@@ -1,42 +1,63 @@
11[{
2+ "name":"suspiciously frequent queries",
3+ "filters":[
4+ "Param:q",
5+ "Path=^(/|/search)$"
6+ ],
7+ "interval":120,
8+ "limit":9,
9+ "actions":[
10+ {"name":"log"}
11+ ]
12+ },
13+ {
214 "name":"search request",
315 "filters":[
416 "Param:q",
517 "Path=^(/|/search)$"
618 ],
7− "interval":60,
8− "limit":15,
19+ "interval":120,
20+ "limit":19,
21+ "actions":[
22+ {
23+ "name":"block",
24+ "params":{
25+ "message":"common rate limit exceeded"
26+ }
27+ }
28+ ],
929 "subrules":[
1030 {
1131 "name":"roboagent limit",
1232 "interval":60,
13− "limit":15,
33+ "limit":3,
1434 "filters":[
15− "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client)"
35+ "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client|Ruby)"
1636 ],
1737 "actions":[
18− {"name": "log"},
19− {
38+ {"name":"log"},
39+ {
2040 "name":"block",
2141 "params":{
22− "message":"Rate limit exceeded"
42+ "message":"rate limit exceeded"
2343 }
2444 }
2545 ]
2646 },
2747 {
2848 "name":"botlimit",
49+ "interval":60,
2950 "limit":0,
3051 "stop":true,
3152 "filters":[
3253 "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
3354 ],
3455 "actions":[
35− {"name": "log"},
56+ {"name":"log"},
3657 {
3758 "name":"block",
3859 "params":{
39− "message":"Rate limit exceeded"
60+ "message":"rate limit exceeded"
4061 }
4162 }
4263 ]
@@ -44,17 +65,17 @@
4465 {
4566 "name":"IP limit",
4667 "interval":60,
47− "limit":15,
68+ "limit":13,
4869 "stop":true,
4970 "aggregations":[
5071 "Header:X-Forwarded-For"
5172 ],
5273 "actions":[
53− {"name": "log"},
74+ {"name":"log"},
5475 {
5576 "name":"block",
5677 "params":{
57− "message":"Rate limit exceeded"
78+ "message":"rate limit exceeded"
5879 }
5980 }
6081 ]
@@ -62,34 +83,34 @@
6283 {
6384 "name":"rss/json limit",
6485 "interval":60,
65− "limit":15,
86+ "limit":13,
6687 "stop":true,
6788 "filters":[
6889 "Param:format=(csv|json|rss)"
6990 ],
7091 "actions":[
71− {"name": "log"},
92+ {"name":"log"},
7293 {
7394 "name":"block",
7495 "params":{
75− "message":"Rate limit exceeded"
96+ "message":"rate limit exceeded"
7697 }
7798 }
7899 ]
79− },
100+ },
80101 {
81102 "name":"useragent limit",
82103 "interval":60,
83− "limit":15,
104+ "limit":13,
84105 "aggregations":[
85106 "Header:User-Agent"
86107 ],
87108 "actions":[
88− {"name": "log"},
109+ {"name":"log"},
89110 {
90111 "name":"block",
91112 "params":{
92− "message":"Rate limit exceeded"
113+ "message":"rate limit exceeded"
93114 }
94115 }
95116 ]