Gecko [ explonortespa.com ]

Name	Size	Permission	Date
104-TYPO3-MAGENTO-EXCLUSION-RULES.conf	471 B	-rw-r--r--	2026-03-10 01:32
400-BITNINJA-INITIALIZATION.conf	3.04 KB	-rw-r--r--	2026-03-10 01:32
400030-status.conf	241 B	-rw-r-----	2024-07-30 15:17
401-WORDPRESS-BACKDOOR-PROTECTION.conf	2.73 KB	-rw-r--r--	2026-03-10 01:32
402-DRUPAL-REMOTE-EXECUTION-PROTECTION.conf	1.8 KB	-rw-r--r--	2026-03-10 01:32
403-MODX-REVOLUTION-REMOETE-EXECUTION-PROTECTION.conf	455 B	-rw-r--r--	2026-03-10 01:32
404-SCANNER-PROTECTION.conf	1.85 KB	-rw-r--r--	2026-03-10 01:32
405-MAGENTO-REMOTE-EXECUTION-PROTECTION.conf	4.62 KB	-rw-r--r--	2026-03-10 01:32
406-WORDPRESS-PLUGIN-VULNERABILITY-PROTECTION.conf	28.08 KB	-rw-r--r--	2026-03-10 01:32
407-BOTNET-PROTECTION.conf	1.25 KB	-rw-r--r--	2026-03-10 01:32
408-SYMFONY-PROTECTION-BN.conf	531 B	-rw-r--r--	2026-03-10 01:32
409-ANTIMALWARE-PROTECTION-BN.conf	20.06 KB	-rw-r--r--	2026-03-10 01:32
410-OTHER-BN.conf	13.95 KB	-rw-r--r--	2026-03-10 01:32
419-REQUEST-BLOCKING-EVALUATION-BN.conf	1.57 KB	-rw-r--r--	2026-03-10 01:32
botnet-post-request.data	80 B	-rw-r--r--	2026-03-10 01:32
malware-endpoints.data	450 B	-rw-r--r--	2026-03-10 01:32
web-shell-uri.data	195 B	-rw-r--r--	2026-03-10 01:32

Rename

SecRule REQUEST_URI "@pmf web-shell-uri.data" "chain,phase:2,id:404001,block,\
severity:CRITICAL,\
msg:'Scanner protection based on Hello Peppa botnet',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}'"
    SecRule ARGS_POST "@pmf botnet-post-request.data" "setvar:tx.bn_inbound_found=+1"
SecRule RESPONSE_STATUS "404" "phase:3,id:404002,chain,\
msg:'Scanner protection based on Hello Peppa botnet',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}'"
    SecRule ARGS_POST "@pmf botnet-post-request.data" "setvar:tx.bn_outbound_found=+1"
SecRule RESPONSE_STATUS "404" "block,auditlog,phase:3,id:404003,chain,\
severity:CRITICAL,\
msg:'Scripting user agent protection',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}'"
SecRule REQUEST_FILENAME "!@endsWith /robots.txt" \
"t:none, chain"
SecRule REQUEST_HEADERS:User-Agent "@pmf ../crs/rules/scripting-user-agents.data" "setvar:tx.bn_outbound_found=+1"SecRule  REQUEST_HEADERS:User-Agent "@rx Bytespider" \
    "id:404004,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,\
    setvar:'tx.bn_inbound_found=+1',\
    msg:'WAF Rule against Bytespider User-Agent',\
    logdata:'WAF Rule against Bytespider User-Agent'"

SecRule  REQUEST_HEADERS:User-Agent "@rx claudebot" \
    "id:404005,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,t:lowercase,\
    setvar:'tx.bn_inbound_found=+1',\
    msg:'WAF Rule against ClaudeBot User-Agent',\
    logdata:'WAF Rule against ClaudeBot User-Agent'"

SecRule  REQUEST_HEADERS:User-Agent "@rx Scrapy" \
    "id:404006,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,t:lowercase,\
    setvar:'tx.bn_inbound_found=+1',\
    msg:'WAF Rule against Scrapy User-Agent',\
    logdata:'WAF Rule against Scrapy User-Agent'"