File Manager
Upload
Current Directory: /home/lartcid/public_html/journal.lartc.id
[Back]
..
[Open]
Hapus
Rename
.htaccess
[Edit]
Hapus
Rename
.well-known
[Open]
Hapus
Rename
README.md
[Edit]
Hapus
Rename
api
[Open]
Hapus
Rename
cache
[Open]
Hapus
Rename
cgi-bin
[Open]
Hapus
Rename
classes
[Open]
Hapus
Rename
config.TEMPLATE.inc.php
[Edit]
Hapus
Rename
config.inc.php
[Edit]
Hapus
Rename
controllers
[Open]
Hapus
Rename
cypress.json
[Edit]
Hapus
Rename
dbscripts
[Open]
Hapus
Rename
docs
[Open]
Hapus
Rename
error_log
[Edit]
Hapus
Rename
favicon.ico
[Edit]
Hapus
Rename
index.php
[Edit]
Hapus
Rename
js
[Open]
Hapus
Rename
lib
[Open]
Hapus
Rename
locale
[Open]
Hapus
Rename
mini.php
[Edit]
Hapus
Rename
pages
[Open]
Hapus
Rename
php.ini
[Edit]
Hapus
Rename
plugins
[Open]
Hapus
Rename
public
[Open]
Hapus
Rename
registry
[Open]
Hapus
Rename
scheduledTaskLogs
[Open]
Hapus
Rename
schemas
[Open]
Hapus
Rename
styles
[Open]
Hapus
Rename
templates
[Open]
Hapus
Rename
tools
[Open]
Hapus
Rename
Edit File
Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/000_i360_0.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/001_i360_1_wp_reset.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/002_i360_1_vectors.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/003_i360_2_bruteforce.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/004_i360_3_webshells.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/005_i360_4_malware.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/006_i360_4_custom.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/007_i360_4_wordpress.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/008_i360_5_joomla.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/009_i360_6_drupal.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/010_i360_7_otherapps.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/011_i360_1_infectors.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/012_i360_8_spam.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/013_i360_1_generic.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/014_i360_filescan.conf" Include "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/015_Disable_WP_Redirect.conf" SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},initcol:user=%{REMOTE_ADDR},id:5000134 <Locationmatch "/wp-login.php"> # Setup brute force detection. # React if block flag has been set. SecRule user:bf_block "@gt 0" "deny,status:401,log,id:5000135,msg:'ip address blocked for 5 minutes, more than 10 login attempts in 3 minutes.'" # Setup Tracking. On a successful login, a 302 redirect is performed, a 200 indicates login failed. SecRule RESPONSE_STATUS "^302" "phase:5,t:none,nolog,pass,setvar:ip.bf_counter=0,id:5000136" SecRule RESPONSE_STATUS "^200" "phase:5,chain,t:none,nolog,pass,setvar:ip.bf_counter=+1,deprecatevar:ip.bf_counter=1/180,id:5000137" SecRule ip:bf_counter "@gt 10" "t:none,setvar:user.bf_block=1,expirevar:user.bf_block=300,setvar:ip.bf_counter=0" </locationmatch> SecCacheTransformations Off # Check Content-Length and reject all non numeric ones SecRule REQUEST_HEADERS:Content-Length "!^\d+$" "deny,log,auditlog,msg:'Content-Length HTTP header is not numeric', severity:'2',id:'1234123444'" # Do not accept GET or HEAD requests with bodies SecRule REQUEST_METHOD "^(?:GET|HEAD)$" "chain,phase:2,t:none,deny,log,auditlog,status:400,msg:'GET or HEAD requests with bodies', severity:'2',id:'1234123443',tag:'PROTOCOL_VIOLATION/EVASION'" SecRule REQUEST_HEADERS:Content-Length "!^0?$" t:none # Require Content-Length to be provided with every POST request. SecRule REQUEST_METHOD "^POST$" "chain,phase:2,t:none,deny,log,auditlog,status:400,msg:'POST request must have a Content-Length header',id:'1234123442',tag:'PROTOCOL_VIOLATION/EVASION',severity:'4'" SecRule &REQUEST_HEADERS:Content-Length "@eq 0" t:none # Don't accept transfer encodings we know we don't know how to handle SecRule REQUEST_HEADERS:Transfer-Encoding "!^$" "phase:2,t:none,deny,log,auditlog,status:501,msg:'ModSecurity does not support transfer encodings',id:'1234123441',tag:'PROTOCOL_VIOLATION/EVASION',severity:'3'" # Proxy access attempt SecRule REQUEST_URI_RAW ^\w+:/ "phase:2,t:none,deny,log,auditlog,status:400,msg:'Proxy access attempt', severity:'2',id:'1234123438',tag:'PROTOCOL_VIOLATION/PROXY_ACCESS'" # Restrict type of characters sent SecRule REQUEST_FILENAME|REQUEST_HEADERS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer \ "@validateByteRange 1-255" \ "log,auditlog,msg:'Request Missing an Accept Header', severity:'2',id:'1234123437',t:urlDecodeUni,phase:1" SecRule ARGS|ARGS_NAMES "@validateByteRange 1-255" \ "deny,log,auditlog,msg:'Invalid character in request',id:'1234123436',severity:'4',t:urlDecodeUni,phase:2" # allow request methods SecRule REQUEST_METHOD "!^((?:(?:POS|GE)T|OPTIONS|HEAD))$" \ "phase:2,t:none,log,auditlog,status:501,msg:'Method is not allowed by policy', severity:'2',id:'1234123435',tag:'POLICY/METHOD_NOT_ALLOWED'" # Restrict file extension # removed exe so that frontpage will work # Restricted HTTP headers SecRule REQUEST_HEADERS_NAMES "\.(?:Lock-Token|Translate|If)$" \ "deny,log,auditlog,msg:'HTTP header is restricted by policy',id:'1234123434',severity:'4'" SecRule HTTP_User-Agent "(?:\b(?:m(?:ozilla\/4\.0 \(compatible\)|etis)|webtrends security analyzer|pmafind)\b|n(?:-stealth|sauditor|essus|ikto)|b(?:lack ?widow|rutus|ilbo)|(?:jaascoi|paro)s|internet explorer|webinspect|\.nasl)" \ "deny,log,auditlog,msg:'Request Indicates a Security Scanner Scanned the Site',id:'1234123433',severity:'2'" SecRule REQUEST_HEADERS_NAMES "\bacunetix-product\b" \ "deny,log,auditlog,msg:'Request Indicates a Security Scanner Scanned the Site',id:'1234123432',severity:'2'" SecRule REQUEST_FILENAME "^/nessustest" \ "deny,log,auditlog,msg:'Request Indicates a Security Scanner Scanned the Site',id:'1234123431',severity:'2'" SecRule REQUEST_HEADERS:User-Agent "(?:m(?:ozilla\/(?:4\.0 \(compatible; advanced email extractor|2\.0 \(compatible; newt activex; win32\))|ailto:craftbot\@yahoo\.com)|e(?:mail(?:(?:collec|harves|magne)t|(?: extracto|reape)r|siphon|wolf)|(?:collecto|irgrabbe)r|xtractorpro|o browse)|a(?:t(?:tache|hens)|utoemailspider|dsarobot)|w(?:eb(?:emailextrac| by mail)|3mir)|f(?:astlwspider|loodgate)|p(?:cbrowser|ackrat|surf)|(?:digout4uagen|takeou)t|(?:chinacla|be)w|hhjhj@yahoo|rsync|shai|zeus)" \ "deny,log,auditlog,msg:'Rogue web site crawler',id:'1234123430',severity:'2'" SecRule REQUEST_HEADERS:User-Agent "(?:\b(?:(?:indy librar|snoop)y|microsoft url control|lynx)\b|d(?:ownload demon|isco)|w(?:3mirror|get)|l(?:ibwww|wp)|p(?:avuk|erl)|cu(?:sto|rl)|big brother|autohttp|netants|eCatch)" \ "chain,log,auditlog,msg:'Request Indicates an automated program explored the site',id:'1234123429',severity:'5'" SecRule REQUEST_HEADERS:User-Agent "!^apache.*perl" # Session fixation SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "@pm set-cookie .cookie" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,pass,nolog,skip:1,id:1234123428" SecAction phase:2,pass,nolog,skipAfter:1234123454,id:1234123427 SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES "(?:\.cookie\b.*?;\W*?(?:expires|domain)\W*?=|\bhttp-equiv\W+set-cookie\b)" \ "phase:2,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,capture,ctl:auditLogParts=+E,log,auditlog,msg:'Session Fixation',id:'1234123426',tag:'WEB_ATTACK/SESSION_FIXATION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "(?:\.cookie\b.*?;\W*?(?:expires|domain)\W*?=|\bhttp-equiv\W+set-cookie\b)" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,capture,ctl:auditLogParts=+E,log,auditlog,msg:'Session Fixation',id:'1234123454',tag:'WEB_ATTACK/SESSION_FIXATION',logdata:'%{TX.0}',severity:'2'" # Blind SQL injection SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "@pm sys.user_triggers sys.user_objects @@spid msysaces instr sys.user_views sys.tab charindex sys.user_catalog constraint_type locate select msysobjects attnotnull sys.user_tables sys.user_tab_columns sys.user_constraints waitfor mysql.user sys.all_tables msysrelationships msyscolumns msysqueries" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceComments,t:compressWhiteSpace,pass,nolog,skip:1,id:1234123424" SecAction phase:2,pass,nolog,skipAfter:1234123453,id:1234123423 SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "(?:\b(?:(?:s(?:ys\.(?:user_(?:(?:t(?:ab(?:_column|le)|rigger)|object|view)s|c(?:onstraints|atalog))|all_tables|tab)|elect\b.{0,40}\b(?:substring|ascii|user))|m(?:sys(?:(?:queri|ac)e|relationship|column|object)s|ysql.user)|c(?:onstraint_type|harindex)|attnotnull)\b|(?:locate|instr)\W+\()|\@\@spid\b)" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:lowercase,t:replaceComments,t:compressWhiteSpace,ctl:auditLogParts=+E,log,auditlog,msg:'Blind SQL Injection Attack',id:'1234123422',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_FILENAME|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "\b(?:(?:s(?:ys(?:(?:(?:process|tabl)e|filegroup|object)s|c(?:o(?:nstraint|lumn)s|at)|dba|ibm)|ubstr(?:ing)?)