# Notable HTTP URL Paths Observed (Honeylabs)

# VPN/Remote Access Portal Probing
/dana-na/auth/url_default/welcome.cgi  -- Pulse Secure VPN (AEZA, 138.124.51.186)
/sslvpnLogin.html  -- SSL VPN portal (AEZA, 138.124.51.186)
/global-protect/login.esp  -- Palo Alto GlobalProtect (AEZA, 138.124.51.186)
/remote/login  -- Remote access portal (AEZA, 138.124.51.186)
/+CSCOE+/logon.html  -- Cisco VPN (AEZA, 138.124.51.186)
/RDWeb/Pages/  -- Microsoft RD Web Access (AEZA, 138.124.51.186)

# General Login Probing
/login  -- Generic login page (AEZA)
/Login/Login  -- Generic login page variant (AEZA)
/cgi/login  -- CGI login (AEZA)
/my.policy  -- Policy page probe (AEZA)

# Remote Desktop / Guacamole
/guacamole/  -- Apache Guacamole (AEZA, 138.124.51.186)

# WinRM
/wsman?PSVersion=5.1.19041.1  -- WinRM probing (KAOPU-HK, 154.90.37.55)

# 3x-ui Proxy Panel
/assets/login-J3fs_cbU.js  -- 3x-ui panel assets (AEZA, 138.124.51.186:2053)
/assets/vendor-antd-B5BXDqMa.css  -- 3x-ui UI framework (AEZA)