diff --git a/owasp_rules.json b/owasp_rules.json
index f44d515..e5d4ed6 100644
--- a/owasp_rules.json
+++ b/owasp_rules.json
@@ -120,59 +120,55 @@
         "pattern": "@lt %{tx.blocking_paranoia_level}"
     },
     {
-        "category": "EXCEPTIONS",
-        "pattern": "@streq GET /"
-    },
-    {
-        "category": "EXCEPTIONS",
-        "pattern": "@ipMatch 127.0.0.1,::1"
+        "category": "LFI",
+        "pattern": "@lt 1"
     },
     {
-        "category": "EXCEPTIONS",
-        "pattern": "@ipMatch 127.0.0.1,::1"
+        "category": "LFI",
+        "pattern": "@lt 1"
     },
     {
-        "category": "EXCEPTIONS",
-        "pattern": "@endsWith (internal dummy connection)"
+        "category": "LFI",
+        "pattern": "@rx (?i)(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:.(?:%0[0-1]|?)?|?.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:.|%[25-6ae-f]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))"
     },
     {
-        "category": "EXCEPTIONS",
-        "pattern": "@rx ^(?:GET /|OPTIONS *) HTTP/[12].[01]$"
+        "category": "LFI",
+        "pattern": "@rx (?:(?:^|[x5c/;]).{2,3}[x5c/;]|[x5c/;].{2,3}(?:[x5c/;]|$))"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 1"
+        "category": "LFI",
+        "pattern": "@pmFromFile lfi-os-files.data"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 1"
+        "category": "LFI",
+        "pattern": "@pmFromFile restricted-files.data"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@within %{tx.allowed_methods}"
+        "category": "LFI",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ENFORCEMENT",
+        "category": "LFI",
         "pattern": "@lt 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 2"
+        "category": "LFI",
+        "pattern": "@pmFromFile lfi-os-files.data"
     },
     {
-        "category": "ENFORCEMENT",
+        "category": "LFI",
         "pattern": "@lt 3"
     },
     {
-        "category": "ENFORCEMENT",
+        "category": "LFI",
         "pattern": "@lt 3"
     },
     {
-        "category": "ENFORCEMENT",
+        "category": "LFI",
         "pattern": "@lt 4"
     },
     {
-        "category": "ENFORCEMENT",
+        "category": "LFI",
         "pattern": "@lt 4"
     },
     {
@@ -212,1644 +208,1548 @@
         "pattern": "@lt 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 1"
+        "category": "EVALUATION",
+        "pattern": "@ge 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 1"
+        "category": "EVALUATION",
+        "pattern": "@ge 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx (?i)^(?:get /[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?|(?:connect (?:(?:[0-9]{1,3}.){3}[0-9]{1,3}.?(?::[0-9]+)?|[--9A-Z_a-z]+:[0-9]+)|options *|[a-z]{3,10}[sv]+(?:[0-9A-Z_a-z]{3,7}?://[--9A-Z_a-z]*(?::[0-9]+)?)?/[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?)[sv]+[.-9A-Z_a-z]+)$"
+        "category": "EVALUATION",
+        "pattern": "@ge 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx (?i)^(?:&(?:(?:[acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|(?:[cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^\"';=])*$"
+        "category": "EVALUATION",
+        "pattern": "@ge 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx ^d+$"
+        "category": "EVALUATION",
+        "pattern": "@ge 3"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^(?:GET|HEAD)$"
+        "category": "EVALUATION",
+        "pattern": "@ge 3"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx ^0?$"
+        "category": "EVALUATION",
+        "pattern": "@ge 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^(?:GET|HEAD)$"
+        "category": "EVALUATION",
+        "pattern": "@ge 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@eq 0"
+        "category": "EVALUATION",
+        "pattern": "@ge 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0"
+        "category": "EVALUATION",
+        "pattern": "@ge 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@streq POST"
+        "category": "EVALUATION",
+        "pattern": "@ge 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 0"
+        "category": "EVALUATION",
+        "pattern": "@ge 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 0"
+        "category": "EVALUATION",
+        "pattern": "@ge 3"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@eq 0"
+        "category": "EVALUATION",
+        "pattern": "@ge 3"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@eq 0"
+        "category": "EVALUATION",
+        "pattern": "@ge 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx (d+)-(d+)"
+        "category": "EVALUATION",
+        "pattern": "@ge 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt %{tx.1}"
+        "category": "EVALUATION",
+        "pattern": "@ge %{tx.inbound_anomaly_score_threshold}"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx b(?:keep-alive|close),s?(?:keep-alive|close)b"
+        "category": "EVALUATION",
+        "pattern": "@eq 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx x25"
+        "category": "EVALUATION",
+        "pattern": "@ge %{tx.inbound_anomaly_score_threshold}"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@validateUrlEncoding"
+        "category": "EVALUATION",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^(?i)application/x-www-form-urlencoded"
+        "category": "EVALUATION",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx x25"
+        "category": "EVALUATION",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@validateUrlEncoding"
+        "category": "EVALUATION",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 1"
+        "category": "EVALUATION",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@validateUtf8Encoding"
+        "category": "EVALUATION",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx %u[fF]{2}[0-9a-fA-F]{2}"
+        "category": "EVALUATION",
+        "pattern": "@lt 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@validateByteRange 1-255"
+        "category": "EVALUATION",
+        "pattern": "@lt 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 0"
+        "category": "PHP",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^$"
+        "category": "PHP",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^$"
+        "category": "PHP",
+        "pattern": "@rx (?:<?(?:[^x]|x[^m]|xm[^l]|xml[^s]|xml$|$)|<?php|[(?:/|x5c)?php])"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx ^OPTIONS$"
+        "category": "PHP",
+        "pattern": "@rx .*.ph(?:pd*|tml|ar|ps|t|pt).*$"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@pm AppleWebKit Android Business Enterprise Entreprise"
+        "category": "PHP",
+        "pattern": "@pmFromFile php-config-directives.data"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^$"
+        "category": "PHP",
+        "pattern": "@pm ="
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx ^OPTIONS$"
+        "category": "PHP",
+        "pattern": "@pmFromFile php-variables.data"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 0"
+        "category": "PHP",
+        "pattern": "@rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^$"
+        "category": "PHP",
+        "pattern": "@rx (?:bzip2|expect|glob|ogg|(?:ph|r)ar|ssh2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?|z(?:ip|lib))://"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx ^0$"
+        "category": "PHP",
+        "pattern": "@pmFromFile php-function-names-933150.data"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 0"
+        "category": "PHP",
+        "pattern": "@rx (?i)b(?[\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:*.**/|/.*)|#.*[sv]|\")*[\"']*)?[sv]*(.*)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx (?:^([d.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$)"
+        "category": "PHP",
+        "pattern": "@rx [oOcC]:d+:\".+?\":d+:{.*}"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 1"
+        "category": "PHP",
+        "pattern": "@rx $+(?:[a-zA-Z_x7f-xff][a-zA-Z0-9_x7f-xff]*|s*{.+})(?:s|[.+]|{.+}|/*.**/|//.*|#.*)*(.*)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@gt %{tx.max_num_args}"
+        "category": "PHP",
+        "pattern": "@rx (?:((?:.+)(?:[\"'][-0-9A-Z_a-z]+[\"'])?(.+|[^)]*string[^)]*)[sv\"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|[\"'][-0-9A-Zx5c_a-z]+[\"'])(.+));"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 1"
+        "category": "PHP",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@gt %{tx.arg_name_length}"
+        "category": "PHP",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 1"
+        "category": "PHP",
+        "pattern": "@pmFromFile php-function-names-933151.data"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@gt %{tx.arg_length}"
+        "category": "PHP",
+        "pattern": "@pm ("
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 1"
+        "category": "PHP",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@gt %{tx.total_arg_length}"
+        "category": "PHP",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 1"
+        "category": "PHP",
+        "pattern": "@rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^(?i)multipart/form-data"
+        "category": "PHP",
+        "pattern": "@rx (?i)b(?:a(?:bs|s(?:in|sert(?:_options)?))|basename|c(?:h(?:eckdate|r(?:oot)?)|o(?:(?:mpac|(?:nsta|u)n)t|py|sh?)|r(?:eate_function|ypt)|urrent)|d(?:ate|e(?:coct|fined?)|ir)|e(?:nd|val|x(?:ec|p(?:lode)?|tract))|f(?:ile(?:(?:[acm]tim|inod|siz|typ)e|group|owner|perms)?|l(?:o(?:ck|or)|ush))|glob|h(?:ash|eader)|i(?:date|m(?:age(?:gif|(?:jpe|pn)g|wbmp|xbm)|plode)|s_a)|key|l(?:ink|og)|m(?:a(?:il|x)|d5|in)|n(?:ame|ext)|o(?:pendir|rd)|p(?:a(?:ck|ss(?:thru)?)|i|o(?:pen|w)|rev)|r(?:an(?:d|ge)|e(?:(?:adfil|nam)e|set)|ound)|s(?:(?:erializ|huffl)e|in|leep|(?:or|ta)t|ubstr|y(?:mlink|s(?:log|tem)))|t(?:an|(?:im|mpfil)e|ouch|rim)|u(?:cfirst|n(?:lin|pac)k)|virtual)(?:[sv]|/*.**/|(?:#|//).*)*(.*)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@gt %{tx.max_file_size}"
+        "category": "PHP",
+        "pattern": "@rx .*.(?:phpd*|phtml)..*$"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 1"
+        "category": "PHP",
+        "pattern": "@pm ?>"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@gt %{tx.combined_file_sizes}"
+        "category": "PHP",
+        "pattern": "@rx (?:((?:.+)(?:[\"'][-0-9A-Z_a-z]+[\"'])?(.+|[^)]*string[^)]*)[sv\"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|[\"'][-0-9A-Zx5c_a-z]+[\"'])(.+))(?:;|$)?"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx ^[w/.+*-]+(?:s?;s?(?:action|boundary|charset|component|start(?:-info)?|type|version)s?=s?['\"w.()+,/:=?<>@#*-]+)*$"
+        "category": "PHP",
+        "pattern": "@lt 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^[^;s]+"
+        "category": "PHP",
+        "pattern": "@lt 4"
     },
     {
         "category": "ENFORCEMENT",
-        "pattern": "!@within %{tx.allowed_request_content_type}"
+        "pattern": "@lt 1"
     },
     {
         "category": "ENFORCEMENT",
-        "pattern": "@rx charsets*=s*[\"']?([^;\"'s]+)"
+        "pattern": "@lt 1"
     },
     {
         "category": "ENFORCEMENT",
-        "pattern": "!@within %{tx.allowed_request_content_type_charset}"
+        "pattern": "!@within %{tx.allowed_methods}"
     },
     {
         "category": "ENFORCEMENT",
-        "pattern": "@rx charset.*?charset"
+        "pattern": "@lt 2"
     },
     {
         "category": "ENFORCEMENT",
-        "pattern": "!@within %{tx.allowed_http_versions}"
+        "pattern": "@lt 2"
     },
     {
         "category": "ENFORCEMENT",
-        "pattern": "@rx .([^.]+)$"
+        "pattern": "@lt 3"
     },
     {
         "category": "ENFORCEMENT",
-        "pattern": "@within %{tx.restricted_extensions}"
+        "pattern": "@lt 3"
     },
     {
         "category": "ENFORCEMENT",
-        "pattern": "@rx .[^.~]+~(?:/.*|)$"
+        "pattern": "@lt 4"
     },
     {
         "category": "ENFORCEMENT",
-        "pattern": "@rx ^.*$"
+        "pattern": "@lt 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@within %{tx.restricted_headers_basic}"
+        "category": "ATTACK",
+        "pattern": "!@eq 0"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@gt 50"
+        "category": "ATTACK",
+        "pattern": "!@within |%{tx.allowed_request_content_type_charset}|"
     },
     {
-        "category": "ENFORCEMENT",
+        "category": "ATTACK",
+        "pattern": "@rx ^content-types*:s*(.*)$"
+    },
+    {
+        "category": "ATTACK",
         "pattern": "!@rx ^(?:(?:*|[^!-\"(-),/:-?[-]{}]+)/(?:*|[^!-\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\"?(?:iso-8859-15?|utf-8|windows-1252)b\"?|(?:[^sv -\"(-),/:-?[-]c{}]|c(?:[^!-\"(-),/:-?[-]h{}]|h(?:[^!-\"(-),/:-?[-]a{}]|a(?:[^!-\"(-),/:-?[-]r{}]|r(?:[^!-\"(-),/:-?[-]s{}]|s(?:[^!-\"(-),/:-?[-]e{}]|e[^!-\"(-),/:-?[-]t{}]))))))[^!-\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\"(-),/:-?[-]{}]+)/(?:*|[^!-\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\"?(?:iso-8859-15?|utf-8|windows-1252)b\"?|(?:[^sv -\"(-),/:-?[-]c{}]|c(?:[^!-\"(-),/:-?[-]h{}]|h(?:[^!-\"(-),/:-?[-]a{}]|a(?:[^!-\"(-),/:-?[-]r{}]|r(?:[^!-\"(-),/:-?[-]s{}]|s(?:[^!-\"(-),/:-?[-]e{}]|e[^!-\"(-),/:-?[-]t{}]))))))[^!-\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@streq JSON"
+        "category": "ATTACK",
+        "pattern": "@rx content-transfer-encoding:(.*)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx (?i)x5cu[0-9a-f]{4}"
+        "category": "SQL",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@contains #"
+        "category": "SQL",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@gt 1"
+        "category": "SQL",
+        "pattern": "!@pmFromFile sql-errors.data"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 2"
+        "category": "SQL",
+        "pattern": "@rx (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 2"
+        "category": "SQL",
+        "pattern": "@rx (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}"
+        "category": "SQL",
+        "pattern": "@rx (?i:DB2 SQL error:|[IBM][CLI Driver][DB2/6000]|CLI Driver.*DB2|DB2 SQL error|db2_w+()"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@endsWith .pdf"
+        "category": "SQL",
+        "pattern": "@rx (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@endsWith .pdf"
+        "category": "SQL",
+        "pattern": "@rx (?i)Dynamic SQL Error"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){63}"
+        "category": "SQL",
+        "pattern": "@rx (?i)Exception (?:condition )?d+. Transaction rollback."
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx %[0-9a-fA-F]{2}"
+        "category": "SQL",
+        "pattern": "@rx (?i)org.hsqldb.jdbc"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@validateByteRange 9,10,13,32-126,128-255"
+        "category": "SQL",
+        "pattern": "@rx (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception.*Informix)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 0"
+        "category": "SQL",
+        "pattern": "@rx (?i:Warning.*ingres_|Ingres SQLSTATE|IngresW.*Driver)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ['\";=]"
+        "category": "SQL",
+        "pattern": "@rx (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx ^0$"
+        "category": "SQL",
+        "pattern": "@rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 0"
+        "category": "SQL",
+        "pattern": "@rx (?i)(?:System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*WSystem.Data.SqlClient.|Conversion failed when converting the varchar value .*? to data type int.)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^.*$"
+        "category": "SQL",
+        "pattern": "@rx (?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array()|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient.)|[MySQL][ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[(-)_a-z]{1,26})?|(?:ERROR [0-9]{4} ([0-9a-z]{5})|XPATH syntax error):"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@within %{tx.restricted_headers_extended}"
+        "category": "SQL",
+        "pattern": "@rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|pg_(?:query|exec)() [:|Warning.{1,20}bpg_.*|valid PostgreSQL result|Npgsql.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 3"
+        "category": "SQL",
+        "pattern": "@rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 3"
+        "category": "SQL",
+        "pattern": "@rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*Server message.*)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@validateByteRange 32-36,38-126"
+        "category": "SQL",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@eq 0"
+        "category": "SQL",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx ^(?:OPTIONS|CONNECT)$"
+        "category": "SQL",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@pm AppleWebKit Android"
+        "category": "SQL",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@ge 1"
+        "category": "SQL",
+        "pattern": "@lt 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^(?i)up"
+        "category": "SQL",
+        "pattern": "@lt 4"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@gt 0"
+        "category": "GENERIC",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:s*,s*|$)){1,7}$"
+        "category": "GENERIC",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx br|compress|deflate|(?:pack200-)?gzip|identity|*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)"
+        "category": "GENERIC",
+        "pattern": "@rx _(?:$$ND_FUNC$$_|_js_function)|(?:beval|new[sv]+Function[sv]*)(|String.fromCharCode|function(){|this.constructor|module.exports=|([sv]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][sv]*)|process(?:.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:.call)?(|binding|constructor|env|global|main(?:Module)?|process|require)|[[\"'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)[\"'`]])|(?:binding|constructor|env|global|main(?:Module)?|process|require)[|console(?:.(?:debug|error|info|trace|warn)(?:.call)?(|[[\"'`](?:debug|error|info|trace|warn)[\"'`]])|require(?:.(?:resolve(?:.call)?(|main|extensions|cache)|[[\"'`](?:(?:resolv|cach)e|main|extensions)[\"'`]])"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 4"
+        "category": "GENERIC",
+        "pattern": "@rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[sv]*("
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@lt 4"
+        "category": "GENERIC",
+        "pattern": "@pmFromFile ssrf.data"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@endsWith .pdf"
+        "category": "GENERIC",
+        "pattern": "@rx (?:__proto__|constructors*(?:.|[)s*prototype)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}"
+        "category": "GENERIC",
+        "pattern": "@rx Process[sv]*.[sv]*spawn[sv]*("
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@validateByteRange 38,44-46,48-58,61,65-90,95,97-122"
+        "category": "GENERIC",
+        "pattern": "@rx while[sv]*([sv(]*(?:!+(?:false|null|undefined|NaN|[+-]?0|\"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[+-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)b|{.*}|[.*]|\"[^\"]+\"|'[^']+'|`[^`]+`)).*)"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@validateByteRange 32,34,38,42-59,61,65-90,95,97-122"
+        "category": "GENERIC",
+        "pattern": "@rx ^data:(?:(?:*|[^!-\"(-),/:-?[-]{}]+)/(?:*|[^!-\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\"?(?:iso-8859-15?|utf-8|windows-1252)b\"?|(?:[^sv -\"(-),/:-?[-]c{}]|c(?:[^!-\"(-),/:-?[-]h{}]|h(?:[^!-\"(-),/:-?[-]a{}]|a(?:[^!-\"(-),/:-?[-]r{}]|r(?:[^!-\"(-),/:-?[-]s{}]|s(?:[^!-\"(-),/:-?[-]e{}]|e[^!-\"(-),/:-?[-]t{}]))))))[^!-\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\"(-),/:-?[-]{}]+)/(?:*|[^!-\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\"?(?:iso-8859-15?|utf-8|windows-1252)b\"?|(?:[^sv -\"(-),/:-?[-]c{}]|c(?:[^!-\"(-),/:-?[-]h{}]|h(?:[^!-\"(-),/:-?[-]a{}]|a(?:[^!-\"(-),/:-?[-]r{}]|r(?:[^!-\"(-),/:-?[-]s{}]|s(?:[^!-\"(-),/:-?[-]e{}]|e[^!-\"(-),/:-?[-]t{}]))))))[^!-\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "!@rx ^(?:?[01])?$"
+        "category": "GENERIC",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ENFORCEMENT",
-        "pattern": "@rx (?:^|[^x5c])x5c[cdeghijklmpqwxyz123456789]"
+        "category": "GENERIC",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@lt 1"
+        "category": "GENERIC",
+        "pattern": "@rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}.(?:[0-9]{1,3}.[0-9]{5}|[0-9]{8})|(?:x5cx5c[-0-9a-z].?_?)+|[[0-:a-f]+(?:[.0-9]+|%[0-9A-Z_a-z]+)?]|[a-z][--.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[sv]*&?@(?:(?:[0-9]{1,3}.){3}[0-9]{1,3}|[a-z][--.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[.0-9]{0,11}(?:xe2(?:x91[xa0-xbf]|x92[x80-xbf]|x93[x80-xa9xab-xbf])|xe3x80x82)+))"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@lt 1"
+        "category": "GENERIC",
+        "pattern": "@rx [s*constructors*]"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d"
+        "category": "GENERIC",
+        "pattern": "@rx @{.*}"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx [rn]W*?(?:content-(?:type|length)|set-cookie|location):s*w"
+        "category": "GENERIC",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx (?:bhttp/d|<(?:html|meta)b)"
+        "category": "GENERIC",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx [nr]"
+        "category": "GENERIC",
+        "pattern": "@lt 4"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx [nr]"
+        "category": "GENERIC",
+        "pattern": "@lt 4"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx [nr]+(?:s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*:"
+        "category": "RFI",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx [nr]"
+        "category": "RFI",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx ^[^:()&|!<>~]*)s*(?:((?:[^,()=&|!<>~]+[><~]?=|s*[&!|]s*(?:)|()?s*)|)s*(s*[&|!]s*|[&!|]s*([^()=&|!<>~]+[><~]?=[^:()&|!<>~]*)"
+        "category": "RFI",
+        "pattern": "@rx ^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx ^[^sv,;]+[sv,;].*?(?:application/(?:.++)?json|(?:application/(?:soap+)?|text/)xml)"
+        "category": "RFI",
+        "pattern": "@rx (?i)(?:bincludes*([^)]*|mosConfig_absolute_path|_CONF[path]|_SERVER[DOCUMENT_ROOT]|GALLERY_BASEDIR|path[docroot]|appserv_root|config[root_dir])=(?:file|ftps?|https?)://"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx unix:[^|]*|"
+        "category": "RFI",
+        "pattern": "@rx ^(?i:file|ftps?|https?).*??+$"
     },
     {
-        "category": "ATTACK",
+        "category": "RFI",
         "pattern": "@lt 2"
     },
     {
-        "category": "ATTACK",
+        "category": "RFI",
         "pattern": "@lt 2"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx [nr]"
+        "category": "RFI",
+        "pattern": "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx ^[^sv,;]+[sv,;].*?b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([+/]))b"
+        "category": "RFI",
+        "pattern": "!@endsWith .%{request_headers.host}"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@lt 3"
+        "category": "RFI",
+        "pattern": "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)"
     },
     {
-        "category": "ATTACK",
+        "category": "RFI",
+        "pattern": "!@endsWith .%{request_headers.host}"
+    },
+    {
+        "category": "RFI",
         "pattern": "@lt 3"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@gt 0"
+        "category": "RFI",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx ."
+        "category": "RFI",
+        "pattern": "@lt 4"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@gt 1"
+        "category": "RFI",
+        "pattern": "@lt 4"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx TX:paramcounter_(.*)"
+        "category": "LEAKAGES",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx (][^]]+$|][^]]+[)"
+        "category": "LEAKAGES",
+        "pattern": "@lt 1"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@lt 4"
+        "category": "LEAKAGES",
+        "pattern": "@rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>[To Parent Directory]</[Aa]><br>)"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@lt 4"
+        "category": "LEAKAGES",
+        "pattern": "@rx ^#!s?/"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx ["
+        "category": "LEAKAGES",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ATTACK",
-        "pattern": "!@eq 0"
+        "category": "LEAKAGES",
+        "pattern": "@lt 2"
     },
     {
-        "category": "ATTACK",
-        "pattern": "!@within |%{tx.allowed_request_content_type_charset}|"
+        "category": "LEAKAGES",
+        "pattern": "@rx ^5d{2}$"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx ^content-types*:s*(.*)$"
+        "category": "LEAKAGES",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ATTACK",
-        "pattern": "!@rx ^(?:(?:*|[^!-\"(-),/:-?[-]{}]+)/(?:*|[^!-\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\"?(?:iso-8859-15?|utf-8|windows-1252)b\"?|(?:[^sv -\"(-),/:-?[-]c{}]|c(?:[^!-\"(-),/:-?[-]h{}]|h(?:[^!-\"(-),/:-?[-]a{}]|a(?:[^!-\"(-),/:-?[-]r{}]|r(?:[^!-\"(-),/:-?[-]s{}]|s(?:[^!-\"(-),/:-?[-]e{}]|e[^!-\"(-),/:-?[-]t{}]))))))[^!-\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\"(-),/:-?[-]{}]+)/(?:*|[^!-\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\"?(?:iso-8859-15?|utf-8|windows-1252)b\"?|(?:[^sv -\"(-),/:-?[-]c{}]|c(?:[^!-\"(-),/:-?[-]h{}]|h(?:[^!-\"(-),/:-?[-]a{}]|a(?:[^!-\"(-),/:-?[-]r{}]|r(?:[^!-\"(-),/:-?[-]s{}]|s(?:[^!-\"(-),/:-?[-]e{}]|e[^!-\"(-),/:-?[-]t{}]))))))[^!-\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$"
+        "category": "LEAKAGES",
+        "pattern": "@lt 3"
     },
     {
-        "category": "ATTACK",
-        "pattern": "@rx content-transfer-encoding:(.*)"
+        "category": "LEAKAGES",
+        "pattern": "@lt 4"
     },
     {
-        "category": "LFI",
+        "category": "LEAKAGES",
+        "pattern": "@lt 4"
+    },
+    {
+        "category": "XSS",
         "pattern": "@lt 1"
     },
     {
-        "category": "LFI",
+        "category": "XSS",
         "pattern": "@lt 1"
     },
     {
-        "category": "LFI",
-        "pattern": "@rx (?i)(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:.(?:%0[0-1]|?)?|?.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:.|%[25-6ae-f]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))"
+        "category": "XSS",
+        "pattern": "!@validateByteRange 20, 45-47, 48-57, 65-90, 95, 97-122"
     },
     {
-        "category": "LFI",
-        "pattern": "@rx (?:(?:^|[x5c/;]).{2,3}[x5c/;]|[x5c/;].{2,3}(?:[x5c/;]|$))"
+        "category": "XSS",
+        "pattern": "@detectXSS"
     },
     {
-        "category": "LFI",
-        "pattern": "@pmFromFile lfi-os-files.data"
+        "category": "XSS",
+        "pattern": "@rx (?i)<script[^>]*>[sS]*?"
     },
     {
-        "category": "LFI",
-        "pattern": "@pmFromFile restricted-files.data"
+        "category": "XSS",
+        "pattern": "@rx (?i).(?:b(?:x(?:link:href|html|mlns)|data:text/html|formaction|patternb.*?=)|!ENTITY[sv]+(?:%[sv]+)?[^sv]+[sv]+(?:SYSTEM|PUBLIC)|@import|;base64)b"
     },
     {
-        "category": "LFI",
-        "pattern": "@lt 2"
+        "category": "XSS",
+        "pattern": "@rx (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url(javascript"
     },
     {
-        "category": "LFI",
-        "pattern": "@lt 2"
+        "category": "XSS",
+        "pattern": "@rx (?i)<[^0-9<>A-Z_a-z]*(?:[^sv\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e|v[^0-9A-Z_a-z]*?g|e[^0-9A-Z_a-z]*?t[^0-9>A-Z_a-z])|f[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?m|m[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?q[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?e|e[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?a[^0-9>A-Z_a-z])|(?:l[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?k|o[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?j[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?c[^0-9A-Z_a-z]*?t|e[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?d|a[^0-9A-Z_a-z]*?(?:p[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?t|u[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?o|n[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?e)|p[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m|i?[^0-9A-Z_a-z]*?f[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?e|b[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?s[^0-9A-Z_a-z]*?e|o[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?y|i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?s)|i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a?[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?e?|v[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?o)[^0-9>A-Z_a-z])|(?:<[0-9A-Z_a-z].*[sv/]|[\"'](?:.*[sv/])?)(?:background|formaction|lowsrc|on(?:a(?:bort|ctivate|d(?:apteradded|dtrack)|fter(?:print|(?:scriptexecu|upda)te)|lerting|n(?:imation(?:cancel|end|iteration|start)|tennastatechange)|ppcommand|u(?:dio(?:end|process|start)|xclick))|b(?:e(?:fore(?:(?:(?:(?:de)?activa|scriptexecu)t|toggl)e|c(?:opy|ut)|editfocus|input|p(?:aste|rint)|u(?:nload|pdate))|gin(?:Event)?)|l(?:ocked|ur)|oun(?:ce|dary)|roadcast|usy)|c(?:a(?:(?:ch|llschang)ed|nplay(?:through)?|rdstatechange)|(?:ell|fstate)change|h(?:a(?:rging(?:time)?cha)?nge|ecking)|l(?:ick|ose)|o(?:m(?:mand(?:update)?|p(?:lete|osition(?:end|start|update)))|n(?:nect(?:ed|ing)|t(?:extmenu|rolselect))|py)|u(?:echange|t))|d(?:ata(?:(?:availabl|chang)e|error|setc(?:hanged|omplete))|blclick|e(?:activate|livery(?:error|success)|vice(?:found|light|(?:mo|orienta)tion|proximity))|i(?:aling|s(?:abled|c(?:hargingtimechange|onnect(?:ed|ing))))|o(?:m(?:a(?:ctivate|ttrmodified)|(?:characterdata|subtree)modified|focus(?:in|out)|mousescroll|node(?:inserted(?:intodocument)?|removed(?:fromdocument)?))|wnloading)|r(?:ag(?:drop|e(?:n(?:d|ter)|xit)|(?:gestur|leav)e|over|start)|op)|urationchange)|e(?:mptied|n(?:abled|d(?:ed|Event)?|ter)|rror(?:update)?|xit)|f(?:ailed|i(?:lterchange|nish)|o(?:cus(?:in|out)?|rm(?:change|input))|ullscreenchange)|g(?:amepad(?:axismove|button(?:down|up)|(?:dis)?connected)|et)|h(?:ashchange|e(?:adphoneschange|l[dp])|olding)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|put|valid))|key(?:down|press|up)|l(?:evelchange|o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|y)|m(?:ark|essage|o(?:use(?:down|enter|(?:lea|mo)ve|o(?:ut|ver)|up|wheel)|ve(?:end|start)?|z(?:a(?:fterpaint|udioavailable)|(?:beforeresiz|orientationchang|t(?:apgestur|imechang))e|(?:edgeui(?:c(?:ancel|omplet)|start)e|network(?:down|up)loa)d|fullscreen(?:change|error)|m(?:agnifygesture(?:start|update)?|ouse(?:hittest|pixelscroll))|p(?:ointerlock(?:change|error)|resstapgesture)|rotategesture(?:start|update)?|s(?:crolledareachanged|wipegesture(?:end|start|update)?))))|no(?:match|update)|o(?:(?:bsolet|(?:ff|n)lin)e|pen|verflow(?:changed)?)|p(?:a(?:ge(?:hide|show)|int|(?:st|us)e)|lay(?:ing)?|o(?:inter(?:down|enter|(?:(?:lea|mo)v|rawupdat)e|o(?:ut|ver)|up)|p(?:state|up(?:hid(?:den|ing)|show(?:ing|n))))|ro(?:gress|pertychange))|r(?:atechange|e(?:adystatechange|ceived|movetrack|peat(?:Event)?|quest|s(?:et|ize|u(?:lt|m(?:e|ing)))|trieving)|ow(?:e(?:nter|xit)|s(?:delete|inserted)))|s(?:croll(?:end)?|e(?:arch|ek(?:complete|ed|ing)|lect(?:ionchange|start)?|n(?:ding|t)|t)|how|(?:ound|peech)(?:end|start)|t(?:a(?:lled|rt|t(?:echange|uschanged))|k(?:comma|sessione)nd|op)|u(?:bmit|ccess|spend)|vg(?:abort|error|(?:un)?load|resize|scroll|zoom))|t(?:ext|ime(?:out|update)|o(?:ggle|uch(?:cancel|en(?:d|ter)|(?:lea|mo)ve|start))|ransition(?:cancel|end|run|start))|u(?:n(?:derflow|handledrejection|load)|p(?:dateready|gradeneeded)|s(?:erproximity|sdreceived))|v(?:ersion|o(?:ic|lum)e)change|w(?:a(?:it|rn)ing|ebkit(?:animation(?:end|iteration|start)|transitionend)|heel)|zoom)|ping|s(?:rc|tyle))[x08-nf-r ]*?="
     },
     {
-        "category": "LFI",
-        "pattern": "@pmFromFile lfi-os-files.data"
+        "category": "XSS",
+        "pattern": "@rx (?i)(?:W|^)(?:javascript:(?:[sS]+[=x5c([.<]|[sS]*?(?:bnameb|x5c[ux]d))|data:(?:(?:[a-z]w+/w[w+-]+w)?[;,]|[sS]*?;[sS]*?b(?:base64|charset=)|[sS]*?,[sS]*?<[sS]*?w[sS]*?>))|@W*?iW*?mW*?pW*?oW*?rW*?tW*?(?:/*[sS]*?)?(?:[\"']|W*?uW*?rW*?l[sS]*?()|[^-]*?-W*?mW*?oW*?zW*?-W*?bW*?iW*?nW*?dW*?iW*?nW*?g[^:]*?:W*?uW*?rW*?l[sS]*?("
     },
     {
-        "category": "LFI",
-        "pattern": "@lt 3"
+        "category": "XSS",
+        "pattern": "@pm document.cookie document.domain document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata["
     },
     {
-        "category": "LFI",
-        "pattern": "@lt 3"
+        "category": "XSS",
+        "pattern": "@rx (?i:<style.*?>.*?(?:@[ix5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(x5c]|&#x?0*(?:40|28|92|5C);?)))"
     },
     {
-        "category": "LFI",
-        "pattern": "@lt 4"
+        "category": "XSS",
+        "pattern": "@rx (?i:<.*[:]?vmlframe.*?[s/+]*?src[s/+]*=)"
     },
     {
-        "category": "LFI",
-        "pattern": "@lt 4"
+        "category": "XSS",
+        "pattern": "@rx (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:v|&#(?:0*(?:86|118)|x0*[57]6);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;))."
     },
     {
-        "category": "RFI",
-        "pattern": "@lt 1"
+        "category": "XSS",
+        "pattern": "@rx (?i)(?:v|&#(?:0*8|x0*5)[36];)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*6[26]|x0*(?:98|42));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;))."
     },
     {
-        "category": "RFI",
-        "pattern": "@lt 1"
+        "category": "XSS",
+        "pattern": "@rx (?i)<EMBED[s/+].*?(?:src|type).*?="
     },
     {
-        "category": "RFI",
-        "pattern": "@rx ^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})"
+        "category": "XSS",
+        "pattern": "@rx <[?]?import[s/+S]*?implementation[s/+]*?="
     },
     {
-        "category": "RFI",
-        "pattern": "@rx (?i)(?:bincludes*([^)]*|mosConfig_absolute_path|_CONF[path]|_SERVER[DOCUMENT_ROOT]|GALLERY_BASEDIR|path[docroot]|appserv_root|config[root_dir])=(?:file|ftps?|https?)://"
+        "category": "XSS",
+        "pattern": "@rx (?i:<META[s/+].*?http-equiv[s/+]*=[s/+]*[\"'`]?(?:(?:c|&#x?0*(?:67|43|99|63);?)|(?:r|&#x?0*(?:82|52|114|72);?)|(?:s|&#x?0*(?:83|53|115|73);?)))"
     },
     {
-        "category": "RFI",
-        "pattern": "@rx ^(?i:file|ftps?|https?).*??+$"
+        "category": "XSS",
+        "pattern": "@rx (?i:<META[s/+].*?charset[s/+]*=)"
     },
     {
-        "category": "RFI",
-        "pattern": "@lt 2"
+        "category": "XSS",
+        "pattern": "@rx (?i)<LINK[s/+].*?href[s/+]*="
     },
     {
-        "category": "RFI",
-        "pattern": "@lt 2"
+        "category": "XSS",
+        "pattern": "@rx (?i)<BASE[s/+].*?href[s/+]*="
     },
     {
-        "category": "RFI",
-        "pattern": "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)"
+        "category": "XSS",
+        "pattern": "@rx (?i)<APPLET[s/+>]"
     },
     {
-        "category": "RFI",
-        "pattern": "!@endsWith .%{request_headers.host}"
+        "category": "XSS",
+        "pattern": "@rx (?i)<OBJECT[s/+].*?(?:type|codetype|classid|code|data)[s/+]*="
     },
     {
-        "category": "RFI",
-        "pattern": "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)"
+        "category": "XSS",
+        "pattern": "@rx xbc[^xbe>]*[xbe>]|<[^xbe]*xbe"
     },
     {
-        "category": "RFI",
-        "pattern": "!@endsWith .%{request_headers.host}"
+        "category": "XSS",
+        "pattern": "@rx (?:xbcs*/s*[^xbe>]*[xbe>])|(?:<s*/s*[^xbe]*xbe)"
     },
     {
-        "category": "RFI",
-        "pattern": "@lt 3"
+        "category": "XSS",
+        "pattern": "@rx +ADw-.*(?:+AD4-|>)|<.*+AD4-"
     },
     {
-        "category": "RFI",
-        "pattern": "@lt 3"
+        "category": "XSS",
+        "pattern": "@rx ![!+ ][]"
     },
     {
-        "category": "RFI",
-        "pattern": "@lt 4"
+        "category": "XSS",
+        "pattern": "@rx (?:self|document|this|top|window)s*(?:/*|[[)]).+?(?:]|*/)"
     },
     {
-        "category": "RFI",
-        "pattern": "@lt 4"
+        "category": "XSS",
+        "pattern": "@rx (?i)b(?:eval|set(?:timeout|interval)|new[sv]+Function|a(?:lert|tob)|btoa)[sv]*("
     },
     {
-        "category": "RCE",
-        "pattern": "@lt 1"
+        "category": "XSS",
+        "pattern": "@rx ((?:[[^]]*][^.]*.)|Reflect[^.]*.).*(?:map|sort|apply)[^.]*..*call[^`]*`.*`"
     },
     {
-        "category": "RCE",
-        "pattern": "@lt 1"
+        "category": "XSS",
+        "pattern": "@lt 2"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?i)(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:7[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:(?:b[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|[ckz][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[&,<>|]|(?:[--.0-9A-Z_a-z][\"'[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#*-0-9?-@_a-{]*)?x5c?)+[sv&,<>|]).*|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:4|[sv&),<>|].*))|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*)?|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|(?:e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)b"
+        "category": "XSS",
+        "pattern": "@lt 2"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?i)(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[sv&)<>|]|a(?:dd(?:group|user)|getty|l(?:ias|pine)[sv&)<>|]|nsible-playbook|pt(?:-get|itude[sv&)<>|])|r(?:ch[sv&)<>|]|ia2c)|s(?:cii(?:-xfr|85)|pell)|tobm|xel)|b(?:a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu)|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:a(?:ncel|psh)[sv&)<>|]|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|p(?:an|io|ulimit)|r(?:ash[sv&)<>|]|on(?:tab)?)|s(?:plit|vtool)|u(?:psfilter|rl[sv&)<>|]))|d(?:(?:a(?:sh|te)|i(?:alog|ff))[sv&)<>|]|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:2fsck|(?:asy_instal|va)l|cho[sv&)<>|]|fax|grep|macs|n(?:d(?:if|sw)|v-update)|sac|x(?:ec[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r)))|f(?:acter|(?:etch|lock|unction)[sv&)<>|]|grep|i(?:le(?:[sv&)<>|]|test)|(?:n(?:d|ger)|sh)[sv&)<>|])|o(?:ld[sv&)<>|]|reach)|ping|tp(?:stats|who))|g(?:awk[sv&)<>|]|core|e(?:ni(?:e[sv&)<>|]|soimage)|tfacl[sv&)<>|])|hci|i(?:mp[sv&)<>|]|nsh)|r(?:ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:conv|f(?:config|top)|nstall[sv&)<>|]|onice|p(?:6?tables|config)|spell)|j(?:ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:ill(?:[sv&)<>|]|all)|nife[sv&)<>|]|sshell)|l(?:a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|dconfig|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|(?:inks|ynx)[sv&)<>|]|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:il(?:[sv&)<>q|]|x[sv&)<>|])|ke[sv&)<>|]|ster.passwd|wk)|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|utt[sv&)<>|]|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:a(?:no[sv&)<>|]|sm|wk)|c(?:.(?:openbsd|traditional)|at)|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan))|(?:ice|ull)[sv&)<>|]|map|o(?:de[sv&)<>|]|hup)|ping|roff|s(?:enter|lookup|tat))|o(?:ctave[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:f(?:la)?tex|ksh)|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|(?:ft|gre)p|hp(?:-cgi|[57])|i(?:(?:co|ng)[sv&)<>|]|dstat|gz)|k(?:exec|g_?info|ill)|opd|rint(?:env|f[sv&)<>|])|s(?:ed|ftp|ql)|tar(?:diff|grep)?|u(?:ppet[sv&)<>|]|shd)|wd.db|ython[^sv])|r(?:ak(?:e[sv&)<>|]|u)|bash|e(?:a(?:delf|lpath)|(?:dcarpet|name|p(?:eat|lace))[sv&)<>|]|stic)|l(?:ogin|wrap)|m(?:dir[sv&)<>|]|user)|nano|oute[sv&)<>|]|pm(?:db|(?:quer|verif)y)|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:(?:ash|nap)[sv&)<>|]|c(?:hed|r(?:een|ipt)[sv&)<>|])|diff|e(?:(?:lf|rvice)[sv&)<>|]|ndmail|t(?:arch|env|facl[sv&)<>|]|sid))|ftp|h(?:.distrib|(?:adow|ells)[sv&)<>|]|u(?:f|tdown[sv&)<>|]))|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|sh(?:-key(?:ge|sca)n|pass)|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|udo|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|c(?:l?sh|p(?:dump|ing|traceroute))|elnet|ftp|ime(?:(?:out)?[sv&)<>|]|datectl)|mux|ouch[sv&)<>|]|r(?:aceroute6?|off)|shark)|u(?:limit[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:ew[sv&)<>|]|gr|mdiff|pw|rsh)|olatility[sv&)<>|])|w(?:a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:args|e(?:la)?tex|mo(?:dmap|re)|pad|term|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|s(?:oelim|td(?:(?:ca|m)t|grep|less)?)|ypper))"
+        "category": "XSS",
+        "pattern": "@detectXSS"
     },
     {
-        "category": "RCE",
-        "pattern": "@pmFromFile windows-powershell-commands.data"
+        "category": "XSS",
+        "pattern": "@rx (?i)[s\"'`;/0-9=x0Bx09x0Cx3Bx2Cx28x3B]on[a-zA-Z]{3,25}[sx0Bx09x0Cx3Bx2Cx28x3B]*?=[^=]"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?i)(?:[nr;`{]|||?|&&?)[sv]*[sv\"'-(,@]*(?:[\"'.-9A-Z_a-z]+/|(?:[\"'x5c^]*[0-9A-Z_a-z][\"'x5c^]*:.*|[ \"'.-9A-Zx5c^-_a-z]*)x5c)?[\"^]*(?:(?:a[\"^]*(?:c|s[\"^]*n[\"^]*p)|e[\"^]*(?:b[\"^]*p|p[\"^]*(?:a[\"^]*l|c[\"^]*s[\"^]*v|s[\"^]*n)|[tx][\"^]*s[\"^]*n)|f[\"^]*(?:[cltw]|o[\"^]*r[\"^]*e[\"^]*a[\"^]*c[\"^]*h)|i[\"^]*(?:[cr][\"^]*m|e[\"^]*x|h[\"^]*y|i|p[\"^]*(?:a[\"^]*l|c[\"^]*s[\"^]*v|m[\"^]*o|s[\"^]*n)|s[\"^]*e|w[\"^]*(?:m[\"^]*i|r))|m[\"^]*(?:a[\"^]*n|[dipv]|o[\"^]*u[\"^]*n[\"^]*t)|o[\"^]*g[\"^]*v|p[\"^]*(?:o[\"^]*p|u[\"^]*s[\"^]*h)[\"^]*d|t[\"^]*r[\"^]*c[\"^]*m|w[\"^]*j[\"^]*b)[\"^]*[sv,.-/;-<>].*|c[\"^]*(?:(?:(?:d|h[\"^]*d[\"^]*i[\"^]*r|v[\"^]*p[\"^]*a)[\"^]*|p[\"^]*(?:[ip][\"^]*)?)[sv,.-/;-<>].*|l[\"^]*(?:(?:[cipv]|h[\"^]*y)[\"^]*[sv,.-/;-<>].*|s)|n[\"^]*s[\"^]*n)|d[\"^]*(?:(?:b[\"^]*p|e[\"^]*l|i[\"^]*(?:f[\"^]*f|r))[\"^]*[sv,.-/;-<>].*|n[\"^]*s[\"^]*n)|g[\"^]*(?:(?:(?:(?:a[\"^]*)?l|b[\"^]*p|d[\"^]*r|h[\"^]*y|(?:w[\"^]*m[\"^]*)?i|j[\"^]*b|[u-v])[\"^]*|c[\"^]*(?:[ims][\"^]*)?|m[\"^]*(?:o[\"^]*)?|s[\"^]*(?:n[\"^]*(?:p[\"^]*)?|v[\"^]*))[sv,.-/;-<>].*|e[\"^]*r[\"^]*r|p[\"^]*(?:(?:s[\"^]*)?[sv,.-/;-<>].*|v))|l[\"^]*s|n[\"^]*(?:(?:a[\"^]*l|d[\"^]*r|[iv]|m[\"^]*o|s[\"^]*n)[\"^]*[sv,.-/;-<>].*|p[\"^]*s[\"^]*s[\"^]*c)|r[\"^]*(?:(?:(?:(?:b[\"^]*)?p|e[\"^]*n|(?:w[\"^]*m[\"^]*)?i|j[\"^]*b|n[\"^]*[ip])[\"^]*|d[\"^]*(?:r[\"^]*)?|m[\"^]*(?:(?:d[\"^]*i[\"^]*r|o)[\"^]*)?|s[\"^]*n[\"^]*(?:p[\"^]*)?|v[\"^]*(?:p[\"^]*a[\"^]*)?)[sv,.-/;-<>].*|c[\"^]*(?:j[\"^]*b[\"^]*[sv,.-/;-<>].*|s[\"^]*n)|u[\"^]*j[\"^]*b)|s[\"^]*(?:(?:(?:a[\"^]*(?:j[\"^]*b|l|p[\"^]*s|s[\"^]*v)|b[\"^]*p|[civ]|w[\"^]*m[\"^]*i)[\"^]*|l[\"^]*(?:s[\"^]*)?|p[\"^]*(?:(?:j[\"^]*b|p[\"^]*s|s[\"^]*v)[\"^]*)?)[sv,.-/;-<>].*|h[\"^]*c[\"^]*m|u[\"^]*j[\"^]*b))(?:.[\"^]*[0-9A-Z_a-z]+)?b"
+        "category": "XSS",
+        "pattern": "@rx (?i)b(?:s(?:tyle|rc)|href)b[sS]*?="
     },
     {
-        "category": "RCE",
-        "pattern": "@rx $(?:((?:.*|(.*)))|{.*})|[<>](.*)|/[0-9A-Z_a-z]*[!?.+]"
+        "category": "XSS",
+        "pattern": "@contains -->"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx b(?:for(?:/[dflr].*)? %+[^ ]+ in(.*)[sv]?do|if(?:/i)?(?: not)?(?: (?:e(?:xist|rrorlevel)|defined|cmdextversion)b|[ (].*(?:b(?:g(?:eq|tr)|equ|neq|l(?:eq|ss))b|==)))"
+        "category": "XSS",
+        "pattern": "@rx <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|hr|html|i|iframe|ilayer|img|input|ins|isindex|kdb|keygen|label|layer|legend|li|limittext|link|listing|map|marquee|menu|meta|multicol|nobr|noembed|noframes|noscript|nosmartquotes|object|ol|optgroup|option|p|param|plaintext|pre|q|rt|ruby|s|samp|script|select|server|shadow|sidebar|small|spacer|span|strike|strong|style|sub|sup|table|tbody|td|textarea|tfoot|th|thead|title|tr|tt|u|ul|var|wbr|xml|xmp)W"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?i)(?:^|=)[sv]*(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:7[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:b[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|[ckz][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|(?:h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)[sv&)<>|]"
+        "category": "XSS",
+        "pattern": "@rx (?i:[\"'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|x5cu006C)(?:o|x5cu006F)(?:c|x5cu0063)(?:a|x5cu0061)(?:t|x5cu0074)(?:i|x5cu0069)(?:o|x5cu006F)(?:n|x5cu006E)|(?:n|x5cu006E)(?:a|x5cu0061)(?:m|x5cu006D)(?:e|x5cu0065)|(?:o|x5cu006F)(?:n|x5cu006E)(?:e|x5cu0065)(?:r|x5cu0072)(?:r|x5cu0072)(?:o|x5cu006F)(?:r|x5cu0072)|(?:v|x5cu0076)(?:a|x5cu0061)(?:l|x5cu006C)(?:u|x5cu0075)(?:e|x5cu0065)(?:O|x5cu004F)(?:f|x5cu0066)).*?=)"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?i)(?:^|=)[sv]*(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:a(?:ddgroup|xel)|b(?:ase(?:32|64|nc)|lkid|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|yobu|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:h(?:g(?:passwd|rp)|pass|sh)|lang++|oproc|ron)|d(?:iff[sv&)<>|]|mesg|oas)|e(?:2fsck|grep)|f(?:grep|iletest|tp(?:stats|who))|g(?:r(?:ep[sv&)<>|]|oupmod)|unzip|z(?:cat|exe|ip))|htop|l(?:ast(?:comm|log(?:in)?)|ess(?:echo|(?:fil|pip)e)|ftp(?:get)?|osetup|s(?:-F|b_release|cpu|mod|of|pci|usb)|wp-download|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:ilq|ster.passwd)|k(?:fifo|nod|temp)|locate|ysql(?:admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:.(?:openbsd|traditional)|at)|et(?:(?:c|st)at|kit-ftp|plan)|ohup|ping|stat)|onintr|p(?:dksh|erl5?|(?:ft|gre)p|hp(?:-cgi|[57])|igz|k(?:exec|ill)|(?:op|se)d|rint(?:env|f[sv&)<>|])|tar(?:diff|grep)?|wd.db|ython[2-3])|r(?:(?:bas|ealpat)h|m(?:dir[sv&)<>|]|user)|nano|sync)|s(?:diff|e(?:ndmail|t(?:env|sid))|ftp|(?:h.distri|pwd.d)b|ocat|td(?:err|in|out)|udo|ysctl)|t(?:ailf|c(?:p(?:ing|traceroute)|sh)|elnet|imeout[sv&)<>|]|raceroute6?)|u(?:n(?:ame|lz(?:4|ma)|(?:pig|x)z|rar|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:gr|pw)|w(?:get|hoami)|x(?:args|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:c(?:at|mp)|diff|[e-f]?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|std(?:(?:ca|m)t|grep|less)?))"
