Attack reporting
Every server on the internet is attacked. Someone guesses passwords at the sign-in page, tries stolen client secrets at the token endpoint, or asks for files like /.env that would hold secrets on a careless server. A FoxAuth server already refuses these requests. Attack reporting also tells FoxTrust which addresses did it.
FoxTrust combines the reports of many FoxAuth servers. An address that guesses passwords at five unrelated servers in one hour is an attacker, and every server can know that before the address reaches it.
Why this is allowed
An IP address is personal data. Processing the addresses that attack a service, to protect that service and others, is a legitimate interest in network and information security (GDPR, Recital 49). No consent is needed for it, but you, the operator, must be able to say what is sent. This page is that statement: you can point your own privacy notice at it.
Turning it off
In the console: Settings → Integrations → Attack reporting. The change applies at once, without a restart, and what was counted and not yet sent is thrown away. This setting is the only switch. It is separate from usage reporting, so you can keep one and turn off the other.
Turn it off while you test your own server, for example with a penetration test or a conformance suite. Otherwise your testing address is reported like any other.
The card under the switch shows the exact report the server last sent, addresses included, and the tables below.
When a report is sent
Each server process counts attacks in memory, for one UTC hour at a time. In the first half of the next hour it sends one report, but only if some address crossed a threshold. A quiet hour sends nothing. A report that cannot be delivered is thrown away and never sent again, and it is not an error: the server shows nothing and logs nothing.
Where it goes
Reports go to https://api.foxtrust.dev/v1/foxauth/attacks, run by the FoxAuth maintainers. FoxTrust keeps each raw report for 30 days, then deletes it. FoxTrust never lists an address because of one server's reports alone, because a report could be forged or come from a server whose proxy setting is wrong.
What counts as an attack
An address is reported for a type only once it reaches the threshold within one hour, in one server process. The thresholds are set so that an honest visitor who mistypes a password or asks for a second reset email never reaches them.
| Type | Reported at | What counts | What does not |
|---|---|---|---|
signin_failures | 10 | A password or second-factor code refused at the sign-in page of any project, including a refusal because the page is throttling that account. | A sign-in refused after the password was right, for example a deactivated account. |
client_auth_failures | 10 | A request to the token, introspection, revocation, pushed authorization, backchannel authentication or device authorization endpoint refused because the client secret, assertion or certificate it presented is wrong. | A request that presented no client credential at all, such as a public client sending only its client_id. |
admin_credential_failures | 5 | A credential presented at a SCIM endpoint or at the MCP endpoint and refused as invalid. | A request without any credential, which is how an MCP client starts by protocol. |
mail_requests | 10 | A request that asks the server to send an email to an address the caller names: a password reset, a self-service sign-up or a verification resend. Counted whatever the outcome, refused ones included. | Email an administrator sends from the console. |
flood | 20 | A request refused by the per-address rate limit because the caller sent too many. | Requests under the limit, and the per-connection limit of a SCIM connection. |
probe | 1 | A request for one of the probe paths below: files and panels of other products that no FoxAuth server has, asked for only by scanners. | Any other path the server does not serve, such as a missing favicon. |
Probe paths
A request for one of these paths is reported the first time. Each is a file or panel of another product that no FoxAuth server has, so only a scanner asks for it. A path ending in … covers everything under it. Other missing pages, such as a missing favicon, are never reported.
| Label | Paths |
|---|---|
dotenv | /.env, /.env.local, /.env.production, /.env.bak, /.env.old, /.env.backup |
git | /.git, /.git/… |
wordpress | /wp-login.php, /xmlrpc.php, /wp-config.php, /wp-admin…, /wp-content/…, /wp-includes/… |
php_admin | /phpinfo.php, /phpmyadmin…, /phpMyAdmin… |
cloud_credentials | /.aws/credentials, /.docker/config.json, /.dockercfg |
ssh_keys | /.ssh/… |
editor_config | /.vscode/sftp.json, /sftp-config.json |
server_status | /server-status |
spring_actuator | /actuator, /actuator/… |
cgi | /cgi-bin/… |
Which addresses are never sent
Only public internet addresses leave the server. Private, loopback, link-local, carrier-grade NAT, documentation, benchmarking, multicast and reserved addresses are never sent, nor anything that is not an address. An IPv6 address is sent only as its /64 network, never in full. Which address a request came from follows your caller address setting, so set it to match how the server is reached.
Every field
This is format 1. A report carries at most 500addresses, those with the highest counts. Nothing else is in it: no account, password, code, client identifier, token, project, path, query, header, user agent or body.
| Field | What it says | Values |
|---|---|---|
format | The version of this report format. | 1 |
instanceId | The random identifier this server generated for itself, the same one its usage report carries. It says nothing about who runs the server. | a UUID |
version | The FoxAuth release this server runs. Left out when the package manifest cannot be read. | a version such as 1.4.0 |
hour | The UTC hour the counts below were made in. | a time such as 2026-10-28T17:00:00.000Z |
addressSource | How the operator told the server it is reached. Only direct means no address can have come from a forwarded header. | automatic, direct, fly, cloudflare or listed |
addresses[].address | An address that crossed a threshold in that hour. Only public internet addresses are ever sent. | an IPv4 address, or the /64 network of an IPv6 address |
addresses[].counts.<type> | How many times the address did that in the hour. A type appears only when its count reached the threshold. | a whole number; types are signin_failures, client_auth_failures, admin_credential_failures, mail_requests, flood, probe |
addresses[].probes | Which probe paths the address asked for, by label. Left out when the address asked for no probe path. | labels from dotenv, git, wordpress, php_admin, cloud_credentials, ssh_keys, editor_config, server_status, spring_actuator, cgi |
omitted | How many addresses crossed a threshold but did not fit; a report carries at most 500, those with the highest counts. | a whole number, usually 0 |