A network security analyst reviews Zeek http.log and notices that a web server is receiving requests where the referrer field is blank but the URI contains deeply nested paths such as '/admin/config/backup/export'. This pattern repeats from multiple external source IPs. What does this suggest?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're seeing automated scanning or exploitation attempts targeting administrative paths without following normal navigation links. Blank referrer plus deep admin paths from many external IPs means the client isn't clicking through the site; it's probing known targets directly.
Full Explanation
Automated scanning or exploitation attempts targeting administrative paths without following normal navigation links is correct because automated scanners and exploit tools directly request specific administrative paths without a referrer, since they are not navigating from a normal page. That produces blank referrer fields combined with targeted path access, which is a key indicator of tool-based scanning. Normal web crawler activity indexing the site for search engines is wrong because search engine crawlers follow links and have identifiable user agents, and they do not typically target administrative paths. A load balancer health check probing application endpoints is wrong because load balancer health checks probe specific health-check endpoints configured in the load balancer, not deep administrative paths from many external IPs. Browser prefetching of predicted URLs based on browsing history is wrong because browser prefetching uses the user's browse history within a single session, not many external IPs hitting the same paths.