|user_(?:(?:(?:constrain|objec)t|tab(?:_column|le)|ind_column|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|(?:dba|mb)_users|xtype\W+\bchar|rownum)\b|t(?:able_name\b|extpos\W+\())" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceComments,t:compressWhiteSpace,ctl:auditLogParts=+E,log,auditlog,msg:'Blind SQL Injection Attack',id:'1234123453',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_FILENAME|ARGS|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "@pm substr xtype textpos all_objects rownum sysfilegroups sysprocesses user_group sysobjects user_tables systables pg_attribute user_users user_password column_id attrelid user_tab_columns table_name pg_class user_constraints user_objects object_type dba_users sysconstraints mb_users column_name atttypid object_id substring syscat user_ind_columns sysibm syscolumns sysdba object_name" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,pass,nolog,skip:1,id:1234123420" SecAction phase:2,pass,nolog,skipAfter:1234123452,id:1234123419 SecRule REQUEST_FILENAME|ARGS "\b(?:(?:s(?:ys(?:(?:(?:process|tabl)e|filegroup|object)s|c(?:o(?:nstraint|lumn)s|at)|dba|ibm)|ubstr(?:ing)?)|user_(?:(?:(?:constrain|objec)t|tab(?:_column|le)|ind_column|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|(?:dba|mb)_users|xtype\W+\bchar|rownum)\b|t(?:able_name\b|extpos\W+\())" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'Blind SQL Injection Attack',id:'1234123418',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "\b(?:(?:s(?:ys(?:(?:(?:process|tabl)e|filegroup|object)s|c(?:o(?:nstraint|lumn)s|at)|dba|ibm)|ubstr(?:ing)?)|user_(?:(?:(?:constrain|objec)t|tab(?:_column|le)|ind_column|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|(?:dba|mb)_users|xtype\W+\bchar|rownum)\b|t(?:able_name\b|extpos\W+\())" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'Blind SQL Injection Attack',id:'1234123452',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" # SQL injection SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "@pm insert xp_enumdsn infile openrowset nvarchar autonomous_transaction print data_type or outfile inner shutdown tbcreator @@version xp_filelist sp_prepare sql_longvarchar xp_regenumkeys xp_loginconfig xp_dirtree ifnull sp_addextendedproc xp_regaddmultistring delete sp_sqlexec and sp_oacreate sp_execute cast xp_ntsec xp_regdeletekey drop varchar xp_execresultset having utl_file xp_regenumvalues xp_terminate xp_availablemedia xp_regdeletevalue dumpfile isnull sql_variant select 'sa' xp_regremovemultistring xp_makecab 'msdasql' xp_cmdshell openquery sp_executesql 'sqloledb' dbms_java 'dbo' utl_http sp_makewebtask benchmark xp_regread xp_regwrite" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,pass,nolog,skip:1,id:1234123417" SecAction phase:2,pass,nolog,id:1234123416,skipAfter:1234123451 SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES "(?:\b(?:(?:s(?:elect\b(?:.{1,100}?\b(?:(?:length|count|top)\b.{1,100}?\bfrom|from\b.{1,100}?\bwhere)|.*?\b(?:d(?:ump\b.*\bfrom|ata_type)|(?:to_(?:numbe|cha)|inst)r))|p_(?:(?:addextendedpro|sqlexe)c|(?:oacreat|prepar)e|execute(?:sql)?|makewebtask)|ql_(?:longvarchar|variant))|xp_(?:reg(?:re(?:movemultistring|ad)|delete(?:value|key)|enum(?:value|key)s|addmultistring|write)|e(?:xecresultset|numdsn)|(?:terminat|dirtre)e|availablemedia|loginconfig|cmdshell|filelist|makecab|ntsec)|u(?:nion\b.{1,100}?\bselect|tl_(?:file|http))|group\b.*\bby\b.{1,100}?\bhaving|d(?:elete\b\W*?\bfrom|bms_java)|load\b\W*?\bdata\b.*\binfile|(?:n?varcha|tbcreato)r)\b|i(?:n(?:to\b\W*?\b(?:dump|out)file|sert\b\W*?\binto|ner\b\W*?\bjoin)\b|(?:f(?:\b\W*?\(\W*?\bbenchmark|null\b)|snull\b)\W*?\()|a(?:nd\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|utonomous_transaction\b)|o(?:r\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|pen(?:rowset|query)\b)|having\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|print\b\W*?\@\@|cast\b\W*?\()|(?:;\W*?\b(?:shutdown|drop)|\@\@version)\b|'(?:s(?:qloledb|a)|msdasql|dbo)')" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'SQL Injection Attack',id:'1234123415',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "(?:\b(?:(?:s(?:elect\b(?:.{1,100}?\b(?:(?:length|count|top)\b.{1,100}?\bfrom|from\b.{1,100}?\bwhere)|.*?\b(?:d(?:ump\b.*\bfrom|ata_type)|(?:to_(?:numbe|cha)|inst)r))|p_(?:(?:addextendedpro|sqlexe)c|(?:oacreat|prepar)e|execute(?:sql)?|makewebtask)|ql_(?:longvarchar|variant))|xp_(?:reg(?:re(?:movemultistring|ad)|delete(?:value|key)|enum(?:value|key)s|addmultistring|write)|e(?:xecresultset|numdsn)|(?:terminat|dirtre)e|availablemedia|loginconfig|cmdshell|filelist|makecab|ntsec)|u(?:nion\b.{1,100}?\bselect|tl_(?:file|http))|group\b.*\bby\b.{1,100}?\bhaving|d(?:elete\b\W*?\bfrom|bms_java)|load\b\W*?\bdata\b.*\binfile|(?:n?varcha|tbcreato)r)\b|i(?:n(?:to\b\W*?\b(?:dump|out)file|sert\b\W*?\binto|ner\b\W*?\bjoin)\b|(?:f(?:\b\W*?\(\W*?\bbenchmark|null\b)|snull\b)\W*?\()|a(?:nd\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|utonomous_transaction\b)|o(?:r\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|pen(?:rowset|query)\b)|having\b ?(?:\d{1,10}|[\'\"][^=]{1,10}[\'\"]) ?[=<>]+|print\b\W*?\@\@|cast\b\W*?\()|(?:;\W*?\b(?:shutdown|drop)|\@\@version)\b|'(?:s(?:qloledb|a)|msdasql|dbo)')" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'SQL Injection Attack',id:'1234123451',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES "\b(\d+) ?= ?\1\b|[\'\"](\w+)[\'\"] ?= ?[\'\"]\2\b" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'SQL Injection Attack',id:'1234123414',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_FILENAME|ARGS|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "@pm user_objects object_type substr all_objects mb_users column_name rownum atttypid substring object_id user_group user_tables pg_attribute user_users column_id user_password attrelid object_name table_name pg_class" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,pass,nolog,skip:1,id:1234123412" SecAction phase:2,pass,nolog,skipAfter:1234123450,id:1234123411 SecRule REQUEST_FILENAME|ARGS "\b(?:user_(?:(?:object|table|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|substr(?:ing)?|table_name|mb_users|rownum)\b" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'SQL Injection Attack',id:'1234123410',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "\b(?:user_(?:(?:object|table|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|substr(?:ing)?|table_name|mb_users|rownum)\b" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'SQL Injection Attack',id:'1234123450',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|!REQUEST_HEADERS:via "\b(?:coalesce\b|root\@)" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'SQL Injection Attack',id:'1234123408',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:via "\b(?:coalesce\b|root\@)" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'SQL Injection Attack',id:'1234123407',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'" # XSS SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "@pm jscript onsubmit copyparentfolder javascript meta onmove onkeydown onchange onkeyup activexobject expression onmouseup ecmascript onmouseover vbscript: <![cdata[ http: settimeout onabort shell: .innerhtml onmousedown onkeypress asfunction: onclick .fromcharcode background-image: .cookie ondragdrop onblur x-javascript mocha: onfocus javascript: getparentfolder lowsrc onresize @import alert onselect script onmouseout onmousemove background application .execscript livescript: getspecialfolder vbscript iframe .addimport onunload createtextrange onload <input" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,pass,nolog,skip:1,id:1234123406" SecAction phase:2,pass,nolog,skipAfter:1234123449,id:1234123405 SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "(?:\b(?:(?:type\b\W*?\b(?:text\b\W*?\b(?:j(?:ava)?|ecma|vb)|application\b\W*?\bx-(?:java|vb))script|c(?:opyparentfolder|reatetextrange)|get(?:special|parent)folder|iframe\b.{0,100}?\bsrc)\b|on(?:(?:mo(?:use(?:o(?:ver|ut)|down|move|up)|ve)|key(?:press|down|up)|c(?:hange|lick)|s(?:elec|ubmi)t|(?:un)?load|dragdrop|resize|focus|blur)\b\W*?=|abort\b)|(?:l(?:owsrc\b\W*?\b(?:(?:java|vb)script|shell|http)|ivescript)|(?:href|url)\b\W*?\b(?:(?:java|vb)script|shell)|background-image|mocha):|s(?:(?:tyle\b\W*=.*\bexpression\b\W*|ettimeout\b\W*?)\(|rc\b\W*?\b(?:(?:java|vb)script|shell|http):)|a(?:ctivexobject\b|lert\b\W*?\(|sfunction:))|<(?:(?:body\b.*?\b(?:backgroun|onloa)d|input\b.*?\btype\b\W*?\bimage)\b| ?(?:(?:script|meta)\b|iframe)|!\[cdata\[)|(?:\.