@@ -1,105 +1,125 @@
11[
2− { "name": "suspiciously frequent IP",
3− "filters": [],
4− "interval": 600,
5− "limit": 30,
6− "aggregations": [
7− "Header:X-Forwarded-For"
8− ],
9− "actions":[
10− {"name":"log"}
11− ]
12− },
13− { "name": "search request",
14− "filters": [
15− "Param:q",
16− "Path=^(/|/search)$"
17− ],
18− "interval": 61,
19− "limit": 999,
20− "subrules": [
21− {
22− "name": "roboagent limit",
23− "interval": 61,
24− "limit": 1,
25− "filters": [
26− "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client)"
27− ],
28− "actions": [
29− { "name": "log"},
30− { "name": "block",
31− "params": {
32− "message": "Rate limit exceeded"
33− }
34− }
35− ]
36− },
37− {
38− "name": "botlimit",
39− "limit": 0,
40− "stop": true,
41− "filters": [
42− "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
43− ],
44− "actions": [
45− { "name": "log"},
46− { "name": "block",
47− "params": {
48− "message": "Rate limit exceeded"
49− }
50− }
51− ]
52− },
53− {
54− "name": "IP limit",
55− "interval": 61,
56− "limit": 9,
57− "stop": true,
58− "aggregations": [
59− "Header:X-Forwarded-For"
60− ],
61− "actions": [
62− { "name": "log"},
63− { "name": "block",
64− "params": {
65− "message": "Rate limit exceeded"
66− }
67− }
68− ]
69− },
70− {
71− "name": "rss/json limit",
72− "interval": 121,
73− "limit": 2,
74− "stop": true,
75− "filters": [
76− "Param:format=(csv|json|rss)"
77− ],
78− "actions": [
79− { "name": "log"},
80− { "name": "block",
81− "params": {
82− "message": "Rate limit exceeded"
83− }
84− }
85− ]
86− },
87− {
88− "name": "useragent limit",
89− "interval": 61,
90− "limit": 199,
91− "aggregations": [
92− "Header:User-Agent"
93− ],
94− "actions": [
95− { "name": "log"},
96− { "name": "block",
97− "params": {
98− "message": "Rate limit exceeded"
99− }
100− }
101− ]
102− }
103− ]
104− }
2+ {
3+ "name": "roboagent limit",
4+ "filters": [
5+ "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client|Ruby|UniversalFeedParser)"
6+ ],
7+ "limit": 0,
8+ "stop": true,
9+ "actions": [
10+ { "name": "log"},
11+ { "name": "block",
12+ "params": {
13+ "message": "Rate limit exceeded"
14+ }
15+ }
16+ ]
17+ },
18+ {
19+ "name": "botlimit",
20+ "filters": [
21+ "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
22+ ],
23+ "limit": 0,
24+ "stop": true,
25+ "actions": [
26+ { "name": "log"},
27+ { "name": "block",
28+ "params": {
29+ "message": "Rate limit exceeded"
30+ }
31+ }
32+ ]
33+ },
34+ { "name": "suspiciously frequent IP",
35+ "filters": [],
36+ "interval": 600,
37+ "limit": 30,
38+ "aggregations": [
39+ "Header:X-Forwarded-For"
40+ ],
41+ "actions":[
42+ {"name":"log"}
43+ ]
44+ },
45+ { "name": "search request",
46+ "filters": [
47+ "Param:q",
48+ "Path=^(/|/search)$"
49+ ],
50+ "interval": 61,
51+ "limit": 999,
52+ "subrules": [
53+ {
54+ "name": "missing Accept-Language",
55+ "filters": ["!Header:Accept-Language"],
56+ "limit": 0,
57+ "stop": true,
58+ "actions": [
59+ {"name": "block",
60+ "params": {"message": "Rate limit exceeded"}}
61+ ]
62+ },
63+ {
64+ "name": "suspiciously Connection=close header",
65+ "filters": ["Header:Connection=close"],
66+ "limit": 0,
67+ "stop": true,
68+ "actions": [
69+ {"name": "block",
70+ "params": {"message": "Rate limit exceeded"}}
71+ ]
72+ },
73+ {
74+ "name": "IP limit",
75+ "interval": 61,
76+ "limit": 9,
77+ "stop": true,
78+ "aggregations": [
79+ "Header:X-Forwarded-For"
80+ ],
81+ "actions": [
82+ { "name": "log"},
83+ { "name": "block",
84+ "params": {
85+ "message": "Rate limit exceeded"
86+ }
87+ }
88+ ]
89+ },
90+ {
91+ "name": "rss/json limit",
92+ "filters": [
93+ "Param:format=(csv|json|rss)"
94+ ],
95+ "interval": 121,
96+ "limit": 2,
97+ "stop": true,
98+ "actions": [
99+ { "name": "log"},
100+ { "name": "block",
101+ "params": {
102+ "message": "Rate limit exceeded"
103+ }
104+ }
105+ ]
106+ },
107+ {
108+ "name": "useragent limit",
109+ "interval": 61,
110+ "limit": 199,
111+ "aggregations": [
112+ "Header:User-Agent"
113+ ],
114+ "actions": [
115+ { "name": "log"},
116+ { "name": "block",
117+ "params": {
118+ "message": "Rate limit exceeded"
119+ }
120+ }
121+ ]
122+ }
123+ ]
124+ }
105125]