+        "category": "XSS",
+        "pattern": "@rx (?i)[\"'][ ]*(?:[^a-z0-9~_:' ]|in).+?[.].+?="
     },
     {
-        "category": "RCE",
-        "pattern": "!@rx [0-9]s*'s*[0-9]"
+        "category": "XSS",
+        "pattern": "@rx {{.*?}}"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx !-d"
+        "category": "XSS",
+        "pattern": "@lt 3"
     },
     {
-        "category": "RCE",
-        "pattern": "@pmFromFile unix-shell.data"
+        "category": "XSS",
+        "pattern": "@lt 3"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx ^(s*)s+{"
+        "category": "XSS",
+        "pattern": "@lt 4"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx ^(s*)s+{"
+        "category": "XSS",
+        "pattern": "@lt 4"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx ba[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?sb[sv]+[!-\"%',0-9@-Z_a-z]+=[^sv]"
+        "category": "JAVA",
+        "pattern": "@lt 1"
     },
     {
-        "category": "RCE",
-        "pattern": "@pmFromFile restricted-upload.data"
+        "category": "JAVA",
+        "pattern": "@lt 1"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?i)(?:t[\"^]*i[\"^]*m[\"^]*e|[nr;`{]|||?|&&?)[sv]*[sv\"'-(,@]*(?:[\"'.-9A-Z_a-z]+/|(?:[\"'x5c^]*[0-9A-Z_a-z][\"'x5c^]*:.*|[ \"'.-9A-Zx5c^-_a-z]*)x5c)?[\"^]*(?:a[\"^]*(?:c[\"^]*c[\"^]*c[\"^]*h[\"^]*e[\"^]*c[\"^]*k[\"^]*c[\"^]*o[\"^]*n[\"^]*s[\"^]*o[\"^]*l[\"^]*e|d[\"^]*(?:p[\"^]*l[\"^]*u[\"^]*s|v[\"^]*p[\"^]*a[\"^]*c[\"^]*k)|(?:g[\"^]*e[\"^]*n[\"^]*t[\"^]*e[\"^]*x[\"^]*e[\"^]*c[\"^]*u[\"^]*t[\"^]*o|s[\"^]*p[\"^]*n[\"^]*e[\"^]*t[\"^]*_[\"^]*c[\"^]*o[\"^]*m[\"^]*p[\"^]*i[\"^]*l[\"^]*e)[\"^]*r|p[\"^]*p[\"^]*(?:i[\"^]*n[\"^]*s[\"^]*t[\"^]*a[\"^]*l[\"^]*l[\"^]*e[\"^]*r|v[\"^]*l[\"^]*p)|t[\"^]*(?:[sv,.-/;-<>].*|b[\"^]*r[\"^]*o[\"^]*k[\"^]*e[\"^]*r))|b[\"^]*(?:a[\"^]*s[\"^]*h|g[\"^]*i[\"^]*n[\"^]*f[\"^]*o|i[\"^]*t[\"^]*s[\"^]*a[\"^]*d[\"^]*m[\"^]*i[\"^]*n)|c[\"^]*(?:d[\"^]*b|e[\"^]*r[\"^]*t[\"^]*(?:o[\"^]*c|r[\"^]*e[\"^]*q|u[\"^]*t[\"^]*i[\"^]*l)|l[\"^]*_[\"^]*(?:i[\"^]*n[\"^]*v[\"^]*o[\"^]*c[\"^]*a[\"^]*t[\"^]*i[\"^]*o[\"^]*n|l[\"^]*o[\"^]*a[\"^]*d[\"^]*a[\"^]*s[\"^]*s[\"^]*e[\"^]*m[\"^]*b[\"^]*l[\"^]*y|m[\"^]*u[\"^]*t[\"^]*e[\"^]*x[\"^]*v[\"^]*e[\"^]*r[\"^]*i[\"^]*f[\"^]*i[\"^]*e[\"^]*r[\"^]*s)|m[\"^]*(?:d(?:[\"^]*(?:k[\"^]*e[\"^]*y|l[\"^]*3[\"^]*2))?|s[\"^]*t[\"^]*p)|o[\"^]*(?:m[\"^]*s[\"^]*v[\"^]*c[\"^]*s|n[\"^]*(?:f[\"^]*i[\"^]*g[\"^]*s[\"^]*e[\"^]*c[\"^]*u[\"^]*r[\"^]*i[\"^]*t[\"^]*y[\"^]*p[\"^]*o[\"^]*l[\"^]*i[\"^]*c[\"^]*y|h[\"^]*o[\"^]*s[\"^]*t|t[\"^]*r[\"^]*o[\"^]*l)|r[\"^]*e[\"^]*g[\"^]*e[\"^]*n)|r[\"^]*e[\"^]*a[\"^]*t[\"^]*e[\"^]*d[\"^]*u[\"^]*m[\"^]*p|s[\"^]*(?:c(?:[\"^]*r[\"^]*i[\"^]*p[\"^]*t)?|i)|u[\"^]*s[\"^]*t[\"^]*o[\"^]*m[\"^]*s[\"^]*h[\"^]*e[\"^]*l[\"^]*l[\"^]*h[\"^]*o[\"^]*s[\"^]*t)|d[\"^]*(?:a[\"^]*t[\"^]*a[\"^]*s[\"^]*v[\"^]*c[\"^]*u[\"^]*t[\"^]*i[\"^]*l|e[\"^]*(?:f[\"^]*a[\"^]*u[\"^]*l[\"^]*t[\"^]*p[\"^]*a[\"^]*c[\"^]*k|s[\"^]*k(?:[\"^]*t[\"^]*o[\"^]*p[\"^]*i[\"^]*m[\"^]*g[\"^]*d[\"^]*o[\"^]*w[\"^]*n[\"^]*l[\"^]*d[\"^]*r)?|v[\"^]*(?:i[\"^]*c[\"^]*e[\"^]*c[\"^]*r[\"^]*e[\"^]*d[\"^]*e[\"^]*n[\"^]*t[\"^]*i[\"^]*a[\"^]*l[\"^]*d[\"^]*e[\"^]*p[\"^]*l[\"^]*o[\"^]*y[\"^]*m[\"^]*e[\"^]*n[\"^]*t|t[\"^]*o[\"^]*o[\"^]*l[\"^]*s[\"^]*l[\"^]*a[\"^]*u[\"^]*n[\"^]*c[\"^]*h[\"^]*e[\"^]*r))|f[\"^]*s[\"^]*(?:h[\"^]*i[\"^]*m|v[\"^]*c)|i[\"^]*(?:a[\"^]*n[\"^]*t[\"^]*z|s[\"^]*k[\"^]*s[\"^]*h[\"^]*a[\"^]*d[\"^]*o[\"^]*w)|n[\"^]*(?:s[\"^]*c[\"^]*m[\"^]*d|x)|o[\"^]*t[\"^]*n[\"^]*e[\"^]*t|u[\"^]*m[\"^]*p[\"^]*6[\"^]*4|x[\"^]*c[\"^]*a[\"^]*p)|e[\"^]*(?:s[\"^]*e[\"^]*n[\"^]*t[\"^]*u[\"^]*t[\"^]*l|v[\"^]*e[\"^]*n[\"^]*t[\"^]*v[\"^]*w[\"^]*r|x[\"^]*(?:c[\"^]*e[\"^]*l|p[\"^]*(?:a[\"^]*n[\"^]*d|l[\"^]*o[\"^]*r[\"^]*e[\"^]*r)|t[\"^]*(?:e[\"^]*x[\"^]*p[\"^]*o[\"^]*r[\"^]*t|r[\"^]*a[\"^]*c[\"^]*3[\"^]*2)))|f[\"^]*(?:i[\"^]*n[\"^]*(?:d[\"^]*s[\"^]*t|g[\"^]*e)[\"^]*r|l[\"^]*t[\"^]*m[\"^]*c|o[\"^]*r[\"^]*f[\"^]*i[\"^]*l[\"^]*e[\"^]*s|s[\"^]*(?:i(?:[\"^]*a[\"^]*n[\"^]*y[\"^]*c[\"^]*p[\"^]*u)?|u[\"^]*t[\"^]*i[\"^]*l)|t[\"^]*p)|g[\"^]*(?:f[\"^]*x[\"^]*d[\"^]*o[\"^]*w[\"^]*n[\"^]*l[\"^]*o[\"^]*a[\"^]*d[\"^]*w[\"^]*r[\"^]*a[\"^]*p[\"^]*p[\"^]*e[\"^]*r|p[\"^]*s[\"^]*c[\"^]*r[\"^]*i[\"^]*p[\"^]*t)|h[\"^]*h|i[\"^]*(?:e[\"^]*(?:4[\"^]*u[\"^]*i[\"^]*n[\"^]*i[\"^]*t|a[\"^]*d[\"^]*v[\"^]*p[\"^]*a[\"^]*c[\"^]*k|e[\"^]*x[\"^]*e[\"^]*c|f[\"^]*r[\"^]*a[\"^]*m[\"^]*e)|l[\"^]*a[\"^]*s[\"^]*m|m[\"^]*e[\"^]*w[\"^]*d[\"^]*b[\"^]*l[\"^]*d|n[\"^]*(?:f[\"^]*d[\"^]*e[\"^]*f[\"^]*a[\"^]*u[\"^]*l[\"^]*t[\"^]*i[\"^]*n[\"^]*s[\"^]*t[\"^]*a[\"^]*l|s[\"^]*t[\"^]*a[\"^]*l[\"^]*l[\"^]*u[\"^]*t[\"^]*i)[\"^]*l)|j[\"^]*s[\"^]*c|l[\"^]*(?:a[\"^]*u[\"^]*n[\"^]*c[\"^]*h[\"^]*-[\"^]*v[\"^]*s[\"^]*d[\"^]*e[\"^]*v[\"^]*s[\"^]*h[\"^]*e[\"^]*l[\"^]*l|d[\"^]*i[\"^]*f[\"^]*d[\"^]*e)|m[\"^]*(?:a[\"^]*(?:k[\"^]*e[\"^]*c[\"^]*a[\"^]*b|n[\"^]*a[\"^]*g[\"^]*e[\"^]*-[\"^]*b[\"^]*d[\"^]*e|v[\"^]*i[\"^]*n[\"^]*j[\"^]*e[\"^]*c[\"^]*t)|f[\"^]*t[\"^]*r[\"^]*a[\"^]*c[\"^]*e|i[\"^]*c[\"^]*r[\"^]*o[\"^]*s[\"^]*o[\"^]*f[\"^]*t|m[\"^]*c|p[\"^]*c[\"^]*m[\"^]*d[\"^]*r[\"^]*u[\"^]*n|s[\"^]*(?:(?:b[\"^]*u[\"^]*i[\"^]*l|o[\"^]*h[\"^]*t[\"^]*m[\"^]*e)[\"^]*d|c[\"^]*o[\"^]*n[\"^]*f[\"^]*i[\"^]*g|d[\"^]*(?:e[\"^]*p[\"^]*l[\"^]*o[\"^]*y|t)|h[\"^]*t[\"^]*(?:a|m[\"^]*l)|i[\"^]*e[\"^]*x[\"^]*e[\"^]*c|p[\"^]*u[\"^]*b|x[\"^]*s[\"^]*l))|n[\"^]*(?:e[\"^]*t[\"^]*s[\"^]*h|t[\"^]*d[\"^]*s[\"^]*u[\"^]*t[\"^]*i[\"^]*l)|o[\"^]*(?:d[\"^]*b[\"^]*c[\"^]*c[\"^]*o[\"^]*n[\"^]*f|f[\"^]*f[\"^]*l[\"^]*i[\"^]*n[\"^]*e[\"^]*s[\"^]*c[\"^]*a[\"^]*n[\"^]*n[\"^]*e[\"^]*r[\"^]*s[\"^]*h[\"^]*e[\"^]*l[\"^]*l|n[\"^]*e[\"^]*d[\"^]*r[\"^]*i[\"^]*v[\"^]*e[\"^]*s[\"^]*t[\"^]*a[\"^]*n[\"^]*d[\"^]*a[\"^]*l[\"^]*o[\"^]*n[\"^]*e[\"^]*u[\"^]*p[\"^]*d[\"^]*a[\"^]*t[\"^]*e[\"^]*r|p[\"^]*e[\"^]*n[\"^]*c[\"^]*o[\"^]*n[\"^]*s[\"^]*o[\"^]*l[\"^]*e)|p[\"^]*(?:c[\"^]*(?:a[\"^]*l[\"^]*u[\"^]*a|w[\"^]*(?:r[\"^]*u[\"^]*n|u[\"^]*t[\"^]*l))|(?:e[\"^]*s[\"^]*t[\"^]*e|s)[\"^]*r|(?:k[\"^]*t[\"^]*m[\"^]*o|u[\"^]*b[\"^]*p[\"^]*r)[\"^]*n|n[\"^]*p[\"^]*u[\"^]*t[\"^]*i[\"^]*l|o[\"^]*w[\"^]*e[\"^]*r[\"^]*p[\"^]*n[\"^]*t|r[\"^]*(?:e[\"^]*s[\"^]*e[\"^]*n[\"^]*t[\"^]*a[\"^]*t[\"^]*i[\"^]*o[\"^]*n[\"^]*h[\"^]*o[\"^]*s[\"^]*t|i[\"^]*n[\"^]*t(?:[\"^]*b[\"^]*r[\"^]*m)?|o[\"^]*(?:c[\"^]*d[\"^]*u[\"^]*m[\"^]*p|t[\"^]*o[\"^]*c[\"^]*o[\"^]*l[\"^]*h[\"^]*a[\"^]*n[\"^]*d[\"^]*l[\"^]*e[\"^]*r)))|r[\"^]*(?:a[\"^]*s[\"^]*a[\"^]*u[\"^]*t[\"^]*o[\"^]*u|c[\"^]*s[\"^]*i|(?:d[\"^]*r[\"^]*l[\"^]*e[\"^]*a[\"^]*k[\"^]*d[\"^]*i[\"^]*a|p[\"^]*c[\"^]*p[\"^]*i[\"^]*n)[\"^]*g|e[\"^]*(?:g(?:[\"^]*(?:a[\"^]*s[\"^]*m|e[\"^]*d[\"^]*i[\"^]*t|i[\"^]*(?:n[\"^]*i|s[\"^]*t[\"^]*e[\"^]*r[\"^]*-[\"^]*c[\"^]*i[\"^]*m[\"^]*p[\"^]*r[\"^]*o[\"^]*v[\"^]*i[\"^]*d[\"^]*e[\"^]*r)|s[\"^]*v[\"^]*(?:c[\"^]*s|r[\"^]*3[\"^]*2)))?|(?:m[\"^]*o[\"^]*t|p[\"^]*l[\"^]*a[\"^]*c)[\"^]*e)|u[\"^]*n[\"^]*(?:d[\"^]*l[\"^]*l[\"^]*3[\"^]*2|(?:e[\"^]*x[\"^]*e|s[\"^]*c[\"^]*r[\"^]*i[\"^]*p[\"^]*t)[\"^]*h[\"^]*e[\"^]*l[\"^]*p[\"^]*e[\"^]*r|o[\"^]*n[\"^]*c[\"^]*e))|s[\"^]*(?:c[\"^]*(?:[sv,.-/;-<>].*|h[\"^]*t[\"^]*a[\"^]*s[\"^]*k[\"^]*s|r[\"^]*i[\"^]*p[\"^]*t[\"^]*r[\"^]*u[\"^]*n[\"^]*n[\"^]*e[\"^]*r)|e[\"^]*t[\"^]*(?:r[\"^]*e[\"^]*s|t[\"^]*i[\"^]*n[\"^]*g[\"^]*s[\"^]*y[\"^]*n[\"^]*c[\"^]*h[\"^]*o[\"^]*s[\"^]*t|u[\"^]*p[\"^]*a[\"^]*p[\"^]*i)|h[\"^]*(?:d[\"^]*o[\"^]*c[\"^]*v[\"^]*w|e[\"^]*l[\"^]*l[\"^]*3[\"^]*2)|q[\"^]*(?:l[\"^]*(?:d[\"^]*u[\"^]*m[\"^]*p[\"^]*e[\"^]*r|(?:t[\"^]*o[\"^]*o[\"^]*l[\"^]*s[\"^]*)?p[\"^]*s)|u[\"^]*i[\"^]*r[\"^]*r[\"^]*e[\"^]*l)|s[\"^]*h|t[\"^]*o[\"^]*r[\"^]*d[\"^]*i[\"^]*a[\"^]*g|y[\"^]*(?:n[\"^]*c[\"^]*a[\"^]*p[\"^]*p[\"^]*v[\"^]*p[\"^]*u[\"^]*b[\"^]*l[\"^]*i[\"^]*s[\"^]*h[\"^]*i[\"^]*n[\"^]*g[\"^]*s[\"^]*e[\"^]*r[\"^]*v[\"^]*e[\"^]*r|s[\"^]*s[\"^]*e[\"^]*t[\"^]*u[\"^]*p))|t[\"^]*(?:e[\"^]*[sv,.-/;-<>].*|r[\"^]*a[\"^]*c[\"^]*k[\"^]*e[\"^]*r|t[\"^]*(?:d[\"^]*i[\"^]*n[\"^]*j[\"^]*e[\"^]*c[\"^]*t|t[\"^]*r[\"^]*a[\"^]*c[\"^]*e[\"^]*r))|u[\"^]*(?:n[\"^]*r[\"^]*e[\"^]*g[\"^]*m[\"^]*p[\"^]*2|p[\"^]*d[\"^]*a[\"^]*t[\"^]*e|r[\"^]*l|t[\"^]*i[\"^]*l[\"^]*i[\"^]*t[\"^]*y[\"^]*f[\"^]*u[\"^]*n[\"^]*c[\"^]*t[\"^]*i[\"^]*o[\"^]*n[\"^]*s)|v[\"^]*(?:b[\"^]*c|e[\"^]*r[\"^]*c[\"^]*l[\"^]*s[\"^]*i[\"^]*d|i[\"^]*s[\"^]*u[\"^]*a[\"^]*l[\"^]*u[\"^]*i[\"^]*a[\"^]*v[\"^]*e[\"^]*r[\"^]*i[\"^]*f[\"^]*y[\"^]*n[\"^]*a[\"^]*t[\"^]*i[\"^]*v[\"^]*e|s[\"^]*(?:i[\"^]*i[\"^]*s[\"^]*e[\"^]*x[\"^]*e[\"^]*l[\"^]*a[\"^]*u[\"^]*n[\"^]*c[\"^]*h|j[\"^]*i[\"^]*t[\"^]*d[\"^]*e[\"^]*b[\"^]*u[\"^]*g[\"^]*g)[\"^]*e[\"^]*r)|w[\"^]*(?:a[\"^]*b|(?:f|m[\"^]*i)[\"^]*c|i[\"^]*n[\"^]*(?:g[\"^]*e[\"^]*t|r[\"^]*m|w[\"^]*o[\"^]*r[\"^]*d)|l[\"^]*r[\"^]*m[\"^]*d[\"^]*r|o[\"^]*r[\"^]*k[\"^]*f[\"^]*o[\"^]*l[\"^]*d[\"^]*e[\"^]*r[\"^]*s|s[\"^]*(?:(?:c[\"^]*r[\"^]*i[\"^]*p|r[\"^]*e[\"^]*s[\"^]*e)[\"^]*t|l)|t[\"^]*[sv,.-/;-<>].*|u[\"^]*a[\"^]*u[\"^]*c[\"^]*l[\"^]*t)|x[\"^]*w[\"^]*i[\"^]*z[\"^]*a[\"^]*r[\"^]*d|z[\"^]*i[\"^]*p[\"^]*f[\"^]*l[\"^]*d[\"^]*r)(?:.[\"^]*[0-9A-Z_a-z]+)?b"
+        "category": "JAVA",
+        "pattern": "@rx java.lang.(?:runtime|processbuilder)"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?i)(?:t[\"^]*i[\"^]*m[\"^]*e|[nr;`{]|||?|&&?)[sv]*[sv\"'-(,@]*(?:[\"'.-9A-Z_a-z]+/|(?:[\"'x5c^]*[0-9A-Z_a-z][\"'x5c^]*:.*|[ \"'.-9A-Zx5c^-_a-z]*)x5c)?[\"^]*(?:a[\"^]*(?:s[\"^]*s[\"^]*o[\"^]*c|t[\"^]*(?:m[\"^]*a[\"^]*d[\"^]*m|t[\"^]*r[\"^]*i[\"^]*b)|u[\"^]*(?:d[\"^]*i[\"^]*t[\"^]*p[\"^]*o[\"^]*l|t[\"^]*o[\"^]*(?:c[\"^]*(?:h[\"^]*k|o[\"^]*n[\"^]*v)|(?:f[\"^]*m|m[\"^]*o[\"^]*u[\"^]*n)[\"^]*t)))|b[\"^]*(?:c[\"^]*d[\"^]*(?:b[\"^]*o[\"^]*o|e[\"^]*d[\"^]*i)[\"^]*t|(?:d[\"^]*e[\"^]*h[\"^]*d|o[\"^]*o[\"^]*t)[\"^]*c[\"^]*f[\"^]*g|i[\"^]*t[\"^]*s[\"^]*a[\"^]*d[\"^]*m[\"^]*i[\"^]*n)|c[\"^]*(?:a[\"^]*c[\"^]*l[\"^]*s|e[\"^]*r[\"^]*t[\"^]*(?:r[\"^]*e[\"^]*q|u[\"^]*t[\"^]*i[\"^]*l)|h[\"^]*(?:c[\"^]*p|d[\"^]*i[\"^]*r|g[\"^]*(?:l[\"^]*o[\"^]*g[\"^]*o[\"^]*n|p[\"^]*o[\"^]*r[\"^]*t|u[\"^]*s[\"^]*r)|k[\"^]*(?:d[\"^]*s[\"^]*k|n[\"^]*t[\"^]*f[\"^]*s))|l[\"^]*e[\"^]*a[\"^]*n[\"^]*m[\"^]*g[\"^]*r|m[\"^]*(?:d(?:[\"^]*k[\"^]*e[\"^]*y)?|s[\"^]*t[\"^]*p)|s[\"^]*c[\"^]*r[\"^]*i[\"^]*p[\"^]*t)|d[\"^]*(?:c[\"^]*(?:d[\"^]*i[\"^]*a[\"^]*g|g[\"^]*p[\"^]*o[\"^]*f[\"^]*i[\"^]*x)|e[\"^]*(?:f[\"^]*r[\"^]*a[\"^]*g|l)|f[\"^]*s[\"^]*(?:d[\"^]*i[\"^]*a|r[\"^]*m[\"^]*i)[\"^]*g|i[\"^]*(?:a[\"^]*n[\"^]*t[\"^]*z|r|s[\"^]*(?:k[\"^]*(?:c[\"^]*o[\"^]*(?:m[\"^]*p|p[\"^]*y)|p[\"^]*(?:a[\"^]*r[\"^]*t|e[\"^]*r[\"^]*f)|r[\"^]*a[\"^]*i[\"^]*d|s[\"^]*h[\"^]*a[\"^]*d[\"^]*o[\"^]*w)|p[\"^]*d[\"^]*i[\"^]*a[\"^]*g))|n[\"^]*s[\"^]*c[\"^]*m[\"^]*d|(?:o[\"^]*s[\"^]*k[\"^]*e|r[\"^]*i[\"^]*v[\"^]*e[\"^]*r[\"^]*q[\"^]*u[\"^]*e[\"^]*r)[\"^]*y)|e[\"^]*(?:n[\"^]*d[\"^]*l[\"^]*o[\"^]*c[\"^]*a[\"^]*l|v[\"^]*e[\"^]*n[\"^]*t[\"^]*c[\"^]*r[\"^]*e[\"^]*a[\"^]*t[\"^]*e)|E[\"^]*v[\"^]*n[\"^]*t[\"^]*c[\"^]*m[\"^]*d|f[\"^]*(?:c|i[\"^]*(?:l[\"^]*e[\"^]*s[\"^]*y[\"^]*s[\"^]*t[\"^]*e[\"^]*m[\"^]*s|n[\"^]*d[\"^]*s[\"^]*t[\"^]*r)|l[\"^]*a[\"^]*t[\"^]*t[\"^]*e[\"^]*m[\"^]*p|o[\"^]*r(?:[\"^]*f[\"^]*i[\"^]*l[\"^]*e[\"^]*s)?|r[\"^]*e[\"^]*e[\"^]*d[\"^]*i[\"^]*s[\"^]*k|s[\"^]*u[\"^]*t[\"^]*i[\"^]*l|(?:t[\"^]*y[\"^]*p|v[\"^]*e[\"^]*u[\"^]*p[\"^]*d[\"^]*a[\"^]*t)[\"^]*e)|g[\"^]*(?:e[\"^]*t[\"^]*(?:m[\"^]*a[\"^]*c|t[\"^]*y[\"^]*p[\"^]*e)|o[\"^]*t[\"^]*o|p[\"^]*(?:f[\"^]*i[\"^]*x[\"^]*u[\"^]*p|(?:r[\"^]*e[\"^]*s[\"^]*u[\"^]*l[\"^]*)?t|u[\"^]*p[\"^]*d[\"^]*a[\"^]*t[\"^]*e)|r[\"^]*a[\"^]*f[\"^]*t[\"^]*a[\"^]*b[\"^]*l)|h[\"^]*(?:e[\"^]*l[\"^]*p[\"^]*c[\"^]*t[\"^]*r|o[\"^]*s[\"^]*t[\"^]*n[\"^]*a[\"^]*m[\"^]*e)|i[\"^]*(?:c[\"^]*a[\"^]*c[\"^]*l[\"^]*s|f|p[\"^]*(?:c[\"^]*o[\"^]*n[\"^]*f[\"^]*i[\"^]*g|x[\"^]*r[\"^]*o[\"^]*u[\"^]*t[\"^]*e)|r[\"^]*f[\"^]*t[\"^]*p)|j[\"^]*e[\"^]*t[\"^]*p[\"^]*a[\"^]*c[\"^]*k|k[\"^]*(?:l[\"^]*i[\"^]*s[\"^]*t|s[\"^]*e[\"^]*t[\"^]*u[\"^]*p|t[\"^]*(?:m[\"^]*u[\"^]*t[\"^]*i[\"^]*l|p[\"^]*a[\"^]*s[\"^]*s))|l[\"^]*(?:o[\"^]*(?:d[\"^]*c[\"^]*t[\"^]*r|g[\"^]*(?:m[\"^]*a[\"^]*n|o[\"^]*f[\"^]*f))|p[\"^]*[q-r])|m[\"^]*(?:a[\"^]*(?:c[\"^]*f[\"^]*i[\"^]*l[\"^]*e|k[\"^]*e[\"^]*c[\"^]*a[\"^]*b|p[\"^]*a[\"^]*d[\"^]*m[\"^]*i[\"^]*n)|k[\"^]*(?:d[\"^]*i[\"^]*r|l[\"^]*i[\"^]*n[\"^]*k)|m[\"^]*c|o[\"^]*u[\"^]*n[\"^]*t[\"^]*v[\"^]*o[\"^]*l|q[\"^]*(?:b[\"^]*k[\"^]*u[\"^]*p|(?:t[\"^]*g[\"^]*)?s[\"^]*v[\"^]*c)|s[\"^]*(?:d[\"^]*t|i[\"^]*(?:e[\"^]*x[\"^]*e[\"^]*c|n[\"^]*f[\"^]*o[\"^]*3[\"^]*2)|t[\"^]*s[\"^]*c))|n[\"^]*(?:b[\"^]*t[\"^]*s[\"^]*t[\"^]*a[\"^]*t|e[\"^]*t[\"^]*(?:c[\"^]*f[\"^]*g|d[\"^]*o[\"^]*m|s[\"^]*(?:h|t[\"^]*a[\"^]*t))|f[\"^]*s[\"^]*(?:a[\"^]*d[\"^]*m[\"^]*i[\"^]*n|s[\"^]*(?:h[\"^]*a[\"^]*r[\"^]*e|t[\"^]*a[\"^]*t))|l[\"^]*(?:b[\"^]*m[\"^]*g[\"^]*r|t[\"^]*e[\"^]*s[\"^]*t)|s[\"^]*l[\"^]*o[\"^]*o[\"^]*k[\"^]*u[\"^]*p|t[\"^]*(?:b[\"^]*a[\"^]*c[\"^]*k[\"^]*u[\"^]*p|c[\"^]*m[\"^]*d[\"^]*p[\"^]*r[\"^]*o[\"^]*m[\"^]*p[\"^]*t|f[\"^]*r[\"^]*s[\"^]*u[\"^]*t[\"^]*l))|o[\"^]*(?:f[\"^]*f[\"^]*l[\"^]*i[\"^]*n[\"^]*e|p[\"^]*e[\"^]*n[\"^]*f[\"^]*i[\"^]*l[\"^]*e[\"^]*s)|p[\"^]*(?:a[\"^]*(?:g[\"^]*e[\"^]*f[\"^]*i[\"^]*l[\"^]*e[\"^]*c[\"^]*o[\"^]*n[\"^]*f[\"^]*i|t[\"^]*h[\"^]*p[\"^]*i[\"^]*n)[\"^]*g|(?:b[\"^]*a[\"^]*d[\"^]*m[\"^]*i|k[\"^]*t[\"^]*m[\"^]*o)[\"^]*n|e[\"^]*(?:n[\"^]*t[\"^]*n[\"^]*t|r[\"^]*f[\"^]*m[\"^]*o[\"^]*n)|n[\"^]*p[\"^]*u[\"^]*(?:n[\"^]*a[\"^]*t[\"^]*t[\"^]*e[\"^]*n[\"^]*d|t[\"^]*i[\"^]*l)|o[\"^]*(?:p[\"^]*d|w[\"^]*e[\"^]*r[\"^]*s[\"^]*h[\"^]*e[\"^]*l[\"^]*l)|r[\"^]*n[\"^]*(?:c[\"^]*n[\"^]*f[\"^]*g|(?:d[\"^]*r[\"^]*v|m[\"^]*n[\"^]*g)[\"^]*r|j[\"^]*o[\"^]*b[\"^]*s|p[\"^]*o[\"^]*r[\"^]*t|q[\"^]*c[\"^]*t[\"^]*l)|u[\"^]*(?:b[\"^]*p[\"^]*r[\"^]*n|s[\"^]*h[\"^]*(?:d|p[\"^]*r[\"^]*i[\"^]*n[\"^]*t[\"^]*e[\"^]*r[\"^]*c[\"^]*o[\"^]*n[\"^]*n[\"^]*e[\"^]*c[\"^]*t[\"^]*i[\"^]*o[\"^]*n[\"^]*s))|w[\"^]*(?:l[\"^]*a[\"^]*u[\"^]*n[\"^]*c[\"^]*h[\"^]*e[\"^]*r|s[\"^]*h))|q[\"^]*(?:a[\"^]*p[\"^]*p[\"^]*s[\"^]*r[\"^]*v|p[\"^]*r[\"^]*o[\"^]*c[\"^]*e[\"^]*s[\"^]*s|u[\"^]*s[\"^]*e[\"^]*r|w[\"^]*i[\"^]*n[\"^]*s[\"^]*t[\"^]*a)|r[\"^]*(?:d(?:[\"^]*p[\"^]*s[\"^]*i[\"^]*g[\"^]*n)?|e[\"^]*(?:f[\"^]*s[\"^]*u[\"^]*t[\"^]*i[\"^]*l|g(?:[\"^]*(?:i[\"^]*n[\"^]*i|s[\"^]*v[\"^]*r[\"^]*3[\"^]*2))?|l[\"^]*o[\"^]*g|(?:(?:p[\"^]*a[\"^]*d[\"^]*m[\"^]*i|s[\"^]*c[\"^]*a)[\"^]*)?n|x[\"^]*e[\"^]*c)|i[\"^]*s[\"^]*e[\"^]*t[\"^]*u[\"^]*p|m[\"^]*d[\"^]*i[\"^]*r|o[\"^]*b[\"^]*o[\"^]*c[\"^]*o[\"^]*p[\"^]*y|p[\"^]*c[\"^]*(?:i[\"^]*n[\"^]*f[\"^]*o|p[\"^]*i[\"^]*n[\"^]*g)|s[\"^]*h|u[\"^]*n[\"^]*d[\"^]*l[\"^]*l[\"^]*3[\"^]*2|w[\"^]*i[\"^]*n[\"^]*s[\"^]*t[\"^]*a)|s[\"^]*(?:a[\"^]*n|c[\"^]*(?:h[\"^]*t[\"^]*a[\"^]*s[\"^]*k[\"^]*s|w[\"^]*c[\"^]*m[\"^]*d)|e[\"^]*(?:c[\"^]*e[\"^]*d[\"^]*i[\"^]*t|r[\"^]*v[\"^]*e[\"^]*r[\"^]*(?:(?:c[\"^]*e[\"^]*i[\"^]*p|w[\"^]*e[\"^]*r)[\"^]*o[\"^]*p[\"^]*t[\"^]*i[\"^]*n|m[\"^]*a[\"^]*n[\"^]*a[\"^]*g[\"^]*e[\"^]*r[\"^]*c[\"^]*m[\"^]*d)|t[\"^]*x)|f[\"^]*c|(?:h[\"^]*o[\"^]*w[\"^]*m[\"^]*o[\"^]*u[\"^]*n|u[\"^]*b[\"^]*s)[\"^]*t|x[\"^]*s[\"^]*t[\"^]*r[\"^]*a[\"^]*c[\"^]*e|y[\"^]*s[\"^]*(?:o[\"^]*c[\"^]*m[\"^]*g[\"^]*r|t[\"^]*e[\"^]*m[\"^]*i[\"^]*n[\"^]*f[\"^]*o))|t[\"^]*(?:a[\"^]*(?:k[\"^]*e[\"^]*o[\"^]*w[\"^]*n|p[\"^]*i[\"^]*c[\"^]*f[\"^]*g|s[\"^]*k[\"^]*(?:k[\"^]*i[\"^]*l[\"^]*l|l[\"^]*i[\"^]*s[\"^]*t))|(?:c[\"^]*m[\"^]*s[\"^]*e[\"^]*t[\"^]*u|f[\"^]*t)[\"^]*p|(?:(?:e[\"^]*l[\"^]*n[\"^]*e|i[\"^]*m[\"^]*e[\"^]*o[\"^]*u)[\"^]*|r[\"^]*a[\"^]*c[\"^]*e[\"^]*r[\"^]*(?:p[\"^]*)?)t|l[\"^]*n[\"^]*t[\"^]*a[\"^]*d[\"^]*m[\"^]*n|p[\"^]*m[\"^]*(?:t[\"^]*o[\"^]*o[\"^]*l|v[\"^]*s[\"^]*c[\"^]*m[\"^]*g[\"^]*r)|s[\"^]*(?:(?:d[\"^]*i[\"^]*s[\"^]*)?c[\"^]*o[\"^]*n|e[\"^]*c[\"^]*i[\"^]*m[\"^]*p|k[\"^]*i[\"^]*l[\"^]*l|p[\"^]*r[\"^]*o[\"^]*f)|y[\"^]*p[\"^]*e[\"^]*p[\"^]*e[\"^]*r[\"^]*f|z[\"^]*u[\"^]*t[\"^]*i[\"^]*l)|u[\"^]*n[\"^]*(?:e[\"^]*x[\"^]*p[\"^]*o[\"^]*s[\"^]*e|i[\"^]*q[\"^]*u[\"^]*e[\"^]*i[\"^]*d|l[\"^]*o[\"^]*d[\"^]*c[\"^]*t[\"^]*r)|v[\"^]*(?:o[\"^]*l|s[\"^]*s[\"^]*a[\"^]*d[\"^]*m[\"^]*i[\"^]*n)|w[\"^]*(?:a[\"^]*i[\"^]*t[\"^]*f[\"^]*o[\"^]*r|b[\"^]*a[\"^]*d[\"^]*m[\"^]*i[\"^]*n|(?:d[\"^]*s|e[\"^]*(?:c|v[\"^]*t))[\"^]*u[\"^]*t[\"^]*i[\"^]*l|h[\"^]*(?:e[\"^]*r[\"^]*e|o[\"^]*a[\"^]*m[\"^]*i)|i[\"^]*n[\"^]*(?:n[\"^]*t(?:[\"^]*3[\"^]*2)?|r[\"^]*s)|m[\"^]*i[\"^]*c|s[\"^]*c[\"^]*r[\"^]*i[\"^]*p[\"^]*t)|x[\"^]*c[\"^]*o[\"^]*p[\"^]*y)(?:.[\"^]*[0-9A-Z_a-z]+)?b"
+        "category": "JAVA",
+        "pattern": "@rx (?:runtime|processbuilder)"
     },
     {
-        "category": "RCE",
-        "pattern": "@lt 2"
+        "category": "JAVA",
+        "pattern": "@rx (?:unmarshaller|base64data|java.)"
     },
     {
-        "category": "RCE",
-        "pattern": "@lt 2"
+        "category": "JAVA",
+        "pattern": "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*.[sv].*b"
+        "category": "JAVA",
+        "pattern": "@rx (?:runtime|processbuilder)"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?:$(?:((?:(.*)|.*))|{.*})|[<>](.*)|[!?.+])"
+        "category": "JAVA",
+        "pattern": "@pmFromFile java-classes.data"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx ['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx /"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx s"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx ^[^.]+.[^;?]+[;?](.*(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]))"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx /"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx s"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx ^[^.]*?(?:['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{])"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx /"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx s"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx (?i).|(?:[sv]*|t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:7[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|G[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?E[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?T|a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:b|(?:p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?t|r(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[jp])?|s(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ks])|b[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[8-9][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?9|[au][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|c|(?:m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?p|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dfu]|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[gr])|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[bdx]|n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|q[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|s(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?)|f[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[c-dgi]|m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|g[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[chr][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|o|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dp]|r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b)|j[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:j[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|q)|k[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|l[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)?|[nps]|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a|z(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|v)|n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[cl]|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|(?:p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|o[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[at][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?x|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|f|(?:k[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?g|h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cp]|r(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?y)?|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|c(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dv]|(?:p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dt]|[g-hu]|s(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cr]|b[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l|[co][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ex]|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c)|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|l)|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:3[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|c)|x[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:x[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|z)|y[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)|z[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h))"
+        "category": "JAVA",
+        "pattern": "@rx .*.(?:jsp|jspx).*$"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?i)[-0-9_a-z]+(?:[\"'[-]]+|$+[!#*-0-9?-@x5c_a-{]+|``|[$<>]())[sv]*[-0-9_a-z]+"
+        "category": "JAVA",
+        "pattern": "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)"
     },
     {
-        "category": "RCE",
-        "pattern": "!@rx [0-9]s*'s*[0-9]"
+        "category": "JAVA",
+        "pattern": "@lt 2"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx ;[sv]*.[sv]*[\"']?(?:a(?:rchive|uth)|b(?:a(?:ckup|il)|inary)|c(?:d|h(?:anges|eck)|lone|onnection)|d(?:atabases|b(?:config|info)|ump)|e(?:cho|qp|x(?:cel|it|p(?:ert|lain)))|f(?:ilectrl|ullschema)|he(?:aders|lp)|i(?:mpo(?:rt|ster)|ndexes|otrace)|l(?:i(?:mi|n)t|o(?:ad|g))|(?:mod|n(?:onc|ullvalu)|unmodul)e|o(?:nce|pen|utput)|p(?:arameter|r(?:int|o(?:gress|mpt)))|quit|re(?:ad|cover|store)|s(?:ave|c(?:anstats|hema)|e(?:lftest|parator|ssion)|h(?:a3sum|ell|ow)?|tats|ystem)|t(?:ables|estc(?:ase|trl)|ime(?:out|r)|race)|vfs(?:info|list|name)|width)"
+        "category": "JAVA",
+        "pattern": "@lt 2"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx rn(?s:.)*?b(?:(?i:E)(?:HLO [--.A-Za-zx17fx212a]{1,255}|XPN .{1,64})|HELO [--.A-Za-zx17fx212a]{1,255}|MAIL FROM:<.{1,64}(?i:@).{1,255}(?i:>)|(?i:R)(?:CPT TO:(?:(?i:<).{1,64}(?i:@).{1,255}(?i:>)|(?i: ))?(?i:<).{1,64}(?i:>)|SETb)|VRFY .{1,64}(?: <.{1,64}(?i:@).{1,255}(?i:>)|(?i:@).{1,255})|AUTH [-0-9A-Z_a-zx17fx212a]{1,20}(?i: )(?:(?:[+/-9A-Z_a-zx17fx212a]{4})*(?:[+/-9A-Z_a-zx17fx212a]{2}(?i:=)|[+/-9A-Z_a-zx17fx212a]{3}))?(?i:=)|STARTTLSb|NOOPb(?:(?i: ).{1,255})?)"
+        "category": "JAVA",
+        "pattern": "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:A(?:PPEND (?:[\"-#%-&*--9A-Zx5c_a-z]+)?(?: ([ x5ca-z]+))?(?: \"?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [+-][0-9]{4}\"?)? {[0-9]{1,20}+?}|UTHENTICATE [-0-9_a-z]{1,20}rn)|L(?:SUB (?:[\"-#*.-9A-Z_a-z~]+)? (?:[\"%-&*.-9A-Zx5c_a-z]+)?|ISTRIGHTS (?:[\"%-&*--9A-Zx5c_a-z]+)?)|S(?:TATUS (?:[\"%-&*--9A-Zx5c_a-z]+)? ((?:U(?:NSEEN|IDNEXT)|MESSAGES|UIDVALIDITY|RECENT| )+)|ETACL (?:[\"%-&*--9A-Zx5c_a-z]+)? [+-][ac-eik-lpr-tw-x]+?)|UID (?:COPY|FETCH|STORE) (?:[*,0-:]+)?|(?:(?:DELETE|GET)ACL|MYRIGHTS) (?:[\"%-&*--9A-Zx5c_a-z]+)?)"
+        "category": "JAVA",
+        "pattern": "@rx xacxedx00x05"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?is)rn.*?b(?:(?:LIST|TOP [0-9]+)(?: [0-9]+)?|U(?:SER .+?|IDL(?: [0-9]+)?)|PASS .+?|(?:RETR|DELE) [0-9]+?|A(?:POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [-0-9A-Z_]{1,20} (?:(?:[+/-9A-Z_a-z]{4})*(?:[+/-9A-Z_a-z]{2}=|[+/-9A-Z_a-z]{3}))?=))"
+        "category": "JAVA",
+        "pattern": "@rx (?:rO0ABQ|KztAAU|Cs7QAF)"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?i)(?:(?:^|=)[sv]*(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*|(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*)[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|an|io|ulimit)|s(?:h|plit|vtool)|u(?:(?:t|rl)[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|inks|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[^sv])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash|nap)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:3m|c|a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))"
+        "category": "JAVA",
+        "pattern": "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?i)(?:(?:^|=)[sv]*(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*|(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*)[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:c|a(?:ll|tch)[sv&)<>|]|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))"
+        "category": "JAVA",
+        "pattern": "@rx javab.+(?:runtime|processbuilder)"
     },
     {
-        "category": "RCE",
-        "pattern": "@pmFromFile unix-shell.data"
+        "category": "JAVA",
+        "pattern": "@rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)"
     },
     {
-        "category": "RCE",
+        "category": "JAVA",
         "pattern": "@lt 3"
     },
     {
-        "category": "RCE",
+        "category": "JAVA",
         "pattern": "@lt 3"
     },
     {
-        "category": "RCE",
-        "pattern": "@rx (?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:(?:(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))b"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx (?i)b(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:(?:itude)?[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|n?f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|s(?:[sv&)<>|]|ed|ftp|ql)?|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:ew)?[sv&)<>|]|m(?:[sv&)<>|]|diff)|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:[sv&)<>c|]|h(?:o(?:[sv&)<>|]|ami|is)?|iptail[sv&)<>|])|a(?:ll|tch)[sv&)<>|]|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))b"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx (?i)(?:(?:^|=)[sv]*(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*|(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*)[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:(?:(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx /(?:[?*]+[a-z/]+|[a-z/]+[?*]+)"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx rn(?s:.)*?b(?:DATA|QUIT|HELP(?: .{1,255})?)"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:C(?:(?:REATE|OPY [*,0-:]+) [\"-#%-&*--9A-Zx5c_a-z]+|APABILITY|HECK|LOSE)|DELETE [\"-#%-&*--.0-9A-Zx5c_a-z]+|EX(?:AMINE [\"-#%-&*--.0-9A-Zx5c_a-z]+|PUNGE)|FETCH [*,0-:]+|L(?:IST [\"-#*--9A-Zx5c_a-z~]+? [\"-#%-&*--9A-Zx5c_a-z]+|OG(?:IN [--.0-9@_a-z]{1,40} .*?|OUT))|RENAME [\"-#%-&*--9A-Zx5c_a-z]+? [\"-#%-&*--9A-Zx5c_a-z]+|S(?:E(?:LECT [\"-#%-&*--9A-Zx5c_a-z]+|ARCH(?: CHARSET [--.0-9A-Z_a-z]{1,40})? (?:(KEYWORD x5c)?(?:A(?:LL|NSWERED)|BCC|D(?:ELETED|RAFT)|(?:FLAGGE|OL)D|RECENT|SEEN|UN(?:(?:ANSWER|FLAGG)ED|D(?:ELETED|RAFT)|SEEN)|NEW)|(?:BODY|CC|FROM|HEADER .{1,100}|NOT|OR .{1,255}|T(?:EXT|O)) .{1,255}|LARGER [0-9]{1,20}|[*,0-:]+|(?:BEFORE|ON|S(?:ENT(?:(?:BEFOR|SINC)E|ON)|INCE)) \"?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4}\"?|S(?:MALLER [0-9]{1,20}|UBJECT .{1,255})|U(?:ID [*,0-:]+?|NKEYWORD x5c(Seen|(?:Answer|Flagg)ed|D(?:eleted|raft)|Recent))))|T(?:ORE [*,0-:]+? [+-]?FLAGS(?:.SILENT)? (?:(x5c[a-z]{1,20}))?|ARTTLS)|UBSCRIBE [\"-#%-&*--9A-Zx5c_a-z]+)|UN(?:SUBSCRIBE [\"-#%-&*--9A-Zx5c_a-z]+|AUTHENTICATE)|NOOP)"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx rn(?s:.)*?b(?:(?:QUI|STA|RSE)(?i:T)|NOOP|CAPA)"
-    },
-    {
-        "category": "RCE",
-        "pattern": "@rx !(?:d|!)"
+        "category": "JAVA",
+        "pattern": "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)"
     },
     {
-        "category": "RCE",
+        "category": "JAVA",
         "pattern": "@lt 4"
     },
     {
-        "category": "RCE",
+        "category": "JAVA",
         "pattern": "@lt 4"
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 1"
+        "category": "JAVA",
+        "pattern": "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)"
     },
     {
-        "category": "PHP",
+        "category": "SQLI",
         "pattern": "@lt 1"
     },
     {
-        "category": "PHP",
-        "pattern": "@rx (?:<?(?:[^x]|x[^m]|xm[^l]|xml[^s]|xml$|$)|<?php|[(?:/|x5c)?php])"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@rx .*.ph(?:pd*|tml|ar|ps|t|pt).*$"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@pmFromFile php-config-directives.data"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@pm ="
-    },
-    {
-        "category": "PHP",
-        "pattern": "@pmFromFile php-variables.data"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@rx (?:bzip2|expect|glob|ogg|(?:ph|r)ar|ssh2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?|z(?:ip|lib))://"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@pmFromFile php-function-names-933150.data"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@rx (?i)b(?[\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:*.**/|/.*)|#.*[sv]|\")*[\"']*)?[sv]*(.*)"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@rx [oOcC]:d+:\".+?\":d+:{.*}"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@rx $+(?:[a-zA-Z_x7f-xff][a-zA-Z0-9_x7f-xff]*|s*{.+})(?:s|[.+]|{.+}|/*.**/|//.*|#.*)*(.*)"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@rx (?:((?:.+)(?:[\"'][-0-9A-Z_a-z]+[\"'])?(.+|[^)]*string[^)]*)[sv\"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|[\"'][-0-9A-Zx5c_a-z]+[\"'])(.+));"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@lt 2"
-    },
-    {
-        "category": "PHP",
-        "pattern": "@lt 2"
+        "category": "SQLI",
+        "pattern": "@lt 1"
     },
     {
-        "category": "PHP",
-        "pattern": "@pmFromFile php-function-names-933151.data"
+        "category": "SQLI",
+        "pattern": "@detectSQLi"
     },
     {
-        "category": "PHP",
-        "pattern": "@pm ("
+        "category": "SQLI",
+        "pattern": "@rx (?i)b(?:d(?:atabas|b_nam)e[^0-9A-Z_a-z]*(|(?:information_schema|m(?:aster..sysdatabases|s(?:db|ys(?:ac(?:cess(?:objects|storage|xml)|es)|modules2?|(?:object|querie|relationship)s))|ysql.db)|northwind|pg_(?:catalog|toast)|tempdb)b|s(?:chema(?:_nameb|[^0-9A-Z_a-z]*()|(?:qlite_(?:temp_)?master|ys(?:aux|.database_name))b))"
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 3"
+        "category": "SQLI",
+        "pattern": "@rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*("
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 3"
+        "category": "SQLI",
+        "pattern": "@rx (?i:sleep(s*?d*?s*?)|benchmark(.*?,.*?))"
     },
     {
-        "category": "PHP",
-        "pattern": "@rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI"
+        "category": "SQLI",
+        "pattern": "@rx (?i)(?:select|;)[sv]+(?:benchmark|if|sleep)[sv]*?([sv]*?(?[sv]*?[0-9A-Z_a-z]+"
     },
     {
-        "category": "PHP",
-        "pattern": "@rx (?i)b(?:a(?:bs|s(?:in|sert(?:_options)?))|basename|c(?:h(?:eckdate|r(?:oot)?)|o(?:(?:mpac|(?:nsta|u)n)t|py|sh?)|r(?:eate_function|ypt)|urrent)|d(?:ate|e(?:coct|fined?)|ir)|e(?:nd|val|x(?:ec|p(?:lode)?|tract))|f(?:ile(?:(?:[acm]tim|inod|siz|typ)e|group|owner|perms)?|l(?:o(?:ck|or)|ush))|glob|h(?:ash|eader)|i(?:date|m(?:age(?:gif|(?:jpe|pn)g|wbmp|xbm)|plode)|s_a)|key|l(?:ink|og)|m(?:a(?:il|x)|d5|in)|n(?:ame|ext)|o(?:pendir|rd)|p(?:a(?:ck|ss(?:thru)?)|i|o(?:pen|w)|rev)|r(?:an(?:d|ge)|e(?:(?:adfil|nam)e|set)|ound)|s(?:(?:erializ|huffl)e|in|leep|(?:or|ta)t|ubstr|y(?:mlink|s(?:log|tem)))|t(?:an|(?:im|mpfil)e|ouch|rim)|u(?:cfirst|n(?:lin|pac)k)|virtual)(?:[sv]|/*.**/|(?:#|//).*)*(.*)"
+        "category": "SQLI",
+        "pattern": "@rx (?i)[\"'`](?:[sv]*![sv]*[\"'0-9A-Z_-z]|;?[sv]*(?:having|select|unionb[sv]*(?:all|(?:distin|sele)ct))b[sv]*[^sv])|b(?:(?:(?:c(?:onnection_id|urrent_user)|database|schema|user)[sv]*?|select.*?[0-9A-Z_a-z]?user)(|exec(?:ute)?[sv]+master.|from[^0-9A-Z_a-z]+information_schema[^0-9A-Z_a-z]|into[sv+]+(?:dump|out)file[sv]*?[\"'`]|union(?:[sv]select[sv]@|[sv(0-9A-Z_a-z]*?select))|[sv]*?exec(?:ute)?.*?[^0-9A-Z_a-z]xp_cmdshell|[^0-9A-Z_a-z]iif[sv]*?("
     },
     {
-        "category": "PHP",
-        "pattern": "@rx .*.(?:phpd*|phtml)..*$"
+        "category": "SQLI",
+        "pattern": "@rx ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$"
     },
     {
-        "category": "PHP",
-        "pattern": "@pm ?>"
+        "category": "SQLI",
+        "pattern": "@rx (?i)[sv(-)]case[sv]+when.*?then|)[sv]*?like[sv]*?(|select.*?having[sv]*?[^sv]+[sv]*?[^sv0-9A-Z_a-z]|if[sv]?([0-9A-Z_a-z]+[sv]*?[<->~]"
     },
     {
-        "category": "PHP",
-        "pattern": "@rx (?:((?:.+)(?:[\"'][-0-9A-Z_a-z]+[\"'])?(.+|[^)]*string[^)]*)[sv\"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|[\"'][-0-9A-Zx5c_a-z]+[\"'])(.+))(?:;|$)?"
+        "category": "SQLI",
+        "pattern": "@rx (?i)alter[sv]*?[0-9A-Z_a-z]+.*?char(?:acter)?[sv]+set[sv]+[0-9A-Z_a-z]+|[\"'`](?:;*?[sv]*?waitfor[sv]+(?:time|delay)[sv]+[\"'`]|;.*?:[sv]*?goto)"
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 4"
+        "category": "SQLI",
+        "pattern": "@rx (?i:merge.*?usings*?(|executes*?immediates*?[\"'`]|matchs*?[w(),+-]+s*?againsts*?()"
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 4"
+        "category": "SQLI",
+        "pattern": "@rx (?i)union.*?select.*?from"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@lt 1"
+        "category": "SQLI",
+        "pattern": "@rx (?i)select[sv]*?pg_sleep|waitfor[sv]*?delay[sv]?[\"'`]+[sv]?[0-9]|;[sv]*?shutdown[sv]*?(?:[#;{]|/*|--)"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@lt 1"
+        "category": "SQLI",
+        "pattern": "@rx (?i)[?$(?:n(?:e|in?|o[rt])|e(?:q|xists|lemMatch)|l(?:te?|ike)|mod|a(?:ll|nd)|(?:s(?:iz|lic)|wher)e|t(?:ype|ext)|x?or|div|between|regex|jsonSchema)]?"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@rx _(?:$$ND_FUNC$$_|_js_function)|(?:beval|new[sv]+Function[sv]*)(|String.fromCharCode|function(){|this.constructor|module.exports=|([sv]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][sv]*)|process(?:.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:.call)?(|binding|constructor|env|global|main(?:Module)?|process|require)|[[\"'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)[\"'`]])|(?:binding|constructor|env|global|main(?:Module)?|process|require)[|console(?:.(?:debug|error|info|trace|warn)(?:.call)?(|[[\"'`](?:debug|error|info|trace|warn)[\"'`]])|require(?:.(?:resolve(?:.call)?(|main|extensions|cache)|[[\"'`](?:(?:resolv|cach)e|main|extensions)[\"'`]])"
+        "category": "SQLI",
+        "pattern": "@rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[sv]*("
+        "category": "SQLI",
+        "pattern": "@rx (?i)create[sv]+function[sv].+[sv]returns|;[sv]*?(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)b[sv]*?[([]?[0-9A-Z_a-z]{2,}"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@pmFromFile ssrf.data"
+        "category": "SQLI",
+        "pattern": "@rx (?i)b(?:(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)b[sv]*(?|end[sv]*?);)|[sv(]load_file[sv]*?(|[\"'`][sv]+regexp[^0-9A-Z_a-z]|[\"'0-9A-Z_-z][sv]+asb[sv]*[\"'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:(?:(?:(?:cre|trunc)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]+[0-9A-Z_a-z]+|u(?:pdate[sv]+[0-9A-Z_a-z]+|nion[sv]*(?:all|(?:sele|distin)ct)b)|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject))b)"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@rx (?:__proto__|constructors*(?:.|[)s*prototype)"
+        "category": "SQLI",
+        "pattern": "@rx (?i:/*[!+](?:[ws=_-()]+)?*/)"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@rx Process[sv]*.[sv]*spawn[sv]*("
+        "category": "SQLI",
+        "pattern": "@rx ^(?:[^']*'|[^\"]*\"|[^`]*`)[sv]*;"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@rx while[sv]*([sv(]*(?:!+(?:false|null|undefined|NaN|[+-]?0|\"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[+-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)b|{.*}|[.*]|\"[^\"]+\"|'[^']+'|`[^`]+`)).*)"
+        "category": "SQLI",
+        "pattern": "@rx (?i)1.e[(-),]"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@rx ^data:(?:(?:*|[^!-\"(-),/:-?[-]{}]+)/(?:*|[^!-\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\"?(?:iso-8859-15?|utf-8|windows-1252)b\"?|(?:[^sv -\"(-),/:-?[-]c{}]|c(?:[^!-\"(-),/:-?[-]h{}]|h(?:[^!-\"(-),/:-?[-]a{}]|a(?:[^!-\"(-),/:-?[-]r{}]|r(?:[^!-\"(-),/:-?[-]s{}]|s(?:[^!-\"(-),/:-?[-]e{}]|e[^!-\"(-),/:-?[-]t{}]))))))[^!-\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\"(-),/:-?[-]{}]+)/(?:*|[^!-\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\"?(?:iso-8859-15?|utf-8|windows-1252)b\"?|(?:[^sv -\"(-),/:-?[-]c{}]|c(?:[^!-\"(-),/:-?[-]h{}]|h(?:[^!-\"(-),/:-?[-]a{}]|a(?:[^!-\"(-),/:-?[-]r{}]|r(?:[^!-\"(-),/:-?[-]s{}]|s(?:[^!-\"(-),/:-?[-]e{}]|e[^!-\"(-),/:-?[-]t{}]))))))[^!-\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*"
+        "category": "SQLI",
+        "pattern": "@rx [\"'`][[{].*[]}][\"'`].*(::.*jsonb?)?.*(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)|(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)[\"'`][[{].*[]}][\"'`]|json_extract.*(.*)"
     },
     {
-        "category": "GENERIC",
+        "category": "SQLI",
         "pattern": "@lt 2"
     },
     {
-        "category": "GENERIC",
+        "category": "SQLI",
         "pattern": "@lt 2"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}.(?:[0-9]{1,3}.[0-9]{5}|[0-9]{8})|(?:x5cx5c[-0-9a-z].?_?)+|[[0-:a-f]+(?:[.0-9]+|%[0-9A-Z_a-z]+)?]|[a-z][--.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[sv]*&?@(?:(?:[0-9]{1,3}.){3}[0-9]{1,3}|[a-z][--.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[.0-9]{0,11}(?:xe2(?:x91[xa0-xbf]|x92[x80-xbf]|x93[x80-xa9xab-xbf])|xe3x80x82)+))"
-    },
-    {
-        "category": "GENERIC",
-        "pattern": "@rx [s*constructors*]"
-    },
-    {
-        "category": "GENERIC",
-        "pattern": "@rx @{.*}"
-    },
-    {
-        "category": "GENERIC",
-        "pattern": "@lt 3"
+        "category": "SQLI",
+        "pattern": "@rx (?:^s*[\"'`;]+|[\"'`]+s*$)"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@lt 3"
+        "category": "SQLI",
+        "pattern": "@rx (?i)!=|&&||||>[=->]|<(?:<|=>?|>(?:[sv]+binary)?)|b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)b|[0-9A-Z_a-z]*?_))|(?:likel(?:ihood|y)|unlikely)[sv]*()|r(?:egexp|like)[sv]+binary|not[sv]+between[sv]+(?:0[sv]+and|(?:'[^']*'|\"[^\"]*\")[sv]+and[sv]+(?:'[^']*'|\"[^\"]*\"))|is[sv]+null|like[sv]+(?:null|[0-9A-Z_a-z]+[sv]+escapeb)|(?:^|[^0-9A-Z_a-z])in[sv+]*([sv\"0-9]+[^(-)]*)|[!<->]{1,2}[sv]*allb"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@lt 4"
+        "category": "SQLI",
+        "pattern": "@rx (?i)[sv\"'-)`]*?b([0-9A-Z_a-z]+)b[sv\"'-)`]*?(?:=|<=>|(?:sounds[sv]+)?like|glob|r(?:like|egexp))[sv\"'-)`]*?b([0-9A-Z_a-z]+)b"
     },
     {
-        "category": "GENERIC",
-        "pattern": "@lt 4"
+        "category": "SQLI",
+        "pattern": "@streq %{TX.2}"
     },
     {
-        "category": "XSS",
-        "pattern": "@lt 1"
+        "category": "SQLI",
+        "pattern": "@rx (?i)[sv\"'-)`]*?b([0-9A-Z_a-z]+)b[sv\"'-)`]*?(?:![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(?:like|r(?:like|egexp)))[sv\"'-)`]*?b([0-9A-Z_a-z]+)b"
     },
     {
-        "category": "XSS",
-        "pattern": "@lt 1"
+        "category": "SQLI",
+        "pattern": "!@streq %{TX.2}"
     },
     {
-        "category": "XSS",
-        "pattern": "!@validateByteRange 20, 45-47, 48-57, 65-90, 95, 97-122"
+        "category": "SQLI",
+        "pattern": "@rx (?i)b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|g(?:lob|roup_concat)|h(?:ex|our)|i(?:f(?:null)?|if|n(?:str)?)|l(?:ast(?:_insert_rowid)?|ength|ike(?:l(?:ihood|y))?|n|o(?:ad_extension|g(?:10|2)?|wer(?:pi)?|cal)|trim)|m(?:ax|in(?:ute)?|o(?:d|nth))|n(?:ullif|ow)|p(?:i|ow(?:er)?|rintf|assword)|quote|r(?:a(?:dians|ndom(?:blob)?)|e(?:p(?:lace|eat)|verse)|ound|trim|ight)|s(?:i(?:gn|nh?)|oundex|q(?:lite_(?:compileoption_(?:get|used)|offset|source_id|version)|rt)|u(?:bstr(?:ing)?|m)|econd|leep)|t(?:anh?|otal(?:_changes)?|r(?:im|unc)|ypeof|ime)|u(?:n(?:icode|likely)|(?:pp|s)er)|zeroblob|bin|v(?:alues|ersion)|week|year)[^0-9A-Z_a-z]*("
     },
     {
-        "category": "XSS",
-        "pattern": "@detectXSS"
+        "category": "SQLI",
+        "pattern": "@rx (?i)(?:/*)+[\"'`]+[sv]?(?:--|[#{]|/*)?|[\"'`](?:[sv]*(?:(?:x?or|and|div|like|between)[sv-0-9A-Z_a-z]+[(-)+--<->][sv]*[\"'0-9`]|[!=|](?:[sv -!+-0-9=]+.*?[\"'-(`].*?|[sv -!0-9=]+.*?[0-9]+)$|(?:like|print)[^0-9A-Z_a-z]+[\"'-(0-9A-Z_-z]|;)|(?:[<>~]+|[sv]*[^sv0-9A-Z_a-z]?=[sv]*|[^0-9A-Z_a-z]*?[+=]+[^0-9A-Z_a-z]*?)[\"'`])|[0-9][\"'`][sv]+[\"'`][sv]+[0-9]|^admin[sv]*?[\"'`]|[sv\"'-(`][sv]*?glob[^0-9A-Z_a-z]+[\"'-(0-9A-Z_-z]|[sv]is[sv]*?0[^0-9A-Z_a-z]|where[sv][sv,-.0-9A-Z_a-z]+[sv]="
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)<script[^>]*>[sS]*?"
+        "category": "SQLI",
+        "pattern": "@rx (?i),.*?[\"')0-9`-f][\"'`](?:[\"'`].*?[\"'`]|(?:r?n)?z|[^\"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]*?([sv]*?space[sv]*?("
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i).(?:b(?:x(?:link:href|html|mlns)|data:text/html|formaction|patternb.*?=)|!ENTITY[sv]+(?:%[sv]+)?[^sv]+[sv]+(?:SYSTEM|PUBLIC)|@import|;base64)b"
+        "category": "SQLI",
+        "pattern": "@rx (?i)(?:&&||||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[sv(]+[0-9A-Z_a-z]+[sv)]*?[!+=]+[sv0-9]*?[\"'-)=`]|[0-9](?:[sv]*?(?:and|between|div|like|x?or)[sv]*?[0-9]+[sv]*?[+-]|[sv]+group[sv]+by.+()|/[0-9A-Z_a-z]+;?[sv]+(?:and|between|div|having|like|x?or|select)[^0-9A-Z_a-z]|(?:[#;]|--)[sv]*?(?:alter|drop|(?:insert|update)[sv]*?[0-9A-Z_a-z]{2,})|@.+=[sv]*?([sv]*?select|[^0-9A-Z_a-z]SET[sv]*?@[0-9A-Z_a-z]+"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url(javascript"
+        "category": "SQLI",
+        "pattern": "@rx (?i)[\"'`][sv]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?[\"'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+[\"'`]|like[sv]*?[\"'`]%|select[sv]+?[sv\"'-),-.0-9A-[]_-z]+from[sv]+"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)<[^0-9<>A-Z_a-z]*(?:[^sv\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e|v[^0-9A-Z_a-z]*?g|e[^0-9A-Z_a-z]*?t[^0-9>A-Z_a-z])|f[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?m|m[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?q[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?e|e[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?a[^0-9>A-Z_a-z])|(?:l[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?k|o[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?j[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?c[^0-9A-Z_a-z]*?t|e[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?d|a[^0-9A-Z_a-z]*?(?:p[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?t|u[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?o|n[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?e)|p[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m|i?[^0-9A-Z_a-z]*?f[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?e|b[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?s[^0-9A-Z_a-z]*?e|o[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?y|i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?s)|i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a?[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?e?|v[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?o)[^0-9>A-Z_a-z])|(?:<[0-9A-Z_a-z].*[sv/]|[\"'](?:.*[sv/])?)(?:background|formaction|lowsrc|on(?:a(?:bort|ctivate|d(?:apteradded|dtrack)|fter(?:print|(?:scriptexecu|upda)te)|lerting|n(?:imation(?:cancel|end|iteration|start)|tennastatechange)|ppcommand|u(?:dio(?:end|process|start)|xclick))|b(?:e(?:fore(?:(?:(?:(?:de)?activa|scriptexecu)t|toggl)e|c(?:opy|ut)|editfocus|input|p(?:aste|rint)|u(?:nload|pdate))|gin(?:Event)?)|l(?:ocked|ur)|oun(?:ce|dary)|roadcast|usy)|c(?:a(?:(?:ch|llschang)ed|nplay(?:through)?|rdstatechange)|(?:ell|fstate)change|h(?:a(?:rging(?:time)?cha)?nge|ecking)|l(?:ick|ose)|o(?:m(?:mand(?:update)?|p(?:lete|osition(?:end|start|update)))|n(?:nect(?:ed|ing)|t(?:extmenu|rolselect))|py)|u(?:echange|t))|d(?:ata(?:(?:availabl|chang)e|error|setc(?:hanged|omplete))|blclick|e(?:activate|livery(?:error|success)|vice(?:found|light|(?:mo|orienta)tion|proximity))|i(?:aling|s(?:abled|c(?:hargingtimechange|onnect(?:ed|ing))))|o(?:m(?:a(?:ctivate|ttrmodified)|(?:characterdata|subtree)modified|focus(?:in|out)|mousescroll|node(?:inserted(?:intodocument)?|removed(?:fromdocument)?))|wnloading)|r(?:ag(?:drop|e(?:n(?:d|ter)|xit)|(?:gestur|leav)e|over|start)|op)|urationchange)|e(?:mptied|n(?:abled|d(?:ed|Event)?|ter)|rror(?:update)?|xit)|f(?:ailed|i(?:lterchange|nish)|o(?:cus(?:in|out)?|rm(?:change|input))|ullscreenchange)|g(?:amepad(?:axismove|button(?:down|up)|(?:dis)?connected)|et)|h(?:ashchange|e(?:adphoneschange|l[dp])|olding)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|put|valid))|key(?:down|press|up)|l(?:evelchange|o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|y)|m(?:ark|essage|o(?:use(?:down|enter|(?:lea|mo)ve|o(?:ut|ver)|up|wheel)|ve(?:end|start)?|z(?:a(?:fterpaint|udioavailable)|(?:beforeresiz|orientationchang|t(?:apgestur|imechang))e|(?:edgeui(?:c(?:ancel|omplet)|start)e|network(?:down|up)loa)d|fullscreen(?:change|error)|m(?:agnifygesture(?:start|update)?|ouse(?:hittest|pixelscroll))|p(?:ointerlock(?:change|error)|resstapgesture)|rotategesture(?:start|update)?|s(?:crolledareachanged|wipegesture(?:end|start|update)?))))|no(?:match|update)|o(?:(?:bsolet|(?:ff|n)lin)e|pen|verflow(?:changed)?)|p(?:a(?:ge(?:hide|show)|int|(?:st|us)e)|lay(?:ing)?|o(?:inter(?:down|enter|(?:(?:lea|mo)v|rawupdat)e|o(?:ut|ver)|up)|p(?:state|up(?:hid(?:den|ing)|show(?:ing|n))))|ro(?:gress|pertychange))|r(?:atechange|e(?:adystatechange|ceived|movetrack|peat(?:Event)?|quest|s(?:et|ize|u(?:lt|m(?:e|ing)))|trieving)|ow(?:e(?:nter|xit)|s(?:delete|inserted)))|s(?:croll(?:end)?|e(?:arch|ek(?:complete|ed|ing)|lect(?:ionchange|start)?|n(?:ding|t)|t)|how|(?:ound|peech)(?:end|start)|t(?:a(?:lled|rt|t(?:echange|uschanged))|k(?:comma|sessione)nd|op)|u(?:bmit|ccess|spend)|vg(?:abort|error|(?:un)?load|resize|scroll|zoom))|t(?:ext|ime(?:out|update)|o(?:ggle|uch(?:cancel|en(?:d|ter)|(?:lea|mo)ve|start))|ransition(?:cancel|end|run|start))|u(?:n(?:derflow|handledrejection|load)|p(?:dateready|gradeneeded)|s(?:erproximity|sdreceived))|v(?:ersion|o(?:ic|lum)e)change|w(?:a(?:it|rn)ing|ebkit(?:animation(?:end|iteration|start)|transitionend)|heel)|zoom)|ping|s(?:rc|tyle))[x08-nf-r ]*?="
+        "category": "SQLI",
+        "pattern": "@rx (?i))[sv]*?when[sv]*?[0-9]+[sv]*?then|[\"'`][sv]*?(?:[#{]|--)|/*![sv]?[0-9]+|b(?:(?:binary|cha?r)[sv]*?([sv]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:egexp|like))[sv]+[0-9A-Z_a-z]+()|(?:|||&&)[sv]*?[0-9A-Z_a-z]+("
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)(?:W|^)(?:javascript:(?:[sS]+[=x5c([.<]|[sS]*?(?:bnameb|x5c[ux]d))|data:(?:(?:[a-z]w+/w[w+-]+w)?[;,]|[sS]*?;[sS]*?b(?:base64|charset=)|[sS]*?,[sS]*?<[sS]*?w[sS]*?>))|@W*?iW*?mW*?pW*?oW*?rW*?tW*?(?:/*[sS]*?)?(?:[\"']|W*?uW*?rW*?l[sS]*?()|[^-]*?-W*?mW*?oW*?zW*?-W*?bW*?iW*?nW*?dW*?iW*?nW*?g[^:]*?:W*?uW*?rW*?l[sS]*?("
+        "category": "SQLI",
+        "pattern": "@rx (?i)(?:([sv]*?select[sv]*?[0-9A-Z_a-z]+|coalesce|order[sv]+by[sv]+if[0-9A-Z_a-z]*?)[sv]*?(|*/from|+[sv]*?[0-9]+[sv]*?+[sv]*?@|[0-9A-Z_a-z][\"'`][sv]*?(?:(?:[+-=@|]+[sv]+?)+|[+-=@|]+)[(0-9]|@@[0-9A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]|[^0-9A-Z_a-z]!+[\"'`][0-9A-Z_a-z]|[\"'`](?:;[sv]*?(?:if|while|begin)|[sv0-9]+=[sv]*?[0-9])|[sv(]+case[0-9]*?[^0-9A-Z_a-z].+[tw]hen[sv(]"
     },
     {
-        "category": "XSS",
-        "pattern": "@pm document.cookie document.domain document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata["
+        "category": "SQLI",
+        "pattern": "@rx (?i)[\"'`][sv]*?b(?:x?or|div|like|between|and)b[sv]*?[\"'`]?[0-9]|x5cx(?:2[37]|3d)|^(?:.?[\"'`]$|[\"'x5c`]*?(?:[\"'0-9`]+|[^\"'`]+[\"'`])[sv]*?b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)b[sv]*?[\"'0-9A-Z_-z][!&(-)+-.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?[\"'`][sv]*?[0-9A-Z_a-z]|@(?:[0-9A-Z_a-z]+[sv]+(?:and|x?or|div|like|between)b[sv]*?[\"'0-9`]+|[-0-9A-Z_a-z]+[sv](?:and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?[\"'`].|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i:<style.*?>.*?(?:@[ix5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(x5c]|&#x?0*(?:40|28|92|5C);?)))"
+        "category": "SQLI",
+        "pattern": "@rx (?i)in[sv]*?(+[sv]*?select|(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)[sv+0-9A-Z_a-z]+(?:regexp[sv]*?(|sounds[sv]+like[sv]*?[\"'`]|[0-9=]+x)|[\"'`](?:[sv]*?(?:[0-9][sv]*?(?:--|#)|is[sv]*?(?:[0-9].+[\"'`]?[0-9A-Z_a-z]|[.0-9]+[sv]*?[^0-9A-Z_a-z].*?[\"'`]))|[%-&<->^]+[0-9][sv]*?(?:=|x?or|div|like|between|and)|(?:[^0-9A-Z_a-z]+[+-0-9A-Z_a-z]+[sv]*?=[sv]*?[0-9][^0-9A-Z_a-z]+||?[-0-9A-Z_a-z]{3,}[^sv,.0-9A-Z_a-z]+)[\"'`]|[sv]*(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)(?:array[sv]*[|[0-9A-Z_a-z]+(?:[sv]*!?~|[sv]+(?:not[sv]+)?similar[sv]+to[sv]+)|(?:tru|fals)eb))|bexcept[sv]+(?:selectb|values[sv]*?()"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i:<.*[:]?vmlframe.*?[s/+]*?src[s/+]*=)"
+        "category": "SQLI",
+        "pattern": "@rx (?i:^[Wd]+s*?(?:alter|union)b)"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:v|&#(?:0*(?:86|118)|x0*[57]6);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;))."
+        "category": "SQLI",
+        "pattern": "@rx (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)[sv]?(?|end[sv]*?);|[sv(]load_file[sv]*?(|[\"'`][sv]+regexp[^0-9A-Z_a-z]|[^A-Z_a-z][sv]+asb[sv]*[\"'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:create[sv]+[0-9A-Z_a-z]+|(?:d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load|(?:renam|truncat)e|u(?:pdate|nion[sv]*(?:all|(?:sele|distin)ct))|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject)))b)"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)(?:v|&#(?:0*8|x0*5)[36];)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*6[26]|x0*(?:98|42));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;))."
+        "category": "SQLI",
+        "pattern": "@rx (?i)[\"'`](?:[sv]*?(?:(?:*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?[\"'`]|(?:x?or|div|like|between|and)[sv][^0-9]+[-0-9A-Z_a-z]+.*?)[0-9]|[^sv0-9?A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]+[sv]*?[\"'`]|[^sv0-9A-Z_a-z]+[sv]*?[^A-Z_a-z].*?(?:#|--))|.*?*[sv]*?[0-9])|^[\"'`]|[%(-+-<>][-0-9A-Z_a-z]+[^sv0-9A-Z_a-z]+[\"'`][^,]"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)<EMBED[s/+].*?(?:src|type).*?="
+        "category": "SQLI",
+        "pattern": "@rx (?i)b(?:havingb(?:[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')[sv]*?[<->]| ?(?:[0-9]{1,10} ?[<->]+|[\"'][^=]{1,10}[ \"'<-?[]+))|ex(?:ecute(?:(|[sv]{1,5}[$.0-9A-Z_a-z]{1,5}[sv]{0,3})|ists[sv]*?([sv]*?selectb)|(?:create[sv]+?table.{0,20}?|like[^0-9A-Z_a-z]*?char[^0-9A-Z_a-z]*?)()|select.*?case|from.*?limit|order[sv]by|exists[sv](?:[sv]select|s(?:elect[^sv](?:if(?:null)?[sv](|top|concat)|ystem[sv]()|bhavingb[sv]+[0-9]{1,10}|'[^=]{1,10}')"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx <[?]?import[s/+S]*?implementation[s/+]*?="
+        "category": "SQLI",
+        "pattern": "@rx (?i)b(?:orb(?:[sv]?(?:[0-9]{1,10}|[\"'][^=]{1,10}[\"'])[sv]?[<->]+|[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|xorb[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|'[sv]+x?or[sv]+.{1,20}[!+-<->]"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i:<META[s/+].*?http-equiv[s/+]*=[s/+]*[\"'`]?(?:(?:c|&#x?0*(?:67|43|99|63);?)|(?:r|&#x?0*(?:82|52|114|72);?)|(?:s|&#x?0*(?:83|53|115|73);?)))"
+        "category": "SQLI",
+        "pattern": "@rx (?i)bandb(?:[sv]+(?:[0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|[\"'][^=]{1,10}[\"']) ?[<->]+)"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i:<META[s/+].*?charset[s/+]*=)"
+        "category": "SQLI",
+        "pattern": "@rx (?i)b(?:a(?:(?:b|co)s|dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:in|cii(?:str)?)|tan2?|vg)|b(?:enchmark|i(?:n(?:_to_num)?|t_(?:and|count|length|x?or)))|c(?:ast|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|o(?:alesce|ercibility|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|(?:un)?t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|time(?:stamp)?|user)))|d(?:a(?:t(?:abase|e(?:_(?:add|format|sub)|diff)?)|y(?:name|of(?:month|week|year))?)|count|e(?:code|(?:faul|s_(?:de|en)cryp)t|grees)|ump)|e(?:lt|nc(?:ode|rypt)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:eld(?:_in_set)?|nd_in_set)|loor|o(?:rmat|und_rows)|rom_(?:base64|days|unixtime))|g(?:et_(?:format|lock)|r(?:eates|oup_conca)t)|h(?:ex(?:toraw)?|our)|i(?:f(?:null)?|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)?|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull))|null)?)|l(?:ast(?:_(?:day|insert_id))?|case|e(?:(?:as|f)t|ngth)|n|o(?:ad_file|ca(?:l(?:timestamp)?|te)|g(?:10|2)?|wer)|pad|trim)|m(?:a(?:ke(?:date|_set)|ster_pos_wait|x)|d5|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:d|nth(?:name)?))|n(?:ame_const|o(?:t_in|w)|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:assword|eriod_(?:add|diff)|g_sleep|i|o(?:sition|w(?:er)?)|rocedure_analyse)|qu(?:arter|ote)|r(?:a(?:dians|nd|wto(?:hex|nhex(?:toraw)?))|e(?:lease_lock|p(?:eat|lace)|verse)|ight|o(?:und|w_count)|pad|trim)|s(?:chema|e(?:c(?:ond|_to_time)|ssion_user)|ha[1-2]?|ig?n|leep|oundex|pace|qrt|t(?:d(?:dev(?:_(?:po|sam)p)?)?|r(?:cmp|_to_date))|u(?:b(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|m)|ys(?:date|tem_user))|t(?:an|ime(?:diff|_(?:format|to_sec)|stamp(?:add|diff)?)?|o_(?:base64|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|ix_timestamp)|p(?:datexml|per)|ser|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|v(?:a(?:lues|r(?:iance|_(?:po|sam)p))|ersion)|we(?:ek(?:day|ofyear)?|ight_string)|xmltype|year(?:week)?)[^0-9A-Z_a-z]*?("
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)<LINK[s/+].*?href[s/+]*="
+        "category": "SQLI",
+        "pattern": "@rx (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|oacreate|p(?:assword|repare)|replwritetovarbin)|ql_(?:longvarchar|variant))|utl_(?:file|http)|xp_(?:availablemedia|(?:cmdshel|servicecontro)l|dirtree|e(?:numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(?:_enumdomains)?|reg(?:addmultistring|delete(?:key|value)|enum(?:key|value)s|re(?:ad|movemultistring)|write)|terminate(?:_process)?)"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)<BASE[s/+].*?href[s/+]*="
+        "category": "SQLI",
+        "pattern": "@rx (?i)b(?:(?:d(?:bms_[0-9A-Z_a-z]+.|eleteb[^0-9A-Z_a-z]*?bfrom)|(?:groupb.*?bbyb.{1,100}?bhav|overlayb[^0-9A-Z_a-z]*?(.*?b[^0-9A-Z_a-z]*?plac)ing|in(?:nerb[^0-9A-Z_a-z]*?bjoin|sertb[^0-9A-Z_a-z]*?binto|tob[^0-9A-Z_a-z]*?b(?:dump|out)file)|loadb[^0-9A-Z_a-z]*?bdatab.*?binfile|s(?:electb.{1,100}?b(?:(?:.*?bdumpb.*|(?:count|length)b.{1,100}?)bfrom|(?:data_typ|fromb.{1,100}?bwher)e|instr|to(?:_(?:cha|numbe)r|pb.{1,100}?bfrom))|ys_context)|u(?:nionb.{1,100}?bselect|tl_inaddr))b|printb[^0-9A-Z_a-z]*?@@)|(?:collation[^0-9A-Z_a-z]*?(a|@@version|;[^0-9A-Z_a-z]*?b(?:drop|shutdown))b|'(?:dbo|msdasql|s(?:a|qloledb))'"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)<APPLET[s/+>]"
+        "category": "SQLI",
+        "pattern": "@rx ((?:[~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>][^~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>]*?){12})"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)<OBJECT[s/+].*?(?:type|codetype|classid|code|data)[s/+]*="
+        "category": "SQLI",
+        "pattern": "@rx /*!?|*/|[';]--|--(?:[sv]|[^-]*?-)|[^&-]#.*?[sv]|;?x00"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx xbc[^xbe>]*[xbe>]|<[^xbe]*xbe"
+        "category": "SQLI",
+        "pattern": "!@rx ^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+.[-0-9A-Z_a-z]+$"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?:xbcs*/s*[^xbe>]*[xbe>])|(?:<s*/s*[^xbe]*xbe)"
+        "category": "SQLI",
+        "pattern": "@rx (?i:b0x[a-fd]{3,})"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx +ADw-.*(?:+AD4-|>)|<.*+AD4-"
+        "category": "SQLI",
+        "pattern": "@rx (?:`(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)`)"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx ![!+ ][]"
+        "category": "SQLI",
+        "pattern": "@rx (?i)[\"'`][sv]*?(?:(?:is[sv]+not|not[sv]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|])"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?:self|document|this|top|window)s*(?:/*|[[)]).+?(?:]|*/)"
+        "category": "SQLI",
+        "pattern": "@rx (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^\"]*?(?:\"[^\"]*?\"[^\"]*?)*?\"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)b(?:eval|set(?:timeout|interval)|new[sv]+Function|a(?:lert|tob)|btoa)[sv]*("
+        "category": "SQLI",
+        "pattern": "@rx ^(?:and|or)$"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx ((?:[[^]]*][^.]*.)|Reflect[^.]*.).*(?:map|sort|apply)[^.]*..*call[^`]*`.*`"
+        "category": "SQLI",
+        "pattern": "@rx ^.*?x5c['\"`](?:.*?['\"`])?s*(?:and|or)b"
     },
     {
-        "category": "XSS",
-        "pattern": "@lt 2"
+        "category": "SQLI",
+        "pattern": "@detectSQLi"
     },
     {
-        "category": "XSS",
-        "pattern": "@lt 2"
+        "category": "SQLI",
+        "pattern": "@rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*("
     },
     {
-        "category": "XSS",
-        "pattern": "@detectXSS"
+        "category": "SQLI",
+        "pattern": "@rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)[s\"'`;/0-9=x0Bx09x0Cx3Bx2Cx28x3B]on[a-zA-Z]{3,25}[sx0Bx09x0Cx3Bx2Cx28x3B]*?=[^=]"
+        "category": "SQLI",
+        "pattern": "@lt 3"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)b(?:s(?:tyle|rc)|href)b[sS]*?="
+        "category": "SQLI",
+        "pattern": "@lt 3"
     },
     {
-        "category": "XSS",
-        "pattern": "@contains -->"
+        "category": "SQLI",
+        "pattern": "@rx (?i)W+d*?s*?bhavingbs*?[^s-]"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|hr|html|i|iframe|ilayer|img|input|ins|isindex|kdb|keygen|label|layer|legend|li|limittext|link|listing|map|marquee|menu|meta|multicol|nobr|noembed|noframes|noscript|nosmartquotes|object|ol|optgroup|option|p|param|plaintext|pre|q|rt|ruby|s|samp|script|select|server|shadow|sidebar|small|spacer|span|strike|strong|style|sub|sup|table|tbody|td|textarea|tfoot|th|thead|title|tr|tt|u|ul|var|wbr|xml|xmp)W"
+        "category": "SQLI",
+        "pattern": "@rx [\"'`][sd]*?[^ws]W*?dW*?.*?[\"'`d]"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i:[\"'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|x5cu006C)(?:o|x5cu006F)(?:c|x5cu0063)(?:a|x5cu0061)(?:t|x5cu0074)(?:i|x5cu0069)(?:o|x5cu006F)(?:n|x5cu006E)|(?:n|x5cu006E)(?:a|x5cu0061)(?:m|x5cu006D)(?:e|x5cu0065)|(?:o|x5cu006F)(?:n|x5cu006E)(?:e|x5cu0065)(?:r|x5cu0072)(?:r|x5cu0072)(?:o|x5cu006F)(?:r|x5cu0072)|(?:v|x5cu0076)(?:a|x5cu0061)(?:l|x5cu006C)(?:u|x5cu0075)(?:e|x5cu0065)(?:O|x5cu004F)(?:f|x5cu0066)).*?=)"
+        "category": "SQLI",
+        "pattern": "@rx ((?:[~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>][^~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>]*?){8})"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx (?i)[\"'][ ]*(?:[^a-z0-9~_:' ]|in).+?[.].+?="
+        "category": "SQLI",
+        "pattern": "@rx ((?:[~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>][^~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>]*?){6})"
     },
     {
-        "category": "XSS",
-        "pattern": "@rx {{.*?}}"
+        "category": "SQLI",
+        "pattern": "@rx W{4}"
     },
     {
-        "category": "XSS",
-        "pattern": "@lt 3"
+        "category": "SQLI",
+        "pattern": "@rx (?:'(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)')"
     },
     {
-        "category": "XSS",
-        "pattern": "@lt 3"
+        "category": "SQLI",
+        "pattern": "@rx ';"
     },
     {
-        "category": "XSS",
+        "category": "SQLI",
         "pattern": "@lt 4"
     },
     {
-        "category": "XSS",
+        "category": "SQLI",
         "pattern": "@lt 4"
     },
     {
         "category": "SQLI",
-        "pattern": "@lt 1"
+        "pattern": "@rx ((?:[~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>][^~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>]*?){3})"
     },
     {
         "category": "SQLI",
+        "pattern": "@rx ((?:[~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>][^~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>]*?){2})"
+    },
+    {
+        "category": "ENFORCEMENT",
         "pattern": "@lt 1"
     },
     {
-        "category": "SQLI",
-        "pattern": "@detectSQLi"
+        "category": "ENFORCEMENT",
+        "pattern": "@lt 1"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)b(?:d(?:atabas|b_nam)e[^0-9A-Z_a-z]*(|(?:information_schema|m(?:aster..sysdatabases|s(?:db|ys(?:ac(?:cess(?:objects|storage|xml)|es)|modules2?|(?:object|querie|relationship)s))|ysql.db)|northwind|pg_(?:catalog|toast)|tempdb)b|s(?:chema(?:_nameb|[^0-9A-Z_a-z]*()|(?:qlite_(?:temp_)?master|ys(?:aux|.database_name))b))"
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx (?i)^(?:get /[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?|(?:connect (?:(?:[0-9]{1,3}.){3}[0-9]{1,3}.?(?::[0-9]+)?|[--9A-Z_a-z]+:[0-9]+)|options *|[a-z]{3,10}[sv]+(?:[0-9A-Z_a-z]{3,7}?://[--9A-Z_a-z]*(?::[0-9]+)?)?/[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?)[sv]+[.-9A-Z_a-z]+)$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*("
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx (?i)^(?:&(?:(?:[acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|(?:[cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^\"';=])*$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i:sleep(s*?d*?s*?)|benchmark(.*?,.*?))"