(?:(?:execscrip|addimpor)t|(?:fromcharcod|cooki)e|innerhtml)|\@import)\b)" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'Cross-site Scripting (XSS) Attack',id:'1234123449',tag:'WEB_ATTACK/XSS',logdata:'%{TX.0}',severity:'2'" # file injection SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/* "@pm .www_acl .htpasswd .htaccess boot.ini httpd.conf /etc/ .htgroup global.asa .wwwacl" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,pass,nolog,skip:1,id:1234123403" SecAction phase:2,pass,nolog,skipAfter:1234123448,id:1234123402 SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES "(?:\b(?:\.(?:ht(?:access|passwd|group)|www_?acl)|global\.asa|httpd\.conf|boot\.ini)\b|\/etc\/)" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Remote File Access Attempt',id:'1234123401',tag:'WEB_ATTACK/FILE_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_HEADERS|XML:/* "(?:\b(?:\.(?:ht(?:access|passwd|group)|www_?acl)|global\.asa|httpd\.conf|boot\.ini)\b|\/etc\/)" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Remote File Access Attempt',id:'1234123448',tag:'WEB_ATTACK/FILE_INJECTION',logdata:'%{TX.0}',severity:'2'" # Command access SecRule REQUEST_FILENAME "\b(?:n(?:map|et|c)|w(?:guest|sh)|cmd(?:32)?|telnet|rcmd|ftp)\.exe\b" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'System Command Access',id:'1234123399',tag:'WEB_ATTACK/FILE_INJECTION',logdata:'%{TX.0}',severity:'2'" # Command injection SecRule ARGS "@pm uname wguest.exe /perl /nasm rcmd.exe nc tclsh /xterm finger tftp chown /echo nmap.exe ping /passwd /chsh ps /uname telnet.exe /ftp ls tclsh8 lsof /ping echo cmd.exe /kill python traceroute /ps perl passwd wsh.exe /rm /cpp chgrp /telnet localgroup kill /chgrp /finger nasm /ls nc.exe id /chmod /nc /g++ /id /chown cmd /nmap chsh /gcc net.exe /python /lsof ftp.exe ftp xterm mail /mail tracert nmap rm cd chmod cpp telnet cmd32.exe gcc g++" \ "phase:2,t:none,t:htmlEntityDecode,t:lowercase,pass,nolog,skip:1,id:1234123398" SecAction phase:2,pass,nolog,skipAfter:1234123447,id:1234123397 SecRule ARGS "(?:\b(?:(?:n(?:et(?:\b\W+?\blocalgroup|\.exe)|(?:map|c)\.exe)|t(?:racer(?:oute|t)|elnet\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\.exe|echo\b\W*?\by+)\b|c(?:md(?:(?:32)?\.exe\b|\b\W*?\/c)|d(?:\b\W*?[\\\/]|\W*?\.\.)|hmod.{0,40}?\+.{0,3}x))|[\;\|\`]\W*?\b(?:(?:c(?:h(?:grp|mod|own|sh)|md|pp)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)\b|g(?:\+\+|cc\b))|\/(?:c(?:h(?:grp|mod|own|sh)|pp)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|g(?:\+\+|cc)|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)(?:[\'\"\|\;\`\-\s]|$))" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'System Command Injection',id:'1234123447',tag:'WEB_ATTACK/COMMAND_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:'/^(Cookie|Referer|X-OS-Prefs)$/'|REQUEST_COOKIES|REQUEST_COOKIES_NAMES \ "@pm uname wguest.exe /perl /nasm rcmd.exe nc tclsh /xterm finger tftp chown /echo nmap.exe ping /passwd /chsh ps /uname telnet.exe /ftp ls tclsh8 lsof /ping echo cmd.exe /kill python traceroute /ps perl passwd wsh.exe /rm /cpp chgrp /telnet localgroup kill /chgrp /finger nasm /ls nc.exe id /chmod /nc /g++ /id /chown cmd /nmap chsh /gcc net.exe /python /lsof ftp.exe ftp xterm mail /mail tracert nmap rm cd chmod cpp telnet cmd32.exe gcc g++" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,pass,nolog,skip:1,id:1234123396" SecAction pass,nolog,skipAfter:1234123446,id:1234123395 SecRule ARGS \ "(?:(?:[\;\|\`]\W*?\bcc|\bwget)\b|\/cc(?:[\'\"\|\;\`\-\s]|$))" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'System Command Injection',id:'1234123393',tag:'WEB_ATTACK/COMMAND_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule "REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:'/^(Cookie|Referer|X-OS-Prefs|User-Agent)$/'|REQUEST_COOKIES|REQUEST_COOKIES_NAMES" \ "(?:(?:[\;\|\`]\W*?\bcc|\bwget)\b|\/cc(?:[\'\"\|\;\`\-\s]|$))" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'System Command Injection',id:'1234123392',tag:'WEB_ATTACK/COMMAND_INJECTION',logdata:'%{TX.0}',severity:'2'" # SSI injection SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES "<!--\W*?#\W*?(?:e(?:cho|xec)|printenv|include|cmd)" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'SSI injection Attack',id:'1234123391',tag:'WEB_ATTACK/SSI_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_HEADERS|XML:/* "<!--\W*?#\W*?(?:e(?:cho|xec)|printenv|include|cmd)" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'SSI injection Attack',id:'1234123390',tag:'WEB_ATTACK/SSI_INJECTION',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/* "@pm <?fgets move_uploaded_file $_session readfile ftp_put ftp_fget gzencode ftp_nb_put bzopen readdir $_post fopen gzread ftp_nb_fput ftp_nb_fget ftp_get $_get scandir fscanf readgzfile fread proc_open fgetc fgetss ftp_fput ftp_nb_get session_start fwrite gzwrite gzopen gzcompress" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,pass,nolog,skip:1,id:1234123389" SecAction pass,nolog,skipAfter:1234123445,id:1234123388 SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES "(?:(?:\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open)|\$_(?:(?:pos|ge)t|session))\b|<\?(?!xml))" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'PHP Injection Attack',id:'1234123387',tag:'WEB_ATTACK/PHP_INJECTION',tag:'WEB_ATTACK/HTTP_RESPONSSE_SPLITTING',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_HEADERS|XML:/* "(?:(?:\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open)|\$_(?:(?:pos|ge)t|session))\b|<\?(?!xml))" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'PHP Injection Attack',id:'1234123445',tag:'WEB_ATTACK/PHP_INJECTION',tag:'WEB_ATTACK/HTTP_RESPONSSE_SPLITTING',logdata:'%{TX.0}',severity:'2'" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ahrefsbot)" "msg:'ahrefsbot blocked',phase:1,log,id:7777771,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mj12bot)" "msg:'mj12bot blocked',phase:1,log,id:7777772,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:yandex)" "msg:'yandex blocked',phase:1,log,id:7777773,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:semrushbot)" "msg:'semrushbot blocked',phase:1,log,id:7777774,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:404enemy)" "msg:'404enemy blocked',phase:1,log,id:7777775,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:80legs)" "msg:'80legs blocked',phase:1,log,id:7777776,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:admantx)" "msg:'admantx blocked',phase:1,log,id:7777777,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:aibot)" "msg:'aibot blocked',phase:1,log,id:7777778,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:alittle)" "msg:'alittle blocked',phase:1,log,id:7777779,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:aspseek)" "msg:'aspseek blocked',phase:1,log,id:7777780,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:abonti)" "msg:'abonti blocked',phase:1,log,id:7777781,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:aboundex)" "msg:'aboundex blocked',phase:1,log,id:7777782,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:aboundexbot)" "msg:'aboundexbot blocked',phase:1,log,id:7777783,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:acunetix)" "msg:'acunetix blocked',phase:1,log,id:7777784,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:adstxtcrawlertp)" "msg:'adstxtcrawlertp blocked',phase:1,log,id:7777785,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:afd-verbotsverfahren)" "msg:'afd-verbotsverfahren blocked',phase:1,log,id:7777786,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ahrefsbot)" "msg:'ahrefsbot blocked',phase:1,log,id:7777787,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:aihitbot)" "msg:'aihitbot blocked',phase:1,log,id:7777788,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:aipbot)" "msg:'aipbot blocked',phase:1,log,id:7777789,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:alexibot)" "msg:'alexibot blocked',phase:1,log,id:7777790,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:allsubmitter)" "msg:'allsubmitter blocked',phase:1,log,id:7777791,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:alligator)" "msg:'alligator blocked',phase:1,log,id:7777792,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:alphabot)" "msg:'alphabot blocked',phase:1,log,id:7777793,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:anarchie)" "msg:'anarchie blocked',phase:1,log,id:7777794,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:anarchy)" "msg:'anarchy blocked',phase:1,log,id:7777795,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:anarchy99)" "msg:'anarchy99 blocked',phase:1,log,id:7777796,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ankit)" "msg:'ankit blocked',phase:1,log,id:7777797,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:anthill)" "msg:'anthill blocked',phase:1,log,id:7777798,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:apexoo)" "msg:'apexoo blocked',phase:1,log,id:7777799,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:aspiegel)" "msg:'aspiegel blocked',phase:1,log,id:7777800,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:asterias)" "msg:'asterias