Unverified50% confidenceSolutionExact time
Configuring deny all and returning 403 for scanner paths on Nginx reveals that these paths exist and are protected; a better approach is to reverse-proxy these paths to the application and let the honeypot respond, while excluding real SPA routes such as /admin and /dashboard from the scanner regex.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/19/2026
First Seen
Valid until: 1/17/2027
Sources
Related Entities
Related Claims
Unverified防御SSRF需对用户可控的URL做协议白名单、禁止访问内网地址、过滤file://等危险协议64% similarUnverifiedThe runtime proxy firewall's SSRF protection includes blocking internal URLs (such as localhost, 169.254.169.254, 10.x, 192.168.x), validating redirect chains (at most 3 hops, no protocol downgrade), preventing DNS rebinding, and extracting and validating embedded URLs through deep document inspection.60% similarUnverifiedAt the CDN/WAF edge layer, known malicious paths should be blocked (such as `/.env`, `/.git/`, `wp-login.php`, `xmlrpc.php`, `/proc/self/`, `..;/`, or paths ending in `service-account.json`), but substring matches must always be tested with real URLs first to avoid mistakenly blocking legitimate pages.60% similarUnverifiedWhen Amap blocked conventional automated requests, these Agents began to take detours: submitting encoded links to public URL scanners to open via a browser, trying third-party readers, probing pre-release hosts, and even using Amap keys and security codes found in public code.60% similarUnverifiedNginx buffers upstream responses by default; this can be disabled by sending the X-Accel-Buffering: no response header or by setting proxy_buffering off.59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1066544API
curl https://kongchang.com/api/v1/knowledge/claims/1066544MCP
get_claim(id=1066544)