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^d+$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)(?:select|;)[sv]+(?:benchmark|if|sleep)[sv]*?([sv]*?(?[sv]*?[0-9A-Z_a-z]+"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^(?:GET|HEAD)$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)[\"'`](?:[sv]*![sv]*[\"'0-9A-Z_-z]|;?[sv]*(?:having|select|unionb[sv]*(?:all|(?:distin|sele)ct))b[sv]*[^sv])|b(?:(?:(?:c(?:onnection_id|urrent_user)|database|schema|user)[sv]*?|select.*?[0-9A-Z_a-z]?user)(|exec(?:ute)?[sv]+master.|from[^0-9A-Z_a-z]+information_schema[^0-9A-Z_a-z]|into[sv+]+(?:dump|out)file[sv]*?[\"'`]|union(?:[sv]select[sv]@|[sv(0-9A-Z_a-z]*?select))|[sv]*?exec(?:ute)?.*?[^0-9A-Z_a-z]xp_cmdshell|[^0-9A-Z_a-z]iif[sv]*?("
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^0?$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^(?:GET|HEAD)$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)[sv(-)]case[sv]+when.*?then|)[sv]*?like[sv]*?(|select.*?having[sv]*?[^sv]+[sv]*?[^sv0-9A-Z_a-z]|if[sv]?([0-9A-Z_a-z]+[sv]*?[<->~]"
+        "category": "ENFORCEMENT",
+        "pattern": "!@eq 0"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)alter[sv]*?[0-9A-Z_a-z]+.*?char(?:acter)?[sv]+set[sv]+[0-9A-Z_a-z]+|[\"'`](?:;*?[sv]*?waitfor[sv]+(?:time|delay)[sv]+[\"'`]|;.*?:[sv]*?goto)"
+        "category": "ENFORCEMENT",
+        "pattern": "!@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i:merge.*?usings*?(|executes*?immediates*?[\"'`]|matchs*?[w(),+-]+s*?againsts*?()"
+        "category": "ENFORCEMENT",
+        "pattern": "@streq POST"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)union.*?select.*?from"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 0"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)select[sv]*?pg_sleep|waitfor[sv]*?delay[sv]?[\"'`]+[sv]?[0-9]|;[sv]*?shutdown[sv]*?(?:[#;{]|/*|--)"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 0"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)[?$(?:n(?:e|in?|o[rt])|e(?:q|xists|lemMatch)|l(?:te?|ike)|mod|a(?:ll|nd)|(?:s(?:iz|lic)|wher)e|t(?:ype|ext)|x?or|div|between|regex|jsonSchema)]?"
+        "category": "ENFORCEMENT",
+        "pattern": "!@eq 0"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)"
+        "category": "ENFORCEMENT",
+        "pattern": "!@eq 0"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)create[sv]+function[sv].+[sv]returns|;[sv]*?(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)b[sv]*?[([]?[0-9A-Z_a-z]{2,}"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx (d+)-(d+)"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)b(?:(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)b[sv]*(?|end[sv]*?);)|[sv(]load_file[sv]*?(|[\"'`][sv]+regexp[^0-9A-Z_a-z]|[\"'0-9A-Z_-z][sv]+asb[sv]*[\"'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:(?:(?:(?:cre|trunc)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]+[0-9A-Z_a-z]+|u(?:pdate[sv]+[0-9A-Z_a-z]+|nion[sv]*(?:all|(?:sele|distin)ct)b)|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject))b)"
+        "category": "ENFORCEMENT",
+        "pattern": "@lt %{tx.1}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i:/*[!+](?:[ws=_-()]+)?*/)"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx b(?:keep-alive|close),s?(?:keep-alive|close)b"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx ^(?:[^']*'|[^\"]*\"|[^`]*`)[sv]*;"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx x25"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)1.e[(-),]"
+        "category": "ENFORCEMENT",
+        "pattern": "@validateUrlEncoding"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx [\"'`][[{].*[]}][\"'`].*(::.*jsonb?)?.*(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)|(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)[\"'`][[{].*[]}][\"'`]|json_extract.*(.*)"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^(?i)application/x-www-form-urlencoded"
     },
     {
-        "category": "SQLI",
-        "pattern": "@lt 2"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx x25"
     },
     {
-        "category": "SQLI",
-        "pattern": "@lt 2"
+        "category": "ENFORCEMENT",
+        "pattern": "@validateUrlEncoding"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?:^s*[\"'`;]+|[\"'`]+s*$)"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 1"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)!=|&&||||>[=->]|<(?:<|=>?|>(?:[sv]+binary)?)|b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)b|[0-9A-Z_a-z]*?_))|(?:likel(?:ihood|y)|unlikely)[sv]*()|r(?:egexp|like)[sv]+binary|not[sv]+between[sv]+(?:0[sv]+and|(?:'[^']*'|\"[^\"]*\")[sv]+and[sv]+(?:'[^']*'|\"[^\"]*\"))|is[sv]+null|like[sv]+(?:null|[0-9A-Z_a-z]+[sv]+escapeb)|(?:^|[^0-9A-Z_a-z])in[sv+]*([sv\"0-9]+[^(-)]*)|[!<->]{1,2}[sv]*allb"
+        "category": "ENFORCEMENT",
+        "pattern": "@validateUtf8Encoding"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)[sv\"'-)`]*?b([0-9A-Z_a-z]+)b[sv\"'-)`]*?(?:=|<=>|(?:sounds[sv]+)?like|glob|r(?:like|egexp))[sv\"'-)`]*?b([0-9A-Z_a-z]+)b"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx %u[fF]{2}[0-9a-fA-F]{2}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@streq %{TX.2}"
+        "category": "ENFORCEMENT",
+        "pattern": "@validateByteRange 1-255"
+    },
+    {
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 0"
+    },
+    {
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)[sv\"'-)`]*?b([0-9A-Z_a-z]+)b[sv\"'-)`]*?(?:![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(?:like|r(?:like|egexp)))[sv\"'-)`]*?b([0-9A-Z_a-z]+)b"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^$"
     },
     {
-        "category": "SQLI",
-        "pattern": "!@streq %{TX.2}"
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^OPTIONS$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|g(?:lob|roup_concat)|h(?:ex|our)|i(?:f(?:null)?|if|n(?:str)?)|l(?:ast(?:_insert_rowid)?|ength|ike(?:l(?:ihood|y))?|n|o(?:ad_extension|g(?:10|2)?|wer(?:pi)?|cal)|trim)|m(?:ax|in(?:ute)?|o(?:d|nth))|n(?:ullif|ow)|p(?:i|ow(?:er)?|rintf|assword)|quote|r(?:a(?:dians|ndom(?:blob)?)|e(?:p(?:lace|eat)|verse)|ound|trim|ight)|s(?:i(?:gn|nh?)|oundex|q(?:lite_(?:compileoption_(?:get|used)|offset|source_id|version)|rt)|u(?:bstr(?:ing)?|m)|econd|leep)|t(?:anh?|otal(?:_changes)?|r(?:im|unc)|ypeof|ime)|u(?:n(?:icode|likely)|(?:pp|s)er)|zeroblob|bin|v(?:alues|ersion)|week|year)[^0-9A-Z_a-z]*("
+        "category": "ENFORCEMENT",
+        "pattern": "!@pm AppleWebKit Android Business Enterprise Entreprise"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)(?:/*)+[\"'`]+[sv]?(?:--|[#{]|/*)?|[\"'`](?:[sv]*(?:(?:x?or|and|div|like|between)[sv-0-9A-Z_a-z]+[(-)+--<->][sv]*[\"'0-9`]|[!=|](?:[sv -!+-0-9=]+.*?[\"'-(`].*?|[sv -!0-9=]+.*?[0-9]+)$|(?:like|print)[^0-9A-Z_a-z]+[\"'-(0-9A-Z_-z]|;)|(?:[<>~]+|[sv]*[^sv0-9A-Z_a-z]?=[sv]*|[^0-9A-Z_a-z]*?[+=]+[^0-9A-Z_a-z]*?)[\"'`])|[0-9][\"'`][sv]+[\"'`][sv]+[0-9]|^admin[sv]*?[\"'`]|[sv\"'-(`][sv]*?glob[^0-9A-Z_a-z]+[\"'-(0-9A-Z_-z]|[sv]is[sv]*?0[^0-9A-Z_a-z]|where[sv][sv,-.0-9A-Z_a-z]+[sv]="
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i),.*?[\"')0-9`-f][\"'`](?:[\"'`].*?[\"'`]|(?:r?n)?z|[^\"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]*?([sv]*?space[sv]*?("
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^OPTIONS$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)(?:&&||||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[sv(]+[0-9A-Z_a-z]+[sv)]*?[!+=]+[sv0-9]*?[\"'-)=`]|[0-9](?:[sv]*?(?:and|between|div|like|x?or)[sv]*?[0-9]+[sv]*?[+-]|[sv]+group[sv]+by.+()|/[0-9A-Z_a-z]+;?[sv]+(?:and|between|div|having|like|x?or|select)[^0-9A-Z_a-z]|(?:[#;]|--)[sv]*?(?:alter|drop|(?:insert|update)[sv]*?[0-9A-Z_a-z]{2,})|@.+=[sv]*?([sv]*?select|[^0-9A-Z_a-z]SET[sv]*?@[0-9A-Z_a-z]+"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 0"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)[\"'`][sv]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?[\"'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+[\"'`]|like[sv]*?[\"'`]%|select[sv]+?[sv\"'-),-.0-9A-[]_-z]+from[sv]+"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i))[sv]*?when[sv]*?[0-9]+[sv]*?then|[\"'`][sv]*?(?:[#{]|--)|/*![sv]?[0-9]+|b(?:(?:binary|cha?r)[sv]*?([sv]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:egexp|like))[sv]+[0-9A-Z_a-z]+()|(?:|||&&)[sv]*?[0-9A-Z_a-z]+("
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^0$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)(?:([sv]*?select[sv]*?[0-9A-Z_a-z]+|coalesce|order[sv]+by[sv]+if[0-9A-Z_a-z]*?)[sv]*?(|*/from|+[sv]*?[0-9]+[sv]*?+[sv]*?@|[0-9A-Z_a-z][\"'`][sv]*?(?:(?:[+-=@|]+[sv]+?)+|[+-=@|]+)[(0-9]|@@[0-9A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]|[^0-9A-Z_a-z]!+[\"'`][0-9A-Z_a-z]|[\"'`](?:;[sv]*?(?:if|while|begin)|[sv0-9]+=[sv]*?[0-9])|[sv(]+case[0-9]*?[^0-9A-Z_a-z].+[tw]hen[sv(]"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 0"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)[\"'`][sv]*?b(?:x?or|div|like|between|and)b[sv]*?[\"'`]?[0-9]|x5cx(?:2[37]|3d)|^(?:.?[\"'`]$|[\"'x5c`]*?(?:[\"'0-9`]+|[^\"'`]+[\"'`])[sv]*?b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)b[sv]*?[\"'0-9A-Z_-z][!&(-)+-.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?[\"'`][sv]*?[0-9A-Z_a-z]|@(?:[0-9A-Z_a-z]+[sv]+(?:and|x?or|div|like|between)b[sv]*?[\"'0-9`]+|[-0-9A-Z_a-z]+[sv](?:and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?[\"'`].|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx (?:^([d.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$)"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)in[sv]*?(+[sv]*?select|(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)[sv+0-9A-Z_a-z]+(?:regexp[sv]*?(|sounds[sv]+like[sv]*?[\"'`]|[0-9=]+x)|[\"'`](?:[sv]*?(?:[0-9][sv]*?(?:--|#)|is[sv]*?(?:[0-9].+[\"'`]?[0-9A-Z_a-z]|[.0-9]+[sv]*?[^0-9A-Z_a-z].*?[\"'`]))|[%-&<->^]+[0-9][sv]*?(?:=|x?or|div|like|between|and)|(?:[^0-9A-Z_a-z]+[+-0-9A-Z_a-z]+[sv]*?=[sv]*?[0-9][^0-9A-Z_a-z]+||?[-0-9A-Z_a-z]{3,}[^sv,.0-9A-Z_a-z]+)[\"'`]|[sv]*(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)(?:array[sv]*[|[0-9A-Z_a-z]+(?:[sv]*!?~|[sv]+(?:not[sv]+)?similar[sv]+to[sv]+)|(?:tru|fals)eb))|bexcept[sv]+(?:selectb|values[sv]*?()"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 1"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i:^[Wd]+s*?(?:alter|union)b)"
+        "category": "ENFORCEMENT",
+        "pattern": "@gt %{tx.max_num_args}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)[sv]?(?|end[sv]*?);|[sv(]load_file[sv]*?(|[\"'`][sv]+regexp[^0-9A-Z_a-z]|[^A-Z_a-z][sv]+asb[sv]*[\"'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:create[sv]+[0-9A-Z_a-z]+|(?:d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load|(?:renam|truncat)e|u(?:pdate|nion[sv]*(?:all|(?:sele|distin)ct))|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject)))b)"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 1"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)[\"'`](?:[sv]*?(?:(?:*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?[\"'`]|(?:x?or|div|like|between|and)[sv][^0-9]+[-0-9A-Z_a-z]+.*?)[0-9]|[^sv0-9?A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]+[sv]*?[\"'`]|[^sv0-9A-Z_a-z]+[sv]*?[^A-Z_a-z].*?(?:#|--))|.*?*[sv]*?[0-9])|^[\"'`]|[%(-+-<>][-0-9A-Z_a-z]+[^sv0-9A-Z_a-z]+[\"'`][^,]"
+        "category": "ENFORCEMENT",
+        "pattern": "@gt %{tx.arg_name_length}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)b(?:havingb(?:[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')[sv]*?[<->]| ?(?:[0-9]{1,10} ?[<->]+|[\"'][^=]{1,10}[ \"'<-?[]+))|ex(?:ecute(?:(|[sv]{1,5}[$.0-9A-Z_a-z]{1,5}[sv]{0,3})|ists[sv]*?([sv]*?selectb)|(?:create[sv]+?table.{0,20}?|like[^0-9A-Z_a-z]*?char[^0-9A-Z_a-z]*?)()|select.*?case|from.*?limit|order[sv]by|exists[sv](?:[sv]select|s(?:elect[^sv](?:if(?:null)?[sv](|top|concat)|ystem[sv]()|bhavingb[sv]+[0-9]{1,10}|'[^=]{1,10}')"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 1"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)b(?:orb(?:[sv]?(?:[0-9]{1,10}|[\"'][^=]{1,10}[\"'])[sv]?[<->]+|[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|xorb[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|'[sv]+x?or[sv]+.{1,20}[!+-<->]"
+        "category": "ENFORCEMENT",
+        "pattern": "@gt %{tx.arg_length}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)bandb(?:[sv]+(?:[0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|[\"'][^=]{1,10}[\"']) ?[<->]+)"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 1"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)b(?:a(?:(?:b|co)s|dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:in|cii(?:str)?)|tan2?|vg)|b(?:enchmark|i(?:n(?:_to_num)?|t_(?:and|count|length|x?or)))|c(?:ast|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|o(?:alesce|ercibility|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|(?:un)?t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|time(?:stamp)?|user)))|d(?:a(?:t(?:abase|e(?:_(?:add|format|sub)|diff)?)|y(?:name|of(?:month|week|year))?)|count|e(?:code|(?:faul|s_(?:de|en)cryp)t|grees)|ump)|e(?:lt|nc(?:ode|rypt)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:eld(?:_in_set)?|nd_in_set)|loor|o(?:rmat|und_rows)|rom_(?:base64|days|unixtime))|g(?:et_(?:format|lock)|r(?:eates|oup_conca)t)|h(?:ex(?:toraw)?|our)|i(?:f(?:null)?|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)?|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull))|null)?)|l(?:ast(?:_(?:day|insert_id))?|case|e(?:(?:as|f)t|ngth)|n|o(?:ad_file|ca(?:l(?:timestamp)?|te)|g(?:10|2)?|wer)|pad|trim)|m(?:a(?:ke(?:date|_set)|ster_pos_wait|x)|d5|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:d|nth(?:name)?))|n(?:ame_const|o(?:t_in|w)|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:assword|eriod_(?:add|diff)|g_sleep|i|o(?:sition|w(?:er)?)|rocedure_analyse)|qu(?:arter|ote)|r(?:a(?:dians|nd|wto(?:hex|nhex(?:toraw)?))|e(?:lease_lock|p(?:eat|lace)|verse)|ight|o(?:und|w_count)|pad|trim)|s(?:chema|e(?:c(?:ond|_to_time)|ssion_user)|ha[1-2]?|ig?n|leep|oundex|pace|qrt|t(?:d(?:dev(?:_(?:po|sam)p)?)?|r(?:cmp|_to_date))|u(?:b(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|m)|ys(?:date|tem_user))|t(?:an|ime(?:diff|_(?:format|to_sec)|stamp(?:add|diff)?)?|o_(?:base64|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|ix_timestamp)|p(?:datexml|per)|ser|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|v(?:a(?:lues|r(?:iance|_(?:po|sam)p))|ersion)|we(?:ek(?:day|ofyear)?|ight_string)|xmltype|year(?:week)?)[^0-9A-Z_a-z]*?("
+        "category": "ENFORCEMENT",
+        "pattern": "@gt %{tx.total_arg_length}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|oacreate|p(?:assword|repare)|replwritetovarbin)|ql_(?:longvarchar|variant))|utl_(?:file|http)|xp_(?:availablemedia|(?:cmdshel|servicecontro)l|dirtree|e(?:numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(?:_enumdomains)?|reg(?:addmultistring|delete(?:key|value)|enum(?:key|value)s|re(?:ad|movemultistring)|write)|terminate(?:_process)?)"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 1"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)b(?:(?:d(?:bms_[0-9A-Z_a-z]+.|eleteb[^0-9A-Z_a-z]*?bfrom)|(?:groupb.*?bbyb.{1,100}?bhav|overlayb[^0-9A-Z_a-z]*?(.*?b[^0-9A-Z_a-z]*?plac)ing|in(?:nerb[^0-9A-Z_a-z]*?bjoin|sertb[^0-9A-Z_a-z]*?binto|tob[^0-9A-Z_a-z]*?b(?:dump|out)file)|loadb[^0-9A-Z_a-z]*?bdatab.*?binfile|s(?:electb.{1,100}?b(?:(?:.*?bdumpb.*|(?:count|length)b.{1,100}?)bfrom|(?:data_typ|fromb.{1,100}?bwher)e|instr|to(?:_(?:cha|numbe)r|pb.{1,100}?bfrom))|ys_context)|u(?:nionb.{1,100}?bselect|tl_inaddr))b|printb[^0-9A-Z_a-z]*?@@)|(?:collation[^0-9A-Z_a-z]*?(a|@@version|;[^0-9A-Z_a-z]*?b(?:drop|shutdown))b|'(?:dbo|msdasql|s(?:a|qloledb))'"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^(?i)multipart/form-data"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx ((?:[~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>][^~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>]*?){12})"
+        "category": "ENFORCEMENT",
+        "pattern": "@gt %{tx.max_file_size}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx /*!?|*/|[';]--|--(?:[sv]|[^-]*?-)|[^&-]#.*?[sv]|;?x00"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 1"
     },
     {
-        "category": "SQLI",
-        "pattern": "!@rx ^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+.[-0-9A-Z_a-z]+$"
+        "category": "ENFORCEMENT",
+        "pattern": "@gt %{tx.combined_file_sizes}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i:b0x[a-fd]{3,})"
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^[w/.+*-]+(?:s?;s?(?:action|boundary|charset|component|start(?:-info)?|type|version)s?=s?['\"w.()+,/:=?<>@#*-]+)*$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?:`(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)`)"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^[^;s]+"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)[\"'`][sv]*?(?:(?:is[sv]+not|not[sv]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|])"
+        "category": "ENFORCEMENT",
+        "pattern": "!@within %{tx.allowed_request_content_type}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^\"]*?(?:\"[^\"]*?\"[^\"]*?)*?\"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx charsets*=s*[\"']?([^;\"'s]+)"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx ^(?:and|or)$"
+        "category": "ENFORCEMENT",
+        "pattern": "!@within %{tx.allowed_request_content_type_charset}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx ^.*?x5c['\"`](?:.*?['\"`])?s*(?:and|or)b"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx charset.*?charset"
     },
     {
-        "category": "SQLI",
-        "pattern": "@detectSQLi"
+        "category": "ENFORCEMENT",
+        "pattern": "!@within %{tx.allowed_http_versions}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*("
+        "category": "ENFORCEMENT",
+        "pattern": "@rx .([^.]+)$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)"
+        "category": "ENFORCEMENT",
+        "pattern": "@within %{tx.restricted_extensions}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@lt 3"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx .[^.~]+~(?:/.*|)$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@lt 3"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^.*$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?i)W+d*?s*?bhavingbs*?[^s-]"
+        "category": "ENFORCEMENT",
+        "pattern": "@within %{tx.restricted_headers_basic}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx [\"'`][sd]*?[^ws]W*?dW*?.*?[\"'`d]"
+        "category": "ENFORCEMENT",
+        "pattern": "@gt 50"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx ((?:[~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>][^~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>]*?){8})"
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^(?:(?:*|[^!-\"(-),/:-?[-]{}]+)/(?:*|[^!-\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\"?(?:iso-8859-15?|utf-8|windows-1252)b\"?|(?:[^sv -\"(-),/:-?[-]c{}]|c(?:[^!-\"(-),/:-?[-]h{}]|h(?:[^!-\"(-),/:-?[-]a{}]|a(?:[^!-\"(-),/:-?[-]r{}]|r(?:[^!-\"(-),/:-?[-]s{}]|s(?:[^!-\"(-),/:-?[-]e{}]|e[^!-\"(-),/:-?[-]t{}]))))))[^!-\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\"(-),/:-?[-]{}]+)/(?:*|[^!-\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\"?(?:iso-8859-15?|utf-8|windows-1252)b\"?|(?:[^sv -\"(-),/:-?[-]c{}]|c(?:[^!-\"(-),/:-?[-]h{}]|h(?:[^!-\"(-),/:-?[-]a{}]|a(?:[^!-\"(-),/:-?[-]r{}]|r(?:[^!-\"(-),/:-?[-]s{}]|s(?:[^!-\"(-),/:-?[-]e{}]|e[^!-\"(-),/:-?[-]t{}]))))))[^!-\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx ((?:[~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>][^~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>]*?){6})"
+        "category": "ENFORCEMENT",
+        "pattern": "!@streq JSON"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx W{4}"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx (?i)x5cu[0-9a-f]{4}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx (?:'(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)')"
+        "category": "ENFORCEMENT",
+        "pattern": "@contains #"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx ';"
+        "category": "ENFORCEMENT",
+        "pattern": "@gt 1"
     },
     {
-        "category": "SQLI",
-        "pattern": "@lt 4"
+        "category": "ENFORCEMENT",
+        "pattern": "@lt 2"
     },
     {
-        "category": "SQLI",
-        "pattern": "@lt 4"
+        "category": "ENFORCEMENT",
+        "pattern": "@lt 2"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx ((?:[~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>][^~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>]*?){3})"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}"
     },
     {
-        "category": "SQLI",
-        "pattern": "@rx ((?:[~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>][^~!@#$%^&*()-+={}[]|:;\"'\u00b4\u2019\u2018`<>]*?){2})"
+        "category": "ENFORCEMENT",
+        "pattern": "!@endsWith .pdf"
     },
     {
-        "category": "FIXATION",
-        "pattern": "@lt 1"
+        "category": "ENFORCEMENT",
+        "pattern": "@endsWith .pdf"
     },
     {
-        "category": "FIXATION",
-        "pattern": "@lt 1"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){63}"
     },
     {
-        "category": "FIXATION",
-        "pattern": "@rx (?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx %[0-9a-fA-F]{2}"
     },
     {
-        "category": "FIXATION",
-        "pattern": "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$"
+        "category": "ENFORCEMENT",
+        "pattern": "@validateByteRange 9,10,13,32-126,128-255"
     },
     {
-        "category": "FIXATION",
-        "pattern": "@rx ^(?:ht|f)tps?://(.*?)/"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 0"
     },
     {
-        "category": "FIXATION",
-        "pattern": "!@endsWith %{request_headers.host}"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ['\";=]"
     },
     {
-        "category": "FIXATION",
-        "pattern": "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$"
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^0$"
     },
     {
-        "category": "FIXATION",
+        "category": "ENFORCEMENT",
         "pattern": "@eq 0"
     },
     {
-        "category": "FIXATION",
-        "pattern": "@lt 2"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^.*$"
     },
     {
-        "category": "FIXATION",
-        "pattern": "@lt 2"
+        "category": "ENFORCEMENT",
+        "pattern": "@within %{tx.restricted_headers_extended}"
     },
     {
-        "category": "FIXATION",
+        "category": "ENFORCEMENT",
         "pattern": "@lt 3"
     },
     {
-        "category": "FIXATION",
+        "category": "ENFORCEMENT",
         "pattern": "@lt 3"
     },
     {
-        "category": "FIXATION",
-        "pattern": "@lt 4"
+        "category": "ENFORCEMENT",
+        "pattern": "@validateByteRange 32-36,38-126"
     },
     {
-        "category": "FIXATION",
-        "pattern": "@lt 4"
+        "category": "ENFORCEMENT",
+        "pattern": "@eq 0"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 1"
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^(?:OPTIONS|CONNECT)$"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 1"
+        "category": "ENFORCEMENT",
+        "pattern": "!@pm AppleWebKit Android"
     },
     {
-        "category": "JAVA",
-        "pattern": "@rx java.lang.(?:runtime|processbuilder)"
+        "category": "ENFORCEMENT",
+        "pattern": "@ge 1"
     },
     {
-        "category": "JAVA",
-        "pattern": "@rx (?:runtime|processbuilder)"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^(?i)up"
+    },
+    {
+        "category": "ENFORCEMENT",
+        "pattern": "@gt 0"
+    },
+    {
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:s*,s*|$)){1,7}$"
     },
     {
-        "category": "JAVA",
-        "pattern": "@rx (?:unmarshaller|base64data|java.)"
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx br|compress|deflate|(?:pack200-)?gzip|identity|*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)"
     },
     {
-        "category": "JAVA",
-        "pattern": "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)"
+        "category": "ENFORCEMENT",
+        "pattern": "@lt 4"
     },
     {
-        "category": "JAVA",
-        "pattern": "@rx (?:runtime|processbuilder)"
+        "category": "ENFORCEMENT",
+        "pattern": "@lt 4"
     },
     {
-        "category": "JAVA",
-        "pattern": "@pmFromFile java-classes.data"
+        "category": "ENFORCEMENT",
+        "pattern": "@endsWith .pdf"
     },
     {
-        "category": "JAVA",
-        "pattern": "@rx .*.(?:jsp|jspx).*$"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}"
     },
     {
-        "category": "JAVA",
-        "pattern": "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)"
+        "category": "ENFORCEMENT",
+        "pattern": "@validateByteRange 38,44-46,48-58,61,65-90,95,97-122"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 2"
+        "category": "ENFORCEMENT",
+        "pattern": "@validateByteRange 32,34,38,42-59,61,65-90,95,97-122"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 2"
+        "category": "ENFORCEMENT",
+        "pattern": "!@rx ^(?:?[01])?$"
     },
     {
-        "category": "JAVA",
-        "pattern": "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)"
+        "category": "ENFORCEMENT",
+        "pattern": "@rx (?:^|[^x5c])x5c[cdeghijklmpqwxyz123456789]"
     },
     {
         "category": "JAVA",
-        "pattern": "@rx xacxedx00x05"
+        "pattern": "@lt 1"
     },
     {
         "category": "JAVA",
-        "pattern": "@rx (?:rO0ABQ|KztAAU|Cs7QAF)"
+        "pattern": "@lt 1"
     },
     {
         "category": "JAVA",
-        "pattern": "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)"
+        "pattern": "@pmFromFile java-code-leakages.data"
     },
     {
         "category": "JAVA",
-        "pattern": "@rx javab.+(?:runtime|processbuilder)"
+        "pattern": "@pmFromFile java-errors.data"
     },
     {
         "category": "JAVA",
-        "pattern": "@rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)"
+        "pattern": "@lt 2"
     },
     {
         "category": "JAVA",
-        "pattern": "@lt 3"
+        "pattern": "@lt 2"
     },
     {
         "category": "JAVA",
@@ -1857,7 +1757,7 @@
     },
     {
         "category": "JAVA",
-        "pattern": "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)"
+        "pattern": "@lt 3"
     },
     {
         "category": "JAVA",
@@ -1868,399 +1768,427 @@
         "pattern": "@lt 4"
     },
     {
-        "category": "JAVA",
-        "pattern": "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)"
-    },
-    {
-        "category": "EVALUATION",
-        "pattern": "@ge 1"
-    },
-    {
-        "category": "EVALUATION",
-        "pattern": "@ge 1"
+        "category": "ATTACK",
+        "pattern": "@lt 1"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 2"
+        "category": "ATTACK",
+        "pattern": "@lt 1"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 2"
+        "category": "ATTACK",
+        "pattern": "@rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 3"
+        "category": "ATTACK",
+        "pattern": "@rx [rn]W*?(?:content-(?:type|length)|set-cookie|location):s*w"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 3"
+        "category": "ATTACK",
+        "pattern": "@rx (?:bhttp/d|<(?:html|meta)b)"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 4"
+        "category": "ATTACK",
+        "pattern": "@rx [nr]"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 4"
+        "category": "ATTACK",
+        "pattern": "@rx [nr]"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 1"
+        "category": "ATTACK",
+        "pattern": "@rx [nr]+(?:s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*:"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 1"
+        "category": "ATTACK",
+        "pattern": "@rx [nr]"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 2"
+        "category": "ATTACK",
+        "pattern": "@rx ^[^:()&|!<>~]*)s*(?:((?:[^,()=&|!<>~]+[><~]?=|s*[&!|]s*(?:)|()?s*)|)s*(s*[&|!]s*|[&!|]s*([^()=&|!<>~]+[><~]?=[^:()&|!<>~]*)"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 2"
+        "category": "ATTACK",
+        "pattern": "@rx ^[^sv,;]+[sv,;].*?(?:application/(?:.++)?json|(?:application/(?:soap+)?|text/)xml)"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 3"
+        "category": "ATTACK",
+        "pattern": "@rx unix:[^|]*|"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 3"
+        "category": "ATTACK",
+        "pattern": "@lt 2"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 4"
+        "category": "ATTACK",
+        "pattern": "@lt 2"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge 4"
+        "category": "ATTACK",
+        "pattern": "@rx [nr]"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge %{tx.inbound_anomaly_score_threshold}"
+        "category": "ATTACK",
+        "pattern": "@rx ^[^sv,;]+[sv,;].*?b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([+/]))b"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@eq 1"
+        "category": "ATTACK",
+        "pattern": "@lt 3"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@ge %{tx.inbound_anomaly_score_threshold}"
+        "category": "ATTACK",
+        "pattern": "@lt 3"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@lt 1"
+        "category": "ATTACK",
+        "pattern": "@gt 0"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@lt 1"
+        "category": "ATTACK",
+        "pattern": "@rx ."
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@lt 2"
+        "category": "ATTACK",
+        "pattern": "@gt 1"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@lt 2"
+        "category": "ATTACK",
+        "pattern": "@rx TX:paramcounter_(.*)"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@lt 3"
+        "category": "ATTACK",
+        "pattern": "@rx (][^]]+$|][^]]+[)"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@lt 3"
+        "category": "ATTACK",
+        "pattern": "@lt 4"
     },
     {
-        "category": "EVALUATION",
+        "category": "ATTACK",
         "pattern": "@lt 4"
     },
     {
-        "category": "EVALUATION",
-        "pattern": "@lt 4"
+        "category": "ATTACK",
+        "pattern": "@rx ["
     },
     {
-        "category": "LEAKAGES",
+        "category": "PHP",
         "pattern": "@lt 1"
     },
     {
-        "category": "LEAKAGES",
+        "category": "PHP",
         "pattern": "@lt 1"
     },
     {
-        "category": "LEAKAGES",
-        "pattern": "@rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>[To Parent Directory]</[Aa]><br>)"
+        "category": "PHP",
+        "pattern": "@pmFromFile php-errors.data"
     },
     {
-        "category": "LEAKAGES",
-        "pattern": "@rx ^#!s?/"
+        "category": "PHP",
+        "pattern": "@rx (?:b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|$_(?:(?:pos|ge)t|session))b"
     },
     {
-        "category": "LEAKAGES",
+        "category": "PHP",
+        "pattern": "@rx (?i)<?(?:=|php)?s+"
+    },
+    {
+        "category": "PHP",
         "pattern": "@lt 2"
     },
     {
-        "category": "LEAKAGES",
+        "category": "PHP",
         "pattern": "@lt 2"
     },
     {
-        "category": "LEAKAGES",
-        "pattern": "@rx ^5d{2}$"
+        "category": "PHP",
+        "pattern": "@pmFromFile php-errors-pl2.data"
     },
     {
-        "category": "LEAKAGES",
+        "category": "PHP",
         "pattern": "@lt 3"
     },
     {
-        "category": "LEAKAGES",
+        "category": "PHP",
         "pattern": "@lt 3"
     },
     {
-        "category": "LEAKAGES",
+        "category": "PHP",
         "pattern": "@lt 4"
     },
     {
-        "category": "LEAKAGES",
+        "category": "PHP",
         "pattern": "@lt 4"
     },
     {
-        "category": "SQL",
+        "category": "RCE",
         "pattern": "@lt 1"
     },
     {
-        "category": "SQL",
+        "category": "RCE",
         "pattern": "@lt 1"
     },
     {
-        "category": "SQL",
-        "pattern": "!@pmFromFile sql-errors.data"
+        "category": "RCE",
+        "pattern": "@rx (?i)(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:7[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:(?:b[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|[ckz][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[&,<>|]|(?:[--.0-9A-Z_a-z][\"'[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#*-0-9?-@_a-{]*)?x5c?)+[sv&,<>|]).*|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:4|[sv&),<>|].*))|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*)?|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|(?:e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)b"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])"
+        "category": "RCE",
+        "pattern": "@rx (?i)(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[sv&)<>|]|a(?:dd(?:group|user)|getty|l(?:ias|pine)[sv&)<>|]|nsible-playbook|pt(?:-get|itude[sv&)<>|])|r(?:ch[sv&)<>|]|ia2c)|s(?:cii(?:-xfr|85)|pell)|tobm|xel)|b(?:a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu)|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:a(?:ncel|psh)[sv&)<>|]|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|p(?:an|io|ulimit)|r(?:ash[sv&)<>|]|on(?:tab)?)|s(?:plit|vtool)|u(?:psfilter|rl[sv&)<>|]))|d(?:(?:a(?:sh|te)|i(?:alog|ff))[sv&)<>|]|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:2fsck|(?:asy_instal|va)l|cho[sv&)<>|]|fax|grep|macs|n(?:d(?:if|sw)|v-update)|sac|x(?:ec[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r)))|f(?:acter|(?:etch|lock|unction)[sv&)<>|]|grep|i(?:le(?:[sv&)<>|]|test)|(?:n(?:d|ger)|sh)[sv&)<>|])|o(?:ld[sv&)<>|]|reach)|ping|tp(?:stats|who))|g(?:awk[sv&)<>|]|core|e(?:ni(?:e[sv&)<>|]|soimage)|tfacl[sv&)<>|])|hci|i(?:mp[sv&)<>|]|nsh)|r(?:ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:conv|f(?:config|top)|nstall[sv&)<>|]|onice|p(?:6?tables|config)|spell)|j(?:ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:ill(?:[sv&)<>|]|all)|nife[sv&)<>|]|sshell)|l(?:a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|dconfig|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|(?:inks|ynx)[sv&)<>|]|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:il(?:[sv&)<>q|]|x[sv&)<>|])|ke[sv&)<>|]|ster.passwd|wk)|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|utt[sv&)<>|]|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:a(?:no[sv&)<>|]|sm|wk)|c(?:.(?:openbsd|traditional)|at)|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan))|(?:ice|ull)[sv&)<>|]|map|o(?:de[sv&)<>|]|hup)|ping|roff|s(?:enter|lookup|tat))|o(?:ctave[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:f(?:la)?tex|ksh)|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|(?:ft|gre)p|hp(?:-cgi|[57])|i(?:(?:co|ng)[sv&)<>|]|dstat|gz)|k(?:exec|g_?info|ill)|opd|rint(?:env|f[sv&)<>|])|s(?:ed|ftp|ql)|tar(?:diff|grep)?|u(?:ppet[sv&)<>|]|shd)|wd.db|ython[^sv])|r(?:ak(?:e[sv&)<>|]|u)|bash|e(?:a(?:delf|lpath)|(?:dcarpet|name|p(?:eat|lace))[sv&)<>|]|stic)|l(?:ogin|wrap)|m(?:dir[sv&)<>|]|user)|nano|oute[sv&)<>|]|pm(?:db|(?:quer|verif)y)|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:(?:ash|nap)[sv&)<>|]|c(?:hed|r(?:een|ipt)[sv&)<>|])|diff|e(?:(?:lf|rvice)[sv&)<>|]|ndmail|t(?:arch|env|facl[sv&)<>|]|sid))|ftp|h(?:.distrib|(?:adow|ells)[sv&)<>|]|u(?:f|tdown[sv&)<>|]))|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|sh(?:-key(?:ge|sca)n|pass)|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|udo|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|c(?:l?sh|p(?:dump|ing|traceroute))|elnet|ftp|ime(?:(?:out)?[sv&)<>|]|datectl)|mux|ouch[sv&)<>|]|r(?:aceroute6?|off)|shark)|u(?:limit[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:ew[sv&)<>|]|gr|mdiff|pw|rsh)|olatility[sv&)<>|])|w(?:a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:args|e(?:la)?tex|mo(?:dmap|re)|pad|term|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|s(?:oelim|td(?:(?:ca|m)t|grep|less)?)|ypper))"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)"
+        "category": "RCE",
+        "pattern": "@pmFromFile windows-powershell-commands.data"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i:DB2 SQL error:|[IBM][CLI Driver][DB2/6000]|CLI Driver.*DB2|DB2 SQL error|db2_w+()"
+        "category": "RCE",
+        "pattern": "@rx (?i)(?:[nr;`{]|||?|&&?)[sv]*[sv\"'-(,@]*(?:[\"'.-9A-Z_a-z]+/|(?:[\"'x5c^]*[0-9A-Z_a-z][\"'x5c^]*:.*|[ \"'.-9A-Zx5c^-_a-z]*)x5c)?[\"^]*(?:(?:a[\"^]*(?:c|s[\"^]*n[\"^]*p)|e[\"^]*(?:b[\"^]*p|p[\"^]*(?:a[\"^]*l|c[\"^]*s[\"^]*v|s[\"^]*n)|[tx][\"^]*s[\"^]*n)|f[\"^]*(?:[cltw]|o[\"^]*r[\"^]*e[\"^]*a[\"^]*c[\"^]*h)|i[\"^]*(?:[cr][\"^]*m|e[\"^]*x|h[\"^]*y|i|p[\"^]*(?:a[\"^]*l|c[\"^]*s[\"^]*v|m[\"^]*o|s[\"^]*n)|s[\"^]*e|w[\"^]*(?:m[\"^]*i|r))|m[\"^]*(?:a[\"^]*n|[dipv]|o[\"^]*u[\"^]*n[\"^]*t)|o[\"^]*g[\"^]*v|p[\"^]*(?:o[\"^]*p|u[\"^]*s[\"^]*h)[\"^]*d|t[\"^]*r[\"^]*c[\"^]*m|w[\"^]*j[\"^]*b)[\"^]*[sv,.-/;-<>].*|c[\"^]*(?:(?:(?:d|h[\"^]*d[\"^]*i[\"^]*r|v[\"^]*p[\"^]*a)[\"^]*|p[\"^]*(?:[ip][\"^]*)?)[sv,.-/;-<>].*|l[\"^]*(?:(?:[cipv]|h[\"^]*y)[\"^]*[sv,.-/;-<>].*|s)|n[\"^]*s[\"^]*n)|d[\"^]*(?:(?:b[\"^]*p|e[\"^]*l|i[\"^]*(?:f[\"^]*f|r))[\"^]*[sv,.-/;-<>].*|n[\"^]*s[\"^]*n)|g[\"^]*(?:(?:(?:(?:a[\"^]*)?l|b[\"^]*p|d[\"^]*r|h[\"^]*y|(?:w[\"^]*m[\"^]*)?i|j[\"^]*b|[u-v])[\"^]*|c[\"^]*(?:[ims][\"^]*)?|m[\"^]*(?:o[\"^]*)?|s[\"^]*(?:n[\"^]*(?:p[\"^]*)?|v[\"^]*))[sv,.-/;-<>].*|e[\"^]*r[\"^]*r|p[\"^]*(?:(?:s[\"^]*)?[sv,.-/;-<>].*|v))|l[\"^]*s|n[\"^]*(?:(?:a[\"^]*l|d[\"^]*r|[iv]|m[\"^]*o|s[\"^]*n)[\"^]*[sv,.-/;-<>].*|p[\"^]*s[\"^]*s[\"^]*c)|r[\"^]*(?:(?:(?:(?:b[\"^]*)?p|e[\"^]*n|(?:w[\"^]*m[\"^]*)?i|j[\"^]*b|n[\"^]*[ip])[\"^]*|d[\"^]*(?:r[\"^]*)?|m[\"^]*(?:(?:d[\"^]*i[\"^]*r|o)[\"^]*)?|s[\"^]*n[\"^]*(?:p[\"^]*)?|v[\"^]*(?:p[\"^]*a[\"^]*)?)[sv,.-/;-<>].*|c[\"^]*(?:j[\"^]*b[\"^]*[sv,.-/;-<>].*|s[\"^]*n)|u[\"^]*j[\"^]*b)|s[\"^]*(?:(?:(?:a[\"^]*(?:j[\"^]*b|l|p[\"^]*s|s[\"^]*v)|b[\"^]*p|[civ]|w[\"^]*m[\"^]*i)[\"^]*|l[\"^]*(?:s[\"^]*)?|p[\"^]*(?:(?:j[\"^]*b|p[\"^]*s|s[\"^]*v)[\"^]*)?)[sv,.-/;-<>].*|h[\"^]*c[\"^]*m|u[\"^]*j[\"^]*b))(?:.[\"^]*[0-9A-Z_a-z]+)?b"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)"
+        "category": "RCE",
+        "pattern": "@rx $(?:((?:.*|(.*)))|{.*})|[<>](.*)|/[0-9A-Z_a-z]*[!?.+]"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i)Dynamic SQL Error"
+        "category": "RCE",
+        "pattern": "@rx b(?:for(?:/[dflr].*)? %+[^ ]+ in(.*)[sv]?do|if(?:/i)?(?: not)?(?: (?:e(?:xist|rrorlevel)|defined|cmdextversion)b|[ (].*(?:b(?:g(?:eq|tr)|equ|neq|l(?:eq|ss))b|==)))"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i)Exception (?:condition )?d+. Transaction rollback."
+        "category": "RCE",
+        "pattern": "@rx (?i)(?:^|=)[sv]*(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:7[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:b[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|[ckz][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|(?:h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)[sv&)<>|]"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i)org.hsqldb.jdbc"
+        "category": "RCE",
+        "pattern": "@rx (?i)(?:^|=)[sv]*(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:a(?:ddgroup|xel)|b(?:ase(?:32|64|nc)|lkid|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|yobu|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:h(?:g(?:passwd|rp)|pass|sh)|lang++|oproc|ron)|d(?:iff[sv&)<>|]|mesg|oas)|e(?:2fsck|grep)|f(?:grep|iletest|tp(?:stats|who))|g(?:r(?:ep[sv&)<>|]|oupmod)|unzip|z(?:cat|exe|ip))|htop|l(?:ast(?:comm|log(?:in)?)|ess(?:echo|(?:fil|pip)e)|ftp(?:get)?|osetup|s(?:-F|b_release|cpu|mod|of|pci|usb)|wp-download|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:ilq|ster.passwd)|k(?:fifo|nod|temp)|locate|ysql(?:admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:.(?:openbsd|traditional)|at)|et(?:(?:c|st)at|kit-ftp|plan)|ohup|ping|stat)|onintr|p(?:dksh|erl5?|(?:ft|gre)p|hp(?:-cgi|[57])|igz|k(?:exec|ill)|(?:op|se)d|rint(?:env|f[sv&)<>|])|tar(?:diff|grep)?|wd.db|ython[2-3])|r(?:(?:bas|ealpat)h|m(?:dir[sv&)<>|]|user)|nano|sync)|s(?:diff|e(?:ndmail|t(?:env|sid))|ftp|(?:h.distri|pwd.d)b|ocat|td(?:err|in|out)|udo|ysctl)|t(?:ailf|c(?:p(?:ing|traceroute)|sh)|elnet|imeout[sv&)<>|]|raceroute6?)|u(?:n(?:ame|lz(?:4|ma)|(?:pig|x)z|rar|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:gr|pw)|w(?:get|hoami)|x(?:args|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:c(?:at|mp)|diff|[e-f]?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|std(?:(?:ca|m)t|grep|less)?))"
+    },
+    {
+        "category": "RCE",
+        "pattern": "!@rx [0-9]s*'s*[0-9]"
+    },
+    {
+        "category": "RCE",
+        "pattern": "@rx !-d"
+    },
+    {
+        "category": "RCE",
+        "pattern": "@pmFromFile unix-shell.data"
+    },
+    {
+        "category": "RCE",
+        "pattern": "@rx ^(s*)s+{"
+    },
+    {
+        "category": "RCE",
+        "pattern": "@rx ^(s*)s+{"
+    },
+    {
+        "category": "RCE",
+        "pattern": "@rx ba[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?sb[sv]+[!-\"%',0-9@-Z_a-z]+=[^sv]"
+    },
+    {
+        "category": "RCE",
+        "pattern": "@pmFromFile restricted-upload.data"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception.*Informix)"
+        "category": "RCE",
+        "pattern": "@rx (?i)(?:t[\"^]*i[\"^]*m[\"^]*e|[nr;`{]|||?|&&?)[sv]*[sv\"'-(,@]*(?:[\"'.-9A-Z_a-z]+/|(?:[\"'x5c^]*[0-9A-Z_a-z][\"'x5c^]*:.*|[ \"'.-9A-Zx5c^-_a-z]*)x5c)?[\"^]*(?:a[\"^]*(?:c[\"^]*c[\"^]*c[\"^]*h[\"^]*e[\"^]*c[\"^]*k[\"^]*c[\"^]*o[\"^]*n[\"^]*s[\"^]*o[\"^]*l[\"^]*e|d[\"^]*(?:p[\"^]*l[\"^]*u[\"^]*s|v[\"^]*p[\"^]*a[\"^]*c[\"^]*k)|(?:g[\"^]*e[\"^]*n[\"^]*t[\"^]*e[\"^]*x[\"^]*e[\"^]*c[\"^]*u[\"^]*t[\"^]*o|s[\"^]*p[\"^]*n[\"^]*e[\"^]*t[\"^]*_[\"^]*c[\"^]*o[\"^]*m[\"^]*p[\"^]*i[\"^]*l[\"^]*e)[\"^]*r|p[\"^]*p[\"^]*(?:i[\"^]*n[\"^]*s[\"^]*t[\"^]*a[\"^]*l[\"^]*l[\"^]*e[\"^]*r|v[\"^]*l[\"^]*p)|t[\"^]*(?:[sv,.-/;-<>].*|b[\"^]*r[\"^]*o[\"^]*k[\"^]*e[\"^]*r))|b[\"^]*(?:a[\"^]*s[\"^]*h|g[\"^]*i[\"^]*n[\"^]*f[\"^]*o|i[\"^]*t[\"^]*s[\"^]*a[\"^]*d[\"^]*m[\"^]*i[\"^]*n)|c[\"^]*(?:d[\"^]*b|e[\"^]*r[\"^]*t[\"^]*(?:o[\"^]*c|r[\"^]*e[\"^]*q|u[\"^]*t[\"^]*i[\"^]*l)|l[\"^]*_[\"^]*(?:i[\"^]*n[\"^]*v[\"^]*o[\"^]*c[\"^]*a[\"^]*t[\"^]*i[\"^]*o[\"^]*n|l[\"^]*o[\"^]*a[\"^]*d[\"^]*a[\"^]*s[\"^]*s[\"^]*e[\"^]*m[\"^]*b[\"^]*l[\"^]*y|m[\"^]*u[\"^]*t[\"^]*e[\"^]*x[\"^]*v[\"^]*e[\"^]*r[\"^]*i[\"^]*f[\"^]*i[\"^]*e[\"^]*r[\"^]*s)|m[\"^]*(?:d(?:[\"^]*(?:k[\"^]*e[\"^]*y|l[\"^]*3[\"^]*2))?|s[\"^]*t[\"^]*p)|o[\"^]*(?:m[\"^]*s[\"^]*v[\"^]*c[\"^]*s|n[\"^]*(?:f[\"^]*i[\"^]*g[\"^]*s[\"^]*e[\"^]*c[\"^]*u[\"^]*r[\"^]*i[\"^]*t[\"^]*y[\"^]*p[\"^]*o[\"^]*l[\"^]*i[\"^]*c[\"^]*y|h[\"^]*o[\"^]*s[\"^]*t|t[\"^]*r[\"^]*o[\"^]*l)|r[\"^]*e[\"^]*g[\"^]*e[\"^]*n)|r[\"^]*e[\"^]*a[\"^]*t[\"^]*e[\"^]*d[\"^]*u[\"^]*m[\"^]*p|s[\"^]*(?:c(?:[\"^]*r[\"^]*i[\"^]*p[\"^]*t)?|i)|u[\"^]*s[\"^]*t[\"^]*o[\"^]*m[\"^]*s[\"^]*h[\"^]*e[\"^]*l[\"^]*l[\"^]*h[\"^]*o[\"^]*s[\"^]*t)|d[\"^]*(?:a[\"^]*t[\"^]*a[\"^]*s[\"^]*v[\"^]*c[\"^]*u[\"^]*t[\"^]*i[\"^]*l|e[\"^]*(?:f[\"^]*a[\"^]*u[\"^]*l[\"^]*t[\"^]*p[\"^]*a[\"^]*c[\"^]*k|s[\"^]*k(?:[\"^]*t[\"^]*o[\"^]*p[\"^]*i[\"^]*m[\"^]*g[\"^]*d[\"^]*o[\"^]*w[\"^]*n[\"^]*l[\"^]*d[\"^]*r)?|v[\"^]*(?:i[\"^]*c[\"^]*e[\"^]*c[\"^]*r[\"^]*e[\"^]*d[\"^]*e[\"^]*n[\"^]*t[\"^]*i[\"^]*a[\"^]*l[\"^]*d[\"^]*e[\"^]*p[\"^]*l[\"^]*o[\"^]*y[\"^]*m[\"^]*e[\"^]*n[\"^]*t|t[\"^]*o[\"^]*o[\"^]*l[\"^]*s[\"^]*l[\"^]*a[\"^]*u[\"^]*n[\"^]*c[\"^]*h[\"^]*e[\"^]*r))|f[\"^]*s[\"^]*(?:h[\"^]*i[\"^]*m|v[\"^]*c)|i[\"^]*(?:a[\"^]*n[\"^]*t[\"^]*z|s[\"^]*k[\"^]*s[\"^]*h[\"^]*a[\"^]*d[\"^]*o[\"^]*w)|n[\"^]*(?:s[\"^]*c[\"^]*m[\"^]*d|x)|o[\"^]*t[\"^]*n[\"^]*e[\"^]*t|u[\"^]*m[\"^]*p[\"^]*6[\"^]*4|x[\"^]*c[\"^]*a[\"^]*p)|e[\"^]*(?:s[\"^]*e[\"^]*n[\"^]*t[\"^]*u[\"^]*t[\"^]*l|v[\"^]*e[\"^]*n[\"^]*t[\"^]*v[\"^]*w[\"^]*r|x[\"^]*(?:c[\"^]*e[\"^]*l|p[\"^]*(?:a[\"^]*n[\"^]*d|l[\"^]*o[\"^]*r[\"^]*e[\"^]*r)|t[\"^]*(?:e[\"^]*x[\"^]*p[\"^]*o[\"^]*r[\"^]*t|r[\"^]*a[\"^]*c[\"^]*3[\"^]*2)))|f[\"^]*(?:i[\"^]*n[\"^]*(?:d[\"^]*s[\"^]*t|g[\"^]*e)[\"^]*r|l[\"^]*t[\"^]*m[\"^]*c|o[\"^]*r[\"^]*f[\"^]*i[\"^]*l[\"^]*e[\"^]*s|s[\"^]*(?:i(?:[\"^]*a[\"^]*n[\"^]*y[\"^]*c[\"^]*p[\"^]*u)?|u[\"^]*t[\"^]*i[\"^]*l)|t[\"^]*p)|g[\"^]*(?:f[\"^]*x[\"^]*d[\"^]*o[\"^]*w[\"^]*n[\"^]*l[\"^]*o[\"^]*a[\"^]*d[\"^]*w[\"^]*r[\"^]*a[\"^]*p[\"^]*p[\"^]*e[\"^]*r|p[\"^]*s[\"^]*c[\"^]*r[\"^]*i[\"^]*p[\"^]*t)|h[\"^]*h|i[\"^]*(?:e[\"^]*(?:4[\"^]*u[\"^]*i[\"^]*n[\"^]*i[\"^]*t|a[\"^]*d[\"^]*v[\"^]*p[\"^]*a[\"^]*c[\"^]*k|e[\"^]*x[\"^]*e[\"^]*c|f[\"^]*r[\"^]*a[\"^]*m[\"^]*e)|l[\"^]*a[\"^]*s[\"^]*m|m[\"^]*e[\"^]*w[\"^]*d[\"^]*b[\"^]*l[\"^]*d|n[\"^]*(?:f[\"^]*d[\"^]*e[\"^]*f[\"^]*a[\"^]*u[\"^]*l[\"^]*t[\"^]*i[\"^]*n[\"^]*s[\"^]*t[\"^]*a[\"^]*l|s[\"^]*t[\"^]*a[\"^]*l[\"^]*l[\"^]*u[\"^]*t[\"^]*i)[\"^]*l)|j[\"^]*s[\"^]*c|l[\"^]*(?:a[\"^]*u[\"^]*n[\"^]*c[\"^]*h[\"^]*-[\"^]*v[\"^]*s[\"^]*d[\"^]*e[\"^]*v[\"^]*s[\"^]*h[\"^]*e[\"^]*l[\"^]*l|d[\"^]*i[\"^]*f[\"^]*d[\"^]*e)|m[\"^]*(?:a[\"^]*(?:k[\"^]*e[\"^]*c[\"^]*a[\"^]*b|n[\"^]*a[\"^]*g[\"^]*e[\"^]*-[\"^]*b[\"^]*d[\"^]*e|v[\"^]*i[\"^]*n[\"^]*j[\"^]*e[\"^]*c[\"^]*t)|f[\"^]*t[\"^]*r[\"^]*a[\"^]*c[\"^]*e|i[\"^]*c[\"^]*r[\"^]*o[\"^]*s[\"^]*o[\"^]*f[\"^]*t|m[\"^]*c|p[\"^]*c[\"^]*m[\"^]*d[\"^]*r[\"^]*u[\"^]*n|s[\"^]*(?:(?:b[\"^]*u[\"^]*i[\"^]*l|o[\"^]*h[\"^]*t[\"^]*m[\"^]*e)[\"^]*d|c[\"^]*o[\"^]*n[\"^]*f[\"^]*i[\"^]*g|d[\"^]*(?:e[\"^]*p[\"^]*l[\"^]*o[\"^]*y|t)|h[\"^]*t[\"^]*(?:a|m[\"^]*l)|i[\"^]*e[\"^]*x[\"^]*e[\"^]*c|p[\"^]*u[\"^]*b|x[\"^]*s[\"^]*l))|n[\"^]*(?:e[\"^]*t[\"^]*s[\"^]*h|t[\"^]*d[\"^]*s[\"^]*u[\"^]*t[\"^]*i[\"^]*l)|o[\"^]*(?:d[\"^]*b[\"^]*c[\"^]*c[\"^]*o[\"^]*n[\"^]*f|f[\"^]*f[\"^]*l[\"^]*i[\"^]*n[\"^]*e[\"^]*s[\"^]*c[\"^]*a[\"^]*n[\"^]*n[\"^]*e[\"^]*r[\"^]*s[\"^]*h[\"^]*e[\"^]*l[\"^]*l|n[\"^]*e[\"^]*d[\"^]*r[\"^]*i[\"^]*v[\"^]*e[\"^]*s[\"^]*t[\"^]*a[\"^]*n[\"^]*d[\"^]*a[\"^]*l[\"^]*o[\"^]*n[\"^]*e[\"^]*u[\"^]*p[\"^]*d[\"^]*a[\"^]*t[\"^]*e[\"^]*r|p[\"^]*e[\"^]*n[\"^]*c[\"^]*o[\"^]*n[\"^]*s[\"^]*o[\"^]*l[\"^]*e)|p[\"^]*(?:c[\"^]*(?:a[\"^]*l[\"^]*u[\"^]*a|w[\"^]*(?:r[\"^]*u[\"^]*n|u[\"^]*t[\"^]*l))|(?:e[\"^]*s[\"^]*t[\"^]*e|s)[\"^]*r|(?:k[\"^]*t[\"^]*m[\"^]*o|u[\"^]*b[\"^]*p[\"^]*r)[\"^]*n|n[\"^]*p[\"^]*u[\"^]*t[\"^]*i[\"^]*l|o[\"^]*w[\"^]*e[\"^]*r[\"^]*p[\"^]*n[\"^]*t|r[\"^]*(?:e[\"^]*s[\"^]*e[\"^]*n[\"^]*t[\"^]*a[\"^]*t[\"^]*i[\"^]*o[\"^]*n[\"^]*h[\"^]*o[\"^]*s[\"^]*t|i[\"^]*n[\"^]*t(?:[\"^]*b[\"^]*r[\"^]*m)?|o[\"^]*(?:c[\"^]*d[\"^]*u[\"^]*m[\"^]*p|t[\"^]*o[\"^]*c[\"^]*o[\"^]*l[\"^]*h[\"^]*a[\"^]*n[\"^]*d[\"^]*l[\"^]*e[\"^]*r)))|r[\"^]*(?:a[\"^]*s[\"^]*a[\"^]*u[\"^]*t[\"^]*o[\"^]*u|c[\"^]*s[\"^]*i|(?:d[\"^]*r[\"^]*l[\"^]*e[\"^]*a[\"^]*k[\"^]*d[\"^]*i[\"^]*a|p[\"^]*c[\"^]*p[\"^]*i[\"^]*n)[\"^]*g|e[\"^]*(?:g(?:[\"^]*(?:a[\"^]*s[\"^]*m|e[\"^]*d[\"^]*i[\"^]*t|i[\"^]*(?:n[\"^]*i|s[\"^]*t[\"^]*e[\"^]*r[\"^]*-[\"^]*c[\"^]*i[\"^]*m[\"^]*p[\"^]*r[\"^]*o[\"^]*v[\"^]*i[\"^]*d[\"^]*e[\"^]*r)|s[\"^]*v[\"^]*(?:c[\"^]*s|r[\"^]*3[\"^]*2)))?|(?:m[\"^]*o[\"^]*t|p[\"^]*l[\"^]*a[\"^]*c)[\"^]*e)|u[\"^]*n[\"^]*(?:d[\"^]*l[\"^]*l[\"^]*3[\"^]*2|(?:e[\"^]*x[\"^]*e|s[\"^]*c[\"^]*r[\"^]*i[\"^]*p[\"^]*t)[\"^]*h[\"^]*e[\"^]*l[\"^]*p[\"^]*e[\"^]*r|o[\"^]*n[\"^]*c[\"^]*e))|s[\"^]*(?:c[\"^]*(?:[sv,.-/;-<>].*|h[\"^]*t[\"^]*a[\"^]*s[\"^]*k[\"^]*s|r[\"^]*i[\"^]*p[\"^]*t[\"^]*r[\"^]*u[\"^]*n[\"^]*n[\"^]*e[\"^]*r)|e[\"^]*t[\"^]*(?:r[\"^]*e[\"^]*s|t[\"^]*i[\"^]*n[\"^]*g[\"^]*s[\"^]*y[\"^]*n[\"^]*c[\"^]*h[\"^]*o[\"^]*s[\"^]*t|u[\"^]*p[\"^]*a[\"^]*p[\"^]*i)|h[\"^]*(?:d[\"^]*o[\"^]*c[\"^]*v[\"^]*w|e[\"^]*l[\"^]*l[\"^]*3[\"^]*2)|q[\"^]*(?:l[\"^]*(?:d[\"^]*u[\"^]*m[\"^]*p[\"^]*e[\"^]*r|(?:t[\"^]*o[\"^]*o[\"^]*l[\"^]*s[\"^]*)?p[\"^]*s)|u[\"^]*i[\"^]*r[\"^]*r[\"^]*e[\"^]*l)|s[\"^]*h|t[\"^]*o[\"^]*r[\"^]*d[\"^]*i[\"^]*a[\"^]*g|y[\"^]*(?:n[\"^]*c[\"^]*a[\"^]*p[\"^]*p[\"^]*v[\"^]*p[\"^]*u[\"^]*b[\"^]*l[\"^]*i[\"^]*s[\"^]*h[\"^]*i[\"^]*n[\"^]*g[\"^]*s[\"^]*e[\"^]*r[\"^]*v[\"^]*e[\"^]*r|s[\"^]*s[\"^]*e[\"^]*t[\"^]*u[\"^]*p))|t[\"^]*(?:e[\"^]*[sv,.-/;-<>].*|r[\"^]*a[\"^]*c[\"^]*k[\"^]*e[\"^]*r|t[\"^]*(?:d[\"^]*i[\"^]*n[\"^]*j[\"^]*e[\"^]*c[\"^]*t|t[\"^]*r[\"^]*a[\"^]*c[\"^]*e[\"^]*r))|u[\"^]*(?:n[\"^]*r[\"^]*e[\"^]*g[\"^]*m[\"^]*p[\"^]*2|p[\"^]*d[\"^]*a[\"^]*t[\"^]*e|r[\"^]*l|t[\"^]*i[\"^]*l[\"^]*i[\"^]*t[\"^]*y[\"^]*f[\"^]*u[\"^]*n[\"^]*c[\"^]*t[\"^]*i[\"^]*o[\"^]*n[\"^]*s)|v[\"^]*(?:b[\"^]*c|e[\"^]*r[\"^]*c[\"^]*l[\"^]*s[\"^]*i[\"^]*d|i[\"^]*s[\"^]*u[\"^]*a[\"^]*l[\"^]*u[\"^]*i[\"^]*a[\"^]*v[\"^]*e[\"^]*r[\"^]*i[\"^]*f[\"^]*y[\"^]*n[\"^]*a[\"^]*t[\"^]*i[\"^]*v[\"^]*e|s[\"^]*(?:i[\"^]*i[\"^]*s[\"^]*e[\"^]*x[\"^]*e[\"^]*l[\"^]*a[\"^]*u[\"^]*n[\"^]*c[\"^]*h|j[\"^]*i[\"^]*t[\"^]*d[\"^]*e[\"^]*b[\"^]*u[\"^]*g[\"^]*g)[\"^]*e[\"^]*r)|w[\"^]*(?:a[\"^]*b|(?:f|m[\"^]*i)[\"^]*c|i[\"^]*n[\"^]*(?:g[\"^]*e[\"^]*t|r[\"^]*m|w[\"^]*o[\"^]*r[\"^]*d)|l[\"^]*r[\"^]*m[\"^]*d[\"^]*r|o[\"^]*r[\"^]*k[\"^]*f[\"^]*o[\"^]*l[\"^]*d[\"^]*e[\"^]*r[\"^]*s|s[\"^]*(?:(?:c[\"^]*r[\"^]*i[\"^]*p|r[\"^]*e[\"^]*s[\"^]*e)[\"^]*t|l)|t[\"^]*[sv,.-/;-<>].*|u[\"^]*a[\"^]*u[\"^]*c[\"^]*l[\"^]*t)|x[\"^]*w[\"^]*i[\"^]*z[\"^]*a[\"^]*r[\"^]*d|z[\"^]*i[\"^]*p[\"^]*f[\"^]*l[\"^]*d[\"^]*r)(?:.[\"^]*[0-9A-Z_a-z]+)?b"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i:Warning.*ingres_|Ingres SQLSTATE|IngresW.*Driver)"
+        "category": "RCE",
+        "pattern": "@rx (?i)(?:t[\"^]*i[\"^]*m[\"^]*e|[nr;`{]|||?|&&?)[sv]*[sv\"'-(,@]*(?:[\"'.-9A-Z_a-z]+/|(?:[\"'x5c^]*[0-9A-Z_a-z][\"'x5c^]*:.*|[ \"'.-9A-Zx5c^-_a-z]*)x5c)?[\"^]*(?:a[\"^]*(?:s[\"^]*s[\"^]*o[\"^]*c|t[\"^]*(?:m[\"^]*a[\"^]*d[\"^]*m|t[\"^]*r[\"^]*i[\"^]*b)|u[\"^]*(?:d[\"^]*i[\"^]*t[\"^]*p[\"^]*o[\"^]*l|t[\"^]*o[\"^]*(?:c[\"^]*(?:h[\"^]*k|o[\"^]*n[\"^]*v)|(?:f[\"^]*m|m[\"^]*o[\"^]*u[\"^]*n)[\"^]*t)))|b[\"^]*(?:c[\"^]*d[\"^]*(?:b[\"^]*o[\"^]*o|e[\"^]*d[\"^]*i)[\"^]*t|(?:d[\"^]*e[\"^]*h[\"^]*d|o[\"^]*o[\"^]*t)[\"^]*c[\"^]*f[\"^]*g|i[\"^]*t[\"^]*s[\"^]*a[\"^]*d[\"^]*m[\"^]*i[\"^]*n)|c[\"^]*(?:a[\"^]*c[\"^]*l[\"^]*s|e[\"^]*r[\"^]*t[\"^]*(?:r[\"^]*e[\"^]*q|u[\"^]*t[\"^]*i[\"^]*l)|h[\"^]*(?:c[\"^]*p|d[\"^]*i[\"^]*r|g[\"^]*(?:l[\"^]*o[\"^]*g[\"^]*o[\"^]*n|p[\"^]*o[\"^]*r[\"^]*t|u[\"^]*s[\"^]*r)|k[\"^]*(?:d[\"^]*s[\"^]*k|n[\"^]*t[\"^]*f[\"^]*s))|l[\"^]*e[\"^]*a[\"^]*n[\"^]*m[\"^]*g[\"^]*r|m[\"^]*(?:d(?:[\"^]*k[\"^]*e[\"^]*y)?|s[\"^]*t[\"^]*p)|s[\"^]*c[\"^]*r[\"^]*i[\"^]*p[\"^]*t)|d[\"^]*(?:c[\"^]*(?:d[\"^]*i[\"^]*a[\"^]*g|g[\"^]*p[\"^]*o[\"^]*f[\"^]*i[\"^]*x)|e[\"^]*(?:f[\"^]*r[\"^]*a[\"^]*g|l)|f[\"^]*s[\"^]*(?:d[\"^]*i[\"^]*a|r[\"^]*m[\"^]*i)[\"^]*g|i[\"^]*(?:a[\"^]*n[\"^]*t[\"^]*z|r|s[\"^]*(?:k[\"^]*(?:c[\"^]*o[\"^]*(?:m[\"^]*p|p[\"^]*y)|p[\"^]*(?:a[\"^]*r[\"^]*t|e[\"^]*r[\"^]*f)|r[\"^]*a[\"^]*i[\"^]*d|s[\"^]*h[\"^]*a[\"^]*d[\"^]*o[\"^]*w)|p[\"^]*d[\"^]*i[\"^]*a[\"^]*g))|n[\"^]*s[\"^]*c[\"^]*m[\"^]*d|(?:o[\"^]*s[\"^]*k[\"^]*e|r[\"^]*i[\"^]*v[\"^]*e[\"^]*r[\"^]*q[\"^]*u[\"^]*e[\"^]*r)[\"^]*y)|e[\"^]*(?:n[\"^]*d[\"^]*l[\"^]*o[\"^]*c[\"^]*a[\"^]*l|v[\"^]*e[\"^]*n[\"^]*t[\"^]*c[\"^]*r[\"^]*e[\"^]*a[\"^]*t[\"^]*e)|E[\"^]*v[\"^]*n[\"^]*t[\"^]*c[\"^]*m[\"^]*d|f[\"^]*(?:c|i[\"^]*(?:l[\"^]*e[\"^]*s[\"^]*y[\"^]*s[\"^]*t[\"^]*e[\"^]*m[\"^]*s|n[\"^]*d[\"^]*s[\"^]*t[\"^]*r)|l[\"^]*a[\"^]*t[\"^]*t[\"^]*e[\"^]*m[\"^]*p|o[\"^]*r(?:[\"^]*f[\"^]*i[\"^]*l[\"^]*e[\"^]*s)?|r[\"^]*e[\"^]*e[\"^]*d[\"^]*i[\"^]*s[\"^]*k|s[\"^]*u[\"^]*t[\"^]*i[\"^]*l|(?:t[\"^]*y[\"^]*p|v[\"^]*e[\"^]*u[\"^]*p[\"^]*d[\"^]*a[\"^]*t)[\"^]*e)|g[\"^]*(?:e[\"^]*t[\"^]*(?:m[\"^]*a[\"^]*c|t[\"^]*y[\"^]*p[\"^]*e)|o[\"^]*t[\"^]*o|p[\"^]*(?:f[\"^]*i[\"^]*x[\"^]*u[\"^]*p|(?:r[\"^]*e[\"^]*s[\"^]*u[\"^]*l[\"^]*)?t|u[\"^]*p[\"^]*d[\"^]*a[\"^]*t[\"^]*e)|r[\"^]*a[\"^]*f[\"^]*t[\"^]*a[\"^]*b[\"^]*l)|h[\"^]*(?:e[\"^]*l[\"^]*p[\"^]*c[\"^]*t[\"^]*r|o[\"^]*s[\"^]*t[\"^]*n[\"^]*a[\"^]*m[\"^]*e)|i[\"^]*(?:c[\"^]*a[\"^]*c[\"^]*l[\"^]*s|f|p[\"^]*(?:c[\"^]*o[\"^]*n[\"^]*f[\"^]*i[\"^]*g|x[\"^]*r[\"^]*o[\"^]*u[\"^]*t[\"^]*e)|r[\"^]*f[\"^]*t[\"^]*p)|j[\"^]*e[\"^]*t[\"^]*p[\"^]*a[\"^]*c[\"^]*k|k[\"^]*(?:l[\"^]*i[\"^]*s[\"^]*t|s[\"^]*e[\"^]*t[\"^]*u[\"^]*p|t[\"^]*(?:m[\"^]*u[\"^]*t[\"^]*i[\"^]*l|p[\"^]*a[\"^]*s[\"^]*s))|l[\"^]*(?:o[\"^]*(?:d[\"^]*c[\"^]*t[\"^]*r|g[\"^]*(?:m[\"^]*a[\"^]*n|o[\"^]*f[\"^]*f))|p[\"^]*[q-r])|m[\"^]*(?:a[\"^]*(?:c[\"^]*f[\"^]*i[\"^]*l[\"^]*e|k[\"^]*e[\"^]*c[\"^]*a[\"^]*b|p[\"^]*a[\"^]*d[\"^]*m[\"^]*i[\"^]*n)|k[\"^]*(?:d[\"^]*i[\"^]*r|l[\"^]*i[\"^]*n[\"^]*k)|m[\"^]*c|o[\"^]*u[\"^]*n[\"^]*t[\"^]*v[\"^]*o[\"^]*l|q[\"^]*(?:b[\"^]*k[\"^]*u[\"^]*p|(?:t[\"^]*g[\"^]*)?s[\"^]*v[\"^]*c)|s[\"^]*(?:d[\"^]*t|i[\"^]*(?:e[\"^]*x[\"^]*e[\"^]*c|n[\"^]*f[\"^]*o[\"^]*3[\"^]*2)|t[\"^]*s[\"^]*c))|n[\"^]*(?:b[\"^]*t[\"^]*s[\"^]*t[\"^]*a[\"^]*t|e[\"^]*t[\"^]*(?:c[\"^]*f[\"^]*g|d[\"^]*o[\"^]*m|s[\"^]*(?:h|t[\"^]*a[\"^]*t))|f[\"^]*s[\"^]*(?:a[\"^]*d[\"^]*m[\"^]*i[\"^]*n|s[\"^]*(?:h[\"^]*a[\"^]*r[\"^]*e|t[\"^]*a[\"^]*t))|l[\"^]*(?:b[\"^]*m[\"^]*g[\"^]*r|t[\"^]*e[\"^]*s[\"^]*t)|s[\"^]*l[\"^]*o[\"^]*o[\"^]*k[\"^]*u[\"^]*p|t[\"^]*(?:b[\"^]*a[\"^]*c[\"^]*k[\"^]*u[\"^]*p|c[\"^]*m[\"^]*d[\"^]*p[\"^]*r[\"^]*o[\"^]*m[\"^]*p[\"^]*t|f[\"^]*r[\"^]*s[\"^]*u[\"^]*t[\"^]*l))|o[\"^]*(?:f[\"^]*f[\"^]*l[\"^]*i[\"^]*n[\"^]*e|p[\"^]*e[\"^]*n[\"^]*f[\"^]*i[\"^]*l[\"^]*e[\"^]*s)|p[\"^]*(?:a[\"^]*(?:g[\"^]*e[\"^]*f[\"^]*i[\"^]*l[\"^]*e[\"^]*c[\"^]*o[\"^]*n[\"^]*f[\"^]*i|t[\"^]*h[\"^]*p[\"^]*i[\"^]*n)[\"^]*g|(?:b[\"^]*a[\"^]*d[\"^]*m[\"^]*i|k[\"^]*t[\"^]*m[\"^]*o)[\"^]*n|e[\"^]*(?:n[\"^]*t[\"^]*n[\"^]*t|r[\"^]*f[\"^]*m[\"^]*o[\"^]*n)|n[\"^]*p[\"^]*u[\"^]*(?:n[\"^]*a[\"^]*t[\"^]*t[\"^]*e[\"^]*n[\"^]*d|t[\"^]*i[\"^]*l)|o[\"^]*(?:p[\"^]*d|w[\"^]*e[\"^]*r[\"^]*s[\"^]*h[\"^]*e[\"^]*l[\"^]*l)|r[\"^]*n[\"^]*(?:c[\"^]*n[\"^]*f[\"^]*g|(?:d[\"^]*r[\"^]*v|m[\"^]*n[\"^]*g)[\"^]*r|j[\"^]*o[\"^]*b[\"^]*s|p[\"^]*o[\"^]*r[\"^]*t|q[\"^]*c[\"^]*t[\"^]*l)|u[\"^]*(?:b[\"^]*p[\"^]*r[\"^]*n|s[\"^]*h[\"^]*(?:d|p[\"^]*r[\"^]*i[\"^]*n[\"^]*t[\"^]*e[\"^]*r[\"^]*c[\"^]*o[\"^]*n[\"^]*n[\"^]*e[\"^]*c[\"^]*t[\"^]*i[\"^]*o[\"^]*n[\"^]*s))|w[\"^]*(?:l[\"^]*a[\"^]*u[\"^]*n[\"^]*c[\"^]*h[\"^]*e[\"^]*r|s[\"^]*h))|q[\"^]*(?:a[\"^]*p[\"^]*p[\"^]*s[\"^]*r[\"^]*v|p[\"^]*r[\"^]*o[\"^]*c[\"^]*e[\"^]*s[\"^]*s|u[\"^]*s[\"^]*e[\"^]*r|w[\"^]*i[\"^]*n[\"^]*s[\"^]*t[\"^]*a)|r[\"^]*(?:d(?:[\"^]*p[\"^]*s[\"^]*i[\"^]*g[\"^]*n)?|e[\"^]*(?:f[\"^]*s[\"^]*u[\"^]*t[\"^]*i[\"^]*l|g(?:[\"^]*(?:i[\"^]*n[\"^]*i|s[\"^]*v[\"^]*r[\"^]*3[\"^]*2))?|l[\"^]*o[\"^]*g|(?:(?:p[\"^]*a[\"^]*d[\"^]*m[\"^]*i|s[\"^]*c[\"^]*a)[\"^]*)?n|x[\"^]*e[\"^]*c)|i[\"^]*s[\"^]*e[\"^]*t[\"^]*u[\"^]*p|m[\"^]*d[\"^]*i[\"^]*r|o[\"^]*b[\"^]*o[\"^]*c[\"^]*o[\"^]*p[\"^]*y|p[\"^]*c[\"^]*(?:i[\"^]*n[\"^]*f[\"^]*o|p[\"^]*i[\"^]*n[\"^]*g)|s[\"^]*h|u[\"^]*n[\"^]*d[\"^]*l[\"^]*l[\"^]*3[\"^]*2|w[\"^]*i[\"^]*n[\"^]*s[\"^]*t[\"^]*a)|s[\"^]*(?:a[\"^]*n|c[\"^]*(?:h[\"^]*t[\"^]*a[\"^]*s[\"^]*k[\"^]*s|w[\"^]*c[\"^]*m[\"^]*d)|e[\"^]*(?:c[\"^]*e[\"^]*d[\"^]*i[\"^]*t|r[\"^]*v[\"^]*e[\"^]*r[\"^]*(?:(?:c[\"^]*e[\"^]*i[\"^]*p|w[\"^]*e[\"^]*r)[\"^]*o[\"^]*p[\"^]*t[\"^]*i[\"^]*n|m[\"^]*a[\"^]*n[\"^]*a[\"^]*g[\"^]*e[\"^]*r[\"^]*c[\"^]*m[\"^]*d)|t[\"^]*x)|f[\"^]*c|(?:h[\"^]*o[\"^]*w[\"^]*m[\"^]*o[\"^]*u[\"^]*n|u[\"^]*b[\"^]*s)[\"^]*t|x[\"^]*s[\"^]*t[\"^]*r[\"^]*a[\"^]*c[\"^]*e|y[\"^]*s[\"^]*(?:o[\"^]*c[\"^]*m[\"^]*g[\"^]*r|t[\"^]*e[\"^]*m[\"^]*i[\"^]*n[\"^]*f[\"^]*o))|t[\"^]*(?:a[\"^]*(?:k[\"^]*e[\"^]*o[\"^]*w[\"^]*n|p[\"^]*i[\"^]*c[\"^]*f[\"^]*g|s[\"^]*k[\"^]*(?:k[\"^]*i[\"^]*l[\"^]*l|l[\"^]*i[\"^]*s[\"^]*t))|(?:c[\"^]*m[\"^]*s[\"^]*e[\"^]*t[\"^]*u|f[\"^]*t)[\"^]*p|(?:(?:e[\"^]*l[\"^]*n[\"^]*e|i[\"^]*m[\"^]*e[\"^]*o[\"^]*u)[\"^]*|r[\"^]*a[\"^]*c[\"^]*e[\"^]*r[\"^]*(?:p[\"^]*)?)t|l[\"^]*n[\"^]*t[\"^]*a[\"^]*d[\"^]*m[\"^]*n|p[\"^]*m[\"^]*(?:t[\"^]*o[\"^]*o[\"^]*l|v[\"^]*s[\"^]*c[\"^]*m[\"^]*g[\"^]*r)|s[\"^]*(?:(?:d[\"^]*i[\"^]*s[\"^]*)?c[\"^]*o[\"^]*n|e[\"^]*c[\"^]*i[\"^]*m[\"^]*p|k[\"^]*i[\"^]*l[\"^]*l|p[\"^]*r[\"^]*o[\"^]*f)|y[\"^]*p[\"^]*e[\"^]*p[\"^]*e[\"^]*r[\"^]*f|z[\"^]*u[\"^]*t[\"^]*i[\"^]*l)|u[\"^]*n[\"^]*(?:e[\"^]*x[\"^]*p[\"^]*o[\"^]*s[\"^]*e|i[\"^]*q[\"^]*u[\"^]*e[\"^]*i[\"^]*d|l[\"^]*o[\"^]*d[\"^]*c[\"^]*t[\"^]*r)|v[\"^]*(?:o[\"^]*l|s[\"^]*s[\"^]*a[\"^]*d[\"^]*m[\"^]*i[\"^]*n)|w[\"^]*(?:a[\"^]*i[\"^]*t[\"^]*f[\"^]*o[\"^]*r|b[\"^]*a[\"^]*d[\"^]*m[\"^]*i[\"^]*n|(?:d[\"^]*s|e[\"^]*(?:c|v[\"^]*t))[\"^]*u[\"^]*t[\"^]*i[\"^]*l|h[\"^]*(?:e[\"^]*r[\"^]*e|o[\"^]*a[\"^]*m[\"^]*i)|i[\"^]*n[\"^]*(?:n[\"^]*t(?:[\"^]*3[\"^]*2)?|r[\"^]*s)|m[\"^]*i[\"^]*c|s[\"^]*c[\"^]*r[\"^]*i[\"^]*p[\"^]*t)|x[\"^]*c[\"^]*o[\"^]*p[\"^]*y)(?:.[\"^]*[0-9A-Z_a-z]+)?b"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)"
+        "category": "RCE",
+        "pattern": "@lt 2"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)"
+        "category": "RCE",
+        "pattern": "@lt 2"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i)(?:System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*WSystem.Data.SqlClient.|Conversion failed when converting the varchar value .*? to data type int.)"