blocked',phase:1,log,id:7777801,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:atomseobot)" "msg:'atomseobot blocked',phase:1,log,id:7777802,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:attach)" "msg:'attach blocked',phase:1,log,id:7777803,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:awariorssbot)" "msg:'awariorssbot blocked',phase:1,log,id:7777804,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:awariosmartbot)" "msg:'awariosmartbot blocked',phase:1,log,id:7777805,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:bbbike)" "msg:'bbbike blocked',phase:1,log,id:7777806,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:bdcbot)" "msg:'bdcbot blocked',phase:1,log,id:7777807,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:bdfetch)" "msg:'bdfetch blocked',phase:1,log,id:7777808,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:blexbot)" "msg:'blexbot blocked',phase:1,log,id:7777809,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:backdoorbot)" "msg:'backdoorbot blocked',phase:1,log,id:7777810,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:backstreet)" "msg:'backstreet blocked',phase:1,log,id:7777811,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:backweb)" "msg:'backweb blocked',phase:1,log,id:7777812,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:backlink-ceck)" "msg:'backlink-ceck blocked',phase:1,log,id:7777813,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:backlinkcrawler)" "msg:'backlinkcrawler blocked',phase:1,log,id:7777814,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:badass)" "msg:'badass blocked',phase:1,log,id:7777815,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:bandit)" "msg:'bandit blocked',phase:1,log,id:7777816,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:barkrowler)" "msg:'barkrowler blocked',phase:1,log,id:7777817,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:batchftp)" "msg:'batchftp blocked',phase:1,log,id:7777818,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:battleztar)" "msg:'battleztar blocked',phase:1,log,id:7777819,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:betabot)" "msg:'betabot blocked',phase:1,log,id:7777820,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:bigfoot)" "msg:'bigfoot blocked',phase:1,log,id:7777821,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:bitacle)" "msg:'bitacle blocked',phase:1,log,id:7777822,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:blackwidow)" "msg:'blackwidow blocked',phase:1,log,id:7777823,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:black)" "msg:'black blocked',phase:1,log,id:7777824,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:blackboard)" "msg:'blackboard blocked',phase:1,log,id:7777825,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:blow)" "msg:'blow blocked',phase:1,log,id:7777826,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:blowfish)" "msg:'blowfish blocked',phase:1,log,id:7777827,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:boardreader)" "msg:'boardreader blocked',phase:1,log,id:7777828,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:bolt)" "msg:'bolt blocked',phase:1,log,id:7777829,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:botalot)" "msg:'botalot blocked',phase:1,log,id:7777830,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:brandprotect)" "msg:'brandprotect blocked',phase:1,log,id:7777831,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:brandwatch)" "msg:'brandwatch blocked',phase:1,log,id:7777832,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:buck)" "msg:'buck blocked',phase:1,log,id:7777833,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:buddy)" "msg:'buddy blocked',phase:1,log,id:7777834,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:builtbottough)" "msg:'builtbottough blocked',phase:1,log,id:7777835,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:builtwith)" "msg:'builtwith blocked',phase:1,log,id:7777836,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:bullseye)" "msg:'bullseye blocked',phase:1,log,id:7777837,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:bunnyslippers)" "msg:'bunnyslippers blocked',phase:1,log,id:7777838,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:buzzsumo)" "msg:'buzzsumo blocked',phase:1,log,id:7777839,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:bytespider)" "msg:'bytespider blocked',phase:1,log,id:7777840,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:catexplorador)" "msg:'catexplorador blocked',phase:1,log,id:7777841,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ccbot)" "msg:'ccbot blocked',phase:1,log,id:7777842,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:code87)" "msg:'code87 blocked',phase:1,log,id:7777843,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cshttp)" "msg:'cshttp blocked',phase:1,log,id:7777844,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:calculon)" "msg:'calculon blocked',phase:1,log,id:7777845,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cazoodlebot)" "msg:'cazoodlebot blocked',phase:1,log,id:7777846,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cegbfeieh)" "msg:'cegbfeieh blocked',phase:1,log,id:7777847,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:censysinspect)" "msg:'censysinspect blocked',phase:1,log,id:7777848,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cheteam)" "msg:'cheteam blocked',phase:1,log,id:7777849,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cheesebot)" "msg:'cheesebot blocked',phase:1,log,id:7777850,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cherrypicker)" "msg:'cherrypicker blocked',phase:1,log,id:7777851,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:chinaclaw)" "msg:'chinaclaw blocked',phase:1,log,id:7777852,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:chlooe)" "msg:'chlooe blocked',phase:1,log,id:7777853,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:citoid)" "msg:'citoid blocked',phase:1,log,id:7777854,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:claritybot)" "msg:'claritybot blocked',phase:1,log,id:7777855,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cliqzbot)" "msg:'cliqzbot blocked',phase:1,log,id:7777856,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cloud)" "msg:'cloud blocked',phase:1,log,id:7777857,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cocolyzebot)" "msg:'cocolyzebot blocked',phase:1,log,id:7777858,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cogentbot)" "msg:'cogentbot blocked',phase:1,log,id:7777859,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:collector)" "msg:'collector blocked',phase:1,log,id:7777860,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:copier)" "msg:'copier blocked',phase:1,log,id:7777861,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:copyrightcheck)" "msg:'copyrightcheck blocked',phase:1,log,id:7777862,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:copyscape)" "msg:'copyscape blocked',phase:1,log,id:7777863,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cosmos)" "msg:'cosmos blocked',phase:1,log,id:7777864,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:craftbot)" "msg:'craftbot blocked',phase:1,log,id:7777865,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:crawling)" "msg:'crawling blocked',phase:1,log,id:7777866,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:crazywebcrawler)" "msg:'crazywebcrawler blocked',phase:1,log,id:7777867,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:crescent)" "msg:'crescent blocked',phase:1,log,id:7777868,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:crunchbot)" "msg:'crunchbot blocked',phase:1,log,id:7777869,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:curious)" "msg:'curious blocked',phase:1,log,id:7777870,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:custo)" "msg:'custo blocked',phase:1,log,id:7777871,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:cyotekwebcopy)" "msg:'cyotekwebcopy blocked',phase:1,log,id:7777872,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:dblbot)" "msg:'dblbot blocked',phase:1,log,id:7777873,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:diibot)" "msg:'diibot blocked',phase:1,log,id:7777874,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:dsearch)" "msg:'dsearch blocked',phase:1,log,id:7777875,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:dts)" "msg:'dts blocked',phase:1,log,id:7777876,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:datacha0s)" "msg:'datacha0s blocked',phase:1,log,id:7777877,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:databasedrivermysqli)" "msg:'databasedrivermysqli blocked',phase:1,log,id:7777878,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:demon)" "msg:'demon blocked',phase:1,log,id:7777879,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:deusu)" "msg:'deusu