Automated Defense: Detecting Traefik Web Server Probing & Fuzzing with Cloudflare Integration

---
title: Traefik Web Server High Volume 404 Scanning
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential directory brute-forcing or fuzzing activity against a Traefik web server by identifying a high volume of HTTP 404 responses from a single source IP within a short timeframe.
references:
 - https://www.elastic.co/security-labs/detecting-web-server-probing-and-fuzzing
author: Security Arsenal
date: 2025/03/17
tags:
  - attack.initial_access
  - attack.t1190
  - attack.discovery
  - attack.t1595
logsource:
  category: web
  product: traefik
detection:
  selection:
    status: 404
  timeframe: 1m
  condition: selection | count(src_ip) > 30
falsepositives:
  - Broken links on a frequently accessed page
  - Misconfigured web applications
level: high
---
title: Traefik Web Server Fuzzing Suspicious URI Patterns
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects potential fuzzing activity by identifying suspicious URL patterns commonly used in scanning tools, such as long random strings or encoded directory traversal sequences in Traefik logs.
references:
 - https://www.elastic.co/security-labs/detecting-web-server-probing-and-fuzzing
author: Security Arsenal
date: 2025/03/17
tags:
  - attack.initial_access
  - attack.t1190
  - attack.discovery
  - attack.t1595
logsource:
  category: web
  product: traefik
detection:
  selection:
    # Common patterns in fuzzing tools like ffuf, dirsearch, etc.
    cs_uri_query|contains:
      - 'FUZ'
      - 'path='
      - 'x='
    # Or extremely long URIs often used in buffer overflow fuzzing
    cs_uri_length|gt: 500
  condition: selection
falsepositives:
  - Legitimate long search queries (rare in APIs)
level: medium

// Hunt for Traefik web server probing via Syslog or CommonSecurityLog
let Lookback = 1h;
union isfuzzy=true withsource=TableName 
    Syslog, 
    CommonSecurityLog,
    DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
// Identify Traefik logs - usually via process name or syslog message content
| where ProcessName =~ "traefik" 
    or SyslogMessage contains "traefik" 
    or DeviceVendor =~ "traefik"
// Parse HTTP status codes. Adjust based on your specific log format/CEF mapping
// Assuming CEF/ Syslog contains the status code in the message or a specific field
| extend HTTPStatus = coalesce(
    extract("HTTPStatus=([\d]+)", 1, SyslogMessage), 
    extract("cs1=([\d]+)", 1, SyslogMessage), 
    tostring(DeviceCustomString1), // Adapt to your CEF mapping for status
    tostring(AdditionalFields)["HTTPStatus"]
)
| where isnotempty(HTTPStatus) and HTTPStatus in ("404", "403", "500")
// Extract Source IP
| extend SourceIP = coalesce(SourceIP, SrcIP, extract("src=([\d.]+)", 1, SyslogMessage))
| summarize Count = count(), TimeSeen = max(TimeGenerated) by SourceIP, HTTPStatus
| where Count > 50 // Threshold tuning required based on traffic volume
| order by Count desc
| project-away TableName

-- Hunt for suspicious web server connections indicative of scanning
SELECT 
    F.SourceAddress as SourceIP,
    F.DestinationPort as DestPort,
    count() as ConnectionCount,
    group_join(array=F.Process, key=Pid).Name as ProcessName
FROM foreach(
    row={
        SELECT Pid FROM pslist() WHERE Name =~ 'traefik'
    },
    query={
        SELECT * FROM netstat(pid=_Pid) WHERE State =~ 'ESTABLISHED' and DestinationPort IN (80, 443, 8080)
    }
) AS F
GROUP BY SourceIP, DestPort
HAVING ConnectionCount > 30
ORDER BY ConnectionCount DESC

#!/bin/bash
# Remediation: Automate Cloudflare Blocking for Traefik Probing IPs
# Requires: curl, jq, and a Cloudflare API Token with Zone:Edit permissions.

# Configuration
CLOUDFLARE_API_TOKEN="YOUR_CLOUDFLARE_API_TOKEN"
ZONE_ID="YOUR_ZONE_ID"
BLOCK_IP="$1"
RULE_NAME="Auto-Block Traefik Probing: $BLOCK_IP"

if [ -z "$BLOCK_IP" ]; then
    echo "Usage: $0 <IP_ADDRESS_TO_BLOCK>"
    exit 1
fi
echo "[*] Initiating automated block for IP: $BLOCK_IP"

# Check if IP is already blocked
EXISTING_RULES=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall/rules" \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    -H "Content-Type: application/")

if echo "$EXISTING_RULES" | jq -e --arg ip "$BLOCK_IP" '.result[] | select(.filter.expression | contains($ip))' > /dev/null; then
    echo "[!] IP $BLOCK_IP is already blocked. Skipping."
    exit 0
fi

# Create the firewall rule
RESPONSE=$(curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall/rules" \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    -H "Content-Type: application/" \
    --data "{
        \"description\": \"$RULE_NAME\",
        \"action\": \"block\",
        \"filter\": {
            \"expression\": \"(ip.src eq $BLOCK_IP)\"
        }
    }")

if echo "$RESPONSE" | jq -e '.success' > /dev/null; then
    echo "[+] SUCCESS: IP $BLOCK_IP has been blocked via Cloudflare."
else
    echo "[-] ERROR: Failed to block IP."
    echo "$RESPONSE" | jq .
    exit 1
fi