+        "category": "RCE",
+        "pattern": "@rx (?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*.[sv].*b"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array()|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient.)|[MySQL][ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[(-)_a-z]{1,26})?|(?:ERROR [0-9]{4} ([0-9a-z]{5})|XPATH syntax error):"
+        "category": "RCE",
+        "pattern": "@rx (?:$(?:((?:(.*)|.*))|{.*})|[<>](.*)|[!?.+])"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|pg_(?:query|exec)() [:|Warning.{1,20}bpg_.*|valid PostgreSQL result|Npgsql.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er"
+        "category": "RCE",
+        "pattern": "@rx ['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)"
+        "category": "RCE",
+        "pattern": "@rx /"
     },
     {
-        "category": "SQL",
-        "pattern": "@rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*Server message.*)"
+        "category": "RCE",
+        "pattern": "@rx s"
     },
     {
-        "category": "SQL",
-        "pattern": "@lt 2"
+        "category": "RCE",
+        "pattern": "@rx ^[^.]+.[^;?]+[;?](.*(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]))"
     },
     {
-        "category": "SQL",
-        "pattern": "@lt 2"
+        "category": "RCE",
+        "pattern": "@rx /"
     },
     {
-        "category": "SQL",
-        "pattern": "@lt 3"
+        "category": "RCE",
+        "pattern": "@rx s"
     },
     {
-        "category": "SQL",
-        "pattern": "@lt 3"
+        "category": "RCE",
+        "pattern": "@rx ^[^.]*?(?:['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{])"
     },
     {
-        "category": "SQL",
-        "pattern": "@lt 4"
+        "category": "RCE",
+        "pattern": "@rx /"
     },
     {
-        "category": "SQL",
-        "pattern": "@lt 4"
+        "category": "RCE",
+        "pattern": "@rx s"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 1"
+        "category": "RCE",
+        "pattern": "@rx (?i).|(?:[sv]*|t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:7[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|G[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?E[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?T|a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:b|(?:p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?t|r(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[jp])?|s(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ks])|b[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[8-9][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?9|[au][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|c|(?:m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?p|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dfu]|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[gr])|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[bdx]|n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|q[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|s(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?)|f[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[c-dgi]|m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|g[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[chr][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|o|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dp]|r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b)|j[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:j[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|q)|k[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|l[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)?|[nps]|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a|z(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|v)|n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[cl]|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|(?:p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|o[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[at][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?x|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|f|(?:k[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?g|h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cp]|r(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?y)?|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|c(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dv]|(?:p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dt]|[g-hu]|s(?:[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cr]|b[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l|[co][\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ex]|i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c)|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|l)|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:3[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|c)|x[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:x[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|z)|y[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:e[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)|z[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|s[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h))"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 1"
+        "category": "RCE",
+        "pattern": "@rx (?i)[-0-9_a-z]+(?:[\"'[-]]+|$+[!#*-0-9?-@x5c_a-{]+|``|[$<>]())[sv]*[-0-9_a-z]+"
     },
     {
-        "category": "JAVA",
-        "pattern": "@pmFromFile java-code-leakages.data"
+        "category": "RCE",
+        "pattern": "!@rx [0-9]s*'s*[0-9]"
     },
     {
-        "category": "JAVA",
-        "pattern": "@pmFromFile java-errors.data"
+        "category": "RCE",
+        "pattern": "@rx ;[sv]*.[sv]*[\"']?(?:a(?:rchive|uth)|b(?:a(?:ckup|il)|inary)|c(?:d|h(?:anges|eck)|lone|onnection)|d(?:atabases|b(?:config|info)|ump)|e(?:cho|qp|x(?:cel|it|p(?:ert|lain)))|f(?:ilectrl|ullschema)|he(?:aders|lp)|i(?:mpo(?:rt|ster)|ndexes|otrace)|l(?:i(?:mi|n)t|o(?:ad|g))|(?:mod|n(?:onc|ullvalu)|unmodul)e|o(?:nce|pen|utput)|p(?:arameter|r(?:int|o(?:gress|mpt)))|quit|re(?:ad|cover|store)|s(?:ave|c(?:anstats|hema)|e(?:lftest|parator|ssion)|h(?:a3sum|ell|ow)?|tats|ystem)|t(?:ables|estc(?:ase|trl)|ime(?:out|r)|race)|vfs(?:info|list|name)|width)"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 2"
+        "category": "RCE",
+        "pattern": "@rx rn(?s:.)*?b(?:(?i:E)(?:HLO [--.A-Za-zx17fx212a]{1,255}|XPN .{1,64})|HELO [--.A-Za-zx17fx212a]{1,255}|MAIL FROM:<.{1,64}(?i:@).{1,255}(?i:>)|(?i:R)(?:CPT TO:(?:(?i:<).{1,64}(?i:@).{1,255}(?i:>)|(?i: ))?(?i:<).{1,64}(?i:>)|SETb)|VRFY .{1,64}(?: <.{1,64}(?i:@).{1,255}(?i:>)|(?i:@).{1,255})|AUTH [-0-9A-Z_a-zx17fx212a]{1,20}(?i: )(?:(?:[+/-9A-Z_a-zx17fx212a]{4})*(?:[+/-9A-Z_a-zx17fx212a]{2}(?i:=)|[+/-9A-Z_a-zx17fx212a]{3}))?(?i:=)|STARTTLSb|NOOPb(?:(?i: ).{1,255})?)"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 2"
+        "category": "RCE",
+        "pattern": "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:A(?:PPEND (?:[\"-#%-&*--9A-Zx5c_a-z]+)?(?: ([ x5ca-z]+))?(?: \"?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [+-][0-9]{4}\"?)? {[0-9]{1,20}+?}|UTHENTICATE [-0-9_a-z]{1,20}rn)|L(?:SUB (?:[\"-#*.-9A-Z_a-z~]+)? (?:[\"%-&*.-9A-Zx5c_a-z]+)?|ISTRIGHTS (?:[\"%-&*--9A-Zx5c_a-z]+)?)|S(?:TATUS (?:[\"%-&*--9A-Zx5c_a-z]+)? ((?:U(?:NSEEN|IDNEXT)|MESSAGES|UIDVALIDITY|RECENT| )+)|ETACL (?:[\"%-&*--9A-Zx5c_a-z]+)? [+-][ac-eik-lpr-tw-x]+?)|UID (?:COPY|FETCH|STORE) (?:[*,0-:]+)?|(?:(?:DELETE|GET)ACL|MYRIGHTS) (?:[\"%-&*--9A-Zx5c_a-z]+)?)"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 3"
+        "category": "RCE",
+        "pattern": "@rx (?is)rn.*?b(?:(?:LIST|TOP [0-9]+)(?: [0-9]+)?|U(?:SER .+?|IDL(?: [0-9]+)?)|PASS .+?|(?:RETR|DELE) [0-9]+?|A(?:POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [-0-9A-Z_]{1,20} (?:(?:[+/-9A-Z_a-z]{4})*(?:[+/-9A-Z_a-z]{2}=|[+/-9A-Z_a-z]{3}))?=))"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 3"
+        "category": "RCE",
+        "pattern": "@rx (?i)(?:(?:^|=)[sv]*(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*|(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*)[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|an|io|ulimit)|s(?:h|plit|vtool)|u(?:(?:t|rl)[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|inks|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[^sv])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash|nap)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:3m|c|a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 4"
+        "category": "RCE",
+        "pattern": "@rx (?i)(?:(?:^|=)[sv]*(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*|(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*)[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:c|a(?:ll|tch)[sv&)<>|]|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))"
     },
     {
-        "category": "JAVA",
-        "pattern": "@lt 4"
+        "category": "RCE",
+        "pattern": "@pmFromFile unix-shell.data"
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 1"
+        "category": "RCE",
+        "pattern": "@lt 3"
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 1"
+        "category": "RCE",
+        "pattern": "@lt 3"
     },
     {
-        "category": "PHP",
-        "pattern": "@pmFromFile php-errors.data"
+        "category": "RCE",
+        "pattern": "@rx (?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:(?:(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))b"
     },
     {
-        "category": "PHP",
-        "pattern": "@rx (?:b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|$_(?:(?:pos|ge)t|session))b"
+        "category": "RCE",
+        "pattern": "@rx (?i)b(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:(?:itude)?[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|n?f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|s(?:[sv&)<>|]|ed|ftp|ql)?|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:ew)?[sv&)<>|]|m(?:[sv&)<>|]|diff)|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:[sv&)<>c|]|h(?:o(?:[sv&)<>|]|ami|is)?|iptail[sv&)<>|])|a(?:ll|tch)[sv&)<>|]|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))b"
     },
     {
-        "category": "PHP",
-        "pattern": "@rx (?i)<?(?:=|php)?s+"
+        "category": "RCE",
+        "pattern": "@rx (?i)(?:(?:^|=)[sv]*(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*|(?:t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\".*\")[sv]+)*)[sv]*[\"']*(?:[\"'-+--9?A-]_a-z|]+/)?[\"'x5c]*(?:(?:(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))"
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 2"
+        "category": "RCE",
+        "pattern": "@rx /(?:[?*]+[a-z/]+|[a-z/]+[?*]+)"
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 2"
+        "category": "RCE",
+        "pattern": "@rx rn(?s:.)*?b(?:DATA|QUIT|HELP(?: .{1,255})?)"
     },
     {
-        "category": "PHP",
-        "pattern": "@pmFromFile php-errors-pl2.data"
+        "category": "RCE",
+        "pattern": "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:C(?:(?:REATE|OPY [*,0-:]+) [\"-#%-&*--9A-Zx5c_a-z]+|APABILITY|HECK|LOSE)|DELETE [\"-#%-&*--.0-9A-Zx5c_a-z]+|EX(?:AMINE [\"-#%-&*--.0-9A-Zx5c_a-z]+|PUNGE)|FETCH [*,0-:]+|L(?:IST [\"-#*--9A-Zx5c_a-z~]+? [\"-#%-&*--9A-Zx5c_a-z]+|OG(?:IN [--.0-9@_a-z]{1,40} .*?|OUT))|RENAME [\"-#%-&*--9A-Zx5c_a-z]+? [\"-#%-&*--9A-Zx5c_a-z]+|S(?:E(?:LECT [\"-#%-&*--9A-Zx5c_a-z]+|ARCH(?: CHARSET [--.0-9A-Z_a-z]{1,40})? (?:(KEYWORD x5c)?(?:A(?:LL|NSWERED)|BCC|D(?:ELETED|RAFT)|(?:FLAGGE|OL)D|RECENT|SEEN|UN(?:(?:ANSWER|FLAGG)ED|D(?:ELETED|RAFT)|SEEN)|NEW)|(?:BODY|CC|FROM|HEADER .{1,100}|NOT|OR .{1,255}|T(?:EXT|O)) .{1,255}|LARGER [0-9]{1,20}|[*,0-:]+|(?:BEFORE|ON|S(?:ENT(?:(?:BEFOR|SINC)E|ON)|INCE)) \"?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4}\"?|S(?:MALLER [0-9]{1,20}|UBJECT .{1,255})|U(?:ID [*,0-:]+?|NKEYWORD x5c(Seen|(?:Answer|Flagg)ed|D(?:eleted|raft)|Recent))))|T(?:ORE [*,0-:]+? [+-]?FLAGS(?:.SILENT)? (?:(x5c[a-z]{1,20}))?|ARTTLS)|UBSCRIBE [\"-#%-&*--9A-Zx5c_a-z]+)|UN(?:SUBSCRIBE [\"-#%-&*--9A-Zx5c_a-z]+|AUTHENTICATE)|NOOP)"
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 3"
+        "category": "RCE",
+        "pattern": "@rx rn(?s:.)*?b(?:(?:QUI|STA|RSE)(?i:T)|NOOP|CAPA)"
     },
     {
-        "category": "PHP",
-        "pattern": "@lt 3"
+        "category": "RCE",
+        "pattern": "@rx !(?:d|!)"
     },
     {
-        "category": "PHP",
+        "category": "RCE",
         "pattern": "@lt 4"
     },
     {
-        "category": "PHP",
+        "category": "RCE",
         "pattern": "@lt 4"
     },
     {
-        "category": "IIS",
+        "category": "FIXATION",
         "pattern": "@lt 1"
     },
     {
-        "category": "IIS",
+        "category": "FIXATION",
         "pattern": "@lt 1"
     },
     {
-        "category": "IIS",
-        "pattern": "@rx [a-z]:x5cinetpubb"
+        "category": "FIXATION",
+        "pattern": "@rx (?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)"
     },
     {
-        "category": "IIS",
-        "pattern": "@rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error.</h2>|cannot connect to the server: timed out)"
+        "category": "FIXATION",
+        "pattern": "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$"
     },
     {
-        "category": "IIS",
-        "pattern": "@pmFromFile iis-errors.data"
+        "category": "FIXATION",
+        "pattern": "@rx ^(?:ht|f)tps?://(.*?)/"
     },
     {
-        "category": "IIS",
-        "pattern": "!@rx ^404$"
+        "category": "FIXATION",
+        "pattern": "!@endsWith %{request_headers.host}"
     },
     {
-        "category": "IIS",
-        "pattern": "@rx bServer Error in.{0,50}?bApplicationb"
+        "category": "FIXATION",
+        "pattern": "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$"
     },
     {
-        "category": "IIS",
+        "category": "FIXATION",
+        "pattern": "@eq 0"
+    },
+    {
+        "category": "FIXATION",
         "pattern": "@lt 2"
     },
     {
-        "category": "IIS",
+        "category": "FIXATION",
         "pattern": "@lt 2"
     },
     {
-        "category": "IIS",
+        "category": "FIXATION",
         "pattern": "@lt 3"
     },
     {
-        "category": "IIS",
+        "category": "FIXATION",
         "pattern": "@lt 3"
     },
     {
-        "category": "IIS",
+        "category": "FIXATION",
         "pattern": "@lt 4"
     },
     {
-        "category": "IIS",
+        "category": "FIXATION",
         "pattern": "@lt 4"
     },
     {
@@ -2507,6 +2435,78 @@
         "category": "EVALUATION",
         "pattern": "@lt 4"
     },
+    {
+        "category": "EXCEPTIONS",
+        "pattern": "@streq GET /"
+    },
+    {
+        "category": "EXCEPTIONS",
+        "pattern": "@ipMatch 127.0.0.1,::1"
+    },
+    {
+        "category": "EXCEPTIONS",
+        "pattern": "@ipMatch 127.0.0.1,::1"
+    },
+    {
+        "category": "EXCEPTIONS",
+        "pattern": "@endsWith (internal dummy connection)"
+    },
+    {
+        "category": "EXCEPTIONS",
+        "pattern": "@rx ^(?:GET /|OPTIONS *) HTTP/[12].[01]$"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@lt 1"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@lt 1"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@rx [a-z]:x5cinetpubb"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error.</h2>|cannot connect to the server: timed out)"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@pmFromFile iis-errors.data"
+    },
+    {
+        "category": "IIS",
+        "pattern": "!@rx ^404$"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@rx bServer Error in.{0,50}?bApplicationb"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@lt 2"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@lt 2"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@lt 3"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@lt 3"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@lt 4"
+    },
+    {
+        "category": "IIS",
+        "pattern": "@lt 4"
+    },
     {
         "category": "CORRELATION",
         "pattern": "@eq 0"
diff --git a/waf_patterns/apache/attack.conf b/waf_patterns/apache/attack.conf
index bc47775..56620d3 100644
--- a/waf_patterns/apache/attack.conf
+++ b/waf_patterns/apache/attack.conf
@@ -1,34 +1,34 @@
 # Apache ModSecurity rules for ATTACK
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1156,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1157,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d" "id:1158,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx [rn]W*?(?:content-(?:type|length)|set-cookie|location):s*w" "id:1159,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx (?:bhttp/d|<(?:html|meta)b)" "id:1160,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx [nr]" "id:1161,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx [nr]" "id:1162,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx [nr]+(?:s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*:" "id:1163,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx [nr]" "id:1164,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx ^[^:()&|!<>~]*)s*(?:((?:[^,()=&|!<>~]+[><~]?=|s*[&!|]s*(?:)|()?s*)|)s*(s*[&|!]s*|[&!|]s*([^()=&|!<>~]+[><~]?=[^:()&|!<>~]*)" "id:1165,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx ^[^sv,;]+[sv,;].*?(?:application/(?:.++)?json|(?:application/(?:soap+)?|text/)xml)" "id:1166,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx unix:[^|]*|" "id:1167,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1168,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1169,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx [nr]" "id:1170,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx ^[^sv,;]+[sv,;].*?b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([+/]))b" "id:1171,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1172,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1173,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@gt 0" "id:1174,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx ." "id:1175,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@gt 1" "id:1176,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx TX:paramcounter_(.*)" "id:1177,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx (][^]]+$|][^]]+[)" "id:1178,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1179,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1180,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx [" "id:1181,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "!@eq 0" "id:1182,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "!@within |%{tx.allowed_request_content_type_charset}|" "id:1183,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx ^content-types*:s*(.*)$" "id:1184,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "!@rx ^(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$" "id:1185,phase:1,deny,status:403,log,msg:'attack attack detected'"
-SecRule REQUEST_URI "@rx content-transfer-encoding:(.*)" "id:1186,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "!@eq 0" "id:1115,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "!@within |%{tx.allowed_request_content_type_charset}|" "id:1116,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx ^content-types*:s*(.*)$" "id:1117,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "!@rx ^(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$" "id:1118,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx content-transfer-encoding:(.*)" "id:1119,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1442,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1443,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d" "id:1444,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx [rn]W*?(?:content-(?:type|length)|set-cookie|location):s*w" "id:1445,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx (?:bhttp/d|<(?:html|meta)b)" "id:1446,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx [nr]" "id:1447,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx [nr]" "id:1448,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx [nr]+(?:s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*:" "id:1449,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx [nr]" "id:1450,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx ^[^:()&|!<>~]*)s*(?:((?:[^,()=&|!<>~]+[><~]?=|s*[&!|]s*(?:)|()?s*)|)s*(s*[&|!]s*|[&!|]s*([^()=&|!<>~]+[><~]?=[^:()&|!<>~]*)" "id:1451,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx ^[^sv,;]+[sv,;].*?(?:application/(?:.++)?json|(?:application/(?:soap+)?|text/)xml)" "id:1452,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx unix:[^|]*|" "id:1453,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1454,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1455,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx [nr]" "id:1456,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx ^[^sv,;]+[sv,;].*?b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([+/]))b" "id:1457,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1458,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1459,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@gt 0" "id:1460,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx ." "id:1461,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@gt 1" "id:1462,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx TX:paramcounter_(.*)" "id:1463,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx (][^]]+$|][^]]+[)" "id:1464,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1465,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1466,phase:1,deny,status:403,log,msg:'attack attack detected'"
+SecRule REQUEST_URI "@rx [" "id:1467,phase:1,deny,status:403,log,msg:'attack attack detected'"
diff --git a/waf_patterns/apache/bots.conf b/waf_patterns/apache/bots.conf
index 8f686d9..507b93b 100644
--- a/waf_patterns/apache/bots.conf
+++ b/waf_patterns/apache/bots.conf
@@ -1,591 +1,1777 @@
 SecRuleEngine On
-SecRule REQUEST_HEADERS:User-Agent "@contains (^| )PTST\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains (^| )sentry\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains (sistrix|SISTRIX) [cC]rawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains 007ac9 Crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains 2ip bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains  YLT" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains 008\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains 13TABS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains 192\.comAgent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains 2GDPR\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains 2ip\.ru" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains 360Spider" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains <li>Mozilla/5.0 (compatible; Ask Jeeves/Teoma; +http://about.ask.com/en/docs/about/webmasters.shtml)</li>" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains A Patent Crawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains 404checker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains 404enemy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains 7Siters" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains 80legs" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains A6-Indexer" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ADmantX" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AHC\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AISearchBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AIBOT" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ALittle\ Client" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains APIs-Google" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ASPSeek" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AWS Security Scanner" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Abonti" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Aboundex" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AcademicBotRTU" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AddSearchBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Aboundexbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Accoona-AI-Agent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Acunetix" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AdAuth\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains AddThis" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Adidxbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AdsBot-Google([^-]|$)" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AdsBot-Google-Mobile" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AdsTxtCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AdvBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Ahrefs(Bot|SiteAudit)" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AlexandriaOrgBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AdminLabs" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AdsTxtCrawlerTP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Adstxtaggregator" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Adyen HttpClient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AfD-Verbotsverfahren" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AffiliateLabz\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AhrefsBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AiHitBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Aipbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Airmail" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Alexibot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Alibaba\.Security\.Heimdall" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AllSubmitter" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Alligator" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains AlphaBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Amazon CloudFront" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Amazonbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AndersPinkBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AnyEvent" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Apercite" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Anarchie" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Anarchy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Anarchy99" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AndroidDownloadManager" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Anemone" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AngleSharp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ankit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ant\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Anthill" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Anturis Agent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AnyEvent-HTTP\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Apache Ant\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Apache Droid" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Apache OpenOffice" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Apache-HttpAsyncClient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Apache-HttpClient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ApacheBench" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Apexoo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AportWorm\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AppBeat\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains AppEngine-Google" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AppInsights" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Applebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ArchiveBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains AspiegelBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Atom Feed Robot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Audisto Crawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AppleSyndication" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Aprc\/[0-9]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Arachmo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Arachnophilia" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Arukereso" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Asana\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ask Jeeves" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AskQuickly" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Aspiegel" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Asterias" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Astute" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Atomseobot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Attach" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains AutomaticWPTester" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Autonomy" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains AwarioBot" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains AwarioRssBot" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains AwarioSmartBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains B2B Bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains B-l-i-t-z-B-O-T" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BBBike" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BCKLINKS" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains BDCbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BIGLOTRON" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BLEXBot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BLP_bbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BTWebClient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BDFetch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BKCTwitterUnshortener\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BLEXBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BPImageWalker" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains BUbiNG" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Baidu-YunGuanCe" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Baiduspider" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Bark[rR]owler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BackDoorBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BackStreet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BackWeb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Backlink-Ceck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BacklinkCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BacklinkHttpStatus" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BacklinksExtendedBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BackupLand" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bad-Neighborhood" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Badass" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bandit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Barkrowler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BatchFTP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Battleztar Bazinga" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Battleztar\ Bazinga" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains BazQux" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BehloolBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Better Uptime Bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BingPreview\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BitBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BitSightBot\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BegunAdvertising" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BetaBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bewica-security-scan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bidtellect" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BigBozz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bigfoot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BingLocalSearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BingPreview" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bitacle" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bitrix link preview" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Black Hole" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BlackWidow" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Black\ Hole" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Blackboard" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BlogTraffic\/\d\.\d+ Feed-Fetcher" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BomboraBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Bot\.AraTurka\.com" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BoxcarBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BrandONbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BrandVerity" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BrightEdge Crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains BublupBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Blackboard Safeassign" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BlockNote\.Net" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BlogBridge" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BlogPulseLive" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BlogSearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bloglines" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bloglovin" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Blogtrottr" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Blow" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BlowFish" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Boardreader" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bolt" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Boost\.Beast" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BotALot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Braintree-Webhooks" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Branch Metrics API" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Branch-Passthrough" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Brandprotect" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Brandwatch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Brodie\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Browsershots" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Buck" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Buck\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Buddy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BuiltBotTough" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BuiltWith" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Bullseye" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BunnySlippers" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Burf Search" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Butterfly\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains BuzzSumo" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Bytespider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CAAM\/[0-9]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CATExplorador" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains CC Metadata Scaper" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains CCBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains CISPA Webcrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Caliperbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains CapsuleChecker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CERT\.at-Statistics-Survey" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CISPA Vulnerability Notification" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CISPA Web Analyser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CJNetworkQuality" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CODE87" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CSHttp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CSSCheck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CakePHP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Calculon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Canary%20Mail" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CaretNail" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CazoodleBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Cegbfeieh" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CensysInspect" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Cerberian Drtrs" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ChangesMeter" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Charlotte" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ChatGPT-User" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains CheckMarkNetwork\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Chrome-Lighthouse" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Cincraw" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Clickagy" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Cliqzbot\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CheTeam" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CheckHost" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CheeseBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CherryPicker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ChinaClaw" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Chirp\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Chlooe" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Chromaxa" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CirrusExplorer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Citoid" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Claritybot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Clarsentia" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ClaudeBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Cliqzbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Cloud mapping" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CloudEndure" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains CloudFlare-AlwaysOnline" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains CloudFlare-Prefetch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Cloud\ mapping" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Cloudflare-Healthchecks" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Cloudflare-SSLDetector" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Cloudflare-Traffic-Manager" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Cloudinary" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Cocolyzebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Companybook-Crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ContextAd Bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains CookieHubScan" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Cookiebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains CrawlyProjectCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains CriteoBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Cogentbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ColdFusion" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Collector" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CommaFeed" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Commons-HttpClient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Contextual Code Sites Explorer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CookieReports" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Copier" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CopyRightCheck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Copyscape" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Cosmos" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Cosmos4j\.feedback" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Covario-IDS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Craftbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Craw\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Crawling\ at\ Home\ Project" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CrazyWebCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Crescent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Criteo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Crowsnest" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains CrunchBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains CrystalSemanticsBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Cutbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains CyberPatrol" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Cula\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Curious" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Curious George" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Custo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains CyotekWebCopy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DAP\/NetHTTP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DBLBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DIIbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DMBrowser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DNSPod-reporting" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DSearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DTS Agent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DTS\ Agent" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains DareBoost" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains DataForSeoBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DataCha0s" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DataXu" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DatabaseDriverMysqli" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DatadogSynthetics" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Datafeedwatch" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Datanyze" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Dataprovider\.com" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Daum\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains DeuSu\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Diffbot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Digg Deeper" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Digincore bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Discordbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Disqus" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DataparkSearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Daum(oa)?[ \/][0-9]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Demon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DeuSu" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Deusu" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Devil" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Digg" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Digincore" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DigitalPebble" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Dirbuster" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Disco" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Discobot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Discourse Forum Onebox" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Discoverybot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Dispatch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Dispatch\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Disqus\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DittoSpyder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DnBCrawler-Analytics" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains DnyzBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Domain Re-Animator Bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Dolphin http client" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DomCopBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DomainAppender" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DomainCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DomainLabz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DomainSigmaCrawler" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains DomainStatsBot" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Domains Project\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Dragonbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Dubbotbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains DuckDuckBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains DuckDuckGo-Favicons-Bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains EZID" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Domains\ Project" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Donuts Content Explorer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Dotbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Download Wonder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Download\ Wonder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DowntimeDetector" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Dragonfly" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Drip" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Drupal \(\+http:\/\/drupal\.org\/\)" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DuplexWeb-Google" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains DynatraceSynthetic" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EARTHCOM" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ECCP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ECCP/1.0" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EMail Exractor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EMail Wolf" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EMail\ Siphon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EMail\ Wolf" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Easy-Thumb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EasyDL" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ebingbong" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ecxi" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EirGrabber" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ElectricMonk" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EmailWolf" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Embarcadero" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Embed PHP Library" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Embedly" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains EveryoneSocialBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Expanse" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Experibot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EroCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EventMachine HttpClient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Everwall Link Expander" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Evidon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Evil" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Evrinid" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Exabot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ExactSearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ExaleadCloudview" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Excel\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ExoRank" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Exploratodo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Express WebPictures" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Express\ WebPictures" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ExtLinksBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Eyeotabot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains FAST Enterprise Crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains FAST-WebCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Facebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains FeedValidator" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Extractor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ExtractorPro" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Extreme Picture Finder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Extreme\ Picture\ Finder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains EyeNetIE" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ezooms" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FHscan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FacebookBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Faraday v" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FavOrg" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Faveeo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Favicon downloader" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Feed Wrangler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FeedBooster" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FeedBucket" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FeedBunch\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FeedBurner" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FeedViewer\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FeedZcollector" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Feedable\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Feedbin" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Feedfetcher-Google" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Feedly" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FeedshowOnline" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Feedshow\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Feedspot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Feedwind\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains FemtosearchBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Fetch\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Fever" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains FindITAnswersbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Flamingo_SearchEngine" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Fetch API" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Fetch\/[0-9]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Fever\/[0-9]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Fiery%20Feeds" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Filestack" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Fimap" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Firefox/7.0" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FlashGet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FlipboardBrowserProxy" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains FlipboardProxy" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains FreeWebMonitoring SiteChecker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FlipboardRSS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Flock\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Florienzh\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Flunky" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Foobot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ForusP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FoundSeoTool" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Freeuploader" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains FreshRSS" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains FreshpingBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Friendica" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FrontPage" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Funnelback" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Fuzz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Fuzz Faster U Fool" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains FyberSpider" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Fyrebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains G2 Web Services" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains G-i-g-a-b-o-t" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GIS-LABS" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains GPTBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains GarlikCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains GeedoBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GRequests" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GT::WWW" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GTmetrix" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GalaxyBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GeedoProductSearch" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Genieo" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Gigablast" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GentleSource" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GermCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GetCode" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GetLinkInfo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GetRight" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GetURLInfo\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GetWeb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Getintent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Geziyor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ghost Inspector" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GigablastOpenSource" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Gigabot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains GingerCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Gluten Free Crawler\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains GnowitNewsbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GitHub-Hookshot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Go [\d\.]* package http" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Go http package" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Go!Zilla" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Go-Ahead-Got-It" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Go-http-client" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Google Favicon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GoSpotCheck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GoZilla" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Gofeed" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Goldfire Server" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GomezAgent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Goodzer\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google AppsViewer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google Desktop" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google Keyword Suggestion" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google Keyword Tool" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google PP Default" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google Page Speed Insights" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google Search Console" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Google Web Preview" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Google-Adwords-Instant" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Google-Certificates-Bridge" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google favicon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-Ads" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-Adwords" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-Apps-Script" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-Calendar-Importer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-HTTP-Java-Client" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-HotelAdsVerifier" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Google-InspectionTool" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Google-PhysicalWeb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-Podcast" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-Publisher-Plugin" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Google-Read-Aloud" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Google-Safety" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-SMTP-STS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-SearchByImage" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Google-Site-Verification" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Google-Structured-Data-Testing-Tool" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-Transparency-Report" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-Youtube-Links" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Google-speakr" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GoogleDocs" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GoogleHC\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains GoogleOther" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Googlebot-Image" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Googlebot-Mobile" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Googlebot-News" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Googlebot-Video" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Googlebot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Gowikibot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GoogleProber" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GoogleProducer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GoogleSites" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Gookey" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Gotit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GrabNet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Grabber" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Grafula" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Grammarly" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GrapeFX" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains GrapeshotCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Grobbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains GroupHigh\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains GroupMeBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Gwene" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GreatNews" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Gregarius" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GridBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains GuzzleHttp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HAA(A)?RTLAND http client" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HEADMasterSEO" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HMView" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HTMLparser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HTTP Banner Detection" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HTTP-Header-Abfrage" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HTTP-Tiny" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HTTP::Lite" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HTTPMon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HTTP_Compression_Test" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HTTPie" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains HTTrack" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Haansoft" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Hadi Agent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HaosouSpider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HappyApps-WebCheck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Hardenize" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Harvest" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Hatena" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Havij" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HaxerMen" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains HeadlessChrome" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HeartRails_Capture" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Heritrix" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Hexometer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Hloader" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Holmes" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HonesoSearchEngine" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HonoluluBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HootSuite Image proxy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Hootsuite-WebFeed" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HostTracker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HttpComponents" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains HttpUrlConnection" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains HubSpot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains IAS crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ICBot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ICC-Crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains INETDEX-BOT" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HubSpot " "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HubSpot-Link-Resolver" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Humanlinks" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains HybridBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IDBTE4M" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IDBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IDG Twitter Links Resolver" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IDwhois\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IODC" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IPS\/[0-9]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IPWorks HTTP\/S Component" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IRLbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IZaBEE" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Iblog" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Id-search" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IdeelaborPlagiaat" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Iframely" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IlTrovatore" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains IlseBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Image Fetch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Image Sucker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ImageEngine\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ImageVisu\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Image\ Fetch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Image\ Sucker" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ImagesiftBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Imagga" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains InAGist" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains InDesign%20CC" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Inboxb0t" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains IndeedBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains InterfaxScanBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Indy Library" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Indy\ Library" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains InetURL" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains InfoNaviRobot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains InfoTekies" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains InfoWizards Reciprocal Link" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Information\ Security\ Team\ InfraSec\ Scanner" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains InfraSec\ Scanner" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Instapaper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Integrity" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Intelliseek" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains InterGET" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Internet Ninja" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains InternetMeasurement" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains IonCrawl" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains InternetSeer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Internet\ Ninja" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Iria" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Irokez" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Iskanie" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains IstellaBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains James BOT" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Jamie's Spider" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Jetslide" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JAHHO" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JOC\ Web\ Spider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JS-Kit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JamesBOT" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Jaunt\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Java.*outbrain" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Jbrofuzz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JennyBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Jersey\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JetCar" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Jetty" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains JobboerseBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Jooblebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Jugendschutzprogramm-Crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains K7MLWCBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains KStandBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Kemvibot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains KeybaseBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains KomodiaBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains KosmioBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Landau-Media-Spider" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Laserlikebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Leikibot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains LightspeedSystemsCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Linespider" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Linguee Bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains LinkArchiver" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains LinkedInBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains LinkisBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Livelap[bB]ot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Luminator-robots" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains MBCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Jigsaw" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JikeSpider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JobFeed discovery" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Jobboerse" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Jobg8 URL Monitor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Jobrapido" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Jobsearch1\.5" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JoinVision Generic" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JolokiaPwn" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Joomla" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Jorgee" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JungleKeyThumbnail" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains JustView" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Jyxobot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains KOCMOHABT" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Kaspersky Lab CFR link resolver" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Kelny\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Kenjin\ Spider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Kerrigan\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains KeyCDN" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Keybot\ Translation-Search-Machine" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Keyword Density" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Keyword\ Density" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Keywords Research" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains KickFire" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains KimonoLabs\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Kinza" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Kml-Google" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Kozmosbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains KumKie" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LNSpiderguy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LWP::Simple" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LYT\.SR" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains L\.webis" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Lanshanbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Larbin" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Lavf\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Leap" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LeechFTP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LeechGet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LexiBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Lftp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LibVLC" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LibWeb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Libwhisker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Licorne" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LieBaoFast" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Liferea\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Lighthouse" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Lightspeedsystems" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Likse" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Link Valet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinkAlarm\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinkAnalyser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinkExaminer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinkPreview" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinkScan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinkTiger" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinkWalker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Linkbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinkextractorPro" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinkpadBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinksManager" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinqiaMetadataDownloaderBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinqiaRSSBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LinqiaScrapeBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Lipperhey" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Lipperhey\ Spider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Litemage_walker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Lmspider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LoadImpactRload" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains LongURL API" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ltx71" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Lucee \(CFML Engine\)" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Lush Http Client" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MFC_Tear_Sample" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MIDown tool" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MIDown\ tool" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MIIxpc" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains MJ12bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MQQBrowser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MS Web Services Client Protocol" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MSFrontPage" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MSIECrawler" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains MTRobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains MaCoCu" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Mail\.RU_Bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Mastodon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MVAClient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MacOutlook\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mag-Net" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Magnet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MagpieRSS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mail.RU_Bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mail::STS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MailChimp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mail\.Ru" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Majestic-SEO" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Majestic12" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Majestic\ SEO" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mandrill" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MapperCmd" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MarkMonitor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MarkWatch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mass Downloader" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mass\ Downloader" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Masscan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mata Hari" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mata\ Hari" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains MauiBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Mediapartners \(Googlebot\)" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mb2345Browser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MeanPath\ Bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Meanpathbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mediametric" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Mediapartners-Google" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Mediatoolkitbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains MegaIndex" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MegaIndex\.ru" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains MeltwaterNews" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains MetaInspector" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains MetaJobBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Melvil Rawi" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MemGator" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains MetaURI" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Miniflux\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains MixnodeCache\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains MojeekBot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Monsidobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains MoodleBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Metaspinner" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Metauri" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MicroMessenger" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Microsearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Microsoft Data Access" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Microsoft Office" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Microsoft Outlook" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Microsoft Windows Network Diagnostics" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Microsoft-WebDAV-MiniRedir" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MicrosoftPreview" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Microsoft\ Data\ Access" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Microsoft\ URL\ Control" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Microsoft\.Data\.Mashup" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mindjet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Minefield" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Miniature\.io" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Miniflux" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Miro-HttpClient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mister PiX" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mister\ PiX" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mnogosearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Moblie\ Safari" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mojeek" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mojolicious" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mojolicious \(Perl\)" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mollie" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MolokaiBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MonTools" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Monit\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Monitority\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Moreover" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains MuckRack" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Multiviewbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains NAVER Blog Rssbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains NING\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains NINJA bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains NIXStatsbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains NTENTbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Neevabot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains NerdByNature\.Bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Morfeus Fucking Scanner" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Morfeus\ Fucking\ Scanner" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Morning Paper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MovableType" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mozlila" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mr.4x3" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mr\.4x3 Powered" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Mrcgiguy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Msrabot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MuckRack\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Musobot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains MxToolbox\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NETCRAFT" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NG-Search" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NICErsPRO" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NLNZ_IAHarvester" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NPbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Najdi\.si" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Name Intelligence" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NameFo\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Name\ Intelligence" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nameprotect" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Navroad" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NearSite" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Needle" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nessus" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Net Vampire" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NetAnts" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NetLyzer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NetMechanic" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NetNewsWire" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NetShelter ContentScan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NetSpider" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains NetSystemsResearch" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains NetcraftSurveyAgent" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Neticle Crawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NetTrack" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NetZIP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Net\ Vampire" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Netcraft" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Netpursual" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Netsparker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nettrack" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Netvibes" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains NewsBlur" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains NextCloud" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Nicecrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Nimbostratus-Bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Neustar WPM" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NeutrinoAPI" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NewRelicPinger" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NewsBlur .