blocked',phase:1,log,id:7777880,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:devil)" "msg:'devil blocked',phase:1,log,id:7777881,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:digincore)" "msg:'digincore blocked',phase:1,log,id:7777882,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:digitalpebble)" "msg:'digitalpebble blocked',phase:1,log,id:7777883,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:dirbuster)" "msg:'dirbuster blocked',phase:1,log,id:7777884,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:disco)" "msg:'disco blocked',phase:1,log,id:7777885,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:discobot)" "msg:'discobot blocked',phase:1,log,id:7777886,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:discoverybot)" "msg:'discoverybot blocked',phase:1,log,id:7777887,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:dispatch)" "msg:'dispatch blocked',phase:1,log,id:7777888,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:dittospyder)" "msg:'dittospyder blocked',phase:1,log,id:7777889,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:dnbcrawler-analytics)" "msg:'dnbcrawler-analytics blocked',phase:1,log,id:7777890,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:dnyzbot)" "msg:'dnyzbot blocked',phase:1,log,id:7777891,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:domcopbot)" "msg:'domcopbot blocked',phase:1,log,id:7777892,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:domainappender)" "msg:'domainappender blocked',phase:1,log,id:7777893,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:domaincrawler)" "msg:'domaincrawler blocked',phase:1,log,id:7777894,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:domainsigmacrawler)" "msg:'domainsigmacrawler blocked',phase:1,log,id:7777895,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:domainstatsbot)" "msg:'domainstatsbot blocked',phase:1,log,id:7777896,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:domains)" "msg:'domains blocked',phase:1,log,id:7777897,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:dotbot)" "msg:'dotbot blocked',phase:1,log,id:7777898,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:dragonfly)" "msg:'dragonfly blocked',phase:1,log,id:7777900,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:drip)" "msg:'drip blocked',phase:1,log,id:7777901,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:eccp)" "msg:'eccp blocked',phase:1,log,id:7777902,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:email)" "msg:'email blocked',phase:1,log,id:7777903,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:email)" "msg:'email blocked',phase:1,log,id:7777904,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:easydl)" "msg:'easydl blocked',phase:1,log,id:7777905,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ebingbong)" "msg:'ebingbong blocked',phase:1,log,id:7777906,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ecxi)" "msg:'ecxi blocked',phase:1,log,id:7777907,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:eirgrabber)" "msg:'eirgrabber blocked',phase:1,log,id:7777908,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:erocrawler)" "msg:'erocrawler blocked',phase:1,log,id:7777909,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:evil)" "msg:'evil blocked',phase:1,log,id:7777910,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:exabot)" "msg:'exabot blocked',phase:1,log,id:7777911,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:express)" "msg:'express blocked',phase:1,log,id:7777912,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:extlinksbot)" "msg:'extlinksbot blocked',phase:1,log,id:7777913,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:extractor)" "msg:'extractor blocked',phase:1,log,id:7777914,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:extractorpro)" "msg:'extractorpro blocked',phase:1,log,id:7777915,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:extreme)" "msg:'extreme blocked',phase:1,log,id:7777916,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:eyenetie)" "msg:'eyenetie blocked',phase:1,log,id:7777917,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ezooms)" "msg:'ezooms blocked',phase:1,log,id:7777918,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:fdm)" "msg:'fdm blocked',phase:1,log,id:7777919,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:fhscan)" "msg:'fhscan blocked',phase:1,log,id:7777920,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:femtosearchbot)" "msg:'femtosearchbot blocked',phase:1,log,id:7777921,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:fimap)" "msg:'fimap blocked',phase:1,log,id:7777922,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:flashget)" "msg:'flashget blocked',phase:1,log,id:7777923,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:flunky)" "msg:'flunky blocked',phase:1,log,id:7777924,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:foobot)" "msg:'foobot blocked',phase:1,log,id:7777925,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:freeuploader)" "msg:'freeuploader blocked',phase:1,log,id:7777926,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:frontpage)" "msg:'frontpage blocked',phase:1,log,id:7777927,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:fuzz)" "msg:'fuzz blocked',phase:1,log,id:7777928,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:fyberspider)" "msg:'fyberspider blocked',phase:1,log,id:7777929,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:fyrebot)" "msg:'fyrebot blocked',phase:1,log,id:7777930,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:g-i-g-a-b-o-t)" "msg:'g-i-g-a-b-o-t blocked',phase:1,log,id:7777931,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:gptbot)" "msg:'gptbot blocked',phase:1,log,id:7777932,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:gt::www)" "msg:'gt::www blocked',phase:1,log,id:7777933,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:galaxybot)" "msg:'galaxybot blocked',phase:1,log,id:7777934,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:genieo)" "msg:'genieo blocked',phase:1,log,id:7777935,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:germcrawler)" "msg:'germcrawler blocked',phase:1,log,id:7777936,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:getright)" "msg:'getright blocked',phase:1,log,id:7777937,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:getweb)" "msg:'getweb blocked',phase:1,log,id:7777938,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:getintent)" "msg:'getintent blocked',phase:1,log,id:7777939,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:gigabot)" "msg:'gigabot blocked',phase:1,log,id:7777940,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:go!zilla)" "msg:'go!zilla blocked',phase:1,log,id:7777941,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:go-ahead-got-it)" "msg:'go-ahead-got-it blocked',phase:1,log,id:7777942,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:gozilla)" "msg:'gozilla blocked',phase:1,log,id:7777943,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:gotit)" "msg:'gotit blocked',phase:1,log,id:7777944,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:grabnet)" "msg:'grabnet blocked',phase:1,log,id:7777945,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:grabber)" "msg:'grabber blocked',phase:1,log,id:7777946,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:grafula)" "msg:'grafula blocked',phase:1,log,id:7777947,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:grapefx)" "msg:'grapefx blocked',phase:1,log,id:7777948,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:grapeshotcrawler)" "msg:'grapeshotcrawler blocked',phase:1,log,id:7777949,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:gridbot)" "msg:'gridbot blocked',phase:1,log,id:7777950,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:headmasterseo)" "msg:'headmasterseo blocked',phase:1,log,id:7777951,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:hmview)" "msg:'hmview blocked',phase:1,log,id:7777952,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:htmlparser)" "msg:'htmlparser blocked',phase:1,log,id:7777953,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:http::lite)" "msg:'http::lite blocked',phase:1,log,id:7777954,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:httrack)" "msg:'httrack blocked',phase:1,log,id:7777955,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:haansoft)" "msg:'haansoft blocked',phase:1,log,id:7777956,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:haosouspider)" "msg:'haosouspider blocked',phase:1,log,id:7777957,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:harvest)" "msg:'harvest blocked',phase:1,log,id:7777958,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:havij)" "msg:'havij