Spot the Scanner: Detect Web Recon Without Flagging Real Users

The nginx access log on a shop server (/var/log/nginx/access.log) shows one source sweeping for sensitive files and admin panels — /admin, /.env, /.git/config, /backup.sql, /wp-login.php and dozens more — almost all returning 404. That's directory/scanner recon. But the log also has an ordinary shopper who hit two genuine 404s (a mistyped product URL and a missing favicon). Build the DETECTION a SOC would run.

1. Identify the scanning source IP and record it in /root/case/scanner_ip.txt.

2. Write a detector at /root/detect.sh that reads the access log on stdin and prints the source IP(s) it flags, one per line. Grading runs bash /root/detect.sh < /var/log/nginx/access.log. Grading also feeds it a second, unseen log the same way, so it must work from what it reads on stdin, not from a hardcoded file path or answer.

3. Tune it: it MUST flag the scanner AND must NOT flag the ordinary visitor. Recon is VOLUME of 404s from one source; two 404s is a normal user. In the combined log format the status follows the quoted request, so 404 lines contain " 404 ". MITRE ATT&CK: T1595 (Active Scanning).