*Finder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NewsGator" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nexgate Ruby Client" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NextGenSearchBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nibbler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NihilScio" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Niki-bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nikto" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NimbleCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nimbostratus" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ninja" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nmap" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Nmap Scripting Engine" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NodePing" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nodemeter" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Norton-Safeweb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Notifixious" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains NotionEmbedder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nuclei" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Nutch" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Nuzzel" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains OAI-SearchBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Ocarinabot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains OdklBot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains OpenGraphCheck" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains OpenHoseBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains OrangeBot\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Nymesis" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OMSC" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OPPO A33" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Observatory\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ocelli\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Octopus" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Offline Explorer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Offline Navigator" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Offline\ Explorer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Offline\ Navigator" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OgScrper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OnCrawl" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Online Domain Tools" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Open Source RSS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OpenCalaisSemanticProxy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OpenLinkProfiler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OpenVAS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Openfind" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Openstat\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Openvas" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Optimizer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OrangeBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OrangeSpider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Orbiter" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OrgProbe\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains OutclicksBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains PR-CY\.RU" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains PagePeeker\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OutfoxBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Outlook-Express" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Outlook-iOS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Owler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Owlin" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains OxfordCloudService" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PDF24 URL To PDF" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PECL::HTTP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PHPCrawl" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains POE-Component-Client-HTTP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PRTG Network Monitor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PTST " "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PTST\/[0-9]+" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Page Valet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PageAnalyzer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PageFreezer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PageGrabber" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PagePeeker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PageScorer" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains PageThing" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Page\ Analyzer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pagespeed\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Pandalytics" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains PaperLiBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Panopta" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Panscient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Papa Foto" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Papa\ Foto" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pavuk" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PayPal IPN" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Pcore-HTTP" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains PerplexityBot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains PetalBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains PhantomJS" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains PhxBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains PiplBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pearltrees" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Peew" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PeoplePal" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Perlu -" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Petalbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PhantomJS Screenshoter" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PhantomJS\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Photon\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pi-Monster" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Picscout" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Picsearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PictureFinder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Piepmatz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pimonster" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PingAdmin\.Ru" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PingSpot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pingability" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pingdom" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pingoscope" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pixray" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pizilla" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Plagger\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PleaseCrawl" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pleroma " "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ploetz \+ Zeller" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Plukkie" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PocketImageCache" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains PocketParser" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Primalbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains PrivacyAwareBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Pulsepoint" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pockey" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PodcastAddict\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Polymail\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pompos" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Porkbun" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Port Monitor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PostPost" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PostmanRuntime" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PowerPoint\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Prebid" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Prerender" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Priceonomics Analysis Engine" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PrintFriendly" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PritTorrent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Prlog" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ProPowerBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ProWebWalker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Probethenet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Project ?25499" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Project-Resonance" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Protopage" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Proximic" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Psbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pu_iN" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Pump" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PxBroker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains PyCurl" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Python-httplib2" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Python-urllib" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains QQDownload" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Qirina Hurdler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains QrafterPro" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Qseero" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Qualidator" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains QueryN Metasearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains QueryN\ Metasearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Quick-Crawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains QuiteRSS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Quora Link Preview" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Qwantify" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ROI Hunter" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RPT-HTTPClient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RSSMix\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RSSOwl" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains RSSingBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Radian6" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RadioPublicImageResizer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Railgun\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Rainbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RankActive" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains RankActiveLinkBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Refindbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains RegionStuttgartBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains RetrevoPageAnalyzer" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ReverseEngineeringBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains RewriteCond %{HTTP_USER_AGENT} ^$|\&lt;|\&gt;|\&#039;|\%|\_iRc|\_Works|\@\$x|\&lt;\?|\$x0e|\+select\+|\+union\+|1\,\1\,1\,|2icommerce|3GSE|4all|59\.64\.153\.|88\.0\.106\.|98|85\.17\.|A\_Browser|ABAC|Abont|abot|Accept|Access|Accoo|AceFTP|Acme|ActiveTouristBot|Address|Adopt|adress|adressendeutschland|ADSARobot|agent|ah\-ha|Ahead|AESOP\_com\_SpiderMan|aipbot|Alarm|Albert|Alek|Alexibot|Alligator|AllSubmitter|alma|almaden|ALot|Alpha|aktuelles|Akregat|Amfi|amzn\_assoc|Anal|Anarchie|andit|Anon|AnotherBot|Ansearch|AnswerBus|antivirx|Apexoo|appie|Aqua_Products|Arachmo|archive|arian|ASPSe|ASSORT|aster|Atari|ATHENS|AtHome|Atlocal|Atomic_Email_Hunter|Atomz|Atrop|^attach|attrib|autoemailspider|autohttp|axod|batch|b2w|Back|BackDoorBot|BackStreet|BackWeb|Badass|Baid|Bali|Bandit|Baidu|Barry|BasicHTTP|BatchFTP|bdfetch|beat|Become|Beij|BenchMark|berts|bew|big.brother|Bigfoot|Bilgi|Bison|Bitacle|Biz360|Black|Black.Hole|BlackWidow|bladder.fusion|Blaiz|Blog.Checker|Blogl|BlogPeople|Blogshares.Spiders|Bloodhound|Blow|bmclient|Board|BOI|boitho|Bond|Bookmark.search.tool|boris|Bost|Boston.Project|BotRightHere|Bot.mailto:craftbot@yahoo.com|BotALot|botpaidtoclick|botw|brandwatch|BravoBrian|Brok|Bropwers|Broth|browseabit|BrowseX|Browsezilla|Bruin|bsalsa|Buddy|Build|Built|Bulls|bumblebee|Bunny|Busca|Busi|Buy|bwh3|c\-spider|CafeK|Cafi|camel|Cand|captu|Catch|cd34|Ceg|CFNetwork|cgichk|Cha0s|Chang|chaos|Char|char\(32\,35\)|charlotte|CheeseBot|Chek|CherryPicker|chill|ChinaClaw|CICC|Cisco|Cita|Clam|Claw|Click.Bot|clipping|clshttp|Clush|COAST|ColdFusion|Coll|Comb|commentreader|Compan|contact|Control|contype|Conc|Conv|Copernic|Copi|Copy|Coral|Corn|core-project|cosmos|costa|cr4nk|crank|craft|Crap|Crawler0|Crazy|Cres|cs\-CZ|cuill|Curl|Custo|Cute|CSHttp|Cyber|cyberalert|^DA$|daoBot|DARK|Data|Daten|Daum|dcbot|dcs|Deep|DepS|Detect|Deweb|Diam|Digger|Digimarc|digout4uagent|DIIbot|Dillo|Ding|DISC|discobot|Disp|Ditto|DLC|DnloadMage|DotBot|Doubanbot|Download|Download.Demon|Download.Devil|Download.Wonder|Downloader|drag|DreamPassport|Drec|Drip|dsdl|dsok|DSurf|DTAAgent|DTS|Dual|dumb|DynaWeb|e\-collector|eag|earn|EARTHCOM|EasyDL|ebin|EBM-APPLE|EBrowse|eCatch|echo|ecollector|Edco|edgeio|efp\@gmx\.net|EirGrabber|email|Email.Extractor|EmailCollector|EmailSearch|EmailSiphon|EmailWolf|Emer|empas|Enfi|Enhan|Enterprise\_Search|envolk|erck|EroCr|ESurf|Eval|Evil|Evere|EWH|Exabot|Exact|EXPLOITER|Expre|Extra|ExtractorPro|EyeN|FairAd|Fake|FANG|FAST|fastlwspider|FavOrg|Favorites.Sweeper|Faxo|FDM\_1|FDSE|fetch|FEZhead|Filan|FileHound|find|Firebat|Firefox.2\.0|Firs|Flam|Flash|FlickBot|Flip|fluffy|flunky|focus|Foob|Fooky|Forex|Forum|ForV|Fost|Foto|Foun|Franklin.Locator|freefind|FreshDownload|FrontPage|FSurf|Fuck|Fuer|futile|Fyber|Gais|GalaxyBot|Galbot|Gamespy\_Arcade|GbPl|Gener|geni|Geona|Get|gigabaz|Gira|Ginxbot|gluc|glx.?v|gnome|Go.Zilla|Goldfire|Google.Wireless.Transcoder|Googlebot\-Image|Got\-It|GOFORIT|gonzo|GornKer|GoSearch|^gotit$|gozilla|grab|Grabber|GrabNet|Grub|Grup|Graf|Green.Research|grub|grub\-client|gsa\-cra|GSearch|GT\:\:WWW|GuideBot|guruji|gvfs|Gyps|hack|haha|hailo|Harv|Hatena|Hax|Head|Helm|herit|hgre|hhjhj\@yahoo|Hippo|hloader|HMView|holm|holy|HomePageSearch|HooWWWer|HouxouCrawler|HMSE|HPPrint|htdig|HTTPConnect|httpdown|http.generic|HTTPGet|httplib|HTTPRetriever|HTTrack|human|Huron|hverify|Hybrid|Hyper|ia\_archiver|iaskspi|IBM\_Planetwide|iCCra|ichiro|ID\-Search|IDA|IDBot|IEAuto|IEMPT|iexplore\.exe|iGetter|Ilse|Iltrov|Image|Image.Stripper|Image.Sucker|imagefetch|iimds\_monitor|Incutio|IncyWincy|Indexer|Industry.Program|Indy|InetURL|informant|InfoNav|InfoTekies|Ingelin|Innerpr|Inspect|InstallShield.DigitalWizard|Insuran\.|Intellig|Intelliseek|InterGET|Internet.Ninja|Internet.x|Internet\_Explorer|InternetLinkagent|InternetSeer.com|Intraf|IP2|Ipsel|Iria|IRLbot|Iron33|Irvine|ISC\_Sys|iSilo|ISRCCrawler|ISSpi|IUPUI.Research.Bot|Jady|Jaka|Jam|^Java|java\/|Java\(tm\)|JBH.agent|Jenny|JetB|JetC|jeteye|jiro|JoBo|JOC|jupit|Just|Jyx|Kapere|kash|Kazo|KBee|Kenjin|Kernel|Keywo|KFSW|KKma|Know|kosmix|KRAE|KRetrieve|Krug|ksibot|ksoap|Kum|KWebGet|Lachesis|lanshan|Lapo|larbin|leacher|leech|LeechFTP|LeechGet|leipzig\.de|Lets|Lexi|lftp|Libby|libcrawl|libcurl|libfetch|libghttp|libWeb|libwhisker|libwww|libwww\-FM|libwww\-perl|LightningDownload|likse|Linc|Link|Link.Sleuth|LinkextractorPro|Linkie|LINKS.ARoMATIZED|LinkScan|linktiger|LinkWalker|Lint|List|lmcrawler|LMQ|LNSpiderguy|loader|LocalcomBot|Locu|London|lone|looksmart|loop|Lork|LTH\_|lwp\-request|LWP|lwp-request|lwp-trivial|Mac.Finder|Macintosh\;.I\;.PPC|Mac\_F|magi|Mag\-Net|Magnet|Magp|Mail.Sweeper|main|majest|Mam|Mana|MarcoPolo|mark.blonin|MarkWatch|MaSagool|Mass|Mass.Downloader|Mata|mavi|McBot|Mecha|MCspider|mediapartners|^Memo|MEGAUPLOAD|MetaProducts.Download.Express|Metaspin|Mete|Microsoft.Data.Access|Microsoft.URL|Microsoft\_Internet\_Explorer|MIDo|MIIx|miner|Mira|MIRE|Mirror|Miss|Missauga|Missigua.Locator|Missouri.College.Browse|Mist|Mizz|MJ12|mkdb|mlbot|MLM|MMMoCrawl|MnoG|moge|Moje|Monster|Monza.Browser|Mooz|Moreoverbot|MOT\-MPx220|mothra\/netscan|mouse|MovableType|Mozdex|Mozi\!|^Mozilla$|Mozilla\/1\.22|Mozilla\/22|^Mozilla\/3\.0.\(compatible|Mozilla\/3\.Mozilla\/2\.01|Mozilla\/4\.0\(compatible|Mozilla\/4\.08|Mozilla\/4\.61.\(Macintosh|Mozilla\/5\.0|Mozilla\/7\.0|Mozilla\/8|Mozilla\/9|Mozilla\:|Mozilla\/Firefox|^Mozilla.*Indy|^Mozilla.*NEWT|^Mozilla*MSIECrawler|Mp3Bot|MPF|MRA|MS.FrontPage|MS.?Search|MSFrontPage|MSIE\_6\.0|MSIE6|MSIECrawler|msnbot\-media|msnbot\-Products|MSNPTC|MSProxy|MSRBOT|multithreaddb|musc|MVAC|MWM|My\_age|MyApp|MyDog|MyEng|MyFamilyBot|MyGetRight|MyIE2|mysearch|myurl|NAG|NAMEPROTECT|NASA.Search|nationaldirectory|Naver|Navr|Near|NetAnts|netattache|Netcach|NetCarta|Netcraft|NetCrawl|NetMech|netprospector|NetResearchServer|NetSp|Net.Vampire|netX|NetZ|Neut|newLISP|NewsGatorInbox|NEWT|NEWT.ActiveX|Next|^NG|NICE|nikto|Nimb|Ninja|Ninte|NIPGCrawler|Noga|nogo|Noko|Nomad|Norb|noxtrumbot|NPbot|NuSe|Nutch|Nutex|NWSp|Obje|Ocel|Octo|ODI3|oegp|Offline|Offline.Explorer|Offline.Navigator|OK.Mozilla|omg|Omni|Onfo|onyx|OpaL|OpenBot|Openf|OpenTextSiteCrawler|OpenU|Orac|OrangeBot|Orbit|Oreg|osis|Outf|Owl|P3P|PackRat|PageGrabber|PagmIEDownload|pansci|Papa|Pars|Patw|pavu|Pb2Pb|pcBrow|PEAR|PEER|PECL|pepe|Perl|PerMan|PersonaPilot|Persuader|petit|PHP|PHP.vers|PHPot|Phras|PicaLo|Piff|Pige|pigs|^Ping|Pingd|PingALink|Pipe|Plag|Plant|playstarmusic|Pluck|Pockey|POE\-Com|Poirot|Pomp|Port.Huron|Post|powerset|Preload|press|Privoxy|Probe|Program.Shareware|Progressive.Download|ProPowerBot|prospector|Provider.Protocol.Discover|ProWebWalker|Prowl|Proxy|Prozilla|psbot|PSurf|psycheclone|^puf$|Pulse|Pump|PushSite|PussyCat|PuxaRapido|PycURL|Pyth|PyQ|QuepasaCreep|Query|Quest|QRVA|Qweer|radian|Radiation|Rambler|RAMP|RealDownload|Reap|Recorder|RedCarpet|RedKernel|ReGet|relevantnoise|replacer|Repo|requ|Rese|Retrieve|Rip|Rix|RMA|Roboz|Rogue|Rover|RPT\-HTTP|Rsync|RTG30|.ru\)|ruby|Rufus|Salt|Sample|SAPO|Sauger|savvy|SBIder|SBP|SCAgent|scan|SCEJ\_|Sched|Schizo|Schlong|Schmo|Scout|Scooter|Scorp|ScoutOut|SCrawl|screen|script|SearchExpress|searchhippo|Searchme|searchpreview|searchterms|Second.Street.Research|Security.Kol|Seekbot|Seeker|Sega|Sensis|Sept|Serious|Sezn|Shai|Share|Sharp|Shaz|shell|shelo|Sherl|Shim|Shiretoko|ShopWiki|SickleBot|Simple|Siph|sitecheck|SiteCrawler|SiteSnagger|Site.Sniper|SiteSucker|sitevigil|SiteX|Sleip|Slide|Slurpy.Verifier|Sly|Smag|SmartDownload|Smurf|sna\-|snag|Snake|Snapbot|Snip|Snoop|So\-net|SocSci|sogou|Sohu|solr|sootle|Soso|SpaceBison|Spad|Span|spanner|Speed|Spegla|Sphere|Sphider|spider|SpiderBot|SpiderEngine|SpiderView|Spin|sproose|Spurl|Spyder|Squi|SQ.Webscanner|sqwid|Sqworm|SSM\_Ag|Stack|Stamina|stamp|Stanford|Statbot|State|Steel|Strateg|Stress|Strip|studybot|Style|subot|Suck|Sume|sun4m|Sunrise|SuperBot|SuperBro|Supervi|Surf4Me|SuperHTTP|Surfbot|SurfWalker|Susi|suza|suzu|Sweep|sygol|syncrisis|Systems|Szukacz|Tagger|Tagyu|tAke|Talkro|TALWinHttpClient|tamu|Tandem|Tarantula|tarspider|tBot|TCF|Tcs\/1|TeamSoft|Tecomi|Teleport|Telesoft|Templeton|Tencent|Terrawiz|Test|TexNut|trivial|Turnitin|The.Intraformant|TheNomad|Thomas|TightTwatBot|Timely|Titan|TMCrawler|TMhtload|toCrawl|Todobr|Tongco|topic|Torrent|Track|translate|Traveler|TREEVIEW|True|Tunnel|turing|Turnitin|TutorGig|TV33\_Mercator|Twat|Tweak|Twice|Twisted.PageGetter|Tygo|ubee|UCmore|UdmSearch|UIowaCrawler|Ultraseek|UMBC|unf|UniversalFeedParser|unknown|UPG1|UtilMind|URLBase|URL.Control|URL\_Spider\_Pro|urldispatcher|URLGetFile|urllib|URLSpiderPro|URLy|User\-Agent|UserAgent|USyd|Vacuum|vagabo|Valet|Valid|Vamp|vayala|VB\_|VCI|VERI\~LI|verif|versus|via|Viewer|virtual|visibilitygap|Visual|vobsub|Void|VoilaBot|voyager|vspider|VSyn|w\:PACBHO60|w0000t|W3C|w3m|w3search|walhello|Walker|Wand|WAOL|WAPT|Watch|Wavefire|wbdbot|Weather|web.by.mail|Web.Data.Extractor|Web.Downloader|Web.Ima|Web.Mole|Web.Sucker|Web2Mal|Web2WAP|WebaltBot|WebAuto|WebBandit|Webbot|WebCapture|WebCat|webcraft\@bea|Webclip|webcollage|WebCollector|WebCopier|WebCopy|WebCor|webcrawl|WebDat|WebDav|webdevil|webdownloader|Webdup|WebEMail|WebEMailExtrac|WebEnhancer|WebFetch|WebGo|WebHook|Webinator|WebInd|webitpr|WebFilter|WebFountain|WebLea|Webmaster|WebmasterWorldForumBot|WebMin|WebMirror|webmole|webpic|WebPin|WebPix|WebReaper|WebRipper|WebRobot|WebSauger|WebSite|Website.eXtractor|Website.Quester|WebSnake|webspider|Webster|WebStripper|websucker|WebTre|WebVac|webwalk|WebWasher|WebWeasel|WebWhacker|WebZIP|Wells|WEP\_S|WEP.Search.00|WeRelateBot|wget|Whack|Whacker|whiz|WhosTalking|Widow|Win67|window.location|Windows.95\;|Windows.95\)|Windows.98\;|Windows.98\)|Winodws|Wildsoft.Surfer|WinHT|winhttp|WinHttpRequest|WinHTTrack|Winnie.Poh|wire|WISEbot|wisenutbot|wish|Wizz|WordP|Works|world|WUMPUS|Wweb|WWWC|WWWOFFLE|WWW\-Collector|WWW.Mechanize|www.ranks.nl|wwwster|^x$|X12R1|x\-Tractor|Xaldon|Xenu|XGET|xirq|Y\!OASIS|Y\!Tunnel|yacy|YaDirectBot|Yahoo\-MMAudVid|YahooSeeker|YahooYSMcm|Yamm|Yand|yang|Yeti|Yoono|yori|Yotta|YTunnel|Zade|zagre|ZBot|Zeal|ZeBot|zerx|Zeus|ZIPCode|Zixy|zmao|Zyborg [NC]" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains RidderBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Rivva" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RankFlex" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RankSonicSiteAuditor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RankingBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RankingBot2" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Rankivabot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RankurBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RapidLoad\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Re-re" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Re-re Studio" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ReGet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ReactorNetty" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Readability" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RealDownload" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RealPlayer%20Downloader" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Reaper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RebelMouse" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Recorder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RecurPost\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RedesScrapy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ReederForMac" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Reeder\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RepoMonkey" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ResponseCodeTest" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RestSharp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Riddler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Ripper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Rival IQ" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Robosourcer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Robozilla" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RocketCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Rogerbot" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains RuxitSynthetic" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains RyteBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SBL-BOT" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains RyowlEngine" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SAP NetWeaver Application Server" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SBIder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SEO Browser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SEOCentro" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains SEOkicks" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SEOkicks-Robot" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains SEOlizer" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SWIMGBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains S[eE][mM]rushBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SafeDNSBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SafeSearch microdata crawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SEOlyt" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SEOlyticsCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SEOprofiler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SEOsearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SEOstats" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SISTRIX" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SMRF URL Expander" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SMTBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SMUrlExpander" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SPDYCheck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SPEng" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SSL Labs" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SalesIntelligent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Saleslift" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SauceNAO" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Scamadviser-Frontend" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ScanAlert" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Scanbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Scoop" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ScopeContentAG-HTTP-Client" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ScoutJet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ScoutURLMonitor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ScrapeBox Page Scanner" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Scrapy" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Screaming Frog SEO Spider" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SearchAtlas" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Screaming" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ScreenShotService" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ScreenerBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ScrepyBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Scrubby" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Scrutiny\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Search37" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SearchExpress" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SearchSight" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SearchWP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Searchestate" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SearchmetricsBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Seeker" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Seekport" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SemanticScholarBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SeekportBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SemanticJuice" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Semiocast HTTP client" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Semrush" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SemrushBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sendsay\.Ru" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains SentiBot" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains SenutoBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Seo Servis" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SeoCheck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SeoCherryBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SeoSiteCheckup" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Seobility" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains SeobilityBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SerendeputyBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SeznamBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SimpleCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Seomoz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Seznam" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Shelob" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Shodan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ShopWiki" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Shoppimon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ShortLinkTranslate" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sideqik" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Siege" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains SimplePie" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SimpleScraper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SimplyFast" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Siphon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Site Sucker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Site-Shot\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Site24x7" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SiteBar" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains SiteCheckerBotCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Siteimprove\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SiteCondor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SiteExplorer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SiteGuardian" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SiteIndexed" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SiteLockSpider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SiteMonitor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SiteSnagger" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SiteSucker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SiteTruth" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Site\ Sucker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sitebeam" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sitebulb\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Siteimprove" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sitemap(s)? Generator" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SitemapGenerator" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Siteshooter B0t" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sitevigil" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains SkypeUriPreview" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Slack-ImgProxy" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Slackbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Slurp" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Snacktory" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Snap URL Preview Service" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Slack\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SlySearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SmartDownload" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Snake" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SnapSearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Snapbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Snappy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Snarfer\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SniffRSS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Snoopy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SnowHaze Search" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains SocialRankIOBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Sogou" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Sonic" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Storebot-Google" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains StorygizeBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains StractBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Streamline3Bot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Superfeedr" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains SurdotlyBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sociscraper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sogou\ web\ spider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SortSite" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sosospider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sottopop" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SpaceBison" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SpamExperts" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Spammen" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SpankBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Spanner" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Spawning-AI" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Spbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Specificfeeds" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SpeedKit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Spider_Bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Spider_Bot/3.0" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Spinn3r" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sprinklr " "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SputnikBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sqlmap" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sqlworm" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sqworm" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains StackRambler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Statastico\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Statically-" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains StatusCake" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Steeler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Stratagems Kumo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Stripe\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Stripper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Stroke\.cz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains StudioFACA" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains StumbleUpon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sucker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Sucuri" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SuperBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SuperHTTP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Surfbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Surphace Scout" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains SurveyBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Synapse" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Suzuran" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Swiftbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Symfony BrowserKit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Symfony2 BrowserKit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains SynHttpClient-Built" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Synapse\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Syndirella\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Sysomos" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Taboolabot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains TangibleeBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains TelegramBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Teoma" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Szukacz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains T0PHackTeam" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains T8Abot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TLSProbe\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Tarantula\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Taringa UGC" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TarmotGezgin" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Teleport" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TeleportPro" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Telesoft" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Telesphoreo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Telesphorep" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Tenon\.io" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Test Certificate Info" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Tetrahedron" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TextRazor Downloader" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains The Drop Reaper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains The Expert HTML Source Viewer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains The Intraformant" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains The Knowledge AI" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TheNomad" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains The\ Intraformant" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Thinklab" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ThumbSniper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Thumbor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Thumbshots" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TightTwatBot" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains TinEye" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Tiny Tiny RSS" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains TombaPublicWebCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ToutiaoSpider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TinyTestBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Titan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Toata" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Toweyabot" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Traackr\.com" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains TrendsmapResolver" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Trove" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Tracemyfile" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Trackuity" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TrapitAgent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Trendiction" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Trendictionbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Trendsmap" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains True_Robot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TryJsoup" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TulipChain" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Turingos" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Turnitin" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains TweetmemeBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TurnitinBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Tweetminster" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Tweezler\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains TwengaBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Twice" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Twikle" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Twingly" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Twitterbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Twurly" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains UT-Dorkbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Twisted PageGetter" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Typhoeus" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains URL Verifier" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains URLTester" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains URL\/Emacs" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains URLitor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains URLy Warning" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains URLy\ Warning" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains URLy\.Warning" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains UdmSearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains UnisterBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains UniversalFeedParser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Unshorten\.It" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Untiny" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains UnwindFetchor" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Upflow" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Uptime-Kuma" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains UptimeRobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Uptimebot\.org" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains UsineNouvelleCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains VKRobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Validator\.nu" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Valve\/Steam" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Uptimia" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains UrlTrends Ranking Updater" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Urlcheckr" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Urlstat" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains V-BOT" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains VB Project" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains VB\ Project" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains VSAgent\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains VSB-TUO\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains VYU2" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Vacuum" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Vagabondo" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains VelenPublicWebCrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Veoozbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Vercelbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Viber" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Vigil\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains VoluumDSP-content-bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains VeriCiteCrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Verity" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains VidibleScraper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Virusdie" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Visual Rights Group" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains VoidEYE" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Voil" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Voltron" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Vulnbusters Meter" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains W3C-checklink" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains W3C-mobileOK" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains W3C_CSS_Validator" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains W3C_I18n-Checker" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains W3C_Unicorn" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains W3C_Validator" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains WeSEE:Search" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WAC-OFU" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WASALive-Bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WBSearchBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WDT\.io" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WEBDAV" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WEPA" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WISENutbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WP Engine Install Performance API" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WP Rocket" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WPScan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WWW-Collector-E" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WWW-Mechanize" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WWW::Document" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WWW::Mechanize" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WWWOFFLE" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WakeletLinkExpander" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Wallpapers" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Wallpapers/3.0" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WallpapersHD" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Wallpapers\/[0-9]+" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Wappalyzer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WatchMouse" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WbSrch\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WeLikeLinks" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WeSEE" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web Auto" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web Collage" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web Enhancer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web Fetch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web Fuck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web Pix" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web Sauger" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web Sucker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web spyder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web-sniffer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebAuto" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebBandit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebCapture" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebClient\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebCollage" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebCookies" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebCopier" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebCorp" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains WebDataStats" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains WellKnownBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebDoc" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebEnhancer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebFetch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebFuck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebGazer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebGo IS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebGo\ IS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebImageCollector" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebImages" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebIndex" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebLeacher" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebPix" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebReaper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebSauger" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebSniffer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebStripper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebSucker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebThumbnail" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebWhacker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebZIP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web\ Auto" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web\ Collage" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web\ Enhancer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web\ Fetch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web\ Fuck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web\ Pix" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web\ Sauger" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Web\ Sucker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Webalta" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Webauskunft" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebmasterWorldForumBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Webshag" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Webshot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Website Quester" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebsiteExtractor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WebsiteQuester" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Website\ Quester" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Websnapr" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Webster" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Webthumb\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Wfuzz\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Whack" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Whacker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WhatCMS" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WhatWeb" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains WhatsApp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WhatsMyIP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Whatweb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WhereGoes\?" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Whibse" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WhoAPI\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WhoRunsCoinHive" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Whynder Magnet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Widow" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WinHTTP\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WinHTTrack" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WinHttp-Autoproxy-Service" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WinPodder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Windows-RSS-Platform" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WiseGuys\ Robot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Woko" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Wolfram HTTPClient" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Wonderbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Woobot" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains WordPress\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains WordupInfoSearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Word\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains WordupinfoSearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Wotbox" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Wprecon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Wtrace" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains XING-contenttabreceiver" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Xaldon\ WebSpider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Xaldon_WebSpider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains XaxisSemanticsClassifier" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains XenForo\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Xenu" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Xenu Link Sleuth" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Y!J" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains YaK\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Y!J-[A-Z][A-Z][A-Z]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains YP\.PL" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Yaanb" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Yahoo Link Preview" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains YandexRenderResourcesBot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Yellowbrandprotectionbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains Yeti" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains YisouSpider" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains YouBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains YahooCacheSystem" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains YahooMailProxy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains YahooYSMcm" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains YandeG" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Yandex(?!Search)" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Yo-yo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains YoYs\.net" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Yoleo Consumer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains YottaaMonitor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains YoudaoBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Your-Website-Sucks" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains Zabbix" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zade" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zapier" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zauba" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zemanta Aggregator" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zend\\Http\\Client" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zend_Http_Client" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zermelo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zeus" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zeus " "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zitebot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ZmEu" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ZnHTTP" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ZnajdzFoto" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zombie\.js" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ZoomBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains Zoom\.Mac" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ZoominfoBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ZoteroTranslationServer" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ZumBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ZuperlistBot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains [Cc]urebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains [cC]laude[bB]ot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains [pP]ingdom" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains [wW]get" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ^Apache-HttpClient" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ^BW\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ^LCC " "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ^PHP-Curl-Class" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ^curl" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains acapbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains acoonbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains adbeat_bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ZyBorg" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains [a-z0-9\-_]*(bot|crawl|archiver|transcoder|spider|uptime|validator|fetcher|cron|checker|reader|extractor|monitoring|analyzer|scraper)" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Aether" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Amazon CloudFront" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Amazon Simple Notification Service Agent$" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Amazon-Route53-Health-Check-Service" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^COMODO DCV" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Calypso v\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Corax" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^DHSH" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^DangDang" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^DavClnt" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Expanse" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^FDM " "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Goose\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Grabber" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Gradle\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^HTTPClient\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^HTTPing" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Java\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Jeode\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Jetty\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Mail\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Mget" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Microsoft URL Control" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Mikrotik\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^NG\/[0-9\.]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^NING\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Netlab360" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Nuclei" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^PHP-AYMAPI\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^PHP\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^RMA\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Ruby|Ruby\/[0-9]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^Swurl " "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^TLS tester " "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^VSE\/[0-9]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^WordPress\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^XRL\/[0-9]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^ZmEu" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^b0t$" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^bluefish " "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^docker\/[0-9]" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^git\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^npm\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^pip\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^pnpm\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^twine\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ^ureq" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains a3logics\.in" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains a\.pr-cy\.ru" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains aboutthedomain" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains acebookexternalhit\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains acoon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains acrylicapps\.com\/pulp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains adbeat" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains adressendeutschland" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains adreview\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains adscanner" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains aiHitBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains aiohttp" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains antibot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains arabot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains archive\.org_bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains awesomecrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains axios" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains backlinkcrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains betaBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains bidswitchbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains bingbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains adstxt-worker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains adstxt\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains affilimate-puppeteer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains agentslug" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains aihit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains aiohttp\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains akka-http\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains akula\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains alertra" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains alexa site audit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains allloadin" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains alyze\.info" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains amagit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains annotate_google" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains anthropic-ai" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains apimon\.de" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains arachnode" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains archive.org_bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains aria2" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains arquivo-web-crawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains asafaweb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains asynchttp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains attohttpc" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains autocite" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains autoemailspider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains awin\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains axios\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains backlink-check" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains baidu\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains basicstate" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains baypup\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains biNu image cacher" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains biglotron" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains binlar" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains bitlybot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains blogmuraBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains bnf\.fr_bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains bot-pge\.chlooe\.com" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains botify" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains brainobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains buzzbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains cXensebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains careerbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains centurybot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains biz_Directory" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains boitho\.com-dc" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains caam dot crwlr at gmail dot com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains catexplorador" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains censys" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains cf-facebook" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains cg-eye" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains changedetection" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains check_http" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains citeseerxbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains chatterino-api-cache" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains checkprivacy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains chkme\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains clark-crawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains clips\.ua\.ac\.be" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains cmcm\.com" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains coccoc" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains collection@infegy\.com" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains content crawler spider" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains contxbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains coccocbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains cognitiveseo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains cohere-ai" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains colly -" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains commonscan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains contactbigdatafr" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains contentkingapp" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains convera" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains copyright sheriff" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains cortex\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains crawler4j" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains datagnionbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains dcrawl" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains deadlinkchecker" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains deepnoc" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains developers\.google\.com\/\+\/web\/snippet" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains discobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains domaincrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains dotbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains curb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains curl" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains cuwhois\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains cybo\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains dBpoweramp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains dataforseobot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains dataprovider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ddline" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains deeris" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains delve\.ai" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains demandbase-bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains developers\.google\.com\/\+\/web\/snippet\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains dlvr" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains docoloc" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains dotMailer content retrieval" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains dotSemantic" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains downforeveryoneorjustme" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains downnotifier" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains drupact" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains e\.ventures Investment Crawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains dubaiindex" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains eCairn-Grabber" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains eCatch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains eContext\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ec2linkfinder" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains edisterbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains electricmonk" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains elisabot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains epicbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains eright" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains elefent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains endo\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains europarchive\.org" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ev-crawler\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains evc-batch" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains exabot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains everyfeed-spider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains exif" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ezooms" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains facebookcatalog\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains facebookcatalog" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains facebookexternalhit" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains fedoraplanet" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains feedbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains filterdb\.iss\.net\/crawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains facebookexternalua" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains facebookplatform" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains facebookscraper" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains fairshare" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains fasthttp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains faviconarchive" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains faviconkit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains feeder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains feeltiptop" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains findlink" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains findthatfile" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains findxbot" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains fluffy" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains fr-crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains fuelbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains flynxapp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains forensiq" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains fragFINN\.de" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains free thumbnails" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains frontman" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains g00g1e\.net" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains g2reader-bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains gnam gnam spider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains gSOAP\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ganarvisitas" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains gdnplus\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains geek-tools" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains getprismatic" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains getroot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains github-camo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains github\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains go-mtasts\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains gobuster" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains gobyus" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains gofetch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains gooblog" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains google-xrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains grub\.org" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains gslfbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains gopher" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains gosquared-thumbnailer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains grabify" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains grokkit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains grouphigh" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains grub-client" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains gvfs\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains hackney\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains help@dataminr\.com" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains heritrix" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains historious" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains hkedcity" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains hledejLevne\.cz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains hosterstats" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ht:\/\/check" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains htdig" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains htmlyse" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains http-get" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains http-kit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains http-request\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains httpRequest" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains http\.rb\/" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains http_get" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains https:\/\/developers\.cloudflare\.com\/security-center\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains http_request2" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains http_requester" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains httphr" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains httpscheck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains httpssites_power" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains httpunit" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains httpx" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains hypestat" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains hyscore\.io" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ia_archiver" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains httrack" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains huaweisymantec" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains i2kconnect\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains iGooglePortal" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains iThemes Sync\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains iZSearch" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ichiro" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains imrbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains infoobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains inoreader" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains igdeSpyder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains imagineeasy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains imgsizer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains inbound\.li parser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains infegy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains infohelfer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains inpwrd\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains instabid" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains integromedb" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains intelium_bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains ip-web-crawler\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains internetVista monitor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains internetVista\ monitor" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains internet_archive" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains internetwache" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains intraVnews" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains iplabel" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ips-agent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains iqdb\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains isUp\.li" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains isitup\.org" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains iskanie" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains it2media-domain-crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains jpg-newsbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains jyxobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains lb-spider" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains libwww-perl" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains linkapediabot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains iubenda-radar" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains janforman" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains javelin\.io" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains jobo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains khttp\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains knows\.is" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains kouio" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains kube-probe" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains kubectl" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains kulturarw3" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains leakix\.net" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains letsencrypt" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains libwww" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains limber\.io" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains link-check" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains linkCheck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains link_thumbnailer" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains linkdex" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains lipperhey" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains lkxscan" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains lssbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains lssrocketcrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains linkdexbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains linkfluence" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains linkpeek" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains livedoor ScreenShot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains localsearch-web" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains longurl-r-package" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains looid\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains looksystems\.net" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains lscache_runner" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains ltx71" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains lua-resty-http" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains lwp-request" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains lwp-trivial" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains lycos" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains mShots" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains mabontland" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains magpie-crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains mappydata" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains memorybot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains meta-externalagent\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains meta-externalfetcher\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains mindUpBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains minicrawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains mlbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains moatbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains msnbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains msrbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains nerdybot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains netEstate NE Crawler" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains netresearchserver" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains newsharecounts" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains makecontact\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains marketinggrader" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains masscan\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains mattermost" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains meanpathbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains mediawords" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains mio_httpc" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains mixdata dot com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains mixed-content-scan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains mixnode" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains mogimogi" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains monitis" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains montastic" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains mowser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains muhstik-scan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains myseosnapshot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nWormFeedFinder" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nagios" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nationalarchives" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nbertaupete95" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains netEstate\ NE\ Crawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains netresearch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nettle" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains newsme" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains newspaper\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains niki-bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nghttp2" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nineconnections" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains node-fetch" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains officestorebot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains node-superagent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains node-urllib" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains node\.io" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nominet\.org\.uk" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nominet\.uk" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains notifyninja" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nuhk" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nutch" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains nyawc\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains oBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains oegp" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains okhttp" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains omgili" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains online-webceo-bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains openindexspider" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains outbrain" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains openai" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains orion-semantics" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ow\.ly" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ownCloud News" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains page scorer" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains page2rss" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains page\ scorer" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains page_verifier" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains panscient" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains phpcrawl" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains pinterest\.com\/bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains parsijoo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains pcBrowser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains peerindex" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains php-requests" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains phpservermon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ping\.blo\.gs" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains pinterest\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains plumanalytics" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains polaris\ version" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains postano" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains postfix-mta-sts-resolver" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains postplanner\.com" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains postrank" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains probe-image-size" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains probely\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains probethenet" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains prospectb2b" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains proximic" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains psbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains purebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains python-opengraph" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains pshtt, https scanning" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains pulsetic\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains python-httpx" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains python-requests" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains redditbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains rogerbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains rssbot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains scribdbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains search\.marginalia\.nu" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains seekbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains seewithkids" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains semanticbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains sempi\.tech" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains queuedriver" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains quic-go-HTTP\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains redback\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains request\.js" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains reqwest\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ripz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains safe-agent-scanner" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sc-downloader" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains scalaj-http" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains scan\.lol" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains scooter" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains search\.thunderstone" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains searchenginepromotionhelp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains semanticdiscovery" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains semanticjuice" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sentry\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains seo-nastroj\.cz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains seo4ajax" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains seobility" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains seocompany" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains seoscanners" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains seostar\.co" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains serpstatbot\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains sitebot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains siteexplorer\.info" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains smtbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains spbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains seositecheckup" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains seostar" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains serpstatbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains servernfo" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sexsearcher" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains shortURL lengthener" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains shrinktheweb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains siteripz" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sitexy\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sli-systems\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains slider\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains slurp" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sniptracker" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sogou web" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sogouspider" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sovereign\.ai" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sp_auditbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains spaziodati" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains speedy" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains startmebot\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains spray-can" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains spyfu" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains spyonweb" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sqlmap" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ssl-tools" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains suchen" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains summify" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains t3versionsBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains tagoobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains theoldreader\.com" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains tigerbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains toplistbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains swcd " "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains sysscan" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains tAkeOut" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains tchelebi\.io" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains techiaith\.cymru" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains teoma" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains terrainformatica" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains testuri" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains theinternetrules" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains timewe\.net" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains topster" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains touche\.com" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains tracemyfile" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains trendictionbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains trovitBot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains trendspottr" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains truwoGPS" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains tweetedtimes" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains twengabot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains um-LN" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains urlappendbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains vebidoobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains vercel-screenshot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains virustotal" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains twibble" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ubermetrics-technologies" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains uclassify" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains ultimate_sitemap_parser" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains unchaos" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains unirest-java" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains unshortenit" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains updated" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains updown\.io daemon" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains urlresolver" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains vBSEO" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains via ggpht\.com GoogleImageProxy" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains visionutils" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains vkShare" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains voilabot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains vuhuvBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains wbsearchbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains web-archive-net\.com\.bot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains webcompanycrawler" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains voltron" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains voyager\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains w3af\.org" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains wangling" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains web-capture\.net" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains webcollage" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains webgains-bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains webkit2png" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains webmastercoffee" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains webmeup-crawler" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains webmon " "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains wocbot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains woobot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains woorankreview\/" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains woriobot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains webprosbot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains webscreenie" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains websitepulse agent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains webtech\/" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains wf84" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains wget" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains wkhtmlto" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains wmtips" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains woorankreview" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains worldping-api" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains wotbox" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains www\.uptime\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains wpif" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains wprecon\.com survey" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains wscheck" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains www\.monitor\.us" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains x09Mozilla" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains x22Mozilla" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains xovibot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains yacybot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains yandex\.com\/bots" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains xpymep([0-9]?)\.exe" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains yacy" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains yanga" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains yoozBot" "id:3000,phase:1,deny,status:403"
-SecRule REQUEST_HEADERS:User-Agent "@contains zenback bot" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains yeti" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains yomins\.com" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains yoogliFetchAgent" "id:3000,phase:1,deny,status:403"
+SecRule REQUEST_HEADERS:User-Agent "@contains yourls\.org" "id:3000,phase:1,deny,status:403"
 SecRule REQUEST_HEADERS:User-Agent "@contains zgrab" "id:3000,phase:1,deny,status:403"
diff --git a/waf_patterns/apache/detection.conf b/waf_patterns/apache/detection.conf
index 1108987..48fe4cb 100644
--- a/waf_patterns/apache/detection.conf
+++ b/waf_patterns/apache/detection.conf
@@ -1,12 +1,12 @@
 # Apache ModSecurity rules for DETECTION
 SecRuleEngine On
 
+SecRule REQUEST_URI "@lt 1" "id:1043,phase:1,deny,status:403,log,msg:'detection attack detected'"
 SecRule REQUEST_URI "@lt 1" "id:1044,phase:1,deny,status:403,log,msg:'detection attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1045,phase:1,deny,status:403,log,msg:'detection attack detected'"
-SecRule REQUEST_URI "@pmFromFile scanners-user-agents.data" "id:1046,phase:1,deny,status:403,log,msg:'detection attack detected'"
+SecRule REQUEST_URI "@pmFromFile scanners-user-agents.data" "id:1045,phase:1,deny,status:403,log,msg:'detection attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1046,phase:1,deny,status:403,log,msg:'detection attack detected'"
 SecRule REQUEST_URI "@lt 2" "id:1047,phase:1,deny,status:403,log,msg:'detection attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1048,phase:1,deny,status:403,log,msg:'detection attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1048,phase:1,deny,status:403,log,msg:'detection attack detected'"
 SecRule REQUEST_URI "@lt 3" "id:1049,phase:1,deny,status:403,log,msg:'detection attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1050,phase:1,deny,status:403,log,msg:'detection attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1050,phase:1,deny,status:403,log,msg:'detection attack detected'"
 SecRule REQUEST_URI "@lt 4" "id:1051,phase:1,deny,status:403,log,msg:'detection attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1052,phase:1,deny,status:403,log,msg:'detection attack detected'"
diff --git a/waf_patterns/apache/enforcement.conf b/waf_patterns/apache/enforcement.conf
index 8c6a54a..6f8de6b 100644
--- a/waf_patterns/apache/enforcement.conf
+++ b/waf_patterns/apache/enforcement.conf
@@ -1,115 +1,115 @@
 # Apache ModSecurity rules for ENFORCEMENT
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1035,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1036,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@within %{tx.allowed_methods}" "id:1037,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1038,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1039,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1040,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1041,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1042,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1043,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1053,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1054,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx (?i)^(?:get /[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?|(?:connect (?:(?:[0-9]{1,3}.){3}[0-9]{1,3}.?(?::[0-9]+)?|[--9A-Z_a-z]+:[0-9]+)|options *|[a-z]{3,10}[sv]+(?:[0-9A-Z_a-z]{3,7}?://[--9A-Z_a-z]*(?::[0-9]+)?)?/[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?)[sv]+[.-9A-Z_a-z]+)$" "id:1055,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx (?i)^(?:&(?:(?:[acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|(?:[cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^"';=])*$" "id:1056,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^d+$" "id:1057,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^(?:GET|HEAD)$" "id:1058,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^0?$" "id:1059,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^(?:GET|HEAD)$" "id:1060,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@eq 0" "id:1061,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0" "id:1062,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@streq POST" "id:1063,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 0" "id:1064,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 0" "id:1065,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@eq 0" "id:1066,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@eq 0" "id:1067,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx (d+)-(d+)" "id:1068,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt %{tx.1}" "id:1069,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx b(?:keep-alive|close),s?(?:keep-alive|close)b" "id:1070,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx x25" "id:1071,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@validateUrlEncoding" "id:1072,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^(?i)application/x-www-form-urlencoded" "id:1073,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx x25" "id:1074,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@validateUrlEncoding" "id:1075,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 1" "id:1076,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@validateUtf8Encoding" "id:1077,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx %u[fF]{2}[0-9a-fA-F]{2}" "id:1078,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@validateByteRange 1-255" "id:1079,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 0" "id:1080,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^$" "id:1081,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^$" "id:1082,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^OPTIONS$" "id:1083,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@pm AppleWebKit Android Business Enterprise Entreprise" "id:1084,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^$" "id:1085,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^OPTIONS$" "id:1086,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 0" "id:1087,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^$" "id:1088,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^0$" "id:1089,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 0" "id:1090,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx (?:^([d.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$)" "id:1091,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 1" "id:1092,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@gt %{tx.max_num_args}" "id:1093,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 1" "id:1094,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@gt %{tx.arg_name_length}" "id:1095,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 1" "id:1096,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@gt %{tx.arg_length}" "id:1097,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 1" "id:1098,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@gt %{tx.total_arg_length}" "id:1099,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 1" "id:1100,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^(?i)multipart/form-data" "id:1101,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@gt %{tx.max_file_size}" "id:1102,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 1" "id:1103,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@gt %{tx.combined_file_sizes}" "id:1104,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^[w/.+*-]+(?:s?;s?(?:action|boundary|charset|component|start(?:-info)?|type|version)s?=s?['"w.()+,/:=?<>@#*-]+)*$" "id:1105,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^[^;s]+" "id:1106,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@within %{tx.allowed_request_content_type}" "id:1107,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx charsets*=s*["']?([^;"'s]+)" "id:1108,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@within %{tx.allowed_request_content_type_charset}" "id:1109,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx charset.*?charset" "id:1110,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@within %{tx.allowed_http_versions}" "id:1111,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx .([^.]+)$" "id:1112,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@within %{tx.restricted_extensions}" "id:1113,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx .[^.~]+~(?:/.*|)$" "id:1114,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^.*$" "id:1115,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@within %{tx.restricted_headers_basic}" "id:1116,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@gt 50" "id:1117,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$" "id:1118,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@streq JSON" "id:1119,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx (?i)x5cu[0-9a-f]{4}" "id:1120,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@contains #" "id:1121,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@gt 1" "id:1122,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1123,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1124,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}" "id:1125,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@endsWith .pdf" "id:1126,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@endsWith .pdf" "id:1127,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){63}" "id:1128,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx %[0-9a-fA-F]{2}" "id:1129,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@validateByteRange 9,10,13,32-126,128-255" "id:1130,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 0" "id:1131,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ['";=]" "id:1132,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^0$" "id:1133,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 0" "id:1134,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^.*$" "id:1135,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@within %{tx.restricted_headers_extended}" "id:1136,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1137,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1138,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@validateByteRange 32-36,38-126" "id:1139,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@eq 0" "id:1140,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^(?:OPTIONS|CONNECT)$" "id:1141,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@pm AppleWebKit Android" "id:1142,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@ge 1" "id:1143,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^(?i)up" "id:1144,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@gt 0" "id:1145,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:s*,s*|$)){1,7}$" "id:1146,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx br|compress|deflate|(?:pack200-)?gzip|identity|*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)" "id:1147,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1148,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1149,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@endsWith .pdf" "id:1150,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}" "id:1151,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@validateByteRange 38,44-46,48-58,61,65-90,95,97-122" "id:1152,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@validateByteRange 32,34,38,42-59,61,65-90,95,97-122" "id:1153,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "!@rx ^(?:?[01])?$" "id:1154,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
-SecRule REQUEST_URI "@rx (?:^|[^x5c])x5c[cdeghijklmpqwxyz123456789]" "id:1155,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1106,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1107,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@within %{tx.allowed_methods}" "id:1108,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1109,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1110,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1111,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1112,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1113,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1114,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1329,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1330,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx (?i)^(?:get /[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?|(?:connect (?:(?:[0-9]{1,3}.){3}[0-9]{1,3}.?(?::[0-9]+)?|[--9A-Z_a-z]+:[0-9]+)|options *|[a-z]{3,10}[sv]+(?:[0-9A-Z_a-z]{3,7}?://[--9A-Z_a-z]*(?::[0-9]+)?)?/[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?)[sv]+[.-9A-Z_a-z]+)$" "id:1331,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx (?i)^(?:&(?:(?:[acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|(?:[cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^"';=])*$" "id:1332,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^d+$" "id:1333,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^(?:GET|HEAD)$" "id:1334,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^0?$" "id:1335,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^(?:GET|HEAD)$" "id:1336,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@eq 0" "id:1337,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0" "id:1338,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@streq POST" "id:1339,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 0" "id:1340,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 0" "id:1341,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@eq 0" "id:1342,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@eq 0" "id:1343,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx (d+)-(d+)" "id:1344,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt %{tx.1}" "id:1345,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx b(?:keep-alive|close),s?(?:keep-alive|close)b" "id:1346,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx x25" "id:1347,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@validateUrlEncoding" "id:1348,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^(?i)application/x-www-form-urlencoded" "id:1349,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx x25" "id:1350,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@validateUrlEncoding" "id:1351,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 1" "id:1352,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@validateUtf8Encoding" "id:1353,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx %u[fF]{2}[0-9a-fA-F]{2}" "id:1354,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@validateByteRange 1-255" "id:1355,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 0" "id:1356,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^$" "id:1357,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^$" "id:1358,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^OPTIONS$" "id:1359,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@pm AppleWebKit Android Business Enterprise Entreprise" "id:1360,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^$" "id:1361,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^OPTIONS$" "id:1362,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 0" "id:1363,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^$" "id:1364,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^0$" "id:1365,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 0" "id:1366,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx (?:^([d.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$)" "id:1367,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 1" "id:1368,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@gt %{tx.max_num_args}" "id:1369,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 1" "id:1370,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@gt %{tx.arg_name_length}" "id:1371,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 1" "id:1372,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@gt %{tx.arg_length}" "id:1373,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 1" "id:1374,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@gt %{tx.total_arg_length}" "id:1375,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 1" "id:1376,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^(?i)multipart/form-data" "id:1377,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@gt %{tx.max_file_size}" "id:1378,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 1" "id:1379,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@gt %{tx.combined_file_sizes}" "id:1380,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^[w/.+*-]+(?:s?;s?(?:action|boundary|charset|component|start(?:-info)?|type|version)s?=s?['"w.()+,/:=?<>@#*-]+)*$" "id:1381,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^[^;s]+" "id:1382,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@within %{tx.allowed_request_content_type}" "id:1383,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx charsets*=s*["']?([^;"'s]+)" "id:1384,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@within %{tx.allowed_request_content_type_charset}" "id:1385,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx charset.*?charset" "id:1386,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@within %{tx.allowed_http_versions}" "id:1387,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx .([^.]+)$" "id:1388,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@within %{tx.restricted_extensions}" "id:1389,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx .[^.~]+~(?:/.*|)$" "id:1390,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^.*$" "id:1391,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@within %{tx.restricted_headers_basic}" "id:1392,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@gt 50" "id:1393,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$" "id:1394,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@streq JSON" "id:1395,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx (?i)x5cu[0-9a-f]{4}" "id:1396,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@contains #" "id:1397,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@gt 1" "id:1398,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1399,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1400,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}" "id:1401,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@endsWith .pdf" "id:1402,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@endsWith .pdf" "id:1403,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){63}" "id:1404,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx %[0-9a-fA-F]{2}" "id:1405,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@validateByteRange 9,10,13,32-126,128-255" "id:1406,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 0" "id:1407,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ['";=]" "id:1408,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^0$" "id:1409,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 0" "id:1410,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^.*$" "id:1411,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@within %{tx.restricted_headers_extended}" "id:1412,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1413,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1414,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@validateByteRange 32-36,38-126" "id:1415,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@eq 0" "id:1416,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^(?:OPTIONS|CONNECT)$" "id:1417,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@pm AppleWebKit Android" "id:1418,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@ge 1" "id:1419,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^(?i)up" "id:1420,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@gt 0" "id:1421,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:s*,s*|$)){1,7}$" "id:1422,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx br|compress|deflate|(?:pack200-)?gzip|identity|*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)" "id:1423,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1424,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1425,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@endsWith .pdf" "id:1426,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}" "id:1427,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@validateByteRange 38,44-46,48-58,61,65-90,95,97-122" "id:1428,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@validateByteRange 32,34,38,42-59,61,65-90,95,97-122" "id:1429,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "!@rx ^(?:?[01])?$" "id:1430,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
+SecRule REQUEST_URI "@rx (?:^|[^x5c])x5c[cdeghijklmpqwxyz123456789]" "id:1431,phase:1,deny,status:403,log,msg:'enforcement attack detected'"
diff --git a/waf_patterns/apache/evaluation.conf b/waf_patterns/apache/evaluation.conf
index 06a2e4c..f41c1b0 100644
--- a/waf_patterns/apache/evaluation.conf
+++ b/waf_patterns/apache/evaluation.conf
@@ -1,57 +1,57 @@
 # Apache ModSecurity rules for EVALUATION
 SecRuleEngine On
 
-SecRule REQUEST_URI "@ge 1" "id:1468,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 1" "id:1469,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 2" "id:1470,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 2" "id:1471,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 3" "id:1472,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 3" "id:1473,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 4" "id:1474,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 4" "id:1475,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 1" "id:1476,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 1" "id:1477,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 2" "id:1478,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 2" "id:1479,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 3" "id:1480,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 3" "id:1481,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 4" "id:1482,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 4" "id:1483,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge %{tx.inbound_anomaly_score_threshold}" "id:1484,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@eq 1" "id:1485,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge %{tx.inbound_anomaly_score_threshold}" "id:1486,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1487,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1488,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1489,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1490,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1491,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1492,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1493,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1494,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 1" "id:1600,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 1" "id:1601,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 2" "id:1602,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 2" "id:1603,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 3" "id:1604,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 3" "id:1605,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 4" "id:1606,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 4" "id:1607,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 1" "id:1608,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 1" "id:1609,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 2" "id:1610,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 2" "id:1611,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 3" "id:1612,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 3" "id:1613,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 4" "id:1614,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge 4" "id:1615,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge %{tx.outbound_anomaly_score_threshold}" "id:1616,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@eq 1" "id:1617,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@ge %{tx.outbound_anomaly_score_threshold}" "id:1618,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1619,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1620,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1621,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1622,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1623,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1624,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1625,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1626,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 1" "id:1052,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 1" "id:1053,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 2" "id:1054,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 2" "id:1055,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 3" "id:1056,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 3" "id:1057,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 4" "id:1058,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 4" "id:1059,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 1" "id:1060,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 1" "id:1061,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 2" "id:1062,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 2" "id:1063,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 3" "id:1064,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 3" "id:1065,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 4" "id:1066,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 4" "id:1067,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge %{tx.inbound_anomaly_score_threshold}" "id:1068,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@eq 1" "id:1069,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge %{tx.inbound_anomaly_score_threshold}" "id:1070,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1071,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1072,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1073,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1074,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1075,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1076,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1077,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1078,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 1" "id:1582,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 1" "id:1583,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 2" "id:1584,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 2" "id:1585,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 3" "id:1586,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 3" "id:1587,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 4" "id:1588,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 4" "id:1589,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 1" "id:1590,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 1" "id:1591,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 2" "id:1592,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 2" "id:1593,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 3" "id:1594,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 3" "id:1595,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 4" "id:1596,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge 4" "id:1597,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge %{tx.outbound_anomaly_score_threshold}" "id:1598,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@eq 1" "id:1599,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@ge %{tx.outbound_anomaly_score_threshold}" "id:1600,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1601,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1602,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1603,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1604,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1605,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1606,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1607,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1608,phase:1,deny,status:403,log,msg:'evaluation attack detected'"
diff --git a/waf_patterns/apache/exceptions.conf b/waf_patterns/apache/exceptions.conf
index 5976c2b..523c80e 100644
--- a/waf_patterns/apache/exceptions.conf
+++ b/waf_patterns/apache/exceptions.conf
@@ -1,8 +1,8 @@
 # Apache ModSecurity rules for EXCEPTIONS
 SecRuleEngine On
 
-SecRule REQUEST_URI "@streq GET /" "id:1030,phase:1,deny,status:403,log,msg:'exceptions attack detected'"
-SecRule REQUEST_URI "@ipMatch 127.0.0.1,::1" "id:1031,phase:1,deny,status:403,log,msg:'exceptions attack detected'"
-SecRule REQUEST_URI "@ipMatch 127.0.0.1,::1" "id:1032,phase:1,deny,status:403,log,msg:'exceptions attack detected'"
-SecRule REQUEST_URI "@endsWith (internal dummy connection)" "id:1033,phase:1,deny,status:403,log,msg:'exceptions attack detected'"
-SecRule REQUEST_URI "@rx ^(?:GET /|OPTIONS *) HTTP/[12].[01]$" "id:1034,phase:1,deny,status:403,log,msg:'exceptions attack detected'"
+SecRule REQUEST_URI "@streq GET /" "id:1609,phase:1,deny,status:403,log,msg:'exceptions attack detected'"
+SecRule REQUEST_URI "@ipMatch 127.0.0.1,::1" "id:1610,phase:1,deny,status:403,log,msg:'exceptions attack detected'"
+SecRule REQUEST_URI "@ipMatch 127.0.0.1,::1" "id:1611,phase:1,deny,status:403,log,msg:'exceptions attack detected'"
+SecRule REQUEST_URI "@endsWith (internal dummy connection)" "id:1612,phase:1,deny,status:403,log,msg:'exceptions attack detected'"
+SecRule REQUEST_URI "@rx ^(?:GET /|OPTIONS *) HTTP/[12].[01]$" "id:1613,phase:1,deny,status:403,log,msg:'exceptions attack detected'"
diff --git a/waf_patterns/apache/fixation.conf b/waf_patterns/apache/fixation.conf
index 14ac959..9aa0af3 100644
--- a/waf_patterns/apache/fixation.conf
+++ b/waf_patterns/apache/fixation.conf
@@ -1,17 +1,17 @@
 # Apache ModSecurity rules for FIXATION
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1430,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1431,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@rx (?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)" "id:1432,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" "id:1433,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@rx ^(?:ht|f)tps?://(.*?)/" "id:1434,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "!@endsWith %{request_headers.host}" "id:1435,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" "id:1436,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@eq 0" "id:1437,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1438,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1439,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1440,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1441,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1442,phase:1,deny,status:403,log,msg:'fixation attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1443,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1534,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1535,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@rx (?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)" "id:1536,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" "id:1537,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@rx ^(?:ht|f)tps?://(.*?)/" "id:1538,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "!@endsWith %{request_headers.host}" "id:1539,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" "id:1540,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@eq 0" "id:1541,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1542,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1543,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1544,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1545,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1546,phase:1,deny,status:403,log,msg:'fixation attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1547,phase:1,deny,status:403,log,msg:'fixation attack detected'"
diff --git a/waf_patterns/apache/generic.conf b/waf_patterns/apache/generic.conf
index d60f821..395c1d2 100644
--- a/waf_patterns/apache/generic.conf
+++ b/waf_patterns/apache/generic.conf
@@ -1,21 +1,21 @@
 # Apache ModSecurity rules for GENERIC
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1296,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1297,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@rx _(?:$$ND_FUNC$$_|_js_function)|(?:beval|new[sv]+Function[sv]*)(|String.fromCharCode|function(){|this.constructor|module.exports=|([sv]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][sv]*)|process(?:.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:.call)?(|binding|constructor|env|global|main(?:Module)?|process|require)|[["'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)["'`]])|(?:binding|constructor|env|global|main(?:Module)?|process|require)[|console(?:.(?:debug|error|info|trace|warn)(?:.call)?(|[["'`](?:debug|error|info|trace|warn)["'`]])|require(?:.(?:resolve(?:.call)?(|main|extensions|cache)|[["'`](?:(?:resolv|cach)e|main|extensions)["'`]])" "id:1298,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[sv]*(" "id:1299,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@pmFromFile ssrf.data" "id:1300,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@rx (?:__proto__|constructors*(?:.|[)s*prototype)" "id:1301,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@rx Process[sv]*.[sv]*spawn[sv]*(" "id:1302,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@rx while[sv]*([sv(]*(?:!+(?:false|null|undefined|NaN|[+-]?0|"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[+-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)b|{.*}|[.*]|"[^"]+"|'[^']+'|`[^`]+`)).*)" "id:1303,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@rx ^data:(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*" "id:1304,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1305,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1306,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}.(?:[0-9]{1,3}.[0-9]{5}|[0-9]{8})|(?:x5cx5c[-0-9a-z].?_?)+|[[0-:a-f]+(?:[.0-9]+|%[0-9A-Z_a-z]+)?]|[a-z][--.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[sv]*&?@(?:(?:[0-9]{1,3}.){3}[0-9]{1,3}|[a-z][--.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[.0-9]{0,11}(?:xe2(?:x91[xa0-xbf]|x92[x80-xbf]|x93[x80-xa9xab-xbf])|xe3x80x82)+))" "id:1307,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@rx [s*constructors*]" "id:1308,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@rx @{.*}" "id:1309,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1310,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1311,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1312,phase:1,deny,status:403,log,msg:'generic attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1313,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1145,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1146,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@rx _(?:$$ND_FUNC$$_|_js_function)|(?:beval|new[sv]+Function[sv]*)(|String.fromCharCode|function(){|this.constructor|module.exports=|([sv]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][sv]*)|process(?:.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:.call)?(|binding|constructor|env|global|main(?:Module)?|process|require)|[["'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)["'`]])|(?:binding|constructor|env|global|main(?:Module)?|process|require)[|console(?:.(?:debug|error|info|trace|warn)(?:.call)?(|[["'`](?:debug|error|info|trace|warn)["'`]])|require(?:.(?:resolve(?:.call)?(|main|extensions|cache)|[["'`](?:(?:resolv|cach)e|main|extensions)["'`]])" "id:1147,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[sv]*(" "id:1148,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@pmFromFile ssrf.data" "id:1149,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@rx (?:__proto__|constructors*(?:.|[)s*prototype)" "id:1150,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@rx Process[sv]*.[sv]*spawn[sv]*(" "id:1151,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@rx while[sv]*([sv(]*(?:!+(?:false|null|undefined|NaN|[+-]?0|"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[+-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)b|{.*}|[.*]|"[^"]+"|'[^']+'|`[^`]+`)).*)" "id:1152,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@rx ^data:(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*" "id:1153,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1154,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1155,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}.(?:[0-9]{1,3}.[0-9]{5}|[0-9]{8})|(?:x5cx5c[-0-9a-z].?_?)+|[[0-:a-f]+(?:[.0-9]+|%[0-9A-Z_a-z]+)?]|[a-z][--.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[sv]*&?@(?:(?:[0-9]{1,3}.){3}[0-9]{1,3}|[a-z][--.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[.0-9]{0,11}(?:xe2(?:x91[xa0-xbf]|x92[x80-xbf]|x93[x80-xa9xab-xbf])|xe3x80x82)+))" "id:1156,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@rx [s*constructors*]" "id:1157,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@rx @{.*}" "id:1158,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1159,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1160,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1161,phase:1,deny,status:403,log,msg:'generic attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1162,phase:1,deny,status:403,log,msg:'generic attack detected'"
diff --git a/waf_patterns/apache/iis.conf b/waf_patterns/apache/iis.conf
index c5d5d45..6ccb0a9 100644
--- a/waf_patterns/apache/iis.conf
+++ b/waf_patterns/apache/iis.conf
@@ -1,16 +1,16 @@
 # Apache ModSecurity rules for IIS
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1553,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1554,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@rx [a-z]:x5cinetpubb" "id:1555,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error.</h2>|cannot connect to the server: timed out)" "id:1556,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@pmFromFile iis-errors.data" "id:1557,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "!@rx ^404$" "id:1558,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@rx bServer Error in.{0,50}?bApplicationb" "id:1559,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1560,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1561,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1562,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1563,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1564,phase:1,deny,status:403,log,msg:'iis attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1565,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1614,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1615,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@rx [a-z]:x5cinetpubb" "id:1616,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error.</h2>|cannot connect to the server: timed out)" "id:1617,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@pmFromFile iis-errors.data" "id:1618,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "!@rx ^404$" "id:1619,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@rx bServer Error in.{0,50}?bApplicationb" "id:1620,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1621,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1622,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1623,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1624,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1625,phase:1,deny,status:403,log,msg:'iis attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1626,phase:1,deny,status:403,log,msg:'iis attack detected'"
diff --git a/waf_patterns/apache/java.conf b/waf_patterns/apache/java.conf
index 826bca1..337f6d1 100644
--- a/waf_patterns/apache/java.conf
+++ b/waf_patterns/apache/java.conf
@@ -1,37 +1,37 @@
 # Apache ModSecurity rules for JAVA
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1444,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1445,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx java.lang.(?:runtime|processbuilder)" "id:1446,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?:runtime|processbuilder)" "id:1447,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?:unmarshaller|base64data|java.)" "id:1448,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" "id:1449,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?:runtime|processbuilder)" "id:1450,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@pmFromFile java-classes.data" "id:1451,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx .*.(?:jsp|jspx).*$" "id:1452,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)" "id:1453,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1454,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1455,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)" "id:1456,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx xacxedx00x05" "id:1457,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?:rO0ABQ|KztAAU|Cs7QAF)" "id:1458,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" "id:1459,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx javab.+(?:runtime|processbuilder)" "id:1460,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)" "id:1461,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1462,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1463,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)" "id:1464,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1465,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1466,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)" "id:1467,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1531,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1532,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@pmFromFile java-code-leakages.data" "id:1533,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@pmFromFile java-errors.data" "id:1534,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1535,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1536,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1537,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1538,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1539,phase:1,deny,status:403,log,msg:'java attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1540,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1232,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1233,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx java.lang.(?:runtime|processbuilder)" "id:1234,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?:runtime|processbuilder)" "id:1235,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?:unmarshaller|base64data|java.)" "id:1236,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" "id:1237,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?:runtime|processbuilder)" "id:1238,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@pmFromFile java-classes.data" "id:1239,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx .*.(?:jsp|jspx).*$" "id:1240,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)" "id:1241,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1242,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1243,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)" "id:1244,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx xacxedx00x05" "id:1245,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?:rO0ABQ|KztAAU|Cs7QAF)" "id:1246,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" "id:1247,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx javab.+(?:runtime|processbuilder)" "id:1248,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)" "id:1249,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1250,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1251,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)" "id:1252,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1253,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1254,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)" "id:1255,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1432,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1433,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@pmFromFile java-code-leakages.data" "id:1434,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@pmFromFile java-errors.data" "id:1435,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1436,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1437,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1438,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1439,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1440,phase:1,deny,status:403,log,msg:'java attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1441,phase:1,deny,status:403,log,msg:'java attack detected'"
diff --git a/waf_patterns/apache/leakages.conf b/waf_patterns/apache/leakages.conf
index e1f48c4..5164375 100644
--- a/waf_patterns/apache/leakages.conf
+++ b/waf_patterns/apache/leakages.conf
@@ -1,14 +1,14 @@
 # Apache ModSecurity rules for LEAKAGES
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1495,phase:1,deny,status:403,log,msg:'leakages attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1496,phase:1,deny,status:403,log,msg:'leakages attack detected'"
-SecRule REQUEST_URI "@rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>[To Parent Directory]</[Aa]><br>)" "id:1497,phase:1,deny,status:403,log,msg:'leakages attack detected'"
-SecRule REQUEST_URI "@rx ^#!s?/" "id:1498,phase:1,deny,status:403,log,msg:'leakages attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1499,phase:1,deny,status:403,log,msg:'leakages attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1500,phase:1,deny,status:403,log,msg:'leakages attack detected'"
-SecRule REQUEST_URI "@rx ^5d{2}$" "id:1501,phase:1,deny,status:403,log,msg:'leakages attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1502,phase:1,deny,status:403,log,msg:'leakages attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1503,phase:1,deny,status:403,log,msg:'leakages attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1504,phase:1,deny,status:403,log,msg:'leakages attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1505,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1178,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1179,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>[To Parent Directory]</[Aa]><br>)" "id:1180,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@rx ^#!s?/" "id:1181,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1182,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1183,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@rx ^5d{2}$" "id:1184,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1185,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1186,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1187,phase:1,deny,status:403,log,msg:'leakages attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1188,phase:1,deny,status:403,log,msg:'leakages attack detected'"
diff --git a/waf_patterns/apache/lfi.conf b/waf_patterns/apache/lfi.conf
index 62f5db7..b703ec3 100644
--- a/waf_patterns/apache/lfi.conf
+++ b/waf_patterns/apache/lfi.conf
@@ -1,16 +1,16 @@
 # Apache ModSecurity rules for LFI
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1187,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1188,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:.(?:%0[0-1]|?)?|?.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:.|%[25-6ae-f]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))" "id:1189,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@rx (?:(?:^|[x5c/;]).{2,3}[x5c/;]|[x5c/;].{2,3}(?:[x5c/;]|$))" "id:1190,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@pmFromFile lfi-os-files.data" "id:1191,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@pmFromFile restricted-files.data" "id:1192,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1193,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1194,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@pmFromFile lfi-os-files.data" "id:1195,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1196,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1197,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1198,phase:1,deny,status:403,log,msg:'lfi attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1199,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1030,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1031,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:.(?:%0[0-1]|?)?|?.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:.|%[25-6ae-f]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))" "id:1032,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@rx (?:(?:^|[x5c/;]).{2,3}[x5c/;]|[x5c/;].{2,3}(?:[x5c/;]|$))" "id:1033,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@pmFromFile lfi-os-files.data" "id:1034,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@pmFromFile restricted-files.data" "id:1035,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1036,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1037,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@pmFromFile lfi-os-files.data" "id:1038,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1039,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1040,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1041,phase:1,deny,status:403,log,msg:'lfi attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1042,phase:1,deny,status:403,log,msg:'lfi attack detected'"
diff --git a/waf_patterns/apache/php.conf b/waf_patterns/apache/php.conf
index 941dee9..27bad38 100644
--- a/waf_patterns/apache/php.conf
+++ b/waf_patterns/apache/php.conf
@@ -1,42 +1,42 @@
 # Apache ModSecurity rules for PHP
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1269,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1270,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx (?:<?(?:[^x]|x[^m]|xm[^l]|xml[^s]|xml$|$)|<?php|[(?:/|x5c)?php])" "id:1271,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx .*.ph(?:pd*|tml|ar|ps|t|pt).*$" "id:1272,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@pmFromFile php-config-directives.data" "id:1273,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@pm =" "id:1274,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@pmFromFile php-variables.data" "id:1275,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" "id:1276,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx (?:bzip2|expect|glob|ogg|(?:ph|r)ar|ssh2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?|z(?:ip|lib))://" "id:1277,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@pmFromFile php-function-names-933150.data" "id:1278,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?["']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:*.**/|/.*)|#.*[sv]|")*["']*)?[sv]*(.*)" "id:1279,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx [oOcC]:d+:".+?":d+:{.*}" "id:1280,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx $+(?:[a-zA-Z_x7f-xff][a-zA-Z0-9_x7f-xff]*|s*{.+})(?:s|[.+]|{.+}|/*.**/|//.*|#.*)*(.*)" "id:1281,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx (?:((?:.+)(?:["'][-0-9A-Z_a-z]+["'])?(.+|[^)]*string[^)]*)[sv"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|["'][-0-9A-Zx5c_a-z]+["'])(.+));" "id:1282,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1283,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1284,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@pmFromFile php-function-names-933151.data" "id:1285,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@pm (" "id:1286,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1287,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1288,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI" "id:1289,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:a(?:bs|s(?:in|sert(?:_options)?))|basename|c(?:h(?:eckdate|r(?:oot)?)|o(?:(?:mpac|(?:nsta|u)n)t|py|sh?)|r(?:eate_function|ypt)|urrent)|d(?:ate|e(?:coct|fined?)|ir)|e(?:nd|val|x(?:ec|p(?:lode)?|tract))|f(?:ile(?:(?:[acm]tim|inod|siz|typ)e|group|owner|perms)?|l(?:o(?:ck|or)|ush))|glob|h(?:ash|eader)|i(?:date|m(?:age(?:gif|(?:jpe|pn)g|wbmp|xbm)|plode)|s_a)|key|l(?:ink|og)|m(?:a(?:il|x)|d5|in)|n(?:ame|ext)|o(?:pendir|rd)|p(?:a(?:ck|ss(?:thru)?)|i|o(?:pen|w)|rev)|r(?:an(?:d|ge)|e(?:(?:adfil|nam)e|set)|ound)|s(?:(?:erializ|huffl)e|in|leep|(?:or|ta)t|ubstr|y(?:mlink|s(?:log|tem)))|t(?:an|(?:im|mpfil)e|ouch|rim)|u(?:cfirst|n(?:lin|pac)k)|virtual)(?:[sv]|/*.**/|(?:#|//).*)*(.*)" "id:1290,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx .*.(?:phpd*|phtml)..*$" "id:1291,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@pm ?>" "id:1292,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx (?:((?:.+)(?:["'][-0-9A-Z_a-z]+["'])?(.+|[^)]*string[^)]*)[sv"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|["'][-0-9A-Zx5c_a-z]+["'])(.+))(?:;|$)?" "id:1293,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1294,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1295,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1541,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1542,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@pmFromFile php-errors.data" "id:1543,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx (?:b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|$_(?:(?:pos|ge)t|session))b" "id:1544,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@rx (?i)<?(?:=|php)?s+" "id:1545,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1546,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1547,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@pmFromFile php-errors-pl2.data" "id:1548,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1549,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1550,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1551,phase:1,deny,status:403,log,msg:'php attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1552,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1079,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1080,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx (?:<?(?:[^x]|x[^m]|xm[^l]|xml[^s]|xml$|$)|<?php|[(?:/|x5c)?php])" "id:1081,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx .*.ph(?:pd*|tml|ar|ps|t|pt).*$" "id:1082,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@pmFromFile php-config-directives.data" "id:1083,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@pm =" "id:1084,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@pmFromFile php-variables.data" "id:1085,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" "id:1086,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx (?:bzip2|expect|glob|ogg|(?:ph|r)ar|ssh2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?|z(?:ip|lib))://" "id:1087,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@pmFromFile php-function-names-933150.data" "id:1088,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?["']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:*.**/|/.*)|#.*[sv]|")*["']*)?[sv]*(.*)" "id:1089,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx [oOcC]:d+:".+?":d+:{.*}" "id:1090,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx $+(?:[a-zA-Z_x7f-xff][a-zA-Z0-9_x7f-xff]*|s*{.+})(?:s|[.+]|{.+}|/*.**/|//.*|#.*)*(.*)" "id:1091,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx (?:((?:.+)(?:["'][-0-9A-Z_a-z]+["'])?(.+|[^)]*string[^)]*)[sv"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|["'][-0-9A-Zx5c_a-z]+["'])(.+));" "id:1092,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1093,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1094,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@pmFromFile php-function-names-933151.data" "id:1095,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@pm (" "id:1096,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1097,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1098,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI" "id:1099,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:a(?:bs|s(?:in|sert(?:_options)?))|basename|c(?:h(?:eckdate|r(?:oot)?)|o(?:(?:mpac|(?:nsta|u)n)t|py|sh?)|r(?:eate_function|ypt)|urrent)|d(?:ate|e(?:coct|fined?)|ir)|e(?:nd|val|x(?:ec|p(?:lode)?|tract))|f(?:ile(?:(?:[acm]tim|inod|siz|typ)e|group|owner|perms)?|l(?:o(?:ck|or)|ush))|glob|h(?:ash|eader)|i(?:date|m(?:age(?:gif|(?:jpe|pn)g|wbmp|xbm)|plode)|s_a)|key|l(?:ink|og)|m(?:a(?:il|x)|d5|in)|n(?:ame|ext)|o(?:pendir|rd)|p(?:a(?:ck|ss(?:thru)?)|i|o(?:pen|w)|rev)|r(?:an(?:d|ge)|e(?:(?:adfil|nam)e|set)|ound)|s(?:(?:erializ|huffl)e|in|leep|(?:or|ta)t|ubstr|y(?:mlink|s(?:log|tem)))|t(?:an|(?:im|mpfil)e|ouch|rim)|u(?:cfirst|n(?:lin|pac)k)|virtual)(?:[sv]|/*.**/|(?:#|//).*)*(.*)" "id:1100,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx .*.(?:phpd*|phtml)..*$" "id:1101,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@pm ?>" "id:1102,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx (?:((?:.+)(?:["'][-0-9A-Z_a-z]+["'])?(.+|[^)]*string[^)]*)[sv"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|["'][-0-9A-Zx5c_a-z]+["'])(.+))(?:;|$)?" "id:1103,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1104,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1105,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1468,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1469,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@pmFromFile php-errors.data" "id:1470,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx (?:b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|$_(?:(?:pos|ge)t|session))b" "id:1471,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@rx (?i)<?(?:=|php)?s+" "id:1472,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1473,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1474,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@pmFromFile php-errors-pl2.data" "id:1475,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1476,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1477,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1478,phase:1,deny,status:403,log,msg:'php attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1479,phase:1,deny,status:403,log,msg:'php attack detected'"