blocked',phase:1,log,id:7777959,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:heritrix)" "msg:'heritrix blocked',phase:1,log,id:7777960,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:hloader)" "msg:'hloader blocked',phase:1,log,id:7777961,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:honolulubot)" "msg:'honolulubot blocked',phase:1,log,id:7777962,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:humanlinks)" "msg:'humanlinks blocked',phase:1,log,id:7777963,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:hybridbot)" "msg:'hybridbot blocked',phase:1,log,id:7777964,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:idbte4m)" "msg:'idbte4m blocked',phase:1,log,id:7777965,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:idbot)" "msg:'idbot blocked',phase:1,log,id:7777966,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:irlbot)" "msg:'irlbot blocked',phase:1,log,id:7777967,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:iblog)" "msg:'iblog blocked',phase:1,log,id:7777968,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:id-search)" "msg:'id-search blocked',phase:1,log,id:7777969,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ilsebot)" "msg:'ilsebot blocked',phase:1,log,id:7777970,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:indeedbot)" "msg:'indeedbot blocked',phase:1,log,id:7777972,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:infonavirobot)" "msg:'infonavirobot blocked',phase:1,log,id:7777973,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:infotekies)" "msg:'infotekies blocked',phase:1,log,id:7777974,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:intelliseek)" "msg:'intelliseek blocked',phase:1,log,id:7777975,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:interget)" "msg:'interget blocked',phase:1,log,id:7777976,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:internetseer)" "msg:'internetseer blocked',phase:1,log,id:7777977,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:iria)" "msg:'iria blocked',phase:1,log,id:7777978,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:iskanie)" "msg:'iskanie blocked',phase:1,log,id:7777979,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:istellabot)" "msg:'istellabot blocked',phase:1,log,id:7777980,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:joc)" "msg:'joc blocked',phase:1,log,id:7777981,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:jamesbot)" "msg:'jamesbot blocked',phase:1,log,id:7777982,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:jbrofuzz)" "msg:'jbrofuzz blocked',phase:1,log,id:7777983,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:jennybot)" "msg:'jennybot blocked',phase:1,log,id:7777984,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:jetcar)" "msg:'jetcar blocked',phase:1,log,id:7777985,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:jetty)" "msg:'jetty blocked',phase:1,log,id:7777986,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:jikespider)" "msg:'jikespider blocked',phase:1,log,id:7777987,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:joomla)" "msg:'joomla blocked',phase:1,log,id:7777988,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:jorgee)" "msg:'jorgee blocked',phase:1,log,id:7777989,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:justview)" "msg:'justview blocked',phase:1,log,id:7777990,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:jyxobot)" "msg:'jyxobot blocked',phase:1,log,id:7777991,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:kenjin)" "msg:'kenjin blocked',phase:1,log,id:7777992,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:keybot)" "msg:'keybot blocked',phase:1,log,id:7777993,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:keyword)" "msg:'keyword blocked',phase:1,log,id:7777994,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:kinza)" "msg:'kinza blocked',phase:1,log,id:7777995,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:kozmosbot)" "msg:'kozmosbot blocked',phase:1,log,id:7777996,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:lnspiderguy)" "msg:'lnspiderguy blocked',phase:1,log,id:7777997,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:lwp::simple)" "msg:'lwp::simple blocked',phase:1,log,id:7777998,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:lanshanbot)" "msg:'lanshanbot blocked',phase:1,log,id:7777999,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:larbin)" "msg:'larbin blocked',phase:1,log,id:7778000,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:leap)" "msg:'leap blocked',phase:1,log,id:7778001,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:leechftp)" "msg:'leechftp blocked',phase:1,log,id:7778002,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:leechget)" "msg:'leechget blocked',phase:1,log,id:7778003,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:lexibot)" "msg:'lexibot blocked',phase:1,log,id:7778004,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:lftp)" "msg:'lftp blocked',phase:1,log,id:7778005,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:libweb)" "msg:'libweb blocked',phase:1,log,id:7778006,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:libwhisker)" "msg:'libwhisker blocked',phase:1,log,id:7778007,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:liebaofast)" "msg:'liebaofast blocked',phase:1,log,id:7778008,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:lightspeedsystems)" "msg:'lightspeedsystems blocked',phase:1,log,id:7778009,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:likse)" "msg:'likse blocked',phase:1,log,id:7778010,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:linkscan)" "msg:'linkscan blocked',phase:1,log,id:7778011,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:linkwalker)" "msg:'linkwalker blocked',phase:1,log,id:7778012,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:linkbot)" "msg:'linkbot blocked',phase:1,log,id:7778013,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:linkextractorpro)" "msg:'linkextractorpro blocked',phase:1,log,id:7778014,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:linkpadbot)" "msg:'linkpadbot blocked',phase:1,log,id:7778015,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:linksmanager)" "msg:'linksmanager blocked',phase:1,log,id:7778016,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:linqiametadatadownloaderbot)" "msg:'linqiametadatadownloaderbot blocked',phase:1,log,id:7778017,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:linqiarssbot)" "msg:'linqiarssbot blocked',phase:1,log,id:7778018,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:linqiascrapebot)" "msg:'linqiascrapebot blocked',phase:1,log,id:7778019,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:lipperheyr)" "msg:'lipperheyr blocked',phase:1,log,id:7778020,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:litemage_walker)" "msg:'litemage_walker blocked',phase:1,log,id:7778021,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:lmspider)" "msg:'lmspider blocked',phase:1,log,id:7778022,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ltx71)" "msg:'ltx71 blocked',phase:1,log,id:7778023,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mfc_tear_sample)" "msg:'mfc_tear_sample blocked',phase:1,log,id:7778024,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:midown)" "msg:'midown blocked',phase:1,log,id:7778025,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:miixpc)" "msg:'miixpc blocked',phase:1,log,id:7778026,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mj12bot)" "msg:'mj12bot blocked',phase:1,log,id:7778027,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mqqbrowser)" "msg:'mqqbrowser blocked',phase:1,log,id:7778028,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:msfrontpage)" "msg:'msfrontpage blocked',phase:1,log,id:7778029,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:msiecrawler)" "msg:'msiecrawler blocked',phase:1,log,id:7778030,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mtrobot)" "msg:'mtrobot blocked',phase:1,log,id:7778031,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mag-net)" "msg:'mag-net blocked',phase:1,log,id:7778032,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:magnet)" "msg:'magnet blocked',phase:1,log,id:7778033,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mail.ru_bot)" "msg:'mail.ru_bot blocked',phase:1,log,id:7778034,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:majestic-seo)" "msg:'majestic-seo blocked',phase:1,log,id:7778035,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:majestic12)" "msg:'majestic12 blocked',phase:1,log,id:7778036,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:majestic)" "msg:'majestic blocked',phase:1,log,id:7778037,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:markmonitor)" "msg:'markmonitor blocked',phase:1,log,id:7778038,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:markwatch)" "msg:'markwatch