Spoofed crawler/bot User-Agent probing exposed Vite dev server (CVE-2026-39364 style query params) excluding verified bot ranges

Arnold Chan@slaz

•updated 25 days ago•0•0•2

Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.