diff --git a/waf_patterns/apache/rce.conf b/waf_patterns/apache/rce.conf
index 386c969..7b112b7 100644
--- a/waf_patterns/apache/rce.conf
+++ b/waf_patterns/apache/rce.conf
@@ -1,57 +1,57 @@
 # Apache ModSecurity rules for RCE
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1215,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1216,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:(?:b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|[ckz]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[&,<>|]|(?:[--.0-9A-Z_a-z]["'[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#*-0-9?-@_a-{]*)?x5c?)+[sv&,<>|]).*|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:4|[sv&),<>|].*))|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*)?|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|(?:e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)b" "id:1217,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[sv&)<>|]|a(?:dd(?:group|user)|getty|l(?:ias|pine)[sv&)<>|]|nsible-playbook|pt(?:-get|itude[sv&)<>|])|r(?:ch[sv&)<>|]|ia2c)|s(?:cii(?:-xfr|85)|pell)|tobm|xel)|b(?:a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu)|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:a(?:ncel|psh)[sv&)<>|]|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|p(?:an|io|ulimit)|r(?:ash[sv&)<>|]|on(?:tab)?)|s(?:plit|vtool)|u(?:psfilter|rl[sv&)<>|]))|d(?:(?:a(?:sh|te)|i(?:alog|ff))[sv&)<>|]|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:2fsck|(?:asy_instal|va)l|cho[sv&)<>|]|fax|grep|macs|n(?:d(?:if|sw)|v-update)|sac|x(?:ec[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r)))|f(?:acter|(?:etch|lock|unction)[sv&)<>|]|grep|i(?:le(?:[sv&)<>|]|test)|(?:n(?:d|ger)|sh)[sv&)<>|])|o(?:ld[sv&)<>|]|reach)|ping|tp(?:stats|who))|g(?:awk[sv&)<>|]|core|e(?:ni(?:e[sv&)<>|]|soimage)|tfacl[sv&)<>|])|hci|i(?:mp[sv&)<>|]|nsh)|r(?:ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:conv|f(?:config|top)|nstall[sv&)<>|]|onice|p(?:6?tables|config)|spell)|j(?:ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:ill(?:[sv&)<>|]|all)|nife[sv&)<>|]|sshell)|l(?:a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|dconfig|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|(?:inks|ynx)[sv&)<>|]|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:il(?:[sv&)<>q|]|x[sv&)<>|])|ke[sv&)<>|]|ster.passwd|wk)|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|utt[sv&)<>|]|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:a(?:no[sv&)<>|]|sm|wk)|c(?:.(?:openbsd|traditional)|at)|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan))|(?:ice|ull)[sv&)<>|]|map|o(?:de[sv&)<>|]|hup)|ping|roff|s(?:enter|lookup|tat))|o(?:ctave[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:f(?:la)?tex|ksh)|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|(?:ft|gre)p|hp(?:-cgi|[57])|i(?:(?:co|ng)[sv&)<>|]|dstat|gz)|k(?:exec|g_?info|ill)|opd|rint(?:env|f[sv&)<>|])|s(?:ed|ftp|ql)|tar(?:diff|grep)?|u(?:ppet[sv&)<>|]|shd)|wd.db|ython[^sv])|r(?:ak(?:e[sv&)<>|]|u)|bash|e(?:a(?:delf|lpath)|(?:dcarpet|name|p(?:eat|lace))[sv&)<>|]|stic)|l(?:ogin|wrap)|m(?:dir[sv&)<>|]|user)|nano|oute[sv&)<>|]|pm(?:db|(?:quer|verif)y)|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:(?:ash|nap)[sv&)<>|]|c(?:hed|r(?:een|ipt)[sv&)<>|])|diff|e(?:(?:lf|rvice)[sv&)<>|]|ndmail|t(?:arch|env|facl[sv&)<>|]|sid))|ftp|h(?:.distrib|(?:adow|ells)[sv&)<>|]|u(?:f|tdown[sv&)<>|]))|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|sh(?:-key(?:ge|sca)n|pass)|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|udo|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|c(?:l?sh|p(?:dump|ing|traceroute))|elnet|ftp|ime(?:(?:out)?[sv&)<>|]|datectl)|mux|ouch[sv&)<>|]|r(?:aceroute6?|off)|shark)|u(?:limit[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:ew[sv&)<>|]|gr|mdiff|pw|rsh)|olatility[sv&)<>|])|w(?:a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:args|e(?:la)?tex|mo(?:dmap|re)|pad|term|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|s(?:oelim|td(?:(?:ca|m)t|grep|less)?)|ypper))" "id:1218,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@pmFromFile windows-powershell-commands.data" "id:1219,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:(?:a["^]*(?:c|s["^]*n["^]*p)|e["^]*(?:b["^]*p|p["^]*(?:a["^]*l|c["^]*s["^]*v|s["^]*n)|[tx]["^]*s["^]*n)|f["^]*(?:[cltw]|o["^]*r["^]*e["^]*a["^]*c["^]*h)|i["^]*(?:[cr]["^]*m|e["^]*x|h["^]*y|i|p["^]*(?:a["^]*l|c["^]*s["^]*v|m["^]*o|s["^]*n)|s["^]*e|w["^]*(?:m["^]*i|r))|m["^]*(?:a["^]*n|[dipv]|o["^]*u["^]*n["^]*t)|o["^]*g["^]*v|p["^]*(?:o["^]*p|u["^]*s["^]*h)["^]*d|t["^]*r["^]*c["^]*m|w["^]*j["^]*b)["^]*[sv,.-/;-<>].*|c["^]*(?:(?:(?:d|h["^]*d["^]*i["^]*r|v["^]*p["^]*a)["^]*|p["^]*(?:[ip]["^]*)?)[sv,.-/;-<>].*|l["^]*(?:(?:[cipv]|h["^]*y)["^]*[sv,.-/;-<>].*|s)|n["^]*s["^]*n)|d["^]*(?:(?:b["^]*p|e["^]*l|i["^]*(?:f["^]*f|r))["^]*[sv,.-/;-<>].*|n["^]*s["^]*n)|g["^]*(?:(?:(?:(?:a["^]*)?l|b["^]*p|d["^]*r|h["^]*y|(?:w["^]*m["^]*)?i|j["^]*b|[u-v])["^]*|c["^]*(?:[ims]["^]*)?|m["^]*(?:o["^]*)?|s["^]*(?:n["^]*(?:p["^]*)?|v["^]*))[sv,.-/;-<>].*|e["^]*r["^]*r|p["^]*(?:(?:s["^]*)?[sv,.-/;-<>].*|v))|l["^]*s|n["^]*(?:(?:a["^]*l|d["^]*r|[iv]|m["^]*o|s["^]*n)["^]*[sv,.-/;-<>].*|p["^]*s["^]*s["^]*c)|r["^]*(?:(?:(?:(?:b["^]*)?p|e["^]*n|(?:w["^]*m["^]*)?i|j["^]*b|n["^]*[ip])["^]*|d["^]*(?:r["^]*)?|m["^]*(?:(?:d["^]*i["^]*r|o)["^]*)?|s["^]*n["^]*(?:p["^]*)?|v["^]*(?:p["^]*a["^]*)?)[sv,.-/;-<>].*|c["^]*(?:j["^]*b["^]*[sv,.-/;-<>].*|s["^]*n)|u["^]*j["^]*b)|s["^]*(?:(?:(?:a["^]*(?:j["^]*b|l|p["^]*s|s["^]*v)|b["^]*p|[civ]|w["^]*m["^]*i)["^]*|l["^]*(?:s["^]*)?|p["^]*(?:(?:j["^]*b|p["^]*s|s["^]*v)["^]*)?)[sv,.-/;-<>].*|h["^]*c["^]*m|u["^]*j["^]*b))(?:.["^]*[0-9A-Z_a-z]+)?b" "id:1220,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx $(?:((?:.*|(.*)))|{.*})|[<>](.*)|/[0-9A-Z_a-z]*[!?.+]" "id:1221,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx b(?:for(?:/[dflr].*)? %+[^ ]+ in(.*)[sv]?do|if(?:/i)?(?: not)?(?: (?:e(?:xist|rrorlevel)|defined|cmdextversion)b|[ (].*(?:b(?:g(?:eq|tr)|equ|neq|l(?:eq|ss))b|==)))" "id:1222,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|[ckz]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)[sv&)<>|]" "id:1223,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:a(?:ddgroup|xel)|b(?:ase(?:32|64|nc)|lkid|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|yobu|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:h(?:g(?:passwd|rp)|pass|sh)|lang++|oproc|ron)|d(?:iff[sv&)<>|]|mesg|oas)|e(?:2fsck|grep)|f(?:grep|iletest|tp(?:stats|who))|g(?:r(?:ep[sv&)<>|]|oupmod)|unzip|z(?:cat|exe|ip))|htop|l(?:ast(?:comm|log(?:in)?)|ess(?:echo|(?:fil|pip)e)|ftp(?:get)?|osetup|s(?:-F|b_release|cpu|mod|of|pci|usb)|wp-download|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:ilq|ster.passwd)|k(?:fifo|nod|temp)|locate|ysql(?:admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:.(?:openbsd|traditional)|at)|et(?:(?:c|st)at|kit-ftp|plan)|ohup|ping|stat)|onintr|p(?:dksh|erl5?|(?:ft|gre)p|hp(?:-cgi|[57])|igz|k(?:exec|ill)|(?:op|se)d|rint(?:env|f[sv&)<>|])|tar(?:diff|grep)?|wd.db|ython[2-3])|r(?:(?:bas|ealpat)h|m(?:dir[sv&)<>|]|user)|nano|sync)|s(?:diff|e(?:ndmail|t(?:env|sid))|ftp|(?:h.distri|pwd.d)b|ocat|td(?:err|in|out)|udo|ysctl)|t(?:ailf|c(?:p(?:ing|traceroute)|sh)|elnet|imeout[sv&)<>|]|raceroute6?)|u(?:n(?:ame|lz(?:4|ma)|(?:pig|x)z|rar|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:gr|pw)|w(?:get|hoami)|x(?:args|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:c(?:at|mp)|diff|[e-f]?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|std(?:(?:ca|m)t|grep|less)?))" "id:1224,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "!@rx [0-9]s*'s*[0-9]" "id:1225,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx !-d" "id:1226,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@pmFromFile unix-shell.data" "id:1227,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx ^(s*)s+{" "id:1228,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx ^(s*)s+{" "id:1229,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx ba["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?sb[sv]+[!-"%',0-9@-Z_a-z]+=[^sv]" "id:1230,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@pmFromFile restricted-upload.data" "id:1231,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:t["^]*i["^]*m["^]*e|[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:a["^]*(?:c["^]*c["^]*c["^]*h["^]*e["^]*c["^]*k["^]*c["^]*o["^]*n["^]*s["^]*o["^]*l["^]*e|d["^]*(?:p["^]*l["^]*u["^]*s|v["^]*p["^]*a["^]*c["^]*k)|(?:g["^]*e["^]*n["^]*t["^]*e["^]*x["^]*e["^]*c["^]*u["^]*t["^]*o|s["^]*p["^]*n["^]*e["^]*t["^]*_["^]*c["^]*o["^]*m["^]*p["^]*i["^]*l["^]*e)["^]*r|p["^]*p["^]*(?:i["^]*n["^]*s["^]*t["^]*a["^]*l["^]*l["^]*e["^]*r|v["^]*l["^]*p)|t["^]*(?:[sv,.-/;-<>].*|b["^]*r["^]*o["^]*k["^]*e["^]*r))|b["^]*(?:a["^]*s["^]*h|g["^]*i["^]*n["^]*f["^]*o|i["^]*t["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|c["^]*(?:d["^]*b|e["^]*r["^]*t["^]*(?:o["^]*c|r["^]*e["^]*q|u["^]*t["^]*i["^]*l)|l["^]*_["^]*(?:i["^]*n["^]*v["^]*o["^]*c["^]*a["^]*t["^]*i["^]*o["^]*n|l["^]*o["^]*a["^]*d["^]*a["^]*s["^]*s["^]*e["^]*m["^]*b["^]*l["^]*y|m["^]*u["^]*t["^]*e["^]*x["^]*v["^]*e["^]*r["^]*i["^]*f["^]*i["^]*e["^]*r["^]*s)|m["^]*(?:d(?:["^]*(?:k["^]*e["^]*y|l["^]*3["^]*2))?|s["^]*t["^]*p)|o["^]*(?:m["^]*s["^]*v["^]*c["^]*s|n["^]*(?:f["^]*i["^]*g["^]*s["^]*e["^]*c["^]*u["^]*r["^]*i["^]*t["^]*y["^]*p["^]*o["^]*l["^]*i["^]*c["^]*y|h["^]*o["^]*s["^]*t|t["^]*r["^]*o["^]*l)|r["^]*e["^]*g["^]*e["^]*n)|r["^]*e["^]*a["^]*t["^]*e["^]*d["^]*u["^]*m["^]*p|s["^]*(?:c(?:["^]*r["^]*i["^]*p["^]*t)?|i)|u["^]*s["^]*t["^]*o["^]*m["^]*s["^]*h["^]*e["^]*l["^]*l["^]*h["^]*o["^]*s["^]*t)|d["^]*(?:a["^]*t["^]*a["^]*s["^]*v["^]*c["^]*u["^]*t["^]*i["^]*l|e["^]*(?:f["^]*a["^]*u["^]*l["^]*t["^]*p["^]*a["^]*c["^]*k|s["^]*k(?:["^]*t["^]*o["^]*p["^]*i["^]*m["^]*g["^]*d["^]*o["^]*w["^]*n["^]*l["^]*d["^]*r)?|v["^]*(?:i["^]*c["^]*e["^]*c["^]*r["^]*e["^]*d["^]*e["^]*n["^]*t["^]*i["^]*a["^]*l["^]*d["^]*e["^]*p["^]*l["^]*o["^]*y["^]*m["^]*e["^]*n["^]*t|t["^]*o["^]*o["^]*l["^]*s["^]*l["^]*a["^]*u["^]*n["^]*c["^]*h["^]*e["^]*r))|f["^]*s["^]*(?:h["^]*i["^]*m|v["^]*c)|i["^]*(?:a["^]*n["^]*t["^]*z|s["^]*k["^]*s["^]*h["^]*a["^]*d["^]*o["^]*w)|n["^]*(?:s["^]*c["^]*m["^]*d|x)|o["^]*t["^]*n["^]*e["^]*t|u["^]*m["^]*p["^]*6["^]*4|x["^]*c["^]*a["^]*p)|e["^]*(?:s["^]*e["^]*n["^]*t["^]*u["^]*t["^]*l|v["^]*e["^]*n["^]*t["^]*v["^]*w["^]*r|x["^]*(?:c["^]*e["^]*l|p["^]*(?:a["^]*n["^]*d|l["^]*o["^]*r["^]*e["^]*r)|t["^]*(?:e["^]*x["^]*p["^]*o["^]*r["^]*t|r["^]*a["^]*c["^]*3["^]*2)))|f["^]*(?:i["^]*n["^]*(?:d["^]*s["^]*t|g["^]*e)["^]*r|l["^]*t["^]*m["^]*c|o["^]*r["^]*f["^]*i["^]*l["^]*e["^]*s|s["^]*(?:i(?:["^]*a["^]*n["^]*y["^]*c["^]*p["^]*u)?|u["^]*t["^]*i["^]*l)|t["^]*p)|g["^]*(?:f["^]*x["^]*d["^]*o["^]*w["^]*n["^]*l["^]*o["^]*a["^]*d["^]*w["^]*r["^]*a["^]*p["^]*p["^]*e["^]*r|p["^]*s["^]*c["^]*r["^]*i["^]*p["^]*t)|h["^]*h|i["^]*(?:e["^]*(?:4["^]*u["^]*i["^]*n["^]*i["^]*t|a["^]*d["^]*v["^]*p["^]*a["^]*c["^]*k|e["^]*x["^]*e["^]*c|f["^]*r["^]*a["^]*m["^]*e)|l["^]*a["^]*s["^]*m|m["^]*e["^]*w["^]*d["^]*b["^]*l["^]*d|n["^]*(?:f["^]*d["^]*e["^]*f["^]*a["^]*u["^]*l["^]*t["^]*i["^]*n["^]*s["^]*t["^]*a["^]*l|s["^]*t["^]*a["^]*l["^]*l["^]*u["^]*t["^]*i)["^]*l)|j["^]*s["^]*c|l["^]*(?:a["^]*u["^]*n["^]*c["^]*h["^]*-["^]*v["^]*s["^]*d["^]*e["^]*v["^]*s["^]*h["^]*e["^]*l["^]*l|d["^]*i["^]*f["^]*d["^]*e)|m["^]*(?:a["^]*(?:k["^]*e["^]*c["^]*a["^]*b|n["^]*a["^]*g["^]*e["^]*-["^]*b["^]*d["^]*e|v["^]*i["^]*n["^]*j["^]*e["^]*c["^]*t)|f["^]*t["^]*r["^]*a["^]*c["^]*e|i["^]*c["^]*r["^]*o["^]*s["^]*o["^]*f["^]*t|m["^]*c|p["^]*c["^]*m["^]*d["^]*r["^]*u["^]*n|s["^]*(?:(?:b["^]*u["^]*i["^]*l|o["^]*h["^]*t["^]*m["^]*e)["^]*d|c["^]*o["^]*n["^]*f["^]*i["^]*g|d["^]*(?:e["^]*p["^]*l["^]*o["^]*y|t)|h["^]*t["^]*(?:a|m["^]*l)|i["^]*e["^]*x["^]*e["^]*c|p["^]*u["^]*b|x["^]*s["^]*l))|n["^]*(?:e["^]*t["^]*s["^]*h|t["^]*d["^]*s["^]*u["^]*t["^]*i["^]*l)|o["^]*(?:d["^]*b["^]*c["^]*c["^]*o["^]*n["^]*f|f["^]*f["^]*l["^]*i["^]*n["^]*e["^]*s["^]*c["^]*a["^]*n["^]*n["^]*e["^]*r["^]*s["^]*h["^]*e["^]*l["^]*l|n["^]*e["^]*d["^]*r["^]*i["^]*v["^]*e["^]*s["^]*t["^]*a["^]*n["^]*d["^]*a["^]*l["^]*o["^]*n["^]*e["^]*u["^]*p["^]*d["^]*a["^]*t["^]*e["^]*r|p["^]*e["^]*n["^]*c["^]*o["^]*n["^]*s["^]*o["^]*l["^]*e)|p["^]*(?:c["^]*(?:a["^]*l["^]*u["^]*a|w["^]*(?:r["^]*u["^]*n|u["^]*t["^]*l))|(?:e["^]*s["^]*t["^]*e|s)["^]*r|(?:k["^]*t["^]*m["^]*o|u["^]*b["^]*p["^]*r)["^]*n|n["^]*p["^]*u["^]*t["^]*i["^]*l|o["^]*w["^]*e["^]*r["^]*p["^]*n["^]*t|r["^]*(?:e["^]*s["^]*e["^]*n["^]*t["^]*a["^]*t["^]*i["^]*o["^]*n["^]*h["^]*o["^]*s["^]*t|i["^]*n["^]*t(?:["^]*b["^]*r["^]*m)?|o["^]*(?:c["^]*d["^]*u["^]*m["^]*p|t["^]*o["^]*c["^]*o["^]*l["^]*h["^]*a["^]*n["^]*d["^]*l["^]*e["^]*r)))|r["^]*(?:a["^]*s["^]*a["^]*u["^]*t["^]*o["^]*u|c["^]*s["^]*i|(?:d["^]*r["^]*l["^]*e["^]*a["^]*k["^]*d["^]*i["^]*a|p["^]*c["^]*p["^]*i["^]*n)["^]*g|e["^]*(?:g(?:["^]*(?:a["^]*s["^]*m|e["^]*d["^]*i["^]*t|i["^]*(?:n["^]*i|s["^]*t["^]*e["^]*r["^]*-["^]*c["^]*i["^]*m["^]*p["^]*r["^]*o["^]*v["^]*i["^]*d["^]*e["^]*r)|s["^]*v["^]*(?:c["^]*s|r["^]*3["^]*2)))?|(?:m["^]*o["^]*t|p["^]*l["^]*a["^]*c)["^]*e)|u["^]*n["^]*(?:d["^]*l["^]*l["^]*3["^]*2|(?:e["^]*x["^]*e|s["^]*c["^]*r["^]*i["^]*p["^]*t)["^]*h["^]*e["^]*l["^]*p["^]*e["^]*r|o["^]*n["^]*c["^]*e))|s["^]*(?:c["^]*(?:[sv,.-/;-<>].*|h["^]*t["^]*a["^]*s["^]*k["^]*s|r["^]*i["^]*p["^]*t["^]*r["^]*u["^]*n["^]*n["^]*e["^]*r)|e["^]*t["^]*(?:r["^]*e["^]*s|t["^]*i["^]*n["^]*g["^]*s["^]*y["^]*n["^]*c["^]*h["^]*o["^]*s["^]*t|u["^]*p["^]*a["^]*p["^]*i)|h["^]*(?:d["^]*o["^]*c["^]*v["^]*w|e["^]*l["^]*l["^]*3["^]*2)|q["^]*(?:l["^]*(?:d["^]*u["^]*m["^]*p["^]*e["^]*r|(?:t["^]*o["^]*o["^]*l["^]*s["^]*)?p["^]*s)|u["^]*i["^]*r["^]*r["^]*e["^]*l)|s["^]*h|t["^]*o["^]*r["^]*d["^]*i["^]*a["^]*g|y["^]*(?:n["^]*c["^]*a["^]*p["^]*p["^]*v["^]*p["^]*u["^]*b["^]*l["^]*i["^]*s["^]*h["^]*i["^]*n["^]*g["^]*s["^]*e["^]*r["^]*v["^]*e["^]*r|s["^]*s["^]*e["^]*t["^]*u["^]*p))|t["^]*(?:e["^]*[sv,.-/;-<>].*|r["^]*a["^]*c["^]*k["^]*e["^]*r|t["^]*(?:d["^]*i["^]*n["^]*j["^]*e["^]*c["^]*t|t["^]*r["^]*a["^]*c["^]*e["^]*r))|u["^]*(?:n["^]*r["^]*e["^]*g["^]*m["^]*p["^]*2|p["^]*d["^]*a["^]*t["^]*e|r["^]*l|t["^]*i["^]*l["^]*i["^]*t["^]*y["^]*f["^]*u["^]*n["^]*c["^]*t["^]*i["^]*o["^]*n["^]*s)|v["^]*(?:b["^]*c|e["^]*r["^]*c["^]*l["^]*s["^]*i["^]*d|i["^]*s["^]*u["^]*a["^]*l["^]*u["^]*i["^]*a["^]*v["^]*e["^]*r["^]*i["^]*f["^]*y["^]*n["^]*a["^]*t["^]*i["^]*v["^]*e|s["^]*(?:i["^]*i["^]*s["^]*e["^]*x["^]*e["^]*l["^]*a["^]*u["^]*n["^]*c["^]*h|j["^]*i["^]*t["^]*d["^]*e["^]*b["^]*u["^]*g["^]*g)["^]*e["^]*r)|w["^]*(?:a["^]*b|(?:f|m["^]*i)["^]*c|i["^]*n["^]*(?:g["^]*e["^]*t|r["^]*m|w["^]*o["^]*r["^]*d)|l["^]*r["^]*m["^]*d["^]*r|o["^]*r["^]*k["^]*f["^]*o["^]*l["^]*d["^]*e["^]*r["^]*s|s["^]*(?:(?:c["^]*r["^]*i["^]*p|r["^]*e["^]*s["^]*e)["^]*t|l)|t["^]*[sv,.-/;-<>].*|u["^]*a["^]*u["^]*c["^]*l["^]*t)|x["^]*w["^]*i["^]*z["^]*a["^]*r["^]*d|z["^]*i["^]*p["^]*f["^]*l["^]*d["^]*r)(?:.["^]*[0-9A-Z_a-z]+)?b" "id:1232,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:t["^]*i["^]*m["^]*e|[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:a["^]*(?:s["^]*s["^]*o["^]*c|t["^]*(?:m["^]*a["^]*d["^]*m|t["^]*r["^]*i["^]*b)|u["^]*(?:d["^]*i["^]*t["^]*p["^]*o["^]*l|t["^]*o["^]*(?:c["^]*(?:h["^]*k|o["^]*n["^]*v)|(?:f["^]*m|m["^]*o["^]*u["^]*n)["^]*t)))|b["^]*(?:c["^]*d["^]*(?:b["^]*o["^]*o|e["^]*d["^]*i)["^]*t|(?:d["^]*e["^]*h["^]*d|o["^]*o["^]*t)["^]*c["^]*f["^]*g|i["^]*t["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|c["^]*(?:a["^]*c["^]*l["^]*s|e["^]*r["^]*t["^]*(?:r["^]*e["^]*q|u["^]*t["^]*i["^]*l)|h["^]*(?:c["^]*p|d["^]*i["^]*r|g["^]*(?:l["^]*o["^]*g["^]*o["^]*n|p["^]*o["^]*r["^]*t|u["^]*s["^]*r)|k["^]*(?:d["^]*s["^]*k|n["^]*t["^]*f["^]*s))|l["^]*e["^]*a["^]*n["^]*m["^]*g["^]*r|m["^]*(?:d(?:["^]*k["^]*e["^]*y)?|s["^]*t["^]*p)|s["^]*c["^]*r["^]*i["^]*p["^]*t)|d["^]*(?:c["^]*(?:d["^]*i["^]*a["^]*g|g["^]*p["^]*o["^]*f["^]*i["^]*x)|e["^]*(?:f["^]*r["^]*a["^]*g|l)|f["^]*s["^]*(?:d["^]*i["^]*a|r["^]*m["^]*i)["^]*g|i["^]*(?:a["^]*n["^]*t["^]*z|r|s["^]*(?:k["^]*(?:c["^]*o["^]*(?:m["^]*p|p["^]*y)|p["^]*(?:a["^]*r["^]*t|e["^]*r["^]*f)|r["^]*a["^]*i["^]*d|s["^]*h["^]*a["^]*d["^]*o["^]*w)|p["^]*d["^]*i["^]*a["^]*g))|n["^]*s["^]*c["^]*m["^]*d|(?:o["^]*s["^]*k["^]*e|r["^]*i["^]*v["^]*e["^]*r["^]*q["^]*u["^]*e["^]*r)["^]*y)|e["^]*(?:n["^]*d["^]*l["^]*o["^]*c["^]*a["^]*l|v["^]*e["^]*n["^]*t["^]*c["^]*r["^]*e["^]*a["^]*t["^]*e)|E["^]*v["^]*n["^]*t["^]*c["^]*m["^]*d|f["^]*(?:c|i["^]*(?:l["^]*e["^]*s["^]*y["^]*s["^]*t["^]*e["^]*m["^]*s|n["^]*d["^]*s["^]*t["^]*r)|l["^]*a["^]*t["^]*t["^]*e["^]*m["^]*p|o["^]*r(?:["^]*f["^]*i["^]*l["^]*e["^]*s)?|r["^]*e["^]*e["^]*d["^]*i["^]*s["^]*k|s["^]*u["^]*t["^]*i["^]*l|(?:t["^]*y["^]*p|v["^]*e["^]*u["^]*p["^]*d["^]*a["^]*t)["^]*e)|g["^]*(?:e["^]*t["^]*(?:m["^]*a["^]*c|t["^]*y["^]*p["^]*e)|o["^]*t["^]*o|p["^]*(?:f["^]*i["^]*x["^]*u["^]*p|(?:r["^]*e["^]*s["^]*u["^]*l["^]*)?t|u["^]*p["^]*d["^]*a["^]*t["^]*e)|r["^]*a["^]*f["^]*t["^]*a["^]*b["^]*l)|h["^]*(?:e["^]*l["^]*p["^]*c["^]*t["^]*r|o["^]*s["^]*t["^]*n["^]*a["^]*m["^]*e)|i["^]*(?:c["^]*a["^]*c["^]*l["^]*s|f|p["^]*(?:c["^]*o["^]*n["^]*f["^]*i["^]*g|x["^]*r["^]*o["^]*u["^]*t["^]*e)|r["^]*f["^]*t["^]*p)|j["^]*e["^]*t["^]*p["^]*a["^]*c["^]*k|k["^]*(?:l["^]*i["^]*s["^]*t|s["^]*e["^]*t["^]*u["^]*p|t["^]*(?:m["^]*u["^]*t["^]*i["^]*l|p["^]*a["^]*s["^]*s))|l["^]*(?:o["^]*(?:d["^]*c["^]*t["^]*r|g["^]*(?:m["^]*a["^]*n|o["^]*f["^]*f))|p["^]*[q-r])|m["^]*(?:a["^]*(?:c["^]*f["^]*i["^]*l["^]*e|k["^]*e["^]*c["^]*a["^]*b|p["^]*a["^]*d["^]*m["^]*i["^]*n)|k["^]*(?:d["^]*i["^]*r|l["^]*i["^]*n["^]*k)|m["^]*c|o["^]*u["^]*n["^]*t["^]*v["^]*o["^]*l|q["^]*(?:b["^]*k["^]*u["^]*p|(?:t["^]*g["^]*)?s["^]*v["^]*c)|s["^]*(?:d["^]*t|i["^]*(?:e["^]*x["^]*e["^]*c|n["^]*f["^]*o["^]*3["^]*2)|t["^]*s["^]*c))|n["^]*(?:b["^]*t["^]*s["^]*t["^]*a["^]*t|e["^]*t["^]*(?:c["^]*f["^]*g|d["^]*o["^]*m|s["^]*(?:h|t["^]*a["^]*t))|f["^]*s["^]*(?:a["^]*d["^]*m["^]*i["^]*n|s["^]*(?:h["^]*a["^]*r["^]*e|t["^]*a["^]*t))|l["^]*(?:b["^]*m["^]*g["^]*r|t["^]*e["^]*s["^]*t)|s["^]*l["^]*o["^]*o["^]*k["^]*u["^]*p|t["^]*(?:b["^]*a["^]*c["^]*k["^]*u["^]*p|c["^]*m["^]*d["^]*p["^]*r["^]*o["^]*m["^]*p["^]*t|f["^]*r["^]*s["^]*u["^]*t["^]*l))|o["^]*(?:f["^]*f["^]*l["^]*i["^]*n["^]*e|p["^]*e["^]*n["^]*f["^]*i["^]*l["^]*e["^]*s)|p["^]*(?:a["^]*(?:g["^]*e["^]*f["^]*i["^]*l["^]*e["^]*c["^]*o["^]*n["^]*f["^]*i|t["^]*h["^]*p["^]*i["^]*n)["^]*g|(?:b["^]*a["^]*d["^]*m["^]*i|k["^]*t["^]*m["^]*o)["^]*n|e["^]*(?:n["^]*t["^]*n["^]*t|r["^]*f["^]*m["^]*o["^]*n)|n["^]*p["^]*u["^]*(?:n["^]*a["^]*t["^]*t["^]*e["^]*n["^]*d|t["^]*i["^]*l)|o["^]*(?:p["^]*d|w["^]*e["^]*r["^]*s["^]*h["^]*e["^]*l["^]*l)|r["^]*n["^]*(?:c["^]*n["^]*f["^]*g|(?:d["^]*r["^]*v|m["^]*n["^]*g)["^]*r|j["^]*o["^]*b["^]*s|p["^]*o["^]*r["^]*t|q["^]*c["^]*t["^]*l)|u["^]*(?:b["^]*p["^]*r["^]*n|s["^]*h["^]*(?:d|p["^]*r["^]*i["^]*n["^]*t["^]*e["^]*r["^]*c["^]*o["^]*n["^]*n["^]*e["^]*c["^]*t["^]*i["^]*o["^]*n["^]*s))|w["^]*(?:l["^]*a["^]*u["^]*n["^]*c["^]*h["^]*e["^]*r|s["^]*h))|q["^]*(?:a["^]*p["^]*p["^]*s["^]*r["^]*v|p["^]*r["^]*o["^]*c["^]*e["^]*s["^]*s|u["^]*s["^]*e["^]*r|w["^]*i["^]*n["^]*s["^]*t["^]*a)|r["^]*(?:d(?:["^]*p["^]*s["^]*i["^]*g["^]*n)?|e["^]*(?:f["^]*s["^]*u["^]*t["^]*i["^]*l|g(?:["^]*(?:i["^]*n["^]*i|s["^]*v["^]*r["^]*3["^]*2))?|l["^]*o["^]*g|(?:(?:p["^]*a["^]*d["^]*m["^]*i|s["^]*c["^]*a)["^]*)?n|x["^]*e["^]*c)|i["^]*s["^]*e["^]*t["^]*u["^]*p|m["^]*d["^]*i["^]*r|o["^]*b["^]*o["^]*c["^]*o["^]*p["^]*y|p["^]*c["^]*(?:i["^]*n["^]*f["^]*o|p["^]*i["^]*n["^]*g)|s["^]*h|u["^]*n["^]*d["^]*l["^]*l["^]*3["^]*2|w["^]*i["^]*n["^]*s["^]*t["^]*a)|s["^]*(?:a["^]*n|c["^]*(?:h["^]*t["^]*a["^]*s["^]*k["^]*s|w["^]*c["^]*m["^]*d)|e["^]*(?:c["^]*e["^]*d["^]*i["^]*t|r["^]*v["^]*e["^]*r["^]*(?:(?:c["^]*e["^]*i["^]*p|w["^]*e["^]*r)["^]*o["^]*p["^]*t["^]*i["^]*n|m["^]*a["^]*n["^]*a["^]*g["^]*e["^]*r["^]*c["^]*m["^]*d)|t["^]*x)|f["^]*c|(?:h["^]*o["^]*w["^]*m["^]*o["^]*u["^]*n|u["^]*b["^]*s)["^]*t|x["^]*s["^]*t["^]*r["^]*a["^]*c["^]*e|y["^]*s["^]*(?:o["^]*c["^]*m["^]*g["^]*r|t["^]*e["^]*m["^]*i["^]*n["^]*f["^]*o))|t["^]*(?:a["^]*(?:k["^]*e["^]*o["^]*w["^]*n|p["^]*i["^]*c["^]*f["^]*g|s["^]*k["^]*(?:k["^]*i["^]*l["^]*l|l["^]*i["^]*s["^]*t))|(?:c["^]*m["^]*s["^]*e["^]*t["^]*u|f["^]*t)["^]*p|(?:(?:e["^]*l["^]*n["^]*e|i["^]*m["^]*e["^]*o["^]*u)["^]*|r["^]*a["^]*c["^]*e["^]*r["^]*(?:p["^]*)?)t|l["^]*n["^]*t["^]*a["^]*d["^]*m["^]*n|p["^]*m["^]*(?:t["^]*o["^]*o["^]*l|v["^]*s["^]*c["^]*m["^]*g["^]*r)|s["^]*(?:(?:d["^]*i["^]*s["^]*)?c["^]*o["^]*n|e["^]*c["^]*i["^]*m["^]*p|k["^]*i["^]*l["^]*l|p["^]*r["^]*o["^]*f)|y["^]*p["^]*e["^]*p["^]*e["^]*r["^]*f|z["^]*u["^]*t["^]*i["^]*l)|u["^]*n["^]*(?:e["^]*x["^]*p["^]*o["^]*s["^]*e|i["^]*q["^]*u["^]*e["^]*i["^]*d|l["^]*o["^]*d["^]*c["^]*t["^]*r)|v["^]*(?:o["^]*l|s["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|w["^]*(?:a["^]*i["^]*t["^]*f["^]*o["^]*r|b["^]*a["^]*d["^]*m["^]*i["^]*n|(?:d["^]*s|e["^]*(?:c|v["^]*t))["^]*u["^]*t["^]*i["^]*l|h["^]*(?:e["^]*r["^]*e|o["^]*a["^]*m["^]*i)|i["^]*n["^]*(?:n["^]*t(?:["^]*3["^]*2)?|r["^]*s)|m["^]*i["^]*c|s["^]*c["^]*r["^]*i["^]*p["^]*t)|x["^]*c["^]*o["^]*p["^]*y)(?:.["^]*[0-9A-Z_a-z]+)?b" "id:1233,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1234,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1235,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*.[sv].*b" "id:1236,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?:$(?:((?:(.*)|.*))|{.*})|[<>](.*)|[!?.+])" "id:1237,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx ['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]" "id:1238,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx /" "id:1239,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx s" "id:1240,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx ^[^.]+.[^;?]+[;?](.*(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]))" "id:1241,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx /" "id:1242,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx s" "id:1243,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx ^[^.]*?(?:['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{])" "id:1244,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx /" "id:1245,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx s" "id:1246,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i).|(?:[sv]*|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|G["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?E["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?T|a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:b|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?t|r(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[jp])?|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ks])|b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[8-9]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?9|[au]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|c|(?:m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?p|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dfu]|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[gr])|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[bdx]|n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|q["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[c-dgi]|m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[chr]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|o|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dp]|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b)|j["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:j["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|q)|k["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)?|[nps]|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a|z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|v)|n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[cl]|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|o["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[at]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?x|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|f|(?:k["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?g|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cp]|r(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?y)?|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dv]|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dt]|[g-hu]|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cr]|b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l|[co]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ex]|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c)|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|l)|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|c)|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|z)|y["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)|z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h))" "id:1247,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)[-0-9_a-z]+(?:["'[-]]+|$+[!#*-0-9?-@x5c_a-{]+|``|[$<>]())[sv]*[-0-9_a-z]+" "id:1248,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "!@rx [0-9]s*'s*[0-9]" "id:1249,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx ;[sv]*.[sv]*["']?(?:a(?:rchive|uth)|b(?:a(?:ckup|il)|inary)|c(?:d|h(?:anges|eck)|lone|onnection)|d(?:atabases|b(?:config|info)|ump)|e(?:cho|qp|x(?:cel|it|p(?:ert|lain)))|f(?:ilectrl|ullschema)|he(?:aders|lp)|i(?:mpo(?:rt|ster)|ndexes|otrace)|l(?:i(?:mi|n)t|o(?:ad|g))|(?:mod|n(?:onc|ullvalu)|unmodul)e|o(?:nce|pen|utput)|p(?:arameter|r(?:int|o(?:gress|mpt)))|quit|re(?:ad|cover|store)|s(?:ave|c(?:anstats|hema)|e(?:lftest|parator|ssion)|h(?:a3sum|ell|ow)?|tats|ystem)|t(?:ables|estc(?:ase|trl)|ime(?:out|r)|race)|vfs(?:info|list|name)|width)" "id:1250,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx rn(?s:.)*?b(?:(?i:E)(?:HLO [--.A-Za-zx17fx212a]{1,255}|XPN .{1,64})|HELO [--.A-Za-zx17fx212a]{1,255}|MAIL FROM:<.{1,64}(?i:@).{1,255}(?i:>)|(?i:R)(?:CPT TO:(?:(?i:<).{1,64}(?i:@).{1,255}(?i:>)|(?i: ))?(?i:<).{1,64}(?i:>)|SETb)|VRFY .{1,64}(?: <.{1,64}(?i:@).{1,255}(?i:>)|(?i:@).{1,255})|AUTH [-0-9A-Z_a-zx17fx212a]{1,20}(?i: )(?:(?:[+/-9A-Z_a-zx17fx212a]{4})*(?:[+/-9A-Z_a-zx17fx212a]{2}(?i:=)|[+/-9A-Z_a-zx17fx212a]{3}))?(?i:=)|STARTTLSb|NOOPb(?:(?i: ).{1,255})?)" "id:1251,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:A(?:PPEND (?:["-#%-&*--9A-Zx5c_a-z]+)?(?: ([ x5ca-z]+))?(?: "?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [+-][0-9]{4}"?)? {[0-9]{1,20}+?}|UTHENTICATE [-0-9_a-z]{1,20}rn)|L(?:SUB (?:["-#*.-9A-Z_a-z~]+)? (?:["%-&*.-9A-Zx5c_a-z]+)?|ISTRIGHTS (?:["%-&*--9A-Zx5c_a-z]+)?)|S(?:TATUS (?:["%-&*--9A-Zx5c_a-z]+)? ((?:U(?:NSEEN|IDNEXT)|MESSAGES|UIDVALIDITY|RECENT| )+)|ETACL (?:["%-&*--9A-Zx5c_a-z]+)? [+-][ac-eik-lpr-tw-x]+?)|UID (?:COPY|FETCH|STORE) (?:[*,0-:]+)?|(?:(?:DELETE|GET)ACL|MYRIGHTS) (?:["%-&*--9A-Zx5c_a-z]+)?)" "id:1252,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?is)rn.*?b(?:(?:LIST|TOP [0-9]+)(?: [0-9]+)?|U(?:SER .+?|IDL(?: [0-9]+)?)|PASS .+?|(?:RETR|DELE) [0-9]+?|A(?:POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [-0-9A-Z_]{1,20} (?:(?:[+/-9A-Z_a-z]{4})*(?:[+/-9A-Z_a-z]{2}=|[+/-9A-Z_a-z]{3}))?=))" "id:1253,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|an|io|ulimit)|s(?:h|plit|vtool)|u(?:(?:t|rl)[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|inks|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[^sv])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash|nap)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:3m|c|a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))" "id:1254,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:c|a(?:ll|tch)[sv&)<>|]|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))" "id:1255,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@pmFromFile unix-shell.data" "id:1256,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1257,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1258,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))b" "id:1259,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:(?:itude)?[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|n?f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|s(?:[sv&)<>|]|ed|ftp|ql)?|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:ew)?[sv&)<>|]|m(?:[sv&)<>|]|diff)|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:[sv&)<>c|]|h(?:o(?:[sv&)<>|]|ami|is)?|iptail[sv&)<>|])|a(?:ll|tch)[sv&)<>|]|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))b" "id:1260,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))" "id:1261,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx /(?:[?*]+[a-z/]+|[a-z/]+[?*]+)" "id:1262,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx rn(?s:.)*?b(?:DATA|QUIT|HELP(?: .{1,255})?)" "id:1263,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:C(?:(?:REATE|OPY [*,0-:]+) ["-#%-&*--9A-Zx5c_a-z]+|APABILITY|HECK|LOSE)|DELETE ["-#%-&*--.0-9A-Zx5c_a-z]+|EX(?:AMINE ["-#%-&*--.0-9A-Zx5c_a-z]+|PUNGE)|FETCH [*,0-:]+|L(?:IST ["-#*--9A-Zx5c_a-z~]+? ["-#%-&*--9A-Zx5c_a-z]+|OG(?:IN [--.0-9@_a-z]{1,40} .*?|OUT))|RENAME ["-#%-&*--9A-Zx5c_a-z]+? ["-#%-&*--9A-Zx5c_a-z]+|S(?:E(?:LECT ["-#%-&*--9A-Zx5c_a-z]+|ARCH(?: CHARSET [--.0-9A-Z_a-z]{1,40})? (?:(KEYWORD x5c)?(?:A(?:LL|NSWERED)|BCC|D(?:ELETED|RAFT)|(?:FLAGGE|OL)D|RECENT|SEEN|UN(?:(?:ANSWER|FLAGG)ED|D(?:ELETED|RAFT)|SEEN)|NEW)|(?:BODY|CC|FROM|HEADER .{1,100}|NOT|OR .{1,255}|T(?:EXT|O)) .{1,255}|LARGER [0-9]{1,20}|[*,0-:]+|(?:BEFORE|ON|S(?:ENT(?:(?:BEFOR|SINC)E|ON)|INCE)) "?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4}"?|S(?:MALLER [0-9]{1,20}|UBJECT .{1,255})|U(?:ID [*,0-:]+?|NKEYWORD x5c(Seen|(?:Answer|Flagg)ed|D(?:eleted|raft)|Recent))))|T(?:ORE [*,0-:]+? [+-]?FLAGS(?:.SILENT)? (?:(x5c[a-z]{1,20}))?|ARTTLS)|UBSCRIBE ["-#%-&*--9A-Zx5c_a-z]+)|UN(?:SUBSCRIBE ["-#%-&*--9A-Zx5c_a-z]+|AUTHENTICATE)|NOOP)" "id:1264,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx rn(?s:.)*?b(?:(?:QUI|STA|RSE)(?i:T)|NOOP|CAPA)" "id:1265,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@rx !(?:d|!)" "id:1266,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1267,phase:1,deny,status:403,log,msg:'rce attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1268,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1480,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1481,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:(?:b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|[ckz]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[&,<>|]|(?:[--.0-9A-Z_a-z]["'[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#*-0-9?-@_a-{]*)?x5c?)+[sv&,<>|]).*|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:4|[sv&),<>|].*))|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*)?|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|(?:e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)b" "id:1482,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[sv&)<>|]|a(?:dd(?:group|user)|getty|l(?:ias|pine)[sv&)<>|]|nsible-playbook|pt(?:-get|itude[sv&)<>|])|r(?:ch[sv&)<>|]|ia2c)|s(?:cii(?:-xfr|85)|pell)|tobm|xel)|b(?:a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu)|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:a(?:ncel|psh)[sv&)<>|]|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|p(?:an|io|ulimit)|r(?:ash[sv&)<>|]|on(?:tab)?)|s(?:plit|vtool)|u(?:psfilter|rl[sv&)<>|]))|d(?:(?:a(?:sh|te)|i(?:alog|ff))[sv&)<>|]|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:2fsck|(?:asy_instal|va)l|cho[sv&)<>|]|fax|grep|macs|n(?:d(?:if|sw)|v-update)|sac|x(?:ec[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r)))|f(?:acter|(?:etch|lock|unction)[sv&)<>|]|grep|i(?:le(?:[sv&)<>|]|test)|(?:n(?:d|ger)|sh)[sv&)<>|])|o(?:ld[sv&)<>|]|reach)|ping|tp(?:stats|who))|g(?:awk[sv&)<>|]|core|e(?:ni(?:e[sv&)<>|]|soimage)|tfacl[sv&)<>|])|hci|i(?:mp[sv&)<>|]|nsh)|r(?:ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:conv|f(?:config|top)|nstall[sv&)<>|]|onice|p(?:6?tables|config)|spell)|j(?:ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:ill(?:[sv&)<>|]|all)|nife[sv&)<>|]|sshell)|l(?:a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|dconfig|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|(?:inks|ynx)[sv&)<>|]|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:il(?:[sv&)<>q|]|x[sv&)<>|])|ke[sv&)<>|]|ster.passwd|wk)|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|utt[sv&)<>|]|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:a(?:no[sv&)<>|]|sm|wk)|c(?:.(?:openbsd|traditional)|at)|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan))|(?:ice|ull)[sv&)<>|]|map|o(?:de[sv&)<>|]|hup)|ping|roff|s(?:enter|lookup|tat))|o(?:ctave[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:f(?:la)?tex|ksh)|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|(?:ft|gre)p|hp(?:-cgi|[57])|i(?:(?:co|ng)[sv&)<>|]|dstat|gz)|k(?:exec|g_?info|ill)|opd|rint(?:env|f[sv&)<>|])|s(?:ed|ftp|ql)|tar(?:diff|grep)?|u(?:ppet[sv&)<>|]|shd)|wd.db|ython[^sv])|r(?:ak(?:e[sv&)<>|]|u)|bash|e(?:a(?:delf|lpath)|(?:dcarpet|name|p(?:eat|lace))[sv&)<>|]|stic)|l(?:ogin|wrap)|m(?:dir[sv&)<>|]|user)|nano|oute[sv&)<>|]|pm(?:db|(?:quer|verif)y)|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:(?:ash|nap)[sv&)<>|]|c(?:hed|r(?:een|ipt)[sv&)<>|])|diff|e(?:(?:lf|rvice)[sv&)<>|]|ndmail|t(?:arch|env|facl[sv&)<>|]|sid))|ftp|h(?:.distrib|(?:adow|ells)[sv&)<>|]|u(?:f|tdown[sv&)<>|]))|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|sh(?:-key(?:ge|sca)n|pass)|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|udo|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|c(?:l?sh|p(?:dump|ing|traceroute))|elnet|ftp|ime(?:(?:out)?[sv&)<>|]|datectl)|mux|ouch[sv&)<>|]|r(?:aceroute6?|off)|shark)|u(?:limit[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:ew[sv&)<>|]|gr|mdiff|pw|rsh)|olatility[sv&)<>|])|w(?:a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:args|e(?:la)?tex|mo(?:dmap|re)|pad|term|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|s(?:oelim|td(?:(?:ca|m)t|grep|less)?)|ypper))" "id:1483,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@pmFromFile windows-powershell-commands.data" "id:1484,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:(?:a["^]*(?:c|s["^]*n["^]*p)|e["^]*(?:b["^]*p|p["^]*(?:a["^]*l|c["^]*s["^]*v|s["^]*n)|[tx]["^]*s["^]*n)|f["^]*(?:[cltw]|o["^]*r["^]*e["^]*a["^]*c["^]*h)|i["^]*(?:[cr]["^]*m|e["^]*x|h["^]*y|i|p["^]*(?:a["^]*l|c["^]*s["^]*v|m["^]*o|s["^]*n)|s["^]*e|w["^]*(?:m["^]*i|r))|m["^]*(?:a["^]*n|[dipv]|o["^]*u["^]*n["^]*t)|o["^]*g["^]*v|p["^]*(?:o["^]*p|u["^]*s["^]*h)["^]*d|t["^]*r["^]*c["^]*m|w["^]*j["^]*b)["^]*[sv,.-/;-<>].*|c["^]*(?:(?:(?:d|h["^]*d["^]*i["^]*r|v["^]*p["^]*a)["^]*|p["^]*(?:[ip]["^]*)?)[sv,.-/;-<>].*|l["^]*(?:(?:[cipv]|h["^]*y)["^]*[sv,.-/;-<>].*|s)|n["^]*s["^]*n)|d["^]*(?:(?:b["^]*p|e["^]*l|i["^]*(?:f["^]*f|r))["^]*[sv,.-/;-<>].*|n["^]*s["^]*n)|g["^]*(?:(?:(?:(?:a["^]*)?l|b["^]*p|d["^]*r|h["^]*y|(?:w["^]*m["^]*)?i|j["^]*b|[u-v])["^]*|c["^]*(?:[ims]["^]*)?|m["^]*(?:o["^]*)?|s["^]*(?:n["^]*(?:p["^]*)?|v["^]*))[sv,.-/;-<>].*|e["^]*r["^]*r|p["^]*(?:(?:s["^]*)?[sv,.-/;-<>].*|v))|l["^]*s|n["^]*(?:(?:a["^]*l|d["^]*r|[iv]|m["^]*o|s["^]*n)["^]*[sv,.-/;-<>].*|p["^]*s["^]*s["^]*c)|r["^]*(?:(?:(?:(?:b["^]*)?p|e["^]*n|(?:w["^]*m["^]*)?i|j["^]*b|n["^]*[ip])["^]*|d["^]*(?:r["^]*)?|m["^]*(?:(?:d["^]*i["^]*r|o)["^]*)?|s["^]*n["^]*(?:p["^]*)?|v["^]*(?:p["^]*a["^]*)?)[sv,.-/;-<>].*|c["^]*(?:j["^]*b["^]*[sv,.-/;-<>].*|s["^]*n)|u["^]*j["^]*b)|s["^]*(?:(?:(?:a["^]*(?:j["^]*b|l|p["^]*s|s["^]*v)|b["^]*p|[civ]|w["^]*m["^]*i)["^]*|l["^]*(?:s["^]*)?|p["^]*(?:(?:j["^]*b|p["^]*s|s["^]*v)["^]*)?)[sv,.-/;-<>].*|h["^]*c["^]*m|u["^]*j["^]*b))(?:.["^]*[0-9A-Z_a-z]+)?b" "id:1485,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx $(?:((?:.*|(.*)))|{.*})|[<>](.*)|/[0-9A-Z_a-z]*[!?.+]" "id:1486,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx b(?:for(?:/[dflr].*)? %+[^ ]+ in(.*)[sv]?do|if(?:/i)?(?: not)?(?: (?:e(?:xist|rrorlevel)|defined|cmdextversion)b|[ (].*(?:b(?:g(?:eq|tr)|equ|neq|l(?:eq|ss))b|==)))" "id:1487,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|[ckz]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)[sv&)<>|]" "id:1488,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:a(?:ddgroup|xel)|b(?:ase(?:32|64|nc)|lkid|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|yobu|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:h(?:g(?:passwd|rp)|pass|sh)|lang++|oproc|ron)|d(?:iff[sv&)<>|]|mesg|oas)|e(?:2fsck|grep)|f(?:grep|iletest|tp(?:stats|who))|g(?:r(?:ep[sv&)<>|]|oupmod)|unzip|z(?:cat|exe|ip))|htop|l(?:ast(?:comm|log(?:in)?)|ess(?:echo|(?:fil|pip)e)|ftp(?:get)?|osetup|s(?:-F|b_release|cpu|mod|of|pci|usb)|wp-download|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:ilq|ster.passwd)|k(?:fifo|nod|temp)|locate|ysql(?:admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:.(?:openbsd|traditional)|at)|et(?:(?:c|st)at|kit-ftp|plan)|ohup|ping|stat)|onintr|p(?:dksh|erl5?|(?:ft|gre)p|hp(?:-cgi|[57])|igz|k(?:exec|ill)|(?:op|se)d|rint(?:env|f[sv&)<>|])|tar(?:diff|grep)?|wd.db|ython[2-3])|r(?:(?:bas|ealpat)h|m(?:dir[sv&)<>|]|user)|nano|sync)|s(?:diff|e(?:ndmail|t(?:env|sid))|ftp|(?:h.distri|pwd.d)b|ocat|td(?:err|in|out)|udo|ysctl)|t(?:ailf|c(?:p(?:ing|traceroute)|sh)|elnet|imeout[sv&)<>|]|raceroute6?)|u(?:n(?:ame|lz(?:4|ma)|(?:pig|x)z|rar|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:gr|pw)|w(?:get|hoami)|x(?:args|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:c(?:at|mp)|diff|[e-f]?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|std(?:(?:ca|m)t|grep|less)?))" "id:1489,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "!@rx [0-9]s*'s*[0-9]" "id:1490,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx !-d" "id:1491,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@pmFromFile unix-shell.data" "id:1492,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx ^(s*)s+{" "id:1493,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx ^(s*)s+{" "id:1494,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx ba["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?sb[sv]+[!-"%',0-9@-Z_a-z]+=[^sv]" "id:1495,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@pmFromFile restricted-upload.data" "id:1496,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:t["^]*i["^]*m["^]*e|[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:a["^]*(?:c["^]*c["^]*c["^]*h["^]*e["^]*c["^]*k["^]*c["^]*o["^]*n["^]*s["^]*o["^]*l["^]*e|d["^]*(?:p["^]*l["^]*u["^]*s|v["^]*p["^]*a["^]*c["^]*k)|(?:g["^]*e["^]*n["^]*t["^]*e["^]*x["^]*e["^]*c["^]*u["^]*t["^]*o|s["^]*p["^]*n["^]*e["^]*t["^]*_["^]*c["^]*o["^]*m["^]*p["^]*i["^]*l["^]*e)["^]*r|p["^]*p["^]*(?:i["^]*n["^]*s["^]*t["^]*a["^]*l["^]*l["^]*e["^]*r|v["^]*l["^]*p)|t["^]*(?:[sv,.-/;-<>].*|b["^]*r["^]*o["^]*k["^]*e["^]*r))|b["^]*(?:a["^]*s["^]*h|g["^]*i["^]*n["^]*f["^]*o|i["^]*t["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|c["^]*(?:d["^]*b|e["^]*r["^]*t["^]*(?:o["^]*c|r["^]*e["^]*q|u["^]*t["^]*i["^]*l)|l["^]*_["^]*(?:i["^]*n["^]*v["^]*o["^]*c["^]*a["^]*t["^]*i["^]*o["^]*n|l["^]*o["^]*a["^]*d["^]*a["^]*s["^]*s["^]*e["^]*m["^]*b["^]*l["^]*y|m["^]*u["^]*t["^]*e["^]*x["^]*v["^]*e["^]*r["^]*i["^]*f["^]*i["^]*e["^]*r["^]*s)|m["^]*(?:d(?:["^]*(?:k["^]*e["^]*y|l["^]*3["^]*2))?|s["^]*t["^]*p)|o["^]*(?:m["^]*s["^]*v["^]*c["^]*s|n["^]*(?:f["^]*i["^]*g["^]*s["^]*e["^]*c["^]*u["^]*r["^]*i["^]*t["^]*y["^]*p["^]*o["^]*l["^]*i["^]*c["^]*y|h["^]*o["^]*s["^]*t|t["^]*r["^]*o["^]*l)|r["^]*e["^]*g["^]*e["^]*n)|r["^]*e["^]*a["^]*t["^]*e["^]*d["^]*u["^]*m["^]*p|s["^]*(?:c(?:["^]*r["^]*i["^]*p["^]*t)?|i)|u["^]*s["^]*t["^]*o["^]*m["^]*s["^]*h["^]*e["^]*l["^]*l["^]*h["^]*o["^]*s["^]*t)|d["^]*(?:a["^]*t["^]*a["^]*s["^]*v["^]*c["^]*u["^]*t["^]*i["^]*l|e["^]*(?:f["^]*a["^]*u["^]*l["^]*t["^]*p["^]*a["^]*c["^]*k|s["^]*k(?:["^]*t["^]*o["^]*p["^]*i["^]*m["^]*g["^]*d["^]*o["^]*w["^]*n["^]*l["^]*d["^]*r)?|v["^]*(?:i["^]*c["^]*e["^]*c["^]*r["^]*e["^]*d["^]*e["^]*n["^]*t["^]*i["^]*a["^]*l["^]*d["^]*e["^]*p["^]*l["^]*o["^]*y["^]*m["^]*e["^]*n["^]*t|t["^]*o["^]*o["^]*l["^]*s["^]*l["^]*a["^]*u["^]*n["^]*c["^]*h["^]*e["^]*r))|f["^]*s["^]*(?:h["^]*i["^]*m|v["^]*c)|i["^]*(?:a["^]*n["^]*t["^]*z|s["^]*k["^]*s["^]*h["^]*a["^]*d["^]*o["^]*w)|n["^]*(?:s["^]*c["^]*m["^]*d|x)|o["^]*t["^]*n["^]*e["^]*t|u["^]*m["^]*p["^]*6["^]*4|x["^]*c["^]*a["^]*p)|e["^]*(?:s["^]*e["^]*n["^]*t["^]*u["^]*t["^]*l|v["^]*e["^]*n["^]*t["^]*v["^]*w["^]*r|x["^]*(?:c["^]*e["^]*l|p["^]*(?:a["^]*n["^]*d|l["^]*o["^]*r["^]*e["^]*r)|t["^]*(?:e["^]*x["^]*p["^]*o["^]*r["^]*t|r["^]*a["^]*c["^]*3["^]*2)))|f["^]*(?:i["^]*n["^]*(?:d["^]*s["^]*t|g["^]*e)["^]*r|l["^]*t["^]*m["^]*c|o["^]*r["^]*f["^]*i["^]*l["^]*e["^]*s|s["^]*(?:i(?:["^]*a["^]*n["^]*y["^]*c["^]*p["^]*u)?|u["^]*t["^]*i["^]*l)|t["^]*p)|g["^]*(?:f["^]*x["^]*d["^]*o["^]*w["^]*n["^]*l["^]*o["^]*a["^]*d["^]*w["^]*r["^]*a["^]*p["^]*p["^]*e["^]*r|p["^]*s["^]*c["^]*r["^]*i["^]*p["^]*t)|h["^]*h|i["^]*(?:e["^]*(?:4["^]*u["^]*i["^]*n["^]*i["^]*t|a["^]*d["^]*v["^]*p["^]*a["^]*c["^]*k|e["^]*x["^]*e["^]*c|f["^]*r["^]*a["^]*m["^]*e)|l["^]*a["^]*s["^]*m|m["^]*e["^]*w["^]*d["^]*b["^]*l["^]*d|n["^]*(?:f["^]*d["^]*e["^]*f["^]*a["^]*u["^]*l["^]*t["^]*i["^]*n["^]*s["^]*t["^]*a["^]*l|s["^]*t["^]*a["^]*l["^]*l["^]*u["^]*t["^]*i)["^]*l)|j["^]*s["^]*c|l["^]*(?:a["^]*u["^]*n["^]*c["^]*h["^]*-["^]*v["^]*s["^]*d["^]*e["^]*v["^]*s["^]*h["^]*e["^]*l["^]*l|d["^]*i["^]*f["^]*d["^]*e)|m["^]*(?:a["^]*(?:k["^]*e["^]*c["^]*a["^]*b|n["^]*a["^]*g["^]*e["^]*-["^]*b["^]*d["^]*e|v["^]*i["^]*n["^]*j["^]*e["^]*c["^]*t)|f["^]*t["^]*r["^]*a["^]*c["^]*e|i["^]*c["^]*r["^]*o["^]*s["^]*o["^]*f["^]*t|m["^]*c|p["^]*c["^]*m["^]*d["^]*r["^]*u["^]*n|s["^]*(?:(?:b["^]*u["^]*i["^]*l|o["^]*h["^]*t["^]*m["^]*e)["^]*d|c["^]*o["^]*n["^]*f["^]*i["^]*g|d["^]*(?:e["^]*p["^]*l["^]*o["^]*y|t)|h["^]*t["^]*(?:a|m["^]*l)|i["^]*e["^]*x["^]*e["^]*c|p["^]*u["^]*b|x["^]*s["^]*l))|n["^]*(?:e["^]*t["^]*s["^]*h|t["^]*d["^]*s["^]*u["^]*t["^]*i["^]*l)|o["^]*(?:d["^]*b["^]*c["^]*c["^]*o["^]*n["^]*f|f["^]*f["^]*l["^]*i["^]*n["^]*e["^]*s["^]*c["^]*a["^]*n["^]*n["^]*e["^]*r["^]*s["^]*h["^]*e["^]*l["^]*l|n["^]*e["^]*d["^]*r["^]*i["^]*v["^]*e["^]*s["^]*t["^]*a["^]*n["^]*d["^]*a["^]*l["^]*o["^]*n["^]*e["^]*u["^]*p["^]*d["^]*a["^]*t["^]*e["^]*r|p["^]*e["^]*n["^]*c["^]*o["^]*n["^]*s["^]*o["^]*l["^]*e)|p["^]*(?:c["^]*(?:a["^]*l["^]*u["^]*a|w["^]*(?:r["^]*u["^]*n|u["^]*t["^]*l))|(?:e["^]*s["^]*t["^]*e|s)["^]*r|(?:k["^]*t["^]*m["^]*o|u["^]*b["^]*p["^]*r)["^]*n|n["^]*p["^]*u["^]*t["^]*i["^]*l|o["^]*w["^]*e["^]*r["^]*p["^]*n["^]*t|r["^]*(?:e["^]*s["^]*e["^]*n["^]*t["^]*a["^]*t["^]*i["^]*o["^]*n["^]*h["^]*o["^]*s["^]*t|i["^]*n["^]*t(?:["^]*b["^]*r["^]*m)?|o["^]*(?:c["^]*d["^]*u["^]*m["^]*p|t["^]*o["^]*c["^]*o["^]*l["^]*h["^]*a["^]*n["^]*d["^]*l["^]*e["^]*r)))|r["^]*(?:a["^]*s["^]*a["^]*u["^]*t["^]*o["^]*u|c["^]*s["^]*i|(?:d["^]*r["^]*l["^]*e["^]*a["^]*k["^]*d["^]*i["^]*a|p["^]*c["^]*p["^]*i["^]*n)["^]*g|e["^]*(?:g(?:["^]*(?:a["^]*s["^]*m|e["^]*d["^]*i["^]*t|i["^]*(?:n["^]*i|s["^]*t["^]*e["^]*r["^]*-["^]*c["^]*i["^]*m["^]*p["^]*r["^]*o["^]*v["^]*i["^]*d["^]*e["^]*r)|s["^]*v["^]*(?:c["^]*s|r["^]*3["^]*2)))?|(?:m["^]*o["^]*t|p["^]*l["^]*a["^]*c)["^]*e)|u["^]*n["^]*(?:d["^]*l["^]*l["^]*3["^]*2|(?:e["^]*x["^]*e|s["^]*c["^]*r["^]*i["^]*p["^]*t)["^]*h["^]*e["^]*l["^]*p["^]*e["^]*r|o["^]*n["^]*c["^]*e))|s["^]*(?:c["^]*(?:[sv,.-/;-<>].*|h["^]*t["^]*a["^]*s["^]*k["^]*s|r["^]*i["^]*p["^]*t["^]*r["^]*u["^]*n["^]*n["^]*e["^]*r)|e["^]*t["^]*(?:r["^]*e["^]*s|t["^]*i["^]*n["^]*g["^]*s["^]*y["^]*n["^]*c["^]*h["^]*o["^]*s["^]*t|u["^]*p["^]*a["^]*p["^]*i)|h["^]*(?:d["^]*o["^]*c["^]*v["^]*w|e["^]*l["^]*l["^]*3["^]*2)|q["^]*(?:l["^]*(?:d["^]*u["^]*m["^]*p["^]*e["^]*r|(?:t["^]*o["^]*o["^]*l["^]*s["^]*)?p["^]*s)|u["^]*i["^]*r["^]*r["^]*e["^]*l)|s["^]*h|t["^]*o["^]*r["^]*d["^]*i["^]*a["^]*g|y["^]*(?:n["^]*c["^]*a["^]*p["^]*p["^]*v["^]*p["^]*u["^]*b["^]*l["^]*i["^]*s["^]*h["^]*i["^]*n["^]*g["^]*s["^]*e["^]*r["^]*v["^]*e["^]*r|s["^]*s["^]*e["^]*t["^]*u["^]*p))|t["^]*(?:e["^]*[sv,.-/;-<>].*|r["^]*a["^]*c["^]*k["^]*e["^]*r|t["^]*(?:d["^]*i["^]*n["^]*j["^]*e["^]*c["^]*t|t["^]*r["^]*a["^]*c["^]*e["^]*r))|u["^]*(?:n["^]*r["^]*e["^]*g["^]*m["^]*p["^]*2|p["^]*d["^]*a["^]*t["^]*e|r["^]*l|t["^]*i["^]*l["^]*i["^]*t["^]*y["^]*f["^]*u["^]*n["^]*c["^]*t["^]*i["^]*o["^]*n["^]*s)|v["^]*(?:b["^]*c|e["^]*r["^]*c["^]*l["^]*s["^]*i["^]*d|i["^]*s["^]*u["^]*a["^]*l["^]*u["^]*i["^]*a["^]*v["^]*e["^]*r["^]*i["^]*f["^]*y["^]*n["^]*a["^]*t["^]*i["^]*v["^]*e|s["^]*(?:i["^]*i["^]*s["^]*e["^]*x["^]*e["^]*l["^]*a["^]*u["^]*n["^]*c["^]*h|j["^]*i["^]*t["^]*d["^]*e["^]*b["^]*u["^]*g["^]*g)["^]*e["^]*r)|w["^]*(?:a["^]*b|(?:f|m["^]*i)["^]*c|i["^]*n["^]*(?:g["^]*e["^]*t|r["^]*m|w["^]*o["^]*r["^]*d)|l["^]*r["^]*m["^]*d["^]*r|o["^]*r["^]*k["^]*f["^]*o["^]*l["^]*d["^]*e["^]*r["^]*s|s["^]*(?:(?:c["^]*r["^]*i["^]*p|r["^]*e["^]*s["^]*e)["^]*t|l)|t["^]*[sv,.-/;-<>].*|u["^]*a["^]*u["^]*c["^]*l["^]*t)|x["^]*w["^]*i["^]*z["^]*a["^]*r["^]*d|z["^]*i["^]*p["^]*f["^]*l["^]*d["^]*r)(?:.["^]*[0-9A-Z_a-z]+)?b" "id:1497,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:t["^]*i["^]*m["^]*e|[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:a["^]*(?:s["^]*s["^]*o["^]*c|t["^]*(?:m["^]*a["^]*d["^]*m|t["^]*r["^]*i["^]*b)|u["^]*(?:d["^]*i["^]*t["^]*p["^]*o["^]*l|t["^]*o["^]*(?:c["^]*(?:h["^]*k|o["^]*n["^]*v)|(?:f["^]*m|m["^]*o["^]*u["^]*n)["^]*t)))|b["^]*(?:c["^]*d["^]*(?:b["^]*o["^]*o|e["^]*d["^]*i)["^]*t|(?:d["^]*e["^]*h["^]*d|o["^]*o["^]*t)["^]*c["^]*f["^]*g|i["^]*t["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|c["^]*(?:a["^]*c["^]*l["^]*s|e["^]*r["^]*t["^]*(?:r["^]*e["^]*q|u["^]*t["^]*i["^]*l)|h["^]*(?:c["^]*p|d["^]*i["^]*r|g["^]*(?:l["^]*o["^]*g["^]*o["^]*n|p["^]*o["^]*r["^]*t|u["^]*s["^]*r)|k["^]*(?:d["^]*s["^]*k|n["^]*t["^]*f["^]*s))|l["^]*e["^]*a["^]*n["^]*m["^]*g["^]*r|m["^]*(?:d(?:["^]*k["^]*e["^]*y)?|s["^]*t["^]*p)|s["^]*c["^]*r["^]*i["^]*p["^]*t)|d["^]*(?:c["^]*(?:d["^]*i["^]*a["^]*g|g["^]*p["^]*o["^]*f["^]*i["^]*x)|e["^]*(?:f["^]*r["^]*a["^]*g|l)|f["^]*s["^]*(?:d["^]*i["^]*a|r["^]*m["^]*i)["^]*g|i["^]*(?:a["^]*n["^]*t["^]*z|r|s["^]*(?:k["^]*(?:c["^]*o["^]*(?:m["^]*p|p["^]*y)|p["^]*(?:a["^]*r["^]*t|e["^]*r["^]*f)|r["^]*a["^]*i["^]*d|s["^]*h["^]*a["^]*d["^]*o["^]*w)|p["^]*d["^]*i["^]*a["^]*g))|n["^]*s["^]*c["^]*m["^]*d|(?:o["^]*s["^]*k["^]*e|r["^]*i["^]*v["^]*e["^]*r["^]*q["^]*u["^]*e["^]*r)["^]*y)|e["^]*(?:n["^]*d["^]*l["^]*o["^]*c["^]*a["^]*l|v["^]*e["^]*n["^]*t["^]*c["^]*r["^]*e["^]*a["^]*t["^]*e)|E["^]*v["^]*n["^]*t["^]*c["^]*m["^]*d|f["^]*(?:c|i["^]*(?:l["^]*e["^]*s["^]*y["^]*s["^]*t["^]*e["^]*m["^]*s|n["^]*d["^]*s["^]*t["^]*r)|l["^]*a["^]*t["^]*t["^]*e["^]*m["^]*p|o["^]*r(?:["^]*f["^]*i["^]*l["^]*e["^]*s)?|r["^]*e["^]*e["^]*d["^]*i["^]*s["^]*k|s["^]*u["^]*t["^]*i["^]*l|(?:t["^]*y["^]*p|v["^]*e["^]*u["^]*p["^]*d["^]*a["^]*t)["^]*e)|g["^]*(?:e["^]*t["^]*(?:m["^]*a["^]*c|t["^]*y["^]*p["^]*e)|o["^]*t["^]*o|p["^]*(?:f["^]*i["^]*x["^]*u["^]*p|(?:r["^]*e["^]*s["^]*u["^]*l["^]*)?t|u["^]*p["^]*d["^]*a["^]*t["^]*e)|r["^]*a["^]*f["^]*t["^]*a["^]*b["^]*l)|h["^]*(?:e["^]*l["^]*p["^]*c["^]*t["^]*r|o["^]*s["^]*t["^]*n["^]*a["^]*m["^]*e)|i["^]*(?:c["^]*a["^]*c["^]*l["^]*s|f|p["^]*(?:c["^]*o["^]*n["^]*f["^]*i["^]*g|x["^]*r["^]*o["^]*u["^]*t["^]*e)|r["^]*f["^]*t["^]*p)|j["^]*e["^]*t["^]*p["^]*a["^]*c["^]*k|k["^]*(?:l["^]*i["^]*s["^]*t|s["^]*e["^]*t["^]*u["^]*p|t["^]*(?:m["^]*u["^]*t["^]*i["^]*l|p["^]*a["^]*s["^]*s))|l["^]*(?:o["^]*(?:d["^]*c["^]*t["^]*r|g["^]*(?:m["^]*a["^]*n|o["^]*f["^]*f))|p["^]*[q-r])|m["^]*(?:a["^]*(?:c["^]*f["^]*i["^]*l["^]*e|k["^]*e["^]*c["^]*a["^]*b|p["^]*a["^]*d["^]*m["^]*i["^]*n)|k["^]*(?:d["^]*i["^]*r|l["^]*i["^]*n["^]*k)|m["^]*c|o["^]*u["^]*n["^]*t["^]*v["^]*o["^]*l|q["^]*(?:b["^]*k["^]*u["^]*p|(?:t["^]*g["^]*)?s["^]*v["^]*c)|s["^]*(?:d["^]*t|i["^]*(?:e["^]*x["^]*e["^]*c|n["^]*f["^]*o["^]*3["^]*2)|t["^]*s["^]*c))|n["^]*(?:b["^]*t["^]*s["^]*t["^]*a["^]*t|e["^]*t["^]*(?:c["^]*f["^]*g|d["^]*o["^]*m|s["^]*(?:h|t["^]*a["^]*t))|f["^]*s["^]*(?:a["^]*d["^]*m["^]*i["^]*n|s["^]*(?:h["^]*a["^]*r["^]*e|t["^]*a["^]*t))|l["^]*(?:b["^]*m["^]*g["^]*r|t["^]*e["^]*s["^]*t)|s["^]*l["^]*o["^]*o["^]*k["^]*u["^]*p|t["^]*(?:b["^]*a["^]*c["^]*k["^]*u["^]*p|c["^]*m["^]*d["^]*p["^]*r["^]*o["^]*m["^]*p["^]*t|f["^]*r["^]*s["^]*u["^]*t["^]*l))|o["^]*(?:f["^]*f["^]*l["^]*i["^]*n["^]*e|p["^]*e["^]*n["^]*f["^]*i["^]*l["^]*e["^]*s)|p["^]*(?:a["^]*(?:g["^]*e["^]*f["^]*i["^]*l["^]*e["^]*c["^]*o["^]*n["^]*f["^]*i|t["^]*h["^]*p["^]*i["^]*n)["^]*g|(?:b["^]*a["^]*d["^]*m["^]*i|k["^]*t["^]*m["^]*o)["^]*n|e["^]*(?:n["^]*t["^]*n["^]*t|r["^]*f["^]*m["^]*o["^]*n)|n["^]*p["^]*u["^]*(?:n["^]*a["^]*t["^]*t["^]*e["^]*n["^]*d|t["^]*i["^]*l)|o["^]*(?:p["^]*d|w["^]*e["^]*r["^]*s["^]*h["^]*e["^]*l["^]*l)|r["^]*n["^]*(?:c["^]*n["^]*f["^]*g|(?:d["^]*r["^]*v|m["^]*n["^]*g)["^]*r|j["^]*o["^]*b["^]*s|p["^]*o["^]*r["^]*t|q["^]*c["^]*t["^]*l)|u["^]*(?:b["^]*p["^]*r["^]*n|s["^]*h["^]*(?:d|p["^]*r["^]*i["^]*n["^]*t["^]*e["^]*r["^]*c["^]*o["^]*n["^]*n["^]*e["^]*c["^]*t["^]*i["^]*o["^]*n["^]*s))|w["^]*(?:l["^]*a["^]*u["^]*n["^]*c["^]*h["^]*e["^]*r|s["^]*h))|q["^]*(?:a["^]*p["^]*p["^]*s["^]*r["^]*v|p["^]*r["^]*o["^]*c["^]*e["^]*s["^]*s|u["^]*s["^]*e["^]*r|w["^]*i["^]*n["^]*s["^]*t["^]*a)|r["^]*(?:d(?:["^]*p["^]*s["^]*i["^]*g["^]*n)?|e["^]*(?:f["^]*s["^]*u["^]*t["^]*i["^]*l|g(?:["^]*(?:i["^]*n["^]*i|s["^]*v["^]*r["^]*3["^]*2))?|l["^]*o["^]*g|(?:(?:p["^]*a["^]*d["^]*m["^]*i|s["^]*c["^]*a)["^]*)?n|x["^]*e["^]*c)|i["^]*s["^]*e["^]*t["^]*u["^]*p|m["^]*d["^]*i["^]*r|o["^]*b["^]*o["^]*c["^]*o["^]*p["^]*y|p["^]*c["^]*(?:i["^]*n["^]*f["^]*o|p["^]*i["^]*n["^]*g)|s["^]*h|u["^]*n["^]*d["^]*l["^]*l["^]*3["^]*2|w["^]*i["^]*n["^]*s["^]*t["^]*a)|s["^]*(?:a["^]*n|c["^]*(?:h["^]*t["^]*a["^]*s["^]*k["^]*s|w["^]*c["^]*m["^]*d)|e["^]*(?:c["^]*e["^]*d["^]*i["^]*t|r["^]*v["^]*e["^]*r["^]*(?:(?:c["^]*e["^]*i["^]*p|w["^]*e["^]*r)["^]*o["^]*p["^]*t["^]*i["^]*n|m["^]*a["^]*n["^]*a["^]*g["^]*e["^]*r["^]*c["^]*m["^]*d)|t["^]*x)|f["^]*c|(?:h["^]*o["^]*w["^]*m["^]*o["^]*u["^]*n|u["^]*b["^]*s)["^]*t|x["^]*s["^]*t["^]*r["^]*a["^]*c["^]*e|y["^]*s["^]*(?:o["^]*c["^]*m["^]*g["^]*r|t["^]*e["^]*m["^]*i["^]*n["^]*f["^]*o))|t["^]*(?:a["^]*(?:k["^]*e["^]*o["^]*w["^]*n|p["^]*i["^]*c["^]*f["^]*g|s["^]*k["^]*(?:k["^]*i["^]*l["^]*l|l["^]*i["^]*s["^]*t))|(?:c["^]*m["^]*s["^]*e["^]*t["^]*u|f["^]*t)["^]*p|(?:(?:e["^]*l["^]*n["^]*e|i["^]*m["^]*e["^]*o["^]*u)["^]*|r["^]*a["^]*c["^]*e["^]*r["^]*(?:p["^]*)?)t|l["^]*n["^]*t["^]*a["^]*d["^]*m["^]*n|p["^]*m["^]*(?:t["^]*o["^]*o["^]*l|v["^]*s["^]*c["^]*m["^]*g["^]*r)|s["^]*(?:(?:d["^]*i["^]*s["^]*)?c["^]*o["^]*n|e["^]*c["^]*i["^]*m["^]*p|k["^]*i["^]*l["^]*l|p["^]*r["^]*o["^]*f)|y["^]*p["^]*e["^]*p["^]*e["^]*r["^]*f|z["^]*u["^]*t["^]*i["^]*l)|u["^]*n["^]*(?:e["^]*x["^]*p["^]*o["^]*s["^]*e|i["^]*q["^]*u["^]*e["^]*i["^]*d|l["^]*o["^]*d["^]*c["^]*t["^]*r)|v["^]*(?:o["^]*l|s["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|w["^]*(?:a["^]*i["^]*t["^]*f["^]*o["^]*r|b["^]*a["^]*d["^]*m["^]*i["^]*n|(?:d["^]*s|e["^]*(?:c|v["^]*t))["^]*u["^]*t["^]*i["^]*l|h["^]*(?:e["^]*r["^]*e|o["^]*a["^]*m["^]*i)|i["^]*n["^]*(?:n["^]*t(?:["^]*3["^]*2)?|r["^]*s)|m["^]*i["^]*c|s["^]*c["^]*r["^]*i["^]*p["^]*t)|x["^]*c["^]*o["^]*p["^]*y)(?:.["^]*[0-9A-Z_a-z]+)?b" "id:1498,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1499,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1500,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*.[sv].*b" "id:1501,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?:$(?:((?:(.*)|.*))|{.*})|[<>](.*)|[!?.+])" "id:1502,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx ['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]" "id:1503,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx /" "id:1504,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx s" "id:1505,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx ^[^.]+.[^;?]+[;?](.*(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]))" "id:1506,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx /" "id:1507,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx s" "id:1508,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx ^[^.]*?(?:['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{])" "id:1509,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx /" "id:1510,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx s" "id:1511,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i).|(?:[sv]*|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|G["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?E["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?T|a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:b|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?t|r(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[jp])?|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ks])|b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[8-9]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?9|[au]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|c|(?:m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?p|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dfu]|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[gr])|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[bdx]|n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|q["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[c-dgi]|m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[chr]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|o|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dp]|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b)|j["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:j["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|q)|k["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)?|[nps]|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a|z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|v)|n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[cl]|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|o["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[at]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?x|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|f|(?:k["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?g|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cp]|r(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?y)?|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dv]|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dt]|[g-hu]|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cr]|b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l|[co]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ex]|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c)|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|l)|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|c)|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|z)|y["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)|z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h))" "id:1512,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)[-0-9_a-z]+(?:["'[-]]+|$+[!#*-0-9?-@x5c_a-{]+|``|[$<>]())[sv]*[-0-9_a-z]+" "id:1513,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "!@rx [0-9]s*'s*[0-9]" "id:1514,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx ;[sv]*.[sv]*["']?(?:a(?:rchive|uth)|b(?:a(?:ckup|il)|inary)|c(?:d|h(?:anges|eck)|lone|onnection)|d(?:atabases|b(?:config|info)|ump)|e(?:cho|qp|x(?:cel|it|p(?:ert|lain)))|f(?:ilectrl|ullschema)|he(?:aders|lp)|i(?:mpo(?:rt|ster)|ndexes|otrace)|l(?:i(?:mi|n)t|o(?:ad|g))|(?:mod|n(?:onc|ullvalu)|unmodul)e|o(?:nce|pen|utput)|p(?:arameter|r(?:int|o(?:gress|mpt)))|quit|re(?:ad|cover|store)|s(?:ave|c(?:anstats|hema)|e(?:lftest|parator|ssion)|h(?:a3sum|ell|ow)?|tats|ystem)|t(?:ables|estc(?:ase|trl)|ime(?:out|r)|race)|vfs(?:info|list|name)|width)" "id:1515,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx rn(?s:.)*?b(?:(?i:E)(?:HLO [--.A-Za-zx17fx212a]{1,255}|XPN .{1,64})|HELO [--.A-Za-zx17fx212a]{1,255}|MAIL FROM:<.{1,64}(?i:@).{1,255}(?i:>)|(?i:R)(?:CPT TO:(?:(?i:<).{1,64}(?i:@).{1,255}(?i:>)|(?i: ))?(?i:<).{1,64}(?i:>)|SETb)|VRFY .{1,64}(?: <.{1,64}(?i:@).{1,255}(?i:>)|(?i:@).{1,255})|AUTH [-0-9A-Z_a-zx17fx212a]{1,20}(?i: )(?:(?:[+/-9A-Z_a-zx17fx212a]{4})*(?:[+/-9A-Z_a-zx17fx212a]{2}(?i:=)|[+/-9A-Z_a-zx17fx212a]{3}))?(?i:=)|STARTTLSb|NOOPb(?:(?i: ).{1,255})?)" "id:1516,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:A(?:PPEND (?:["-#%-&*--9A-Zx5c_a-z]+)?(?: ([ x5ca-z]+))?(?: "?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [+-][0-9]{4}"?)? {[0-9]{1,20}+?}|UTHENTICATE [-0-9_a-z]{1,20}rn)|L(?:SUB (?:["-#*.-9A-Z_a-z~]+)? (?:["%-&*.-9A-Zx5c_a-z]+)?|ISTRIGHTS (?:["%-&*--9A-Zx5c_a-z]+)?)|S(?:TATUS (?:["%-&*--9A-Zx5c_a-z]+)? ((?:U(?:NSEEN|IDNEXT)|MESSAGES|UIDVALIDITY|RECENT| )+)|ETACL (?:["%-&*--9A-Zx5c_a-z]+)? [+-][ac-eik-lpr-tw-x]+?)|UID (?:COPY|FETCH|STORE) (?:[*,0-:]+)?|(?:(?:DELETE|GET)ACL|MYRIGHTS) (?:["%-&*--9A-Zx5c_a-z]+)?)" "id:1517,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?is)rn.*?b(?:(?:LIST|TOP [0-9]+)(?: [0-9]+)?|U(?:SER .+?|IDL(?: [0-9]+)?)|PASS .+?|(?:RETR|DELE) [0-9]+?|A(?:POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [-0-9A-Z_]{1,20} (?:(?:[+/-9A-Z_a-z]{4})*(?:[+/-9A-Z_a-z]{2}=|[+/-9A-Z_a-z]{3}))?=))" "id:1518,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|an|io|ulimit)|s(?:h|plit|vtool)|u(?:(?:t|rl)[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|inks|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[^sv])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash|nap)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:3m|c|a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))" "id:1519,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:c|a(?:ll|tch)[sv&)<>|]|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))" "id:1520,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@pmFromFile unix-shell.data" "id:1521,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1522,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1523,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))b" "id:1524,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:(?:itude)?[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|n?f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|s(?:[sv&)<>|]|ed|ftp|ql)?|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:ew)?[sv&)<>|]|m(?:[sv&)<>|]|diff)|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:[sv&)<>c|]|h(?:o(?:[sv&)<>|]|ami|is)?|iptail[sv&)<>|])|a(?:ll|tch)[sv&)<>|]|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))b" "id:1525,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))" "id:1526,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx /(?:[?*]+[a-z/]+|[a-z/]+[?*]+)" "id:1527,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx rn(?s:.)*?b(?:DATA|QUIT|HELP(?: .{1,255})?)" "id:1528,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:C(?:(?:REATE|OPY [*,0-:]+) ["-#%-&*--9A-Zx5c_a-z]+|APABILITY|HECK|LOSE)|DELETE ["-#%-&*--.0-9A-Zx5c_a-z]+|EX(?:AMINE ["-#%-&*--.0-9A-Zx5c_a-z]+|PUNGE)|FETCH [*,0-:]+|L(?:IST ["-#*--9A-Zx5c_a-z~]+? ["-#%-&*--9A-Zx5c_a-z]+|OG(?:IN [--.0-9@_a-z]{1,40} .*?|OUT))|RENAME ["-#%-&*--9A-Zx5c_a-z]+? ["-#%-&*--9A-Zx5c_a-z]+|S(?:E(?:LECT ["-#%-&*--9A-Zx5c_a-z]+|ARCH(?: CHARSET [--.0-9A-Z_a-z]{1,40})? (?:(KEYWORD x5c)?(?:A(?:LL|NSWERED)|BCC|D(?:ELETED|RAFT)|(?:FLAGGE|OL)D|RECENT|SEEN|UN(?:(?:ANSWER|FLAGG)ED|D(?:ELETED|RAFT)|SEEN)|NEW)|(?:BODY|CC|FROM|HEADER .{1,100}|NOT|OR .{1,255}|T(?:EXT|O)) .{1,255}|LARGER [0-9]{1,20}|[*,0-:]+|(?:BEFORE|ON|S(?:ENT(?:(?:BEFOR|SINC)E|ON)|INCE)) "?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4}"?|S(?:MALLER [0-9]{1,20}|UBJECT .{1,255})|U(?:ID [*,0-:]+?|NKEYWORD x5c(Seen|(?:Answer|Flagg)ed|D(?:eleted|raft)|Recent))))|T(?:ORE [*,0-:]+? [+-]?FLAGS(?:.SILENT)? (?:(x5c[a-z]{1,20}))?|ARTTLS)|UBSCRIBE ["-#%-&*--9A-Zx5c_a-z]+)|UN(?:SUBSCRIBE ["-#%-&*--9A-Zx5c_a-z]+|AUTHENTICATE)|NOOP)" "id:1529,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx rn(?s:.)*?b(?:(?:QUI|STA|RSE)(?i:T)|NOOP|CAPA)" "id:1530,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@rx !(?:d|!)" "id:1531,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1532,phase:1,deny,status:403,log,msg:'rce attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1533,phase:1,deny,status:403,log,msg:'rce attack detected'"
diff --git a/waf_patterns/apache/rfi.conf b/waf_patterns/apache/rfi.conf
index e35ec64..f431145 100644
--- a/waf_patterns/apache/rfi.conf
+++ b/waf_patterns/apache/rfi.conf
@@ -1,18 +1,18 @@
 # Apache ModSecurity rules for RFI
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1200,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1201,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@rx ^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})" "id:1202,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:bincludes*([^)]*|mosConfig_absolute_path|_CONF[path]|_SERVER[DOCUMENT_ROOT]|GALLERY_BASEDIR|path[docroot]|appserv_root|config[root_dir])=(?:file|ftps?|https?)://" "id:1203,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@rx ^(?i:file|ftps?|https?).*??+$" "id:1204,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1205,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1206,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)" "id:1207,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "!@endsWith .%{request_headers.host}" "id:1208,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)" "id:1209,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "!@endsWith .%{request_headers.host}" "id:1210,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1211,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1212,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1213,phase:1,deny,status:403,log,msg:'rfi attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1214,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1163,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1164,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@rx ^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})" "id:1165,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:bincludes*([^)]*|mosConfig_absolute_path|_CONF[path]|_SERVER[DOCUMENT_ROOT]|GALLERY_BASEDIR|path[docroot]|appserv_root|config[root_dir])=(?:file|ftps?|https?)://" "id:1166,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@rx ^(?i:file|ftps?|https?).*??+$" "id:1167,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1168,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1169,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)" "id:1170,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "!@endsWith .%{request_headers.host}" "id:1171,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)" "id:1172,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "!@endsWith .%{request_headers.host}" "id:1173,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1174,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1175,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1176,phase:1,deny,status:403,log,msg:'rfi attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1177,phase:1,deny,status:403,log,msg:'rfi attack detected'"
diff --git a/waf_patterns/apache/shells.conf b/waf_patterns/apache/shells.conf
index 67f3101..523faa0 100644
--- a/waf_patterns/apache/shells.conf
+++ b/waf_patterns/apache/shells.conf
@@ -1,37 +1,37 @@
 # Apache ModSecurity rules for SHELLS
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1566,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1567,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@pmFromFile web-shells-php.data" "id:1568,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx (<title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>)" "id:1569,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^<html><head><meta http-equiv='Content-Type' content='text/html; charset=Windows-1251'><title>.*? - WSO [0-9.]+</title>" "id:1570,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx B4TM4N SH3LL</title>.*<meta name='author' content='k4mpr3t'/>" "id:1571,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx <title>Mini Shell</title>.*Developed By LameHacker" "id:1572,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx <title>.:: .* ~ Ashiyane V [0-9.]+ ::.</title>" "id:1573,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx <title>Symlink_Sa [0-9.]+</title>" "id:1574,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx <title>CasuS [0-9.]+ by MafiABoY</title>" "id:1575,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^<html>rn<head>rn<title>GRP WebShell [0-9.]+" "id:1576,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx <small>NGHshell [0-9.]+ by Cr4sh</body></html>n$" "id:1577,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ -" "id:1578,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^<!DOCTYPE html>n<html>n<!-- By Artyum .*<title>Web Shell</title>" "id:1579,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx <title>lama's'hell v. [0-9.]+</title>" "id:1580,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^ *<html>n[ ]+<head>n[ ]+<title>lostDC -" "id:1581,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^<title>PHP Web Shell</title>rn<html>rn<body>rn    <!-- Replaces command with Base64-encoded Data -->" "id:1582,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^<html>n<head>n<div align="left"><font size="1">Input command :</font></div>n<form name="cmd" method="POST" enctype="multipart/form-data">" "id:1583,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^<html>n<head>n<title>Ru24PostWebShell -" "id:1584,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King</title>" "id:1585,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^<html>rn<head>rn<meta http-equiv="Content-Type" content="text/html; charset=gb2312">rn<title>PhpSpy Ver [0-9]+</title>" "id:1586,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^ <html>nn<head>nn<title>g00nshell v[0-9.]+" "id:1587,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@contains <title>punkholicshell</title>" "id:1588,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^<html>n      <head>n             <title>azrail [0-9.]+ by C-W-M</title>" "id:1589,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx >SmEvK_PaThAn Shell v[0-9]+ coded by <a href=" "id:1590,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^<html>n<title>.*? ~ Shell I</title>n<head>n<style>" "id:1591,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@rx ^ <html><head><title>:: b374k m1n1 [0-9.]+ ::</title>" "id:1592,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1593,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1594,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@contains <h1 style="margin-bottom: 0">webadmin.php</h1>" "id:1595,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1596,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1597,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1598,phase:1,deny,status:403,log,msg:'shells attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1599,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1548,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1549,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@pmFromFile web-shells-php.data" "id:1550,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx (<title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>)" "id:1551,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^<html><head><meta http-equiv='Content-Type' content='text/html; charset=Windows-1251'><title>.*? - WSO [0-9.]+</title>" "id:1552,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx B4TM4N SH3LL</title>.*<meta name='author' content='k4mpr3t'/>" "id:1553,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx <title>Mini Shell</title>.*Developed By LameHacker" "id:1554,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx <title>.:: .* ~ Ashiyane V [0-9.]+ ::.</title>" "id:1555,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx <title>Symlink_Sa [0-9.]+</title>" "id:1556,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx <title>CasuS [0-9.]+ by MafiABoY</title>" "id:1557,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^<html>rn<head>rn<title>GRP WebShell [0-9.]+" "id:1558,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx <small>NGHshell [0-9.]+ by Cr4sh</body></html>n$" "id:1559,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ -" "id:1560,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^<!DOCTYPE html>n<html>n<!-- By Artyum .*<title>Web Shell</title>" "id:1561,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx <title>lama's'hell v. [0-9.]+</title>" "id:1562,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^ *<html>n[ ]+<head>n[ ]+<title>lostDC -" "id:1563,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^<title>PHP Web Shell</title>rn<html>rn<body>rn    <!-- Replaces command with Base64-encoded Data -->" "id:1564,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^<html>n<head>n<div align="left"><font size="1">Input command :</font></div>n<form name="cmd" method="POST" enctype="multipart/form-data">" "id:1565,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^<html>n<head>n<title>Ru24PostWebShell -" "id:1566,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King</title>" "id:1567,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^<html>rn<head>rn<meta http-equiv="Content-Type" content="text/html; charset=gb2312">rn<title>PhpSpy Ver [0-9]+</title>" "id:1568,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^ <html>nn<head>nn<title>g00nshell v[0-9.]+" "id:1569,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@contains <title>punkholicshell</title>" "id:1570,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^<html>n      <head>n             <title>azrail [0-9.]+ by C-W-M</title>" "id:1571,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx >SmEvK_PaThAn Shell v[0-9]+ coded by <a href=" "id:1572,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^<html>n<title>.*? ~ Shell I</title>n<head>n<style>" "id:1573,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@rx ^ <html><head><title>:: b374k m1n1 [0-9.]+ ::</title>" "id:1574,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1575,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1576,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@contains <h1 style="margin-bottom: 0">webadmin.php</h1>" "id:1577,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1578,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1579,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1580,phase:1,deny,status:403,log,msg:'shells attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1581,phase:1,deny,status:403,log,msg:'shells attack detected'"
diff --git a/waf_patterns/apache/sql.conf b/waf_patterns/apache/sql.conf
index 3017468..8a87d71 100644
--- a/waf_patterns/apache/sql.conf
+++ b/waf_patterns/apache/sql.conf
@@ -1,28 +1,28 @@
 # Apache ModSecurity rules for SQL
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1506,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1507,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "!@pmFromFile sql-errors.data" "id:1508,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])" "id:1509,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)" "id:1510,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i:DB2 SQL error:|[IBM][CLI Driver][DB2/6000]|CLI Driver.*DB2|DB2 SQL error|db2_w+()" "id:1511,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)" "id:1512,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i)Dynamic SQL Error" "id:1513,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i)Exception (?:condition )?d+. Transaction rollback." "id:1514,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i)org.hsqldb.jdbc" "id:1515,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception.*Informix)" "id:1516,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i:Warning.*ingres_|Ingres SQLSTATE|IngresW.*Driver)" "id:1517,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)" "id:1518,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)" "id:1519,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*WSystem.Data.SqlClient.|Conversion failed when converting the varchar value .*? to data type int.)" "id:1520,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array()|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient.)|[MySQL][ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[(-)_a-z]{1,26})?|(?:ERROR [0-9]{4} ([0-9a-z]{5})|XPATH syntax error):" "id:1521,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|pg_(?:query|exec)() [:|Warning.{1,20}bpg_.*|valid PostgreSQL result|Npgsql.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er" "id:1522,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)" "id:1523,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*Server message.*)" "id:1524,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1525,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1526,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1527,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1528,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1529,phase:1,deny,status:403,log,msg:'sql attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1530,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1120,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1121,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "!@pmFromFile sql-errors.data" "id:1122,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])" "id:1123,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)" "id:1124,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i:DB2 SQL error:|[IBM][CLI Driver][DB2/6000]|CLI Driver.*DB2|DB2 SQL error|db2_w+()" "id:1125,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)" "id:1126,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i)Dynamic SQL Error" "id:1127,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i)Exception (?:condition )?d+. Transaction rollback." "id:1128,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i)org.hsqldb.jdbc" "id:1129,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception.*Informix)" "id:1130,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i:Warning.*ingres_|Ingres SQLSTATE|IngresW.*Driver)" "id:1131,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)" "id:1132,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)" "id:1133,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*WSystem.Data.SqlClient.|Conversion failed when converting the varchar value .*? to data type int.)" "id:1134,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array()|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient.)|[MySQL][ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[(-)_a-z]{1,26})?|(?:ERROR [0-9]{4} ([0-9a-z]{5})|XPATH syntax error):" "id:1135,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|pg_(?:query|exec)() [:|Warning.{1,20}bpg_.*|valid PostgreSQL result|Npgsql.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er" "id:1136,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)" "id:1137,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*Server message.*)" "id:1138,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1139,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1140,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1141,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1142,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1143,phase:1,deny,status:403,log,msg:'sql attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1144,phase:1,deny,status:403,log,msg:'sql attack detected'"
diff --git a/waf_patterns/apache/sqli.conf b/waf_patterns/apache/sqli.conf
index a877e37..79f0b73 100644
--- a/waf_patterns/apache/sqli.conf
+++ b/waf_patterns/apache/sqli.conf
@@ -1,76 +1,76 @@
