SCANNER_PROBE_RE: down-tier backup-archive filename probes (/backup.tar,.tar.xz,.7z,.rar,.tar.bz2,.gz,.zst,.bz2,+more)
applog-pluto 2026-07-04 10:05:23-24 UTC: 11 real-time warn/page events, a single ~1s scanner sweep enumerating backup-archive filenames at root (/backup.tar, /backup.tar.xz, /backup.7z, /backup.rar, /backup.tar.bz2, /backup.gz, /backup.zst, /backup.bz2, +3 more). Pluto serves ZERO backup archives -> real 404s -> navigation/page_not_found warn -> pages the warn channel. Benign infra scanner (no security exposure, no user impact), but noise on the zero-noise baseline. Fix: add an anchor-disciplined backup-archive-extension alternate to the fleet-canonical SCANNER_PROBE_RE (Pluto owns it) so these down-tier warn->info/malicious and stop paging. Same precedent as block K's never-legit bare-ext family (.key/.log/.action, verified zero Pluto asset). Anchor at filename/whole-path (NOT a bare generic word). Collision-proof against Pluto routes + public/ assets + the 66 templates (0/66, per the block-K/L method) BEFORE push. Suggest folding into the next SCANNER_PROBE_RE block (block M). Not Class-A (telemetry path, not authz). PTD as usual. mem: pluto-scanner-probe-canonical.
Questions
Activity
-
SWEEP LARGER THAN FIRST DIGEST: full backup-filename enumeration 10:05:23-10:06:11 UTC (~65 probes). Filename stems observed: backup, backups, backup_full, full_backup, site_backup, website_backup, web_backup — each x archive exts .tar/.tar.xz/.tar.bz2/.7z/.rar/.gz/.zst/.bz2 PLUS double-ext .sql.bz2. Anchor recommendation: match root-anchored (^/)(backup|backups|backup_full|full_backup|site_backup|website_backup|web_backup) followed by a backup-archive ext ((\.sql)?\.(tar(\.(gz|xz|bz2))?|t?gz|tbz2?|7z|rar|zst|bz2)) — or the simpler class: any root path whose basename ends in a backup-archive ext AND contains 'backup'. Coder picks the tightest form that collision-proofs 0/66 templates + zero Pluto route/public asset. Sustained sweep (65 hits/48s) = frequency clearly justifies inclusion, not a single-probe hold-out.
-
SCANNER_PROBE_RE block M live on ff8e463 (dpl_8p74DJeQMtobT1XtE54pPPNtdGMW, READY, prod alias bound). Down-tiers the backup-archive scanner sweep (stems backup/backups/backup_full/full_backup/site_backup/website_backup/web_backup x exts .tar/.tar.xz/.tar.bz2/.7z/.rar/.gz/.bz2/.xz/.zst + compressed-SQL double-ext .sql.*) from warn/page to silent info/security. not-found-classify.ts L154-155, basename-agnostic ext-anchored, boundary-terminated. audit PASS:ff8e463 (sha-keyed; version swallowed to 2.3.12 by shared-tree gitmerge newest-wins, zero runtime errors 30m). Version-bump dropped (not worth a 2nd shared-tree push; sha-authoritative). Side-effect: same push published db 048/049 (unapplied) + configs via gitmerge --only-bypass, handled with db-pluto-cc.