CDN Origin Server Discovery Attempt
This rule detects attempts to discover the origin server behind a Content Delivery Network (CDN). It triggers when an HTTP request is made to a host containing "cdn" (case-insensitive) and the URI contains "origin" (case-insensitive). This behavior is indicative of reconnaissance activities where an attacker tries to bypass CDN protections to directly target the backend server.
Suricata
