Mass web admin panel path scanning across randomized source ports

Ethan Andrews@eandrews

•updated Jul 15, 2026•1•0•5

Detects anomalous web server scanning activity where a single source IP performs rapid requests against multiple common administrative or login panel paths (/admin, /wp-admin, etc.) while utilizing randomized ephemeral source ports. This behavior is consistent with automated enumeration scanning, such as that performed by the TuxBot v3 malware.