blocked',phase:1,log,id:7778039,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mass)" "msg:'mass blocked',phase:1,log,id:7778040,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:masscan)" "msg:'masscan blocked',phase:1,log,id:7778041,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mata)" "msg:'mata blocked',phase:1,log,id:7778042,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mauibot)" "msg:'mauibot blocked',phase:1,log,id:7778043,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mb2345browser)" "msg:'mb2345browser blocked',phase:1,log,id:7778044,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:meanpath)" "msg:'meanpath blocked',phase:1,log,id:7778045,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:meanpathbot)" "msg:'meanpathbot blocked',phase:1,log,id:7778046,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mediatoolkitbot)" "msg:'mediatoolkitbot blocked',phase:1,log,id:7778047,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:megaindex.ru)" "msg:'megaindex.ru blocked',phase:1,log,id:7778048,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:metauri)" "msg:'metauri blocked',phase:1,log,id:7778049,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:micromessenger)" "msg:'micromessenger blocked',phase:1,log,id:7778050,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:minefield)" "msg:'minefield blocked',phase:1,log,id:7778051,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mister)" "msg:'mister blocked',phase:1,log,id:7778052,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:moblie safari)" "msg:'moblie safari blocked',phase:1,log,id:7778053,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mojeek)" "msg:'mojeek blocked',phase:1,log,id:7778054,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mojolicious)" "msg:'mojolicious blocked',phase:1,log,id:7778055,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:molokaibot)" "msg:'molokaibot blocked',phase:1,log,id:7778056,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:morfeus)" "msg:'morfeus blocked',phase:1,log,id:7778057,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mozlila)" "msg:'mozlila blocked',phase:1,log,id:7778058,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:mr.4x3)" "msg:'mr.4x3 blocked',phase:1,log,id:7778059,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:msrabot)" "msg:'msrabot blocked',phase:1,log,id:7778060,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:musobot)" "msg:'musobot blocked',phase:1,log,id:7778061,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nicerspro)" "msg:'nicerspro blocked',phase:1,log,id:7778062,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:npbot)" "msg:'npbot blocked',phase:1,log,id:7778063,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nameprotect)" "msg:'nameprotect blocked',phase:1,log,id:7778064,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:navroad)" "msg:'navroad blocked',phase:1,log,id:7778065,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nearsite)" "msg:'nearsite blocked',phase:1,log,id:7778066,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:needle)" "msg:'needle blocked',phase:1,log,id:7778067,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nessus)" "msg:'nessus blocked',phase:1,log,id:7778068,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:netants)" "msg:'netants blocked',phase:1,log,id:7778069,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:netlyzer)" "msg:'netlyzer blocked',phase:1,log,id:7778070,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:netmechanic)" "msg:'netmechanic blocked',phase:1,log,id:7778071,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:netspider)" "msg:'netspider blocked',phase:1,log,id:7778072,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:netzip)" "msg:'netzip blocked',phase:1,log,id:7778073,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:netcraft)" "msg:'netcraft blocked',phase:1,log,id:7778074,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nettrack)" "msg:'nettrack blocked',phase:1,log,id:7778075,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:netvibes)" "msg:'netvibes blocked',phase:1,log,id:7778076,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nextgensearchbot)" "msg:'nextgensearchbot blocked',phase:1,log,id:7778077,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nibbler)" "msg:'nibbler blocked',phase:1,log,id:7778078,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:niki-bot)" "msg:'niki-bot blocked',phase:1,log,id:7778079,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nikto)" "msg:'nikto blocked',phase:1,log,id:7778080,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nimblecrawler)" "msg:'nimblecrawler blocked',phase:1,log,id:7778081,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nimbostratus)" "msg:'nimbostratus blocked',phase:1,log,id:7778082,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ninja)" "msg:'ninja blocked',phase:1,log,id:7778083,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nmap)" "msg:'nmap blocked',phase:1,log,id:7778084,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nuclei)" "msg:'nuclei blocked',phase:1,log,id:7778085,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:nutch)" "msg:'nutch blocked',phase:1,log,id:7778086,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:octopus)" "msg:'octopus blocked',phase:1,log,id:7778087,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:offline)" "msg:'offline blocked',phase:1,log,id:7778088,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:oncrawl)" "msg:'oncrawl blocked',phase:1,log,id:7778089,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:openlinkprofiler)" "msg:'openlinkprofiler blocked',phase:1,log,id:7778090,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:openvas)" "msg:'openvas blocked',phase:1,log,id:7778091,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:openfind)" "msg:'openfind blocked',phase:1,log,id:7778092,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:openvas)" "msg:'openvas blocked',phase:1,log,id:7778093,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:orangebot)" "msg:'orangebot blocked',phase:1,log,id:7778094,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:orangespider)" "msg:'orangespider blocked',phase:1,log,id:7778095,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:outclicksbot)" "msg:'outclicksbot blocked',phase:1,log,id:7778096,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:outfoxbot)" "msg:'outfoxbot blocked',phase:1,log,id:7778097,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pecl)" "msg:'pecl blocked',phase:1,log,id:7778098,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:phpcrawl)" "msg:'phpcrawl blocked',phase:1,log,id:7778099,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:poe-component-client-http)" "msg:'poe-component-client-http blocked',phase:1,log,id:7778100,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pageanalyzer)" "msg:'pageanalyzer blocked',phase:1,log,id:7778101,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pagegrabber)" "msg:'pagegrabber blocked',phase:1,log,id:7778102,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pagescorer)" "msg:'pagescorer blocked',phase:1,log,id:7778103,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pagething.com)" "msg:'pagething.com blocked',phase:1,log,id:7778104,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:page)" "msg:'page blocked',phase:1,log,id:7778105,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pandalytics)" "msg:'pandalytics blocked',phase:1,log,id:7778106,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:panscient)" "msg:'panscient blocked',phase:1,log,id:7778107,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:papa)" "msg:'papa blocked',phase:1,log,id:7778108,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pavuk)" "msg:'pavuk blocked',phase:1,log,id:7778109,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:peoplepal)" "msg:'peoplepal blocked',phase:1,log,id:7778110,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:petalbot)" "msg:'petalbot blocked',phase:1,log,id:7778111,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pi-monster)" "msg:'pi-monster blocked',phase:1,log,id:7778112,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:picscout)" "msg:'picscout blocked',phase:1,log,id:7778113,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:picsearch)" "msg:'picsearch blocked',phase:1,log,id:7778114,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:picturefinder)" "msg:'picturefinder blocked',phase:1,log,id:7778115,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:piepmatz)" "msg:'piepmatz blocked',phase:1,log,id:7778116,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pimonster)" "msg:'pimonster blocked',phase:1,log,id:7778117,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pixray)" "msg:'pixray