested paths such as '/admin/config/backup/export'. This pattern repeats from multiple external source IPs. What does this suggest?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because automated scanners and exploit tools directly request specific administrative paths without a referrer (since they are not navigating from a normal page), producing blank referrer fields combined with targeted path access — a key indicator of tool-based scanning. A is wrong because search engine crawlers follow links and have identifiable user agents; they do not typically target administrative paths.
Full explanation below image
Full Explanation
B is correct because automated scanners and exploit tools directly request specific administrative paths without a referrer (since they are not navigating from a normal page), producing blank referrer fields combined with targeted path access — a key indicator of tool-based scanning. A is wrong because search engine crawlers follow links and have identifiable user agents; they do not typically target administrative paths. C is wrong because load balancer health checks probe specific health-check endpoints configured in the LB, not deep administrative paths from many external IPs. D is wrong because browser prefetching uses the user's browse history within a single session, not many external IPs hitting the same paths.