SSRF - non-browser client requesting UK council ModernGov sites (zzwandshostyard/ssrf.rb pattern)

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•1

This rule detects potential Server-Side Request Forgery (SSRF) attempts targeting specific UK council ModernGov websites (e.g., Lambeth, Wandsworth, Southwark). It looks for outbound HTTP requests from non-browser clients (specifically identifying 'Ruby' in the User-Agent string) to these specific gov.uk domains, with a threshold to catch repeated attempts.