blocked',phase:1,log,id:7778118,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pleasecrawl)" "msg:'pleasecrawl blocked',phase:1,log,id:7778119,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pockey)" "msg:'pockey blocked',phase:1,log,id:7778120,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:propowerbot)" "msg:'propowerbot blocked',phase:1,log,id:7778121,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:prowebwalker)" "msg:'prowebwalker blocked',phase:1,log,id:7778122,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:probethenet)" "msg:'probethenet blocked',phase:1,log,id:7778123,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:proximic)" "msg:'proximic blocked',phase:1,log,id:7778124,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:psbot)" "msg:'psbot blocked',phase:1,log,id:7778125,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pu_in)" "msg:'pu_in blocked',phase:1,log,id:7778126,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pump)" "msg:'pump blocked',phase:1,log,id:7778127,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pxbroker)" "msg:'pxbroker blocked',phase:1,log,id:7778128,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:pycurl)" "msg:'pycurl blocked',phase:1,log,id:7778129,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:queryn)" "msg:'queryn blocked',phase:1,log,id:7778130,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:quick-crawler)" "msg:'quick-crawler blocked',phase:1,log,id:7778131,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rssingbot)" "msg:'rssingbot blocked',phase:1,log,id:7778132,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rankactive)" "msg:'rankactive blocked',phase:1,log,id:7778133,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rankactivelinkbot)" "msg:'rankactivelinkbot blocked',phase:1,log,id:7778134,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rankflex)" "msg:'rankflex blocked',phase:1,log,id:7778135,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rankingbot)" "msg:'rankingbot blocked',phase:1,log,id:7778136,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rankingbot2)" "msg:'rankingbot2 blocked',phase:1,log,id:7778137,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rankivabot)" "msg:'rankivabot blocked',phase:1,log,id:7778138,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rankurbot)" "msg:'rankurbot blocked',phase:1,log,id:7778139,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:re-re)" "msg:'re-re blocked',phase:1,log,id:7778140,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:reget)" "msg:'reget blocked',phase:1,log,id:7778141,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:realdownload)" "msg:'realdownload blocked',phase:1,log,id:7778142,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:reaper)" "msg:'reaper blocked',phase:1,log,id:7778143,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rebelmouse)" "msg:'rebelmouse blocked',phase:1,log,id:7778144,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:recorder)" "msg:'recorder blocked',phase:1,log,id:7778145,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:redesscrapy)" "msg:'redesscrapy blocked',phase:1,log,id:7778146,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:repomonkey)" "msg:'repomonkey blocked',phase:1,log,id:7778147,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:ripper)" "msg:'ripper blocked',phase:1,log,id:7778148,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rocketcrawler)" "msg:'rocketcrawler blocked',phase:1,log,id:7778149,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:rogerbot)" "msg:'rogerbot blocked',phase:1,log,id:7778150,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:sbider)" "msg:'sbider blocked',phase:1,log,id:7778151,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:seokicks)" "msg:'seokicks blocked',phase:1,log,id:7778152,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:seokicks-robot)" "msg:'seokicks-robot blocked',phase:1,log,id:7778153,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:seolyticscrawler)" "msg:'seolyticscrawler blocked',phase:1,log,id:7778154,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:seoprofiler)" "msg:'seoprofiler blocked',phase:1,log,id:7778155,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:seostats)" "msg:'seostats blocked',phase:1,log,id:7778156,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:sistrix)" "msg:'sistrix blocked',phase:1,log,id:7778157,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:smtbot)" "msg:'smtbot blocked',phase:1,log,id:7778158,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:salesintelligent)" "msg:'salesintelligent blocked',phase:1,log,id:7778159,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:scanalert)" "msg:'scanalert blocked',phase:1,log,id:7778160,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:scanbot)" "msg:'scanbot blocked',phase:1,log,id:7778161,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:scoutjet)" "msg:'scoutjet blocked',phase:1,log,id:7778162,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:scrapy)" "msg:'scrapy blocked',phase:1,log,id:7778163,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:screaming)" "msg:'screaming blocked',phase:1,log,id:7778164,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:screenerbot)" "msg:'screenerbot blocked',phase:1,log,id:7778165,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:screpybot)" "msg:'screpybot blocked',phase:1,log,id:7778166,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:searchestate)" "msg:'searchestate blocked',phase:1,log,id:7778167,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:searchmetricsbot)" "msg:'searchmetricsbot blocked',phase:1,log,id:7778168,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:seekport)" "msg:'seekport blocked',phase:1,log,id:7778169,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:seekportbot)" "msg:'seekportbot blocked',phase:1,log,id:7778170,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:semanticjuice)" "msg:'semanticjuice blocked',phase:1,log,id:7778171,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:semrush)" "msg:'semrush blocked',phase:1,log,id:7778172,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:semrushbot)" "msg:'semrushbot blocked',phase:1,log,id:7778173,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:sentibot)" "msg:'sentibot blocked',phase:1,log,id:7778174,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:senutobot)" "msg:'senutobot blocked',phase:1,log,id:7778175,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:seositecheckup)" "msg:'seositecheckup blocked',phase:1,log,id:7778176,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:seobilitybot)" "msg:'seobilitybot blocked',phase:1,log,id:7778177,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:seomoz)" "msg:'seomoz blocked',phase:1,log,id:7778178,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:shodan)" "msg:'shodan blocked',phase:1,log,id:7778179,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:siphon)" "msg:'siphon blocked',phase:1,log,id:7778180,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:sitecheckerbotcrawler)" "msg:'sitecheckerbotcrawler blocked',phase:1,log,id:7778181,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:siteexplorer)" "msg:'siteexplorer blocked',phase:1,log,id:7778182,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:sitelockspider)" "msg:'sitelockspider blocked',phase:1,log,id:7778183,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:sitesnagger)" "msg:'sitesnagger blocked',phase:1,log,id:7778184,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:sitesucker)" "msg:'sitesucker blocked',phase:1,log,id:7778185,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:sucker)" "msg:'sucker blocked',phase:1,log,id:7778186,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:sitebeam)" "msg:'sitebeam blocked',phase:1,log,id:7778187,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:siteimprove)" "msg:'siteimprove blocked',phase:1,log,id:7778188,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:sitevigil)" "msg:'sitevigil blocked',phase:1,log,id:7778189,t:lowercase,block,status:403" SecRule REQUEST_HEADERS:User-Agent "@rx (?:slysearch)" "msg:'slysearch blocked',phase:1,log,id:7778190,t:lowercase,block,status:403" SecRule REQUEST_URI|ARGS|REQUEST_BODY "gacor" "deny,status:403,id:8857549" SecRule REQUEST_URI|ARGS|REQUEST_BODY "SLOT" "deny,status:403,id:88575491" SecRule HTTP_REFERER "GACOR" "deny,id:184769" SecRule HTTP_REFERER "SLOT" "deny,id:184766" SecRule REQUEST_URI|ARGS|REQUEST_BODY "\/alfa\.cgi" "phase:4,log,id:3,deny,msg:'Access Denied'" SecRule REQUEST_URI|ARGS|REQUEST_BODY "\/perl\.alfa" "phase:4,log,id:1,deny,msg:'Access Denied'" SecRule REQUEST_URI|ARGS|REQUEST_BODY "\/getheader\.alfa" "phase:4,log,id:2,deny,msg:'Access Denied'"
Simpan