 # Apache ModSecurity rules for SQLI
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1357,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1358,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@detectSQLi" "id:1359,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:d(?:atabas|b_nam)e[^0-9A-Z_a-z]*(|(?:information_schema|m(?:aster..sysdatabases|s(?:db|ys(?:ac(?:cess(?:objects|storage|xml)|es)|modules2?|(?:object|querie|relationship)s))|ysql.db)|northwind|pg_(?:catalog|toast)|tempdb)b|s(?:chema(?:_nameb|[^0-9A-Z_a-z]*()|(?:qlite_(?:temp_)?master|ys(?:aux|.database_name))b))" "id:1360,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*(" "id:1361,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i:sleep(s*?d*?s*?)|benchmark(.*?,.*?))" "id:1362,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:select|;)[sv]+(?:benchmark|if|sleep)[sv]*?([sv]*?(?[sv]*?[0-9A-Z_a-z]+" "id:1363,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)["'`](?:[sv]*![sv]*["'0-9A-Z_-z]|;?[sv]*(?:having|select|unionb[sv]*(?:all|(?:distin|sele)ct))b[sv]*[^sv])|b(?:(?:(?:c(?:onnection_id|urrent_user)|database|schema|user)[sv]*?|select.*?[0-9A-Z_a-z]?user)(|exec(?:ute)?[sv]+master.|from[^0-9A-Z_a-z]+information_schema[^0-9A-Z_a-z]|into[sv+]+(?:dump|out)file[sv]*?["'`]|union(?:[sv]select[sv]@|[sv(0-9A-Z_a-z]*?select))|[sv]*?exec(?:ute)?.*?[^0-9A-Z_a-z]xp_cmdshell|[^0-9A-Z_a-z]iif[sv]*?(" "id:1364,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$" "id:1365,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)[sv(-)]case[sv]+when.*?then|)[sv]*?like[sv]*?(|select.*?having[sv]*?[^sv]+[sv]*?[^sv0-9A-Z_a-z]|if[sv]?([0-9A-Z_a-z]+[sv]*?[<->~]" "id:1366,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)alter[sv]*?[0-9A-Z_a-z]+.*?char(?:acter)?[sv]+set[sv]+[0-9A-Z_a-z]+|["'`](?:;*?[sv]*?waitfor[sv]+(?:time|delay)[sv]+["'`]|;.*?:[sv]*?goto)" "id:1367,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i:merge.*?usings*?(|executes*?immediates*?["'`]|matchs*?[w(),+-]+s*?againsts*?()" "id:1368,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)union.*?select.*?from" "id:1369,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)select[sv]*?pg_sleep|waitfor[sv]*?delay[sv]?["'`]+[sv]?[0-9]|;[sv]*?shutdown[sv]*?(?:[#;{]|/*|--)" "id:1370,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)[?$(?:n(?:e|in?|o[rt])|e(?:q|xists|lemMatch)|l(?:te?|ike)|mod|a(?:ll|nd)|(?:s(?:iz|lic)|wher)e|t(?:ype|ext)|x?or|div|between|regex|jsonSchema)]?" "id:1371,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)" "id:1372,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)create[sv]+function[sv].+[sv]returns|;[sv]*?(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)b[sv]*?[([]?[0-9A-Z_a-z]{2,}" "id:1373,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)b[sv]*(?|end[sv]*?);)|[sv(]load_file[sv]*?(|["'`][sv]+regexp[^0-9A-Z_a-z]|["'0-9A-Z_-z][sv]+asb[sv]*["'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:(?:(?:(?:cre|trunc)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]+[0-9A-Z_a-z]+|u(?:pdate[sv]+[0-9A-Z_a-z]+|nion[sv]*(?:all|(?:sele|distin)ct)b)|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject))b)" "id:1374,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i:/*[!+](?:[ws=_-()]+)?*/)" "id:1375,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ^(?:[^']*'|[^"]*"|[^`]*`)[sv]*;" "id:1376,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)1.e[(-),]" "id:1377,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ["'`][[{].*[]}]["'`].*(::.*jsonb?)?.*(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)|(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)["'`][[{].*[]}]["'`]|json_extract.*(.*)" "id:1378,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1379,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1380,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?:^s*["'`;]+|["'`]+s*$)" "id:1381,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)!=|&&||||>[=->]|<(?:<|=>?|>(?:[sv]+binary)?)|b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?["'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)b|[0-9A-Z_a-z]*?_))|(?:likel(?:ihood|y)|unlikely)[sv]*()|r(?:egexp|like)[sv]+binary|not[sv]+between[sv]+(?:0[sv]+and|(?:'[^']*'|"[^"]*")[sv]+and[sv]+(?:'[^']*'|"[^"]*"))|is[sv]+null|like[sv]+(?:null|[0-9A-Z_a-z]+[sv]+escapeb)|(?:^|[^0-9A-Z_a-z])in[sv+]*([sv"0-9]+[^(-)]*)|[!<->]{1,2}[sv]*allb" "id:1382,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)[sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(?:=|<=>|(?:sounds[sv]+)?like|glob|r(?:like|egexp))[sv"'-)`]*?b([0-9A-Z_a-z]+)b" "id:1383,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@streq %{TX.2}" "id:1384,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)[sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(?:![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(?:like|r(?:like|egexp)))[sv"'-)`]*?b([0-9A-Z_a-z]+)b" "id:1385,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "!@streq %{TX.2}" "id:1386,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|g(?:lob|roup_concat)|h(?:ex|our)|i(?:f(?:null)?|if|n(?:str)?)|l(?:ast(?:_insert_rowid)?|ength|ike(?:l(?:ihood|y))?|n|o(?:ad_extension|g(?:10|2)?|wer(?:pi)?|cal)|trim)|m(?:ax|in(?:ute)?|o(?:d|nth))|n(?:ullif|ow)|p(?:i|ow(?:er)?|rintf|assword)|quote|r(?:a(?:dians|ndom(?:blob)?)|e(?:p(?:lace|eat)|verse)|ound|trim|ight)|s(?:i(?:gn|nh?)|oundex|q(?:lite_(?:compileoption_(?:get|used)|offset|source_id|version)|rt)|u(?:bstr(?:ing)?|m)|econd|leep)|t(?:anh?|otal(?:_changes)?|r(?:im|unc)|ypeof|ime)|u(?:n(?:icode|likely)|(?:pp|s)er)|zeroblob|bin|v(?:alues|ersion)|week|year)[^0-9A-Z_a-z]*(" "id:1387,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:/*)+["'`]+[sv]?(?:--|[#{]|/*)?|["'`](?:[sv]*(?:(?:x?or|and|div|like|between)[sv-0-9A-Z_a-z]+[(-)+--<->][sv]*["'0-9`]|[!=|](?:[sv -!+-0-9=]+.*?["'-(`].*?|[sv -!0-9=]+.*?[0-9]+)$|(?:like|print)[^0-9A-Z_a-z]+["'-(0-9A-Z_-z]|;)|(?:[<>~]+|[sv]*[^sv0-9A-Z_a-z]?=[sv]*|[^0-9A-Z_a-z]*?[+=]+[^0-9A-Z_a-z]*?)["'`])|[0-9]["'`][sv]+["'`][sv]+[0-9]|^admin[sv]*?["'`]|[sv"'-(`][sv]*?glob[^0-9A-Z_a-z]+["'-(0-9A-Z_-z]|[sv]is[sv]*?0[^0-9A-Z_a-z]|where[sv][sv,-.0-9A-Z_a-z]+[sv]=" "id:1388,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i),.*?["')0-9`-f]["'`](?:["'`].*?["'`]|(?:r?n)?z|[^"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]*?([sv]*?space[sv]*?(" "id:1389,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:&&||||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[sv(]+[0-9A-Z_a-z]+[sv)]*?[!+=]+[sv0-9]*?["'-)=`]|[0-9](?:[sv]*?(?:and|between|div|like|x?or)[sv]*?[0-9]+[sv]*?[+-]|[sv]+group[sv]+by.+()|/[0-9A-Z_a-z]+;?[sv]+(?:and|between|div|having|like|x?or|select)[^0-9A-Z_a-z]|(?:[#;]|--)[sv]*?(?:alter|drop|(?:insert|update)[sv]*?[0-9A-Z_a-z]{2,})|@.+=[sv]*?([sv]*?select|[^0-9A-Z_a-z]SET[sv]*?@[0-9A-Z_a-z]+" "id:1390,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)["'`][sv]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?["'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+["'`]|like[sv]*?["'`]%|select[sv]+?[sv"'-),-.0-9A-[]_-z]+from[sv]+" "id:1391,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i))[sv]*?when[sv]*?[0-9]+[sv]*?then|["'`][sv]*?(?:[#{]|--)|/*![sv]?[0-9]+|b(?:(?:binary|cha?r)[sv]*?([sv]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:egexp|like))[sv]+[0-9A-Z_a-z]+()|(?:|||&&)[sv]*?[0-9A-Z_a-z]+(" "id:1392,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:([sv]*?select[sv]*?[0-9A-Z_a-z]+|coalesce|order[sv]+by[sv]+if[0-9A-Z_a-z]*?)[sv]*?(|*/from|+[sv]*?[0-9]+[sv]*?+[sv]*?@|[0-9A-Z_a-z]["'`][sv]*?(?:(?:[+-=@|]+[sv]+?)+|[+-=@|]+)[(0-9]|@@[0-9A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]|[^0-9A-Z_a-z]!+["'`][0-9A-Z_a-z]|["'`](?:;[sv]*?(?:if|while|begin)|[sv0-9]+=[sv]*?[0-9])|[sv(]+case[0-9]*?[^0-9A-Z_a-z].+[tw]hen[sv(]" "id:1393,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)["'`][sv]*?b(?:x?or|div|like|between|and)b[sv]*?["'`]?[0-9]|x5cx(?:2[37]|3d)|^(?:.?["'`]$|["'x5c`]*?(?:["'0-9`]+|[^"'`]+["'`])[sv]*?b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)b[sv]*?["'0-9A-Z_-z][!&(-)+-.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?["'`][sv]*?[0-9A-Z_a-z]|@(?:[0-9A-Z_a-z]+[sv]+(?:and|x?or|div|like|between)b[sv]*?["'0-9`]+|[-0-9A-Z_a-z]+[sv](?:and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?["'`].|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]" "id:1394,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)in[sv]*?(+[sv]*?select|(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)[sv+0-9A-Z_a-z]+(?:regexp[sv]*?(|sounds[sv]+like[sv]*?["'`]|[0-9=]+x)|["'`](?:[sv]*?(?:[0-9][sv]*?(?:--|#)|is[sv]*?(?:[0-9].+["'`]?[0-9A-Z_a-z]|[.0-9]+[sv]*?[^0-9A-Z_a-z].*?["'`]))|[%-&<->^]+[0-9][sv]*?(?:=|x?or|div|like|between|and)|(?:[^0-9A-Z_a-z]+[+-0-9A-Z_a-z]+[sv]*?=[sv]*?[0-9][^0-9A-Z_a-z]+||?[-0-9A-Z_a-z]{3,}[^sv,.0-9A-Z_a-z]+)["'`]|[sv]*(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)(?:array[sv]*[|[0-9A-Z_a-z]+(?:[sv]*!?~|[sv]+(?:not[sv]+)?similar[sv]+to[sv]+)|(?:tru|fals)eb))|bexcept[sv]+(?:selectb|values[sv]*?()" "id:1395,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i:^[Wd]+s*?(?:alter|union)b)" "id:1396,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)[sv]?(?|end[sv]*?);|[sv(]load_file[sv]*?(|["'`][sv]+regexp[^0-9A-Z_a-z]|[^A-Z_a-z][sv]+asb[sv]*["'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:create[sv]+[0-9A-Z_a-z]+|(?:d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load|(?:renam|truncat)e|u(?:pdate|nion[sv]*(?:all|(?:sele|distin)ct))|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject)))b)" "id:1397,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)["'`](?:[sv]*?(?:(?:*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?["'`]|(?:x?or|div|like|between|and)[sv][^0-9]+[-0-9A-Z_a-z]+.*?)[0-9]|[^sv0-9?A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]+[sv]*?["'`]|[^sv0-9A-Z_a-z]+[sv]*?[^A-Z_a-z].*?(?:#|--))|.*?*[sv]*?[0-9])|^["'`]|[%(-+-<>][-0-9A-Z_a-z]+[^sv0-9A-Z_a-z]+["'`][^,]" "id:1398,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:havingb(?:[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')[sv]*?[<->]| ?(?:[0-9]{1,10} ?[<->]+|["'][^=]{1,10}[ "'<-?[]+))|ex(?:ecute(?:(|[sv]{1,5}[$.0-9A-Z_a-z]{1,5}[sv]{0,3})|ists[sv]*?([sv]*?selectb)|(?:create[sv]+?table.{0,20}?|like[^0-9A-Z_a-z]*?char[^0-9A-Z_a-z]*?)()|select.*?case|from.*?limit|order[sv]by|exists[sv](?:[sv]select|s(?:elect[^sv](?:if(?:null)?[sv](|top|concat)|ystem[sv]()|bhavingb[sv]+[0-9]{1,10}|'[^=]{1,10}')" "id:1399,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:orb(?:[sv]?(?:[0-9]{1,10}|["'][^=]{1,10}["'])[sv]?[<->]+|[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|xorb[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|'[sv]+x?or[sv]+.{1,20}[!+-<->]" "id:1400,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)bandb(?:[sv]+(?:[0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|["'][^=]{1,10}["']) ?[<->]+)" "id:1401,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:a(?:(?:b|co)s|dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:in|cii(?:str)?)|tan2?|vg)|b(?:enchmark|i(?:n(?:_to_num)?|t_(?:and|count|length|x?or)))|c(?:ast|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|o(?:alesce|ercibility|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|(?:un)?t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|time(?:stamp)?|user)))|d(?:a(?:t(?:abase|e(?:_(?:add|format|sub)|diff)?)|y(?:name|of(?:month|week|year))?)|count|e(?:code|(?:faul|s_(?:de|en)cryp)t|grees)|ump)|e(?:lt|nc(?:ode|rypt)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:eld(?:_in_set)?|nd_in_set)|loor|o(?:rmat|und_rows)|rom_(?:base64|days|unixtime))|g(?:et_(?:format|lock)|r(?:eates|oup_conca)t)|h(?:ex(?:toraw)?|our)|i(?:f(?:null)?|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)?|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull))|null)?)|l(?:ast(?:_(?:day|insert_id))?|case|e(?:(?:as|f)t|ngth)|n|o(?:ad_file|ca(?:l(?:timestamp)?|te)|g(?:10|2)?|wer)|pad|trim)|m(?:a(?:ke(?:date|_set)|ster_pos_wait|x)|d5|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:d|nth(?:name)?))|n(?:ame_const|o(?:t_in|w)|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:assword|eriod_(?:add|diff)|g_sleep|i|o(?:sition|w(?:er)?)|rocedure_analyse)|qu(?:arter|ote)|r(?:a(?:dians|nd|wto(?:hex|nhex(?:toraw)?))|e(?:lease_lock|p(?:eat|lace)|verse)|ight|o(?:und|w_count)|pad|trim)|s(?:chema|e(?:c(?:ond|_to_time)|ssion_user)|ha[1-2]?|ig?n|leep|oundex|pace|qrt|t(?:d(?:dev(?:_(?:po|sam)p)?)?|r(?:cmp|_to_date))|u(?:b(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|m)|ys(?:date|tem_user))|t(?:an|ime(?:diff|_(?:format|to_sec)|stamp(?:add|diff)?)?|o_(?:base64|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|ix_timestamp)|p(?:datexml|per)|ser|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|v(?:a(?:lues|r(?:iance|_(?:po|sam)p))|ersion)|we(?:ek(?:day|ofyear)?|ight_string)|xmltype|year(?:week)?)[^0-9A-Z_a-z]*?(" "id:1402,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|oacreate|p(?:assword|repare)|replwritetovarbin)|ql_(?:longvarchar|variant))|utl_(?:file|http)|xp_(?:availablemedia|(?:cmdshel|servicecontro)l|dirtree|e(?:numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(?:_enumdomains)?|reg(?:addmultistring|delete(?:key|value)|enum(?:key|value)s|re(?:ad|movemultistring)|write)|terminate(?:_process)?)" "id:1403,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:(?:d(?:bms_[0-9A-Z_a-z]+.|eleteb[^0-9A-Z_a-z]*?bfrom)|(?:groupb.*?bbyb.{1,100}?bhav|overlayb[^0-9A-Z_a-z]*?(.*?b[^0-9A-Z_a-z]*?plac)ing|in(?:nerb[^0-9A-Z_a-z]*?bjoin|sertb[^0-9A-Z_a-z]*?binto|tob[^0-9A-Z_a-z]*?b(?:dump|out)file)|loadb[^0-9A-Z_a-z]*?bdatab.*?binfile|s(?:electb.{1,100}?b(?:(?:.*?bdumpb.*|(?:count|length)b.{1,100}?)bfrom|(?:data_typ|fromb.{1,100}?bwher)e|instr|to(?:_(?:cha|numbe)r|pb.{1,100}?bfrom))|ys_context)|u(?:nionb.{1,100}?bselect|tl_inaddr))b|printb[^0-9A-Z_a-z]*?@@)|(?:collation[^0-9A-Z_a-z]*?(a|@@version|;[^0-9A-Z_a-z]*?b(?:drop|shutdown))b|'(?:dbo|msdasql|s(?:a|qloledb))'" "id:1404,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){12})" "id:1405,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx /*!?|*/|[';]--|--(?:[sv]|[^-]*?-)|[^&-]#.*?[sv]|;?x00" "id:1406,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "!@rx ^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+.[-0-9A-Z_a-z]+$" "id:1407,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i:b0x[a-fd]{3,})" "id:1408,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?:`(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)`)" "id:1409,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)["'`][sv]*?(?:(?:is[sv]+not|not[sv]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|])" "id:1410,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^"]*?(?:"[^"]*?"[^"]*?)*?"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b" "id:1411,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ^(?:and|or)$" "id:1412,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ^.*?x5c['"`](?:.*?['"`])?s*(?:and|or)b" "id:1413,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@detectSQLi" "id:1414,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*(" "id:1415,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)" "id:1416,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1417,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1418,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?i)W+d*?s*?bhavingbs*?[^s-]" "id:1419,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ["'`][sd]*?[^ws]W*?dW*?.*?["'`d]" "id:1420,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){8})" "id:1421,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){6})" "id:1422,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx W{4}" "id:1423,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx (?:'(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)')" "id:1424,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ';" "id:1425,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1426,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1427,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){3})" "id:1428,phase:1,deny,status:403,log,msg:'sqli attack detected'"
-SecRule REQUEST_URI "@rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){2})" "id:1429,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1256,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1257,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@detectSQLi" "id:1258,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:d(?:atabas|b_nam)e[^0-9A-Z_a-z]*(|(?:information_schema|m(?:aster..sysdatabases|s(?:db|ys(?:ac(?:cess(?:objects|storage|xml)|es)|modules2?|(?:object|querie|relationship)s))|ysql.db)|northwind|pg_(?:catalog|toast)|tempdb)b|s(?:chema(?:_nameb|[^0-9A-Z_a-z]*()|(?:qlite_(?:temp_)?master|ys(?:aux|.database_name))b))" "id:1259,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*(" "id:1260,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i:sleep(s*?d*?s*?)|benchmark(.*?,.*?))" "id:1261,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:select|;)[sv]+(?:benchmark|if|sleep)[sv]*?([sv]*?(?[sv]*?[0-9A-Z_a-z]+" "id:1262,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)["'`](?:[sv]*![sv]*["'0-9A-Z_-z]|;?[sv]*(?:having|select|unionb[sv]*(?:all|(?:distin|sele)ct))b[sv]*[^sv])|b(?:(?:(?:c(?:onnection_id|urrent_user)|database|schema|user)[sv]*?|select.*?[0-9A-Z_a-z]?user)(|exec(?:ute)?[sv]+master.|from[^0-9A-Z_a-z]+information_schema[^0-9A-Z_a-z]|into[sv+]+(?:dump|out)file[sv]*?["'`]|union(?:[sv]select[sv]@|[sv(0-9A-Z_a-z]*?select))|[sv]*?exec(?:ute)?.*?[^0-9A-Z_a-z]xp_cmdshell|[^0-9A-Z_a-z]iif[sv]*?(" "id:1263,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$" "id:1264,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)[sv(-)]case[sv]+when.*?then|)[sv]*?like[sv]*?(|select.*?having[sv]*?[^sv]+[sv]*?[^sv0-9A-Z_a-z]|if[sv]?([0-9A-Z_a-z]+[sv]*?[<->~]" "id:1265,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)alter[sv]*?[0-9A-Z_a-z]+.*?char(?:acter)?[sv]+set[sv]+[0-9A-Z_a-z]+|["'`](?:;*?[sv]*?waitfor[sv]+(?:time|delay)[sv]+["'`]|;.*?:[sv]*?goto)" "id:1266,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i:merge.*?usings*?(|executes*?immediates*?["'`]|matchs*?[w(),+-]+s*?againsts*?()" "id:1267,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)union.*?select.*?from" "id:1268,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)select[sv]*?pg_sleep|waitfor[sv]*?delay[sv]?["'`]+[sv]?[0-9]|;[sv]*?shutdown[sv]*?(?:[#;{]|/*|--)" "id:1269,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)[?$(?:n(?:e|in?|o[rt])|e(?:q|xists|lemMatch)|l(?:te?|ike)|mod|a(?:ll|nd)|(?:s(?:iz|lic)|wher)e|t(?:ype|ext)|x?or|div|between|regex|jsonSchema)]?" "id:1270,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)" "id:1271,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)create[sv]+function[sv].+[sv]returns|;[sv]*?(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)b[sv]*?[([]?[0-9A-Z_a-z]{2,}" "id:1272,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)b[sv]*(?|end[sv]*?);)|[sv(]load_file[sv]*?(|["'`][sv]+regexp[^0-9A-Z_a-z]|["'0-9A-Z_-z][sv]+asb[sv]*["'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:(?:(?:(?:cre|trunc)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]+[0-9A-Z_a-z]+|u(?:pdate[sv]+[0-9A-Z_a-z]+|nion[sv]*(?:all|(?:sele|distin)ct)b)|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject))b)" "id:1273,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i:/*[!+](?:[ws=_-()]+)?*/)" "id:1274,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ^(?:[^']*'|[^"]*"|[^`]*`)[sv]*;" "id:1275,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)1.e[(-),]" "id:1276,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ["'`][[{].*[]}]["'`].*(::.*jsonb?)?.*(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)|(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)["'`][[{].*[]}]["'`]|json_extract.*(.*)" "id:1277,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1278,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1279,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?:^s*["'`;]+|["'`]+s*$)" "id:1280,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)!=|&&||||>[=->]|<(?:<|=>?|>(?:[sv]+binary)?)|b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?["'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)b|[0-9A-Z_a-z]*?_))|(?:likel(?:ihood|y)|unlikely)[sv]*()|r(?:egexp|like)[sv]+binary|not[sv]+between[sv]+(?:0[sv]+and|(?:'[^']*'|"[^"]*")[sv]+and[sv]+(?:'[^']*'|"[^"]*"))|is[sv]+null|like[sv]+(?:null|[0-9A-Z_a-z]+[sv]+escapeb)|(?:^|[^0-9A-Z_a-z])in[sv+]*([sv"0-9]+[^(-)]*)|[!<->]{1,2}[sv]*allb" "id:1281,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)[sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(?:=|<=>|(?:sounds[sv]+)?like|glob|r(?:like|egexp))[sv"'-)`]*?b([0-9A-Z_a-z]+)b" "id:1282,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@streq %{TX.2}" "id:1283,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)[sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(?:![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(?:like|r(?:like|egexp)))[sv"'-)`]*?b([0-9A-Z_a-z]+)b" "id:1284,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "!@streq %{TX.2}" "id:1285,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|g(?:lob|roup_concat)|h(?:ex|our)|i(?:f(?:null)?|if|n(?:str)?)|l(?:ast(?:_insert_rowid)?|ength|ike(?:l(?:ihood|y))?|n|o(?:ad_extension|g(?:10|2)?|wer(?:pi)?|cal)|trim)|m(?:ax|in(?:ute)?|o(?:d|nth))|n(?:ullif|ow)|p(?:i|ow(?:er)?|rintf|assword)|quote|r(?:a(?:dians|ndom(?:blob)?)|e(?:p(?:lace|eat)|verse)|ound|trim|ight)|s(?:i(?:gn|nh?)|oundex|q(?:lite_(?:compileoption_(?:get|used)|offset|source_id|version)|rt)|u(?:bstr(?:ing)?|m)|econd|leep)|t(?:anh?|otal(?:_changes)?|r(?:im|unc)|ypeof|ime)|u(?:n(?:icode|likely)|(?:pp|s)er)|zeroblob|bin|v(?:alues|ersion)|week|year)[^0-9A-Z_a-z]*(" "id:1286,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:/*)+["'`]+[sv]?(?:--|[#{]|/*)?|["'`](?:[sv]*(?:(?:x?or|and|div|like|between)[sv-0-9A-Z_a-z]+[(-)+--<->][sv]*["'0-9`]|[!=|](?:[sv -!+-0-9=]+.*?["'-(`].*?|[sv -!0-9=]+.*?[0-9]+)$|(?:like|print)[^0-9A-Z_a-z]+["'-(0-9A-Z_-z]|;)|(?:[<>~]+|[sv]*[^sv0-9A-Z_a-z]?=[sv]*|[^0-9A-Z_a-z]*?[+=]+[^0-9A-Z_a-z]*?)["'`])|[0-9]["'`][sv]+["'`][sv]+[0-9]|^admin[sv]*?["'`]|[sv"'-(`][sv]*?glob[^0-9A-Z_a-z]+["'-(0-9A-Z_-z]|[sv]is[sv]*?0[^0-9A-Z_a-z]|where[sv][sv,-.0-9A-Z_a-z]+[sv]=" "id:1287,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i),.*?["')0-9`-f]["'`](?:["'`].*?["'`]|(?:r?n)?z|[^"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]*?([sv]*?space[sv]*?(" "id:1288,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:&&||||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[sv(]+[0-9A-Z_a-z]+[sv)]*?[!+=]+[sv0-9]*?["'-)=`]|[0-9](?:[sv]*?(?:and|between|div|like|x?or)[sv]*?[0-9]+[sv]*?[+-]|[sv]+group[sv]+by.+()|/[0-9A-Z_a-z]+;?[sv]+(?:and|between|div|having|like|x?or|select)[^0-9A-Z_a-z]|(?:[#;]|--)[sv]*?(?:alter|drop|(?:insert|update)[sv]*?[0-9A-Z_a-z]{2,})|@.+=[sv]*?([sv]*?select|[^0-9A-Z_a-z]SET[sv]*?@[0-9A-Z_a-z]+" "id:1289,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)["'`][sv]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?["'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+["'`]|like[sv]*?["'`]%|select[sv]+?[sv"'-),-.0-9A-[]_-z]+from[sv]+" "id:1290,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i))[sv]*?when[sv]*?[0-9]+[sv]*?then|["'`][sv]*?(?:[#{]|--)|/*![sv]?[0-9]+|b(?:(?:binary|cha?r)[sv]*?([sv]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:egexp|like))[sv]+[0-9A-Z_a-z]+()|(?:|||&&)[sv]*?[0-9A-Z_a-z]+(" "id:1291,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:([sv]*?select[sv]*?[0-9A-Z_a-z]+|coalesce|order[sv]+by[sv]+if[0-9A-Z_a-z]*?)[sv]*?(|*/from|+[sv]*?[0-9]+[sv]*?+[sv]*?@|[0-9A-Z_a-z]["'`][sv]*?(?:(?:[+-=@|]+[sv]+?)+|[+-=@|]+)[(0-9]|@@[0-9A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]|[^0-9A-Z_a-z]!+["'`][0-9A-Z_a-z]|["'`](?:;[sv]*?(?:if|while|begin)|[sv0-9]+=[sv]*?[0-9])|[sv(]+case[0-9]*?[^0-9A-Z_a-z].+[tw]hen[sv(]" "id:1292,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)["'`][sv]*?b(?:x?or|div|like|between|and)b[sv]*?["'`]?[0-9]|x5cx(?:2[37]|3d)|^(?:.?["'`]$|["'x5c`]*?(?:["'0-9`]+|[^"'`]+["'`])[sv]*?b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)b[sv]*?["'0-9A-Z_-z][!&(-)+-.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?["'`][sv]*?[0-9A-Z_a-z]|@(?:[0-9A-Z_a-z]+[sv]+(?:and|x?or|div|like|between)b[sv]*?["'0-9`]+|[-0-9A-Z_a-z]+[sv](?:and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?["'`].|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]" "id:1293,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)in[sv]*?(+[sv]*?select|(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)[sv+0-9A-Z_a-z]+(?:regexp[sv]*?(|sounds[sv]+like[sv]*?["'`]|[0-9=]+x)|["'`](?:[sv]*?(?:[0-9][sv]*?(?:--|#)|is[sv]*?(?:[0-9].+["'`]?[0-9A-Z_a-z]|[.0-9]+[sv]*?[^0-9A-Z_a-z].*?["'`]))|[%-&<->^]+[0-9][sv]*?(?:=|x?or|div|like|between|and)|(?:[^0-9A-Z_a-z]+[+-0-9A-Z_a-z]+[sv]*?=[sv]*?[0-9][^0-9A-Z_a-z]+||?[-0-9A-Z_a-z]{3,}[^sv,.0-9A-Z_a-z]+)["'`]|[sv]*(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)(?:array[sv]*[|[0-9A-Z_a-z]+(?:[sv]*!?~|[sv]+(?:not[sv]+)?similar[sv]+to[sv]+)|(?:tru|fals)eb))|bexcept[sv]+(?:selectb|values[sv]*?()" "id:1294,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i:^[Wd]+s*?(?:alter|union)b)" "id:1295,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)[sv]?(?|end[sv]*?);|[sv(]load_file[sv]*?(|["'`][sv]+regexp[^0-9A-Z_a-z]|[^A-Z_a-z][sv]+asb[sv]*["'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:create[sv]+[0-9A-Z_a-z]+|(?:d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load|(?:renam|truncat)e|u(?:pdate|nion[sv]*(?:all|(?:sele|distin)ct))|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject)))b)" "id:1296,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)["'`](?:[sv]*?(?:(?:*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?["'`]|(?:x?or|div|like|between|and)[sv][^0-9]+[-0-9A-Z_a-z]+.*?)[0-9]|[^sv0-9?A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]+[sv]*?["'`]|[^sv0-9A-Z_a-z]+[sv]*?[^A-Z_a-z].*?(?:#|--))|.*?*[sv]*?[0-9])|^["'`]|[%(-+-<>][-0-9A-Z_a-z]+[^sv0-9A-Z_a-z]+["'`][^,]" "id:1297,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:havingb(?:[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')[sv]*?[<->]| ?(?:[0-9]{1,10} ?[<->]+|["'][^=]{1,10}[ "'<-?[]+))|ex(?:ecute(?:(|[sv]{1,5}[$.0-9A-Z_a-z]{1,5}[sv]{0,3})|ists[sv]*?([sv]*?selectb)|(?:create[sv]+?table.{0,20}?|like[^0-9A-Z_a-z]*?char[^0-9A-Z_a-z]*?)()|select.*?case|from.*?limit|order[sv]by|exists[sv](?:[sv]select|s(?:elect[^sv](?:if(?:null)?[sv](|top|concat)|ystem[sv]()|bhavingb[sv]+[0-9]{1,10}|'[^=]{1,10}')" "id:1298,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:orb(?:[sv]?(?:[0-9]{1,10}|["'][^=]{1,10}["'])[sv]?[<->]+|[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|xorb[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|'[sv]+x?or[sv]+.{1,20}[!+-<->]" "id:1299,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)bandb(?:[sv]+(?:[0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|["'][^=]{1,10}["']) ?[<->]+)" "id:1300,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:a(?:(?:b|co)s|dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:in|cii(?:str)?)|tan2?|vg)|b(?:enchmark|i(?:n(?:_to_num)?|t_(?:and|count|length|x?or)))|c(?:ast|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|o(?:alesce|ercibility|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|(?:un)?t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|time(?:stamp)?|user)))|d(?:a(?:t(?:abase|e(?:_(?:add|format|sub)|diff)?)|y(?:name|of(?:month|week|year))?)|count|e(?:code|(?:faul|s_(?:de|en)cryp)t|grees)|ump)|e(?:lt|nc(?:ode|rypt)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:eld(?:_in_set)?|nd_in_set)|loor|o(?:rmat|und_rows)|rom_(?:base64|days|unixtime))|g(?:et_(?:format|lock)|r(?:eates|oup_conca)t)|h(?:ex(?:toraw)?|our)|i(?:f(?:null)?|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)?|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull))|null)?)|l(?:ast(?:_(?:day|insert_id))?|case|e(?:(?:as|f)t|ngth)|n|o(?:ad_file|ca(?:l(?:timestamp)?|te)|g(?:10|2)?|wer)|pad|trim)|m(?:a(?:ke(?:date|_set)|ster_pos_wait|x)|d5|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:d|nth(?:name)?))|n(?:ame_const|o(?:t_in|w)|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:assword|eriod_(?:add|diff)|g_sleep|i|o(?:sition|w(?:er)?)|rocedure_analyse)|qu(?:arter|ote)|r(?:a(?:dians|nd|wto(?:hex|nhex(?:toraw)?))|e(?:lease_lock|p(?:eat|lace)|verse)|ight|o(?:und|w_count)|pad|trim)|s(?:chema|e(?:c(?:ond|_to_time)|ssion_user)|ha[1-2]?|ig?n|leep|oundex|pace|qrt|t(?:d(?:dev(?:_(?:po|sam)p)?)?|r(?:cmp|_to_date))|u(?:b(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|m)|ys(?:date|tem_user))|t(?:an|ime(?:diff|_(?:format|to_sec)|stamp(?:add|diff)?)?|o_(?:base64|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|ix_timestamp)|p(?:datexml|per)|ser|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|v(?:a(?:lues|r(?:iance|_(?:po|sam)p))|ersion)|we(?:ek(?:day|ofyear)?|ight_string)|xmltype|year(?:week)?)[^0-9A-Z_a-z]*?(" "id:1301,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|oacreate|p(?:assword|repare)|replwritetovarbin)|ql_(?:longvarchar|variant))|utl_(?:file|http)|xp_(?:availablemedia|(?:cmdshel|servicecontro)l|dirtree|e(?:numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(?:_enumdomains)?|reg(?:addmultistring|delete(?:key|value)|enum(?:key|value)s|re(?:ad|movemultistring)|write)|terminate(?:_process)?)" "id:1302,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:(?:d(?:bms_[0-9A-Z_a-z]+.|eleteb[^0-9A-Z_a-z]*?bfrom)|(?:groupb.*?bbyb.{1,100}?bhav|overlayb[^0-9A-Z_a-z]*?(.*?b[^0-9A-Z_a-z]*?plac)ing|in(?:nerb[^0-9A-Z_a-z]*?bjoin|sertb[^0-9A-Z_a-z]*?binto|tob[^0-9A-Z_a-z]*?b(?:dump|out)file)|loadb[^0-9A-Z_a-z]*?bdatab.*?binfile|s(?:electb.{1,100}?b(?:(?:.*?bdumpb.*|(?:count|length)b.{1,100}?)bfrom|(?:data_typ|fromb.{1,100}?bwher)e|instr|to(?:_(?:cha|numbe)r|pb.{1,100}?bfrom))|ys_context)|u(?:nionb.{1,100}?bselect|tl_inaddr))b|printb[^0-9A-Z_a-z]*?@@)|(?:collation[^0-9A-Z_a-z]*?(a|@@version|;[^0-9A-Z_a-z]*?b(?:drop|shutdown))b|'(?:dbo|msdasql|s(?:a|qloledb))'" "id:1303,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){12})" "id:1304,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx /*!?|*/|[';]--|--(?:[sv]|[^-]*?-)|[^&-]#.*?[sv]|;?x00" "id:1305,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "!@rx ^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+.[-0-9A-Z_a-z]+$" "id:1306,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i:b0x[a-fd]{3,})" "id:1307,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?:`(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)`)" "id:1308,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)["'`][sv]*?(?:(?:is[sv]+not|not[sv]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|])" "id:1309,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^"]*?(?:"[^"]*?"[^"]*?)*?"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b" "id:1310,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ^(?:and|or)$" "id:1311,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ^.*?x5c['"`](?:.*?['"`])?s*(?:and|or)b" "id:1312,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@detectSQLi" "id:1313,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*(" "id:1314,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)" "id:1315,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1316,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1317,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?i)W+d*?s*?bhavingbs*?[^s-]" "id:1318,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ["'`][sd]*?[^ws]W*?dW*?.*?["'`d]" "id:1319,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){8})" "id:1320,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){6})" "id:1321,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx W{4}" "id:1322,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx (?:'(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)')" "id:1323,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ';" "id:1324,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1325,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1326,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){3})" "id:1327,phase:1,deny,status:403,log,msg:'sqli attack detected'"
+SecRule REQUEST_URI "@rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){2})" "id:1328,phase:1,deny,status:403,log,msg:'sqli attack detected'"
diff --git a/waf_patterns/apache/xss.conf b/waf_patterns/apache/xss.conf
index ac70118..dd3c31b 100644
--- a/waf_patterns/apache/xss.conf
+++ b/waf_patterns/apache/xss.conf
@@ -1,46 +1,46 @@
 # Apache ModSecurity rules for XSS
 SecRuleEngine On
 
-SecRule REQUEST_URI "@lt 1" "id:1314,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@lt 1" "id:1315,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "!@validateByteRange 20, 45-47, 48-57, 65-90, 95, 97-122" "id:1316,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@detectXSS" "id:1317,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)<script[^>]*>[sS]*?" "id:1318,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i).(?:b(?:x(?:link:href|html|mlns)|data:text/html|formaction|patternb.*?=)|!ENTITY[sv]+(?:%[sv]+)?[^sv]+[sv]+(?:SYSTEM|PUBLIC)|@import|;base64)b" "id:1319,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url(javascript" "id:1320,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)<[^0-9<>A-Z_a-z]*(?:[^sv"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e|v[^0-9A-Z_a-z]*?g|e[^0-9A-Z_a-z]*?t[^0-9>A-Z_a-z])|f[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?m|m[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?q[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?e|e[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?a[^0-9>A-Z_a-z])|(?:l[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?k|o[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?j[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?c[^0-9A-Z_a-z]*?t|e[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?d|a[^0-9A-Z_a-z]*?(?:p[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?t|u[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?o|n[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?e)|p[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m|i?[^0-9A-Z_a-z]*?f[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?e|b[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?s[^0-9A-Z_a-z]*?e|o[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?y|i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?s)|i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a?[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?e?|v[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?o)[^0-9>A-Z_a-z])|(?:<[0-9A-Z_a-z].*[sv/]|["'](?:.*[sv/])?)(?:background|formaction|lowsrc|on(?:a(?:bort|ctivate|d(?:apteradded|dtrack)|fter(?:print|(?:scriptexecu|upda)te)|lerting|n(?:imation(?:cancel|end|iteration|start)|tennastatechange)|ppcommand|u(?:dio(?:end|process|start)|xclick))|b(?:e(?:fore(?:(?:(?:(?:de)?activa|scriptexecu)t|toggl)e|c(?:opy|ut)|editfocus|input|p(?:aste|rint)|u(?:nload|pdate))|gin(?:Event)?)|l(?:ocked|ur)|oun(?:ce|dary)|roadcast|usy)|c(?:a(?:(?:ch|llschang)ed|nplay(?:through)?|rdstatechange)|(?:ell|fstate)change|h(?:a(?:rging(?:time)?cha)?nge|ecking)|l(?:ick|ose)|o(?:m(?:mand(?:update)?|p(?:lete|osition(?:end|start|update)))|n(?:nect(?:ed|ing)|t(?:extmenu|rolselect))|py)|u(?:echange|t))|d(?:ata(?:(?:availabl|chang)e|error|setc(?:hanged|omplete))|blclick|e(?:activate|livery(?:error|success)|vice(?:found|light|(?:mo|orienta)tion|proximity))|i(?:aling|s(?:abled|c(?:hargingtimechange|onnect(?:ed|ing))))|o(?:m(?:a(?:ctivate|ttrmodified)|(?:characterdata|subtree)modified|focus(?:in|out)|mousescroll|node(?:inserted(?:intodocument)?|removed(?:fromdocument)?))|wnloading)|r(?:ag(?:drop|e(?:n(?:d|ter)|xit)|(?:gestur|leav)e|over|start)|op)|urationchange)|e(?:mptied|n(?:abled|d(?:ed|Event)?|ter)|rror(?:update)?|xit)|f(?:ailed|i(?:lterchange|nish)|o(?:cus(?:in|out)?|rm(?:change|input))|ullscreenchange)|g(?:amepad(?:axismove|button(?:down|up)|(?:dis)?connected)|et)|h(?:ashchange|e(?:adphoneschange|l[dp])|olding)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|put|valid))|key(?:down|press|up)|l(?:evelchange|o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|y)|m(?:ark|essage|o(?:use(?:down|enter|(?:lea|mo)ve|o(?:ut|ver)|up|wheel)|ve(?:end|start)?|z(?:a(?:fterpaint|udioavailable)|(?:beforeresiz|orientationchang|t(?:apgestur|imechang))e|(?:edgeui(?:c(?:ancel|omplet)|start)e|network(?:down|up)loa)d|fullscreen(?:change|error)|m(?:agnifygesture(?:start|update)?|ouse(?:hittest|pixelscroll))|p(?:ointerlock(?:change|error)|resstapgesture)|rotategesture(?:start|update)?|s(?:crolledareachanged|wipegesture(?:end|start|update)?))))|no(?:match|update)|o(?:(?:bsolet|(?:ff|n)lin)e|pen|verflow(?:changed)?)|p(?:a(?:ge(?:hide|show)|int|(?:st|us)e)|lay(?:ing)?|o(?:inter(?:down|enter|(?:(?:lea|mo)v|rawupdat)e|o(?:ut|ver)|up)|p(?:state|up(?:hid(?:den|ing)|show(?:ing|n))))|ro(?:gress|pertychange))|r(?:atechange|e(?:adystatechange|ceived|movetrack|peat(?:Event)?|quest|s(?:et|ize|u(?:lt|m(?:e|ing)))|trieving)|ow(?:e(?:nter|xit)|s(?:delete|inserted)))|s(?:croll(?:end)?|e(?:arch|ek(?:complete|ed|ing)|lect(?:ionchange|start)?|n(?:ding|t)|t)|how|(?:ound|peech)(?:end|start)|t(?:a(?:lled|rt|t(?:echange|uschanged))|k(?:comma|sessione)nd|op)|u(?:bmit|ccess|spend)|vg(?:abort|error|(?:un)?load|resize|scroll|zoom))|t(?:ext|ime(?:out|update)|o(?:ggle|uch(?:cancel|en(?:d|ter)|(?:lea|mo)ve|start))|ransition(?:cancel|end|run|start))|u(?:n(?:derflow|handledrejection|load)|p(?:dateready|gradeneeded)|s(?:erproximity|sdreceived))|v(?:ersion|o(?:ic|lum)e)change|w(?:a(?:it|rn)ing|ebkit(?:animation(?:end|iteration|start)|transitionend)|heel)|zoom)|ping|s(?:rc|tyle))[x08-nf-r ]*?=" "id:1321,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:W|^)(?:javascript:(?:[sS]+[=x5c([.<]|[sS]*?(?:bnameb|x5c[ux]d))|data:(?:(?:[a-z]w+/w[w+-]+w)?[;,]|[sS]*?;[sS]*?b(?:base64|charset=)|[sS]*?,[sS]*?<[sS]*?w[sS]*?>))|@W*?iW*?mW*?pW*?oW*?rW*?tW*?(?:/*[sS]*?)?(?:["']|W*?uW*?rW*?l[sS]*?()|[^-]*?-W*?mW*?oW*?zW*?-W*?bW*?iW*?nW*?dW*?iW*?nW*?g[^:]*?:W*?uW*?rW*?l[sS]*?(" "id:1322,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@pm document.cookie document.domain document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[" "id:1323,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i:<style.*?>.*?(?:@[ix5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(x5c]|&#x?0*(?:40|28|92|5C);?)))" "id:1324,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i:<.*[:]?vmlframe.*?[s/+]*?src[s/+]*=)" "id:1325,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:v|&#(?:0*(?:86|118)|x0*[57]6);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;))." "id:1326,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)(?:v|&#(?:0*8|x0*5)[36];)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*6[26]|x0*(?:98|42));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;))." "id:1327,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)<EMBED[s/+].*?(?:src|type).*?=" "id:1328,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx <[?]?import[s/+S]*?implementation[s/+]*?=" "id:1329,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i:<META[s/+].*?http-equiv[s/+]*=[s/+]*["'`]?(?:(?:c|&#x?0*(?:67|43|99|63);?)|(?:r|&#x?0*(?:82|52|114|72);?)|(?:s|&#x?0*(?:83|53|115|73);?)))" "id:1330,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i:<META[s/+].*?charset[s/+]*=)" "id:1331,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)<LINK[s/+].*?href[s/+]*=" "id:1332,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)<BASE[s/+].*?href[s/+]*=" "id:1333,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)<APPLET[s/+>]" "id:1334,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)<OBJECT[s/+].*?(?:type|codetype|classid|code|data)[s/+]*=" "id:1335,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx xbc[^xbe>]*[xbe>]|<[^xbe]*xbe" "id:1336,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?:xbcs*/s*[^xbe>]*[xbe>])|(?:<s*/s*[^xbe]*xbe)" "id:1337,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx +ADw-.*(?:+AD4-|>)|<.*+AD4-" "id:1338,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx ![!+ ][]" "id:1339,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?:self|document|this|top|window)s*(?:/*|[[)]).+?(?:]|*/)" "id:1340,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:eval|set(?:timeout|interval)|new[sv]+Function|a(?:lert|tob)|btoa)[sv]*(" "id:1341,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx ((?:[[^]]*][^.]*.)|Reflect[^.]*.).*(?:map|sort|apply)[^.]*..*call[^`]*`.*`" "id:1342,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1343,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@lt 2" "id:1344,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@detectXSS" "id:1345,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)[s"'`;/0-9=x0Bx09x0Cx3Bx2Cx28x3B]on[a-zA-Z]{3,25}[sx0Bx09x0Cx3Bx2Cx28x3B]*?=[^=]" "id:1346,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)b(?:s(?:tyle|rc)|href)b[sS]*?=" "id:1347,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@contains -->" "id:1348,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|hr|html|i|iframe|ilayer|img|input|ins|isindex|kdb|keygen|label|layer|legend|li|limittext|link|listing|map|marquee|menu|meta|multicol|nobr|noembed|noframes|noscript|nosmartquotes|object|ol|optgroup|option|p|param|plaintext|pre|q|rt|ruby|s|samp|script|select|server|shadow|sidebar|small|spacer|span|strike|strong|style|sub|sup|table|tbody|td|textarea|tfoot|th|thead|title|tr|tt|u|ul|var|wbr|xml|xmp)W" "id:1349,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i:["'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|x5cu006C)(?:o|x5cu006F)(?:c|x5cu0063)(?:a|x5cu0061)(?:t|x5cu0074)(?:i|x5cu0069)(?:o|x5cu006F)(?:n|x5cu006E)|(?:n|x5cu006E)(?:a|x5cu0061)(?:m|x5cu006D)(?:e|x5cu0065)|(?:o|x5cu006F)(?:n|x5cu006E)(?:e|x5cu0065)(?:r|x5cu0072)(?:r|x5cu0072)(?:o|x5cu006F)(?:r|x5cu0072)|(?:v|x5cu0076)(?:a|x5cu0061)(?:l|x5cu006C)(?:u|x5cu0075)(?:e|x5cu0065)(?:O|x5cu004F)(?:f|x5cu0066)).*?=)" "id:1350,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx (?i)["'][ ]*(?:[^a-z0-9~_:' ]|in).+?[.].+?=" "id:1351,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@rx {{.*?}}" "id:1352,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1353,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@lt 3" "id:1354,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1355,phase:1,deny,status:403,log,msg:'xss attack detected'"
-SecRule REQUEST_URI "@lt 4" "id:1356,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1189,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@lt 1" "id:1190,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "!@validateByteRange 20, 45-47, 48-57, 65-90, 95, 97-122" "id:1191,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@detectXSS" "id:1192,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)<script[^>]*>[sS]*?" "id:1193,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i).(?:b(?:x(?:link:href|html|mlns)|data:text/html|formaction|patternb.*?=)|!ENTITY[sv]+(?:%[sv]+)?[^sv]+[sv]+(?:SYSTEM|PUBLIC)|@import|;base64)b" "id:1194,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url(javascript" "id:1195,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)<[^0-9<>A-Z_a-z]*(?:[^sv"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e|v[^0-9A-Z_a-z]*?g|e[^0-9A-Z_a-z]*?t[^0-9>A-Z_a-z])|f[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?m|m[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?q[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?e|e[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?a[^0-9>A-Z_a-z])|(?:l[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?k|o[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?j[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?c[^0-9A-Z_a-z]*?t|e[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?d|a[^0-9A-Z_a-z]*?(?:p[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?t|u[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?o|n[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?e)|p[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m|i?[^0-9A-Z_a-z]*?f[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?e|b[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?s[^0-9A-Z_a-z]*?e|o[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?y|i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?s)|i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a?[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?e?|v[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?o)[^0-9>A-Z_a-z])|(?:<[0-9A-Z_a-z].*[sv/]|["'](?:.*[sv/])?)(?:background|formaction|lowsrc|on(?:a(?:bort|ctivate|d(?:apteradded|dtrack)|fter(?:print|(?:scriptexecu|upda)te)|lerting|n(?:imation(?:cancel|end|iteration|start)|tennastatechange)|ppcommand|u(?:dio(?:end|process|start)|xclick))|b(?:e(?:fore(?:(?:(?:(?:de)?activa|scriptexecu)t|toggl)e|c(?:opy|ut)|editfocus|input|p(?:aste|rint)|u(?:nload|pdate))|gin(?:Event)?)|l(?:ocked|ur)|oun(?:ce|dary)|roadcast|usy)|c(?:a(?:(?:ch|llschang)ed|nplay(?:through)?|rdstatechange)|(?:ell|fstate)change|h(?:a(?:rging(?:time)?cha)?nge|ecking)|l(?:ick|ose)|o(?:m(?:mand(?:update)?|p(?:lete|osition(?:end|start|update)))|n(?:nect(?:ed|ing)|t(?:extmenu|rolselect))|py)|u(?:echange|t))|d(?:ata(?:(?:availabl|chang)e|error|setc(?:hanged|omplete))|blclick|e(?:activate|livery(?:error|success)|vice(?:found|light|(?:mo|orienta)tion|proximity))|i(?:aling|s(?:abled|c(?:hargingtimechange|onnect(?:ed|ing))))|o(?:m(?:a(?:ctivate|ttrmodified)|(?:characterdata|subtree)modified|focus(?:in|out)|mousescroll|node(?:inserted(?:intodocument)?|removed(?:fromdocument)?))|wnloading)|r(?:ag(?:drop|e(?:n(?:d|ter)|xit)|(?:gestur|leav)e|over|start)|op)|urationchange)|e(?:mptied|n(?:abled|d(?:ed|Event)?|ter)|rror(?:update)?|xit)|f(?:ailed|i(?:lterchange|nish)|o(?:cus(?:in|out)?|rm(?:change|input))|ullscreenchange)|g(?:amepad(?:axismove|button(?:down|up)|(?:dis)?connected)|et)|h(?:ashchange|e(?:adphoneschange|l[dp])|olding)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|put|valid))|key(?:down|press|up)|l(?:evelchange|o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|y)|m(?:ark|essage|o(?:use(?:down|enter|(?:lea|mo)ve|o(?:ut|ver)|up|wheel)|ve(?:end|start)?|z(?:a(?:fterpaint|udioavailable)|(?:beforeresiz|orientationchang|t(?:apgestur|imechang))e|(?:edgeui(?:c(?:ancel|omplet)|start)e|network(?:down|up)loa)d|fullscreen(?:change|error)|m(?:agnifygesture(?:start|update)?|ouse(?:hittest|pixelscroll))|p(?:ointerlock(?:change|error)|resstapgesture)|rotategesture(?:start|update)?|s(?:crolledareachanged|wipegesture(?:end|start|update)?))))|no(?:match|update)|o(?:(?:bsolet|(?:ff|n)lin)e|pen|verflow(?:changed)?)|p(?:a(?:ge(?:hide|show)|int|(?:st|us)e)|lay(?:ing)?|o(?:inter(?:down|enter|(?:(?:lea|mo)v|rawupdat)e|o(?:ut|ver)|up)|p(?:state|up(?:hid(?:den|ing)|show(?:ing|n))))|ro(?:gress|pertychange))|r(?:atechange|e(?:adystatechange|ceived|movetrack|peat(?:Event)?|quest|s(?:et|ize|u(?:lt|m(?:e|ing)))|trieving)|ow(?:e(?:nter|xit)|s(?:delete|inserted)))|s(?:croll(?:end)?|e(?:arch|ek(?:complete|ed|ing)|lect(?:ionchange|start)?|n(?:ding|t)|t)|how|(?:ound|peech)(?:end|start)|t(?:a(?:lled|rt|t(?:echange|uschanged))|k(?:comma|sessione)nd|op)|u(?:bmit|ccess|spend)|vg(?:abort|error|(?:un)?load|resize|scroll|zoom))|t(?:ext|ime(?:out|update)|o(?:ggle|uch(?:cancel|en(?:d|ter)|(?:lea|mo)ve|start))|ransition(?:cancel|end|run|start))|u(?:n(?:derflow|handledrejection|load)|p(?:dateready|gradeneeded)|s(?:erproximity|sdreceived))|v(?:ersion|o(?:ic|lum)e)change|w(?:a(?:it|rn)ing|ebkit(?:animation(?:end|iteration|start)|transitionend)|heel)|zoom)|ping|s(?:rc|tyle))[x08-nf-r ]*?=" "id:1196,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:W|^)(?:javascript:(?:[sS]+[=x5c([.<]|[sS]*?(?:bnameb|x5c[ux]d))|data:(?:(?:[a-z]w+/w[w+-]+w)?[;,]|[sS]*?;[sS]*?b(?:base64|charset=)|[sS]*?,[sS]*?<[sS]*?w[sS]*?>))|@W*?iW*?mW*?pW*?oW*?rW*?tW*?(?:/*[sS]*?)?(?:["']|W*?uW*?rW*?l[sS]*?()|[^-]*?-W*?mW*?oW*?zW*?-W*?bW*?iW*?nW*?dW*?iW*?nW*?g[^:]*?:W*?uW*?rW*?l[sS]*?(" "id:1197,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@pm document.cookie document.domain document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[" "id:1198,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i:<style.*?>.*?(?:@[ix5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(x5c]|&#x?0*(?:40|28|92|5C);?)))" "id:1199,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i:<.*[:]?vmlframe.*?[s/+]*?src[s/+]*=)" "id:1200,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:v|&#(?:0*(?:86|118)|x0*[57]6);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;))." "id:1201,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)(?:v|&#(?:0*8|x0*5)[36];)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*6[26]|x0*(?:98|42));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;))." "id:1202,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)<EMBED[s/+].*?(?:src|type).*?=" "id:1203,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx <[?]?import[s/+S]*?implementation[s/+]*?=" "id:1204,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i:<META[s/+].*?http-equiv[s/+]*=[s/+]*["'`]?(?:(?:c|&#x?0*(?:67|43|99|63);?)|(?:r|&#x?0*(?:82|52|114|72);?)|(?:s|&#x?0*(?:83|53|115|73);?)))" "id:1205,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i:<META[s/+].*?charset[s/+]*=)" "id:1206,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)<LINK[s/+].*?href[s/+]*=" "id:1207,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)<BASE[s/+].*?href[s/+]*=" "id:1208,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)<APPLET[s/+>]" "id:1209,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)<OBJECT[s/+].*?(?:type|codetype|classid|code|data)[s/+]*=" "id:1210,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx xbc[^xbe>]*[xbe>]|<[^xbe]*xbe" "id:1211,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?:xbcs*/s*[^xbe>]*[xbe>])|(?:<s*/s*[^xbe]*xbe)" "id:1212,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx +ADw-.*(?:+AD4-|>)|<.*+AD4-" "id:1213,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx ![!+ ][]" "id:1214,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?:self|document|this|top|window)s*(?:/*|[[)]).+?(?:]|*/)" "id:1215,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:eval|set(?:timeout|interval)|new[sv]+Function|a(?:lert|tob)|btoa)[sv]*(" "id:1216,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx ((?:[[^]]*][^.]*.)|Reflect[^.]*.).*(?:map|sort|apply)[^.]*..*call[^`]*`.*`" "id:1217,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1218,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@lt 2" "id:1219,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@detectXSS" "id:1220,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)[s"'`;/0-9=x0Bx09x0Cx3Bx2Cx28x3B]on[a-zA-Z]{3,25}[sx0Bx09x0Cx3Bx2Cx28x3B]*?=[^=]" "id:1221,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)b(?:s(?:tyle|rc)|href)b[sS]*?=" "id:1222,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@contains -->" "id:1223,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|hr|html|i|iframe|ilayer|img|input|ins|isindex|kdb|keygen|label|layer|legend|li|limittext|link|listing|map|marquee|menu|meta|multicol|nobr|noembed|noframes|noscript|nosmartquotes|object|ol|optgroup|option|p|param|plaintext|pre|q|rt|ruby|s|samp|script|select|server|shadow|sidebar|small|spacer|span|strike|strong|style|sub|sup|table|tbody|td|textarea|tfoot|th|thead|title|tr|tt|u|ul|var|wbr|xml|xmp)W" "id:1224,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i:["'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|x5cu006C)(?:o|x5cu006F)(?:c|x5cu0063)(?:a|x5cu0061)(?:t|x5cu0074)(?:i|x5cu0069)(?:o|x5cu006F)(?:n|x5cu006E)|(?:n|x5cu006E)(?:a|x5cu0061)(?:m|x5cu006D)(?:e|x5cu0065)|(?:o|x5cu006F)(?:n|x5cu006E)(?:e|x5cu0065)(?:r|x5cu0072)(?:r|x5cu0072)(?:o|x5cu006F)(?:r|x5cu0072)|(?:v|x5cu0076)(?:a|x5cu0061)(?:l|x5cu006C)(?:u|x5cu0075)(?:e|x5cu0065)(?:O|x5cu004F)(?:f|x5cu0066)).*?=)" "id:1225,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx (?i)["'][ ]*(?:[^a-z0-9~_:' ]|in).+?[.].+?=" "id:1226,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@rx {{.*?}}" "id:1227,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1228,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@lt 3" "id:1229,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1230,phase:1,deny,status:403,log,msg:'xss attack detected'"
+SecRule REQUEST_URI "@lt 4" "id:1231,phase:1,deny,status:403,log,msg:'xss attack detected'"
diff --git a/waf_patterns/haproxy/bots.acl b/waf_patterns/haproxy/bots.acl
index 42d225b..5e40b10 100644
--- a/waf_patterns/haproxy/bots.acl
+++ b/waf_patterns/haproxy/bots.acl
@@ -1,592 +1,1778 @@
 # HAProxy WAF - Bad Bot Blocker
-acl bad_bot hdr_sub(User-Agent) -i (^| )PTST\/
-acl bad_bot hdr_sub(User-Agent) -i (^| )sentry\/
-acl bad_bot hdr_sub(User-Agent) -i (sistrix|SISTRIX) [cC]rawler
-acl bad_bot hdr_sub(User-Agent) -i 007ac9 Crawler
-acl bad_bot hdr_sub(User-Agent) -i 2ip bot
+acl bad_bot hdr_sub(User-Agent) -i  YLT
+acl bad_bot hdr_sub(User-Agent) -i 008\/
+acl bad_bot hdr_sub(User-Agent) -i 13TABS
+acl bad_bot hdr_sub(User-Agent) -i 192\.comAgent
+acl bad_bot hdr_sub(User-Agent) -i 2GDPR\/
 acl bad_bot hdr_sub(User-Agent) -i 2ip\.ru
 acl bad_bot hdr_sub(User-Agent) -i 360Spider
-acl bad_bot hdr_sub(User-Agent) -i <li>Mozilla/5.0 (compatible; Ask Jeeves/Teoma; +http://about.ask.com/en/docs/about/webmasters.shtml)</li>
-acl bad_bot hdr_sub(User-Agent) -i A Patent Crawler
+acl bad_bot hdr_sub(User-Agent) -i 404checker
+acl bad_bot hdr_sub(User-Agent) -i 404enemy
+acl bad_bot hdr_sub(User-Agent) -i 7Siters
+acl bad_bot hdr_sub(User-Agent) -i 80legs
 acl bad_bot hdr_sub(User-Agent) -i A6-Indexer
 acl bad_bot hdr_sub(User-Agent) -i ADmantX
-acl bad_bot hdr_sub(User-Agent) -i AHC\/
-acl bad_bot hdr_sub(User-Agent) -i AISearchBot
+acl bad_bot hdr_sub(User-Agent) -i AIBOT
+acl bad_bot hdr_sub(User-Agent) -i ALittle\ Client
 acl bad_bot hdr_sub(User-Agent) -i APIs-Google
+acl bad_bot hdr_sub(User-Agent) -i ASPSeek
+acl bad_bot hdr_sub(User-Agent) -i AWS Security Scanner
+acl bad_bot hdr_sub(User-Agent) -i Abonti
 acl bad_bot hdr_sub(User-Agent) -i Aboundex
-acl bad_bot hdr_sub(User-Agent) -i AcademicBotRTU
-acl bad_bot hdr_sub(User-Agent) -i AddSearchBot
+acl bad_bot hdr_sub(User-Agent) -i Aboundexbot
+acl bad_bot hdr_sub(User-Agent) -i Accoona-AI-Agent
+acl bad_bot hdr_sub(User-Agent) -i Acunetix
+acl bad_bot hdr_sub(User-Agent) -i AdAuth\/
 acl bad_bot hdr_sub(User-Agent) -i AddThis
-acl bad_bot hdr_sub(User-Agent) -i Adidxbot
-acl bad_bot hdr_sub(User-Agent) -i AdsBot-Google([^-]|$)
-acl bad_bot hdr_sub(User-Agent) -i AdsBot-Google-Mobile
-acl bad_bot hdr_sub(User-Agent) -i AdsTxtCrawler
-acl bad_bot hdr_sub(User-Agent) -i AdvBot
-acl bad_bot hdr_sub(User-Agent) -i Ahrefs(Bot|SiteAudit)
-acl bad_bot hdr_sub(User-Agent) -i AlexandriaOrgBot
+acl bad_bot hdr_sub(User-Agent) -i AdminLabs
+acl bad_bot hdr_sub(User-Agent) -i AdsTxtCrawlerTP
+acl bad_bot hdr_sub(User-Agent) -i Adstxtaggregator
+acl bad_bot hdr_sub(User-Agent) -i Adyen HttpClient
+acl bad_bot hdr_sub(User-Agent) -i AfD-Verbotsverfahren
+acl bad_bot hdr_sub(User-Agent) -i AffiliateLabz\/
+acl bad_bot hdr_sub(User-Agent) -i AhrefsBot
+acl bad_bot hdr_sub(User-Agent) -i AiHitBot
+acl bad_bot hdr_sub(User-Agent) -i Aipbot
+acl bad_bot hdr_sub(User-Agent) -i Airmail
+acl bad_bot hdr_sub(User-Agent) -i Alexibot
+acl bad_bot hdr_sub(User-Agent) -i Alibaba\.Security\.Heimdall
+acl bad_bot hdr_sub(User-Agent) -i AllSubmitter
+acl bad_bot hdr_sub(User-Agent) -i Alligator
 acl bad_bot hdr_sub(User-Agent) -i AlphaBot
-acl bad_bot hdr_sub(User-Agent) -i Amazon CloudFront
-acl bad_bot hdr_sub(User-Agent) -i Amazonbot
-acl bad_bot hdr_sub(User-Agent) -i AndersPinkBot
-acl bad_bot hdr_sub(User-Agent) -i AnyEvent
-acl bad_bot hdr_sub(User-Agent) -i Apercite
+acl bad_bot hdr_sub(User-Agent) -i Anarchie
+acl bad_bot hdr_sub(User-Agent) -i Anarchy
+acl bad_bot hdr_sub(User-Agent) -i Anarchy99
+acl bad_bot hdr_sub(User-Agent) -i AndroidDownloadManager
+acl bad_bot hdr_sub(User-Agent) -i Anemone
+acl bad_bot hdr_sub(User-Agent) -i AngleSharp
+acl bad_bot hdr_sub(User-Agent) -i Ankit
+acl bad_bot hdr_sub(User-Agent) -i Ant\.com
+acl bad_bot hdr_sub(User-Agent) -i Anthill
+acl bad_bot hdr_sub(User-Agent) -i Anturis Agent
+acl bad_bot hdr_sub(User-Agent) -i AnyEvent-HTTP\/
+acl bad_bot hdr_sub(User-Agent) -i Apache Ant\/
+acl bad_bot hdr_sub(User-Agent) -i Apache Droid
+acl bad_bot hdr_sub(User-Agent) -i Apache OpenOffice
+acl bad_bot hdr_sub(User-Agent) -i Apache-HttpAsyncClient
+acl bad_bot hdr_sub(User-Agent) -i Apache-HttpClient
+acl bad_bot hdr_sub(User-Agent) -i ApacheBench
+acl bad_bot hdr_sub(User-Agent) -i Apexoo
+acl bad_bot hdr_sub(User-Agent) -i AportWorm\/
+acl bad_bot hdr_sub(User-Agent) -i AppBeat\/
 acl bad_bot hdr_sub(User-Agent) -i AppEngine-Google
-acl bad_bot hdr_sub(User-Agent) -i AppInsights
-acl bad_bot hdr_sub(User-Agent) -i Applebot
-acl bad_bot hdr_sub(User-Agent) -i ArchiveBot
-acl bad_bot hdr_sub(User-Agent) -i AspiegelBot
-acl bad_bot hdr_sub(User-Agent) -i Atom Feed Robot
-acl bad_bot hdr_sub(User-Agent) -i Audisto Crawler
+acl bad_bot hdr_sub(User-Agent) -i AppleSyndication
+acl bad_bot hdr_sub(User-Agent) -i Aprc\/[0-9]
+acl bad_bot hdr_sub(User-Agent) -i Arachmo
+acl bad_bot hdr_sub(User-Agent) -i Arachnophilia
+acl bad_bot hdr_sub(User-Agent) -i Arukereso
+acl bad_bot hdr_sub(User-Agent) -i Asana\/
+acl bad_bot hdr_sub(User-Agent) -i Ask Jeeves
+acl bad_bot hdr_sub(User-Agent) -i AskQuickly
+acl bad_bot hdr_sub(User-Agent) -i Aspiegel
+acl bad_bot hdr_sub(User-Agent) -i Asterias
+acl bad_bot hdr_sub(User-Agent) -i Astute
+acl bad_bot hdr_sub(User-Agent) -i Atomseobot
+acl bad_bot hdr_sub(User-Agent) -i Attach
+acl bad_bot hdr_sub(User-Agent) -i AutomaticWPTester
+acl bad_bot hdr_sub(User-Agent) -i Autonomy
 acl bad_bot hdr_sub(User-Agent) -i AwarioBot
 acl bad_bot hdr_sub(User-Agent) -i AwarioRssBot
 acl bad_bot hdr_sub(User-Agent) -i AwarioSmartBot
-acl bad_bot hdr_sub(User-Agent) -i B2B Bot
+acl bad_bot hdr_sub(User-Agent) -i B-l-i-t-z-B-O-T
+acl bad_bot hdr_sub(User-Agent) -i BBBike
+acl bad_bot hdr_sub(User-Agent) -i BCKLINKS
 acl bad_bot hdr_sub(User-Agent) -i BDCbot
-acl bad_bot hdr_sub(User-Agent) -i BIGLOTRON
-acl bad_bot hdr_sub(User-Agent) -i BLEXBot\/
-acl bad_bot hdr_sub(User-Agent) -i BLP_bbot
-acl bad_bot hdr_sub(User-Agent) -i BTWebClient
+acl bad_bot hdr_sub(User-Agent) -i BDFetch
+acl bad_bot hdr_sub(User-Agent) -i BKCTwitterUnshortener\/
+acl bad_bot hdr_sub(User-Agent) -i BLEXBot
+acl bad_bot hdr_sub(User-Agent) -i BPImageWalker
 acl bad_bot hdr_sub(User-Agent) -i BUbiNG
-acl bad_bot hdr_sub(User-Agent) -i Baidu-YunGuanCe
-acl bad_bot hdr_sub(User-Agent) -i Baiduspider
-acl bad_bot hdr_sub(User-Agent) -i Bark[rR]owler
+acl bad_bot hdr_sub(User-Agent) -i BackDoorBot
+acl bad_bot hdr_sub(User-Agent) -i BackStreet
+acl bad_bot hdr_sub(User-Agent) -i BackWeb
+acl bad_bot hdr_sub(User-Agent) -i Backlink-Ceck
+acl bad_bot hdr_sub(User-Agent) -i BacklinkCrawler
+acl bad_bot hdr_sub(User-Agent) -i BacklinkHttpStatus
+acl bad_bot hdr_sub(User-Agent) -i BacklinksExtendedBot
+acl bad_bot hdr_sub(User-Agent) -i BackupLand
+acl bad_bot hdr_sub(User-Agent) -i Bad-Neighborhood
+acl bad_bot hdr_sub(User-Agent) -i Badass
+acl bad_bot hdr_sub(User-Agent) -i Bandit
+acl bad_bot hdr_sub(User-Agent) -i Barkrowler
+acl bad_bot hdr_sub(User-Agent) -i BatchFTP
+acl bad_bot hdr_sub(User-Agent) -i Battleztar Bazinga
+acl bad_bot hdr_sub(User-Agent) -i Battleztar\ Bazinga
 acl bad_bot hdr_sub(User-Agent) -i BazQux
-acl bad_bot hdr_sub(User-Agent) -i BehloolBot
-acl bad_bot hdr_sub(User-Agent) -i Better Uptime Bot
-acl bad_bot hdr_sub(User-Agent) -i BingPreview\/
-acl bad_bot hdr_sub(User-Agent) -i BitBot
-acl bad_bot hdr_sub(User-Agent) -i BitSightBot\/
+acl bad_bot hdr_sub(User-Agent) -i BegunAdvertising
+acl bad_bot hdr_sub(User-Agent) -i BetaBot
+acl bad_bot hdr_sub(User-Agent) -i Bewica-security-scan
+acl bad_bot hdr_sub(User-Agent) -i Bidtellect
+acl bad_bot hdr_sub(User-Agent) -i BigBozz
+acl bad_bot hdr_sub(User-Agent) -i Bigfoot
+acl bad_bot hdr_sub(User-Agent) -i BingLocalSearch
+acl bad_bot hdr_sub(User-Agent) -i BingPreview
+acl bad_bot hdr_sub(User-Agent) -i Bitacle
+acl bad_bot hdr_sub(User-Agent) -i Bitrix link preview
+acl bad_bot hdr_sub(User-Agent) -i Black Hole
+acl bad_bot hdr_sub(User-Agent) -i BlackWidow
+acl bad_bot hdr_sub(User-Agent) -i Black\ Hole
 acl bad_bot hdr_sub(User-Agent) -i Blackboard
-acl bad_bot hdr_sub(User-Agent) -i BlogTraffic\/\d\.\d+ Feed-Fetcher
-acl bad_bot hdr_sub(User-Agent) -i BomboraBot
-acl bad_bot hdr_sub(User-Agent) -i Bot\.AraTurka\.com
-acl bad_bot hdr_sub(User-Agent) -i BoxcarBot
-acl bad_bot hdr_sub(User-Agent) -i BrandONbot
-acl bad_bot hdr_sub(User-Agent) -i BrandVerity
-acl bad_bot hdr_sub(User-Agent) -i BrightEdge Crawler
-acl bad_bot hdr_sub(User-Agent) -i BublupBot
+acl bad_bot hdr_sub(User-Agent) -i Blackboard Safeassign
+acl bad_bot hdr_sub(User-Agent) -i BlockNote\.Net
+acl bad_bot hdr_sub(User-Agent) -i BlogBridge
+acl bad_bot hdr_sub(User-Agent) -i BlogPulseLive
+acl bad_bot hdr_sub(User-Agent) -i BlogSearch
+acl bad_bot hdr_sub(User-Agent) -i Bloglines
+acl bad_bot hdr_sub(User-Agent) -i Bloglovin
+acl bad_bot hdr_sub(User-Agent) -i Blogtrottr
+acl bad_bot hdr_sub(User-Agent) -i Blow
+acl bad_bot hdr_sub(User-Agent) -i BlowFish
+acl bad_bot hdr_sub(User-Agent) -i Boardreader
+acl bad_bot hdr_sub(User-Agent) -i Bolt
+acl bad_bot hdr_sub(User-Agent) -i Boost\.Beast
+acl bad_bot hdr_sub(User-Agent) -i BotALot
+acl bad_bot hdr_sub(User-Agent) -i Braintree-Webhooks
+acl bad_bot hdr_sub(User-Agent) -i Branch Metrics API
+acl bad_bot hdr_sub(User-Agent) -i Branch-Passthrough
+acl bad_bot hdr_sub(User-Agent) -i Brandprotect
+acl bad_bot hdr_sub(User-Agent) -i Brandwatch
+acl bad_bot hdr_sub(User-Agent) -i Brodie\/
+acl bad_bot hdr_sub(User-Agent) -i Browsershots
+acl bad_bot hdr_sub(User-Agent) -i Buck
 acl bad_bot hdr_sub(User-Agent) -i Buck\/
+acl bad_bot hdr_sub(User-Agent) -i Buddy
+acl bad_bot hdr_sub(User-Agent) -i BuiltBotTough
+acl bad_bot hdr_sub(User-Agent) -i BuiltWith
+acl bad_bot hdr_sub(User-Agent) -i Bullseye
+acl bad_bot hdr_sub(User-Agent) -i BunnySlippers
+acl bad_bot hdr_sub(User-Agent) -i Burf Search
+acl bad_bot hdr_sub(User-Agent) -i Butterfly\/
+acl bad_bot hdr_sub(User-Agent) -i BuzzSumo
 acl bad_bot hdr_sub(User-Agent) -i Bytespider
+acl bad_bot hdr_sub(User-Agent) -i CAAM\/[0-9]
+acl bad_bot hdr_sub(User-Agent) -i CATExplorador
 acl bad_bot hdr_sub(User-Agent) -i CC Metadata Scaper
 acl bad_bot hdr_sub(User-Agent) -i CCBot
-acl bad_bot hdr_sub(User-Agent) -i CISPA Webcrawler
-acl bad_bot hdr_sub(User-Agent) -i Caliperbot
-acl bad_bot hdr_sub(User-Agent) -i CapsuleChecker
+acl bad_bot hdr_sub(User-Agent) -i CERT\.at-Statistics-Survey
+acl bad_bot hdr_sub(User-Agent) -i CISPA Vulnerability Notification
+acl bad_bot hdr_sub(User-Agent) -i CISPA Web Analyser
+acl bad_bot hdr_sub(User-Agent) -i CJNetworkQuality
+acl bad_bot hdr_sub(User-Agent) -i CODE87
+acl bad_bot hdr_sub(User-Agent) -i CSHttp
+acl bad_bot hdr_sub(User-Agent) -i CSSCheck
+acl bad_bot hdr_sub(User-Agent) -i CakePHP
+acl bad_bot hdr_sub(User-Agent) -i Calculon
+acl bad_bot hdr_sub(User-Agent) -i Canary%20Mail
+acl bad_bot hdr_sub(User-Agent) -i CaretNail
+acl bad_bot hdr_sub(User-Agent) -i CazoodleBot
+acl bad_bot hdr_sub(User-Agent) -i Cegbfeieh
+acl bad_bot hdr_sub(User-Agent) -i CensysInspect
+acl bad_bot hdr_sub(User-Agent) -i Cerberian Drtrs
+acl bad_bot hdr_sub(User-Agent) -i ChangesMeter
+acl bad_bot hdr_sub(User-Agent) -i Charlotte
 acl bad_bot hdr_sub(User-Agent) -i ChatGPT-User
-acl bad_bot hdr_sub(User-Agent) -i CheckMarkNetwork\/
-acl bad_bot hdr_sub(User-Agent) -i Chrome-Lighthouse
-acl bad_bot hdr_sub(User-Agent) -i Cincraw
-acl bad_bot hdr_sub(User-Agent) -i Clickagy
-acl bad_bot hdr_sub(User-Agent) -i Cliqzbot\/
+acl bad_bot hdr_sub(User-Agent) -i CheTeam
+acl bad_bot hdr_sub(User-Agent) -i CheckHost
+acl bad_bot hdr_sub(User-Agent) -i CheeseBot
+acl bad_bot hdr_sub(User-Agent) -i CherryPicker
+acl bad_bot hdr_sub(User-Agent) -i ChinaClaw
+acl bad_bot hdr_sub(User-Agent) -i Chirp\/
+acl bad_bot hdr_sub(User-Agent) -i Chlooe
+acl bad_bot hdr_sub(User-Agent) -i Chromaxa
+acl bad_bot hdr_sub(User-Agent) -i CirrusExplorer
+acl bad_bot hdr_sub(User-Agent) -i Citoid
+acl bad_bot hdr_sub(User-Agent) -i Claritybot
+acl bad_bot hdr_sub(User-Agent) -i Clarsentia
+acl bad_bot hdr_sub(User-Agent) -i ClaudeBot
+acl bad_bot hdr_sub(User-Agent) -i Cliqzbot
+acl bad_bot hdr_sub(User-Agent) -i Cloud mapping
+acl bad_bot hdr_sub(User-Agent) -i CloudEndure
 acl bad_bot hdr_sub(User-Agent) -i CloudFlare-AlwaysOnline
-acl bad_bot hdr_sub(User-Agent) -i CloudFlare-Prefetch
+acl bad_bot hdr_sub(User-Agent) -i Cloud\ mapping
 acl bad_bot hdr_sub(User-Agent) -i Cloudflare-Healthchecks
-acl bad_bot hdr_sub(User-Agent) -i Cloudflare-SSLDetector
-acl bad_bot hdr_sub(User-Agent) -i Cloudflare-Traffic-Manager
+acl bad_bot hdr_sub(User-Agent) -i Cloudinary
 acl bad_bot hdr_sub(User-Agent) -i Cocolyzebot
-acl bad_bot hdr_sub(User-Agent) -i Companybook-Crawler
-acl bad_bot hdr_sub(User-Agent) -i ContextAd Bot
-acl bad_bot hdr_sub(User-Agent) -i CookieHubScan
-acl bad_bot hdr_sub(User-Agent) -i Cookiebot
-acl bad_bot hdr_sub(User-Agent) -i CrawlyProjectCrawler
-acl bad_bot hdr_sub(User-Agent) -i CriteoBot
+acl bad_bot hdr_sub(User-Agent) -i Cogentbot
+acl bad_bot hdr_sub(User-Agent) -i ColdFusion
+acl bad_bot hdr_sub(User-Agent) -i Collector
+acl bad_bot hdr_sub(User-Agent) -i CommaFeed
+acl bad_bot hdr_sub(User-Agent) -i Commons-HttpClient
+acl bad_bot hdr_sub(User-Agent) -i Contextual Code Sites Explorer
+acl bad_bot hdr_sub(User-Agent) -i CookieReports
+acl bad_bot hdr_sub(User-Agent) -i Copier
+acl bad_bot hdr_sub(User-Agent) -i CopyRightCheck
+acl bad_bot hdr_sub(User-Agent) -i Copyscape
+acl bad_bot hdr_sub(User-Agent) -i Cosmos
+acl bad_bot hdr_sub(User-Agent) -i Cosmos4j\.feedback
+acl bad_bot hdr_sub(User-Agent) -i Covario-IDS
+acl bad_bot hdr_sub(User-Agent) -i Craftbot
+acl bad_bot hdr_sub(User-Agent) -i Craw\/
+acl bad_bot hdr_sub(User-Agent) -i Crawling\ at\ Home\ Project
+acl bad_bot hdr_sub(User-Agent) -i CrazyWebCrawler
+acl bad_bot hdr_sub(User-Agent) -i Crescent
+acl bad_bot hdr_sub(User-Agent) -i Criteo
+acl bad_bot hdr_sub(User-Agent) -i Crowsnest
 acl bad_bot hdr_sub(User-Agent) -i CrunchBot
-acl bad_bot hdr_sub(User-Agent) -i CrystalSemanticsBot
-acl bad_bot hdr_sub(User-Agent) -i Cutbot
-acl bad_bot hdr_sub(User-Agent) -i CyberPatrol
+acl bad_bot hdr_sub(User-Agent) -i Cula\/
+acl bad_bot hdr_sub(User-Agent) -i Curious
+acl bad_bot hdr_sub(User-Agent) -i Curious George
+acl bad_bot hdr_sub(User-Agent) -i Custo
+acl bad_bot hdr_sub(User-Agent) -i CyotekWebCopy
+acl bad_bot hdr_sub(User-Agent) -i DAP\/NetHTTP
+acl bad_bot hdr_sub(User-Agent) -i DBLBot
+acl bad_bot hdr_sub(User-Agent) -i DIIbot
+acl bad_bot hdr_sub(User-Agent) -i DMBrowser
+acl bad_bot hdr_sub(User-Agent) -i DNSPod-reporting
+acl bad_bot hdr_sub(User-Agent) -i DSearch
+acl bad_bot hdr_sub(User-Agent) -i DTS Agent
+acl bad_bot hdr_sub(User-Agent) -i DTS\ Agent
 acl bad_bot hdr_sub(User-Agent) -i DareBoost
-acl bad_bot hdr_sub(User-Agent) -i DataForSeoBot
+acl bad_bot hdr_sub(User-Agent) -i DataCha0s
+acl bad_bot hdr_sub(User-Agent) -i DataXu
+acl bad_bot hdr_sub(User-Agent) -i DatabaseDriverMysqli
+acl bad_bot hdr_sub(User-Agent) -i DatadogSynthetics
 acl bad_bot hdr_sub(User-Agent) -i Datafeedwatch
 acl bad_bot hdr_sub(User-Agent) -i Datanyze
-acl bad_bot hdr_sub(User-Agent) -i Dataprovider\.com
-acl bad_bot hdr_sub(User-Agent) -i Daum\/
-acl bad_bot hdr_sub(User-Agent) -i DeuSu\/
-acl bad_bot hdr_sub(User-Agent) -i Diffbot\/
-acl bad_bot hdr_sub(User-Agent) -i Digg Deeper
-acl bad_bot hdr_sub(User-Agent) -i Digincore bot
-acl bad_bot hdr_sub(User-Agent) -i Discordbot
-acl bad_bot hdr_sub(User-Agent) -i Disqus
+acl bad_bot hdr_sub(User-Agent) -i DataparkSearch
+acl bad_bot hdr_sub(User-Agent) -i Daum(oa)?[ \/][0-9]
+acl bad_bot hdr_sub(User-Agent) -i Demon
+acl bad_bot hdr_sub(User-Agent) -i DeuSu
+acl bad_bot hdr_sub(User-Agent) -i Deusu
+acl bad_bot hdr_sub(User-Agent) -i Devil
+acl bad_bot hdr_sub(User-Agent) -i Digg
+acl bad_bot hdr_sub(User-Agent) -i Digincore
+acl bad_bot hdr_sub(User-Agent) -i DigitalPebble
+acl bad_bot hdr_sub(User-Agent) -i Dirbuster
+acl bad_bot hdr_sub(User-Agent) -i Disco
+acl bad_bot hdr_sub(User-Agent) -i Discobot
+acl bad_bot hdr_sub(User-Agent) -i Discourse Forum Onebox
+acl bad_bot hdr_sub(User-Agent) -i Discoverybot
+acl bad_bot hdr_sub(User-Agent) -i Dispatch
+acl bad_bot hdr_sub(User-Agent) -i Dispatch\/
+acl bad_bot hdr_sub(User-Agent) -i Disqus\/
+acl bad_bot hdr_sub(User-Agent) -i DittoSpyder
+acl bad_bot hdr_sub(User-Agent) -i DnBCrawler-Analytics
 acl bad_bot hdr_sub(User-Agent) -i DnyzBot
-acl bad_bot hdr_sub(User-Agent) -i Domain Re-Animator Bot
+acl bad_bot hdr_sub(User-Agent) -i Dolphin http client
+acl bad_bot hdr_sub(User-Agent) -i DomCopBot
+acl bad_bot hdr_sub(User-Agent) -i DomainAppender
+acl bad_bot hdr_sub(User-Agent) -i DomainCrawler
+acl bad_bot hdr_sub(User-Agent) -i DomainLabz
+acl bad_bot hdr_sub(User-Agent) -i DomainSigmaCrawler
 acl bad_bot hdr_sub(User-Agent) -i DomainStatsBot
 acl bad_bot hdr_sub(User-Agent) -i Domains Project\/
-acl bad_bot hdr_sub(User-Agent) -i Dragonbot
-acl bad_bot hdr_sub(User-Agent) -i Dubbotbot
-acl bad_bot hdr_sub(User-Agent) -i DuckDuckBot
-acl bad_bot hdr_sub(User-Agent) -i DuckDuckGo-Favicons-Bot
-acl bad_bot hdr_sub(User-Agent) -i EZID
+acl bad_bot hdr_sub(User-Agent) -i Domains\ Project
+acl bad_bot hdr_sub(User-Agent) -i Donuts Content Explorer
+acl bad_bot hdr_sub(User-Agent) -i Dotbot
+acl bad_bot hdr_sub(User-Agent) -i Download Wonder
+acl bad_bot hdr_sub(User-Agent) -i Download\ Wonder
+acl bad_bot hdr_sub(User-Agent) -i DowntimeDetector
+acl bad_bot hdr_sub(User-Agent) -i Dragonfly
+acl bad_bot hdr_sub(User-Agent) -i Drip
+acl bad_bot hdr_sub(User-Agent) -i Drupal \(\+http:\/\/drupal\.org\/\)
+acl bad_bot hdr_sub(User-Agent) -i DuplexWeb-Google
+acl bad_bot hdr_sub(User-Agent) -i DynatraceSynthetic
+acl bad_bot hdr_sub(User-Agent) -i EARTHCOM
+acl bad_bot hdr_sub(User-Agent) -i ECCP
+acl bad_bot hdr_sub(User-Agent) -i ECCP/1.0
+acl bad_bot hdr_sub(User-Agent) -i EMail Exractor
+acl bad_bot hdr_sub(User-Agent) -i EMail Wolf
+acl bad_bot hdr_sub(User-Agent) -i EMail\ Siphon
+acl bad_bot hdr_sub(User-Agent) -i EMail\ Wolf
+acl bad_bot hdr_sub(User-Agent) -i Easy-Thumb
+acl bad_bot hdr_sub(User-Agent) -i EasyDL
+acl bad_bot hdr_sub(User-Agent) -i Ebingbong
+acl bad_bot hdr_sub(User-Agent) -i Ecxi
+acl bad_bot hdr_sub(User-Agent) -i EirGrabber
+acl bad_bot hdr_sub(User-Agent) -i ElectricMonk
+acl bad_bot hdr_sub(User-Agent) -i EmailWolf
+acl bad_bot hdr_sub(User-Agent) -i Embarcadero
+acl bad_bot hdr_sub(User-Agent) -i Embed PHP Library
 acl bad_bot hdr_sub(User-Agent) -i Embedly
-acl bad_bot hdr_sub(User-Agent) -i EveryoneSocialBot
-acl bad_bot hdr_sub(User-Agent) -i Expanse
-acl bad_bot hdr_sub(User-Agent) -i Experibot
+acl bad_bot hdr_sub(User-Agent) -i EroCrawler
+acl bad_bot hdr_sub(User-Agent) -i EventMachine HttpClient
+acl bad_bot hdr_sub(User-Agent) -i Everwall Link Expander
+acl bad_bot hdr_sub(User-Agent) -i Evidon
+acl bad_bot hdr_sub(User-Agent) -i Evil
+acl bad_bot hdr_sub(User-Agent) -i Evrinid
+acl bad_bot hdr_sub(User-Agent) -i Exabot
+acl bad_bot hdr_sub(User-Agent) -i ExactSearch
+acl bad_bot hdr_sub(User-Agent) -i ExaleadCloudview
+acl bad_bot hdr_sub(User-Agent) -i Excel\/
+acl bad_bot hdr_sub(User-Agent) -i ExoRank
+acl bad_bot hdr_sub(User-Agent) -i Exploratodo
+acl bad_bot hdr_sub(User-Agent) -i Express WebPictures
+acl bad_bot hdr_sub(User-Agent) -i Express\ WebPictures
 acl bad_bot hdr_sub(User-Agent) -i ExtLinksBot
-acl bad_bot hdr_sub(User-Agent) -i Eyeotabot
-acl bad_bot hdr_sub(User-Agent) -i FAST Enterprise Crawler
-acl bad_bot hdr_sub(User-Agent) -i FAST-WebCrawler
-acl bad_bot hdr_sub(User-Agent) -i Facebot
-acl bad_bot hdr_sub(User-Agent) -i FeedValidator
+acl bad_bot hdr_sub(User-Agent) -i Extractor
+acl bad_bot hdr_sub(User-Agent) -i ExtractorPro
+acl bad_bot hdr_sub(User-Agent) -i Extreme Picture Finder
+acl bad_bot hdr_sub(User-Agent) -i Extreme\ Picture\ Finder
+acl bad_bot hdr_sub(User-Agent) -i EyeNetIE
+acl bad_bot hdr_sub(User-Agent) -i Ezooms
+acl bad_bot hdr_sub(User-Agent) -i FHscan
+acl bad_bot hdr_sub(User-Agent) -i FacebookBot
+acl bad_bot hdr_sub(User-Agent) -i Faraday v
+acl bad_bot hdr_sub(User-Agent) -i FavOrg
+acl bad_bot hdr_sub(User-Agent) -i Faveeo
+acl bad_bot hdr_sub(User-Agent) -i Favicon downloader
+acl bad_bot hdr_sub(User-Agent) -i Feed Wrangler
+acl bad_bot hdr_sub(User-Agent) -i FeedBooster
+acl bad_bot hdr_sub(User-Agent) -i FeedBucket
+acl bad_bot hdr_sub(User-Agent) -i FeedBunch\/
+acl bad_bot hdr_sub(User-Agent) -i FeedBurner
+acl bad_bot hdr_sub(User-Agent) -i FeedViewer\/
+acl bad_bot hdr_sub(User-Agent) -i FeedZcollector
+acl bad_bot hdr_sub(User-Agent) -i Feedable\/
 acl bad_bot hdr_sub(User-Agent) -i Feedbin
-acl bad_bot hdr_sub(User-Agent) -i Feedfetcher-Google
 acl bad_bot hdr_sub(User-Agent) -i Feedly
+acl bad_bot hdr_sub(User-Agent) -i FeedshowOnline
+acl bad_bot hdr_sub(User-Agent) -i Feedshow\/
 acl bad_bot hdr_sub(User-Agent) -i Feedspot
+acl bad_bot hdr_sub(User-Agent) -i Feedwind\/
 acl bad_bot hdr_sub(User-Agent) -i FemtosearchBot
-acl bad_bot hdr_sub(User-Agent) -i Fetch\/
-acl bad_bot hdr_sub(User-Agent) -i Fever
-acl bad_bot hdr_sub(User-Agent) -i FindITAnswersbot
-acl bad_bot hdr_sub(User-Agent) -i Flamingo_SearchEngine
+acl bad_bot hdr_sub(User-Agent) -i Fetch API
+acl bad_bot hdr_sub(User-Agent) -i Fetch\/[0-9]
+acl bad_bot hdr_sub(User-Agent) -i Fever\/[0-9]
+acl bad_bot hdr_sub(User-Agent) -i Fiery%20Feeds
+acl bad_bot hdr_sub(User-Agent) -i Filestack
+acl bad_bot hdr_sub(User-Agent) -i Fimap
+acl bad_bot hdr_sub(User-Agent) -i Firefox/7.0
+acl bad_bot hdr_sub(User-Agent) -i FlashGet
+acl bad_bot hdr_sub(User-Agent) -i FlipboardBrowserProxy
 acl bad_bot hdr_sub(User-Agent) -i FlipboardProxy
-acl bad_bot hdr_sub(User-Agent) -i FreeWebMonitoring SiteChecker
+acl bad_bot hdr_sub(User-Agent) -i FlipboardRSS
+acl bad_bot hdr_sub(User-Agent) -i Flock\/
+acl bad_bot hdr_sub(User-Agent) -i Florienzh\/
+acl bad_bot hdr_sub(User-Agent) -i Flunky
+acl bad_bot hdr_sub(User-Agent) -i Foobot
+acl bad_bot hdr_sub(User-Agent) -i ForusP
+acl bad_bot hdr_sub(User-Agent) -i FoundSeoTool
+acl bad_bot hdr_sub(User-Agent) -i Freeuploader
 acl bad_bot hdr_sub(User-Agent) -i FreshRSS
-acl bad_bot hdr_sub(User-Agent) -i FreshpingBot
-acl bad_bot hdr_sub(User-Agent) -i Friendica
+acl bad_bot hdr_sub(User-Agent) -i FrontPage
+acl bad_bot hdr_sub(User-Agent) -i Funnelback
+acl bad_bot hdr_sub(User-Agent) -i Fuzz
+acl bad_bot hdr_sub(User-Agent) -i Fuzz Faster U Fool
+acl bad_bot hdr_sub(User-Agent) -i FyberSpider
 acl bad_bot hdr_sub(User-Agent) -i Fyrebot
-acl bad_bot hdr_sub(User-Agent) -i G2 Web Services
+acl bad_bot hdr_sub(User-Agent) -i G-i-g-a-b-o-t
+acl bad_bot hdr_sub(User-Agent) -i GIS-LABS
 acl bad_bot hdr_sub(User-Agent) -i GPTBot
-acl bad_bot hdr_sub(User-Agent) -i GarlikCrawler
-acl bad_bot hdr_sub(User-Agent) -i GeedoBot
+acl bad_bot hdr_sub(User-Agent) -i GRequests
+acl bad_bot hdr_sub(User-Agent) -i GT::WWW
+acl bad_bot hdr_sub(User-Agent) -i GTmetrix
+acl bad_bot hdr_sub(User-Agent) -i GalaxyBot
+acl bad_bot hdr_sub(User-Agent) -i GeedoProductSearch
 acl bad_bot hdr_sub(User-Agent) -i Genieo
-acl bad_bot hdr_sub(User-Agent) -i Gigablast
+acl bad_bot hdr_sub(User-Agent) -i GentleSource
+acl bad_bot hdr_sub(User-Agent) -i GermCrawler
+acl bad_bot hdr_sub(User-Agent) -i GetCode
+acl bad_bot hdr_sub(User-Agent) -i GetLinkInfo
+acl bad_bot hdr_sub(User-Agent) -i GetRight
+acl bad_bot hdr_sub(User-Agent) -i GetURLInfo\/
+acl bad_bot hdr_sub(User-Agent) -i GetWeb
+acl bad_bot hdr_sub(User-Agent) -i Getintent
+acl bad_bot hdr_sub(User-Agent) -i Geziyor
+acl bad_bot hdr_sub(User-Agent) -i Ghost Inspector
+acl bad_bot hdr_sub(User-Agent) -i GigablastOpenSource
 acl bad_bot hdr_sub(User-Agent) -i Gigabot
-acl bad_bot hdr_sub(User-Agent) -i GingerCrawler
-acl bad_bot hdr_sub(User-Agent) -i Gluten Free Crawler\/
-acl bad_bot hdr_sub(User-Agent) -i GnowitNewsbot
+acl bad_bot hdr_sub(User-Agent) -i GitHub-Hookshot
+acl bad_bot hdr_sub(User-Agent) -i Go [\d\.]* package http
+acl bad_bot hdr_sub(User-Agent) -i Go http package
+acl bad_bot hdr_sub(User-Agent) -i Go!Zilla
+acl bad_bot hdr_sub(User-Agent) -i Go-Ahead-Got-It
 acl bad_bot hdr_sub(User-Agent) -i Go-http-client
-acl bad_bot hdr_sub(User-Agent) -i Google Favicon
+acl bad_bot hdr_sub(User-Agent) -i GoSpotCheck
+acl bad_bot hdr_sub(User-Agent) -i GoZilla
+acl bad_bot hdr_sub(User-Agent) -i Gofeed
+acl bad_bot hdr_sub(User-Agent) -i Goldfire Server
+acl bad_bot hdr_sub(User-Agent) -i GomezAgent
+acl bad_bot hdr_sub(User-Agent) -i Goodzer\/
+acl bad_bot hdr_sub(User-Agent) -i Google AppsViewer
+acl bad_bot hdr_sub(User-Agent) -i Google Desktop
+acl bad_bot hdr_sub(User-Agent) -i Google Keyword Suggestion
+acl bad_bot hdr_sub(User-Agent) -i Google Keyword Tool
+acl bad_bot hdr_sub(User-Agent) -i Google PP Default
+acl bad_bot hdr_sub(User-Agent) -i Google Page Speed Insights
+acl bad_bot hdr_sub(User-Agent) -i Google Search Console
 acl bad_bot hdr_sub(User-Agent) -i Google Web Preview
-acl bad_bot hdr_sub(User-Agent) -i Google-Adwords-Instant
-acl bad_bot hdr_sub(User-Agent) -i Google-Certificates-Bridge
+acl bad_bot hdr_sub(User-Agent) -i Google favicon
+acl bad_bot hdr_sub(User-Agent) -i Google-Ads
+acl bad_bot hdr_sub(User-Agent) -i Google-Adwords
+acl bad_bot hdr_sub(User-Agent) -i Google-Apps-Script
+acl bad_bot hdr_sub(User-Agent) -i Google-Calendar-Importer
+acl bad_bot hdr_sub(User-Agent) -i Google-HTTP-Java-Client
+acl bad_bot hdr_sub(User-Agent) -i Google-HotelAdsVerifier
 acl bad_bot hdr_sub(User-Agent) -i Google-InspectionTool
-acl bad_bot hdr_sub(User-Agent) -i Google-PhysicalWeb
+acl bad_bot hdr_sub(User-Agent) -i Google-Podcast
+acl bad_bot hdr_sub(User-Agent) -i Google-Publisher-Plugin
 acl bad_bot hdr_sub(User-Agent) -i Google-Read-Aloud
-acl bad_bot hdr_sub(User-Agent) -i Google-Safety
+acl bad_bot hdr_sub(User-Agent) -i Google-SMTP-STS
+acl bad_bot hdr_sub(User-Agent) -i Google-SearchByImage
 acl bad_bot hdr_sub(User-Agent) -i Google-Site-Verification
 acl bad_bot hdr_sub(User-Agent) -i Google-Structured-Data-Testing-Tool
+acl bad_bot hdr_sub(User-Agent) -i Google-Transparency-Report
+acl bad_bot hdr_sub(User-Agent) -i Google-Youtube-Links
+acl bad_bot hdr_sub(User-Agent) -i Google-speakr
+acl bad_bot hdr_sub(User-Agent) -i GoogleDocs
+acl bad_bot hdr_sub(User-Agent) -i GoogleHC\/
 acl bad_bot hdr_sub(User-Agent) -i GoogleOther
-acl bad_bot hdr_sub(User-Agent) -i Googlebot-Image
-acl bad_bot hdr_sub(User-Agent) -i Googlebot-Mobile
-acl bad_bot hdr_sub(User-Agent) -i Googlebot-News
-acl bad_bot hdr_sub(User-Agent) -i Googlebot-Video
-acl bad_bot hdr_sub(User-Agent) -i Googlebot\/
-acl bad_bot hdr_sub(User-Agent) -i Gowikibot
+acl bad_bot hdr_sub(User-Agent) -i GoogleProber
+acl bad_bot hdr_sub(User-Agent) -i GoogleProducer
+acl bad_bot hdr_sub(User-Agent) -i GoogleSites
+acl bad_bot hdr_sub(User-Agent) -i Gookey
+acl bad_bot hdr_sub(User-Agent) -i Gotit
+acl bad_bot hdr_sub(User-Agent) -i GrabNet
+acl bad_bot hdr_sub(User-Agent) -i Grabber
+acl bad_bot hdr_sub(User-Agent) -i Grafula
+acl bad_bot hdr_sub(User-Agent) -i Grammarly
+acl bad_bot hdr_sub(User-Agent) -i GrapeFX
 acl bad_bot hdr_sub(User-Agent) -i GrapeshotCrawler
-acl bad_bot hdr_sub(User-Agent) -i Grobbot
-acl bad_bot hdr_sub(User-Agent) -i GroupHigh\/
-acl bad_bot hdr_sub(User-Agent) -i GroupMeBot
-acl bad_bot hdr_sub(User-Agent) -i Gwene
+acl bad_bot hdr_sub(User-Agent) -i GreatNews
+acl bad_bot hdr_sub(User-Agent) -i Gregarius
+acl bad_bot hdr_sub(User-Agent) -i GridBot
+acl bad_bot hdr_sub(User-Agent) -i GuzzleHttp
+acl bad_bot hdr_sub(User-Agent) -i HAA(A)?RTLAND http client
+acl bad_bot hdr_sub(User-Agent) -i HEADMasterSEO
+acl bad_bot hdr_sub(User-Agent) -i HMView
+acl bad_bot hdr_sub(User-Agent) -i HTMLparser
+acl bad_bot hdr_sub(User-Agent) -i HTTP Banner Detection
+acl bad_bot hdr_sub(User-Agent) -i HTTP-Header-Abfrage
+acl bad_bot hdr_sub(User-Agent) -i HTTP-Tiny
+acl bad_bot hdr_sub(User-Agent) -i HTTP::Lite
+acl bad_bot hdr_sub(User-Agent) -i HTTPMon
+acl bad_bot hdr_sub(User-Agent) -i HTTP_Compression_Test
+acl bad_bot hdr_sub(User-Agent) -i HTTPie
 acl bad_bot hdr_sub(User-Agent) -i HTTrack
+acl bad_bot hdr_sub(User-Agent) -i Haansoft
+acl bad_bot hdr_sub(User-Agent) -i Hadi Agent
+acl bad_bot hdr_sub(User-Agent) -i HaosouSpider
+acl bad_bot hdr_sub(User-Agent) -i HappyApps-WebCheck
+acl bad_bot hdr_sub(User-Agent) -i Hardenize
+acl bad_bot hdr_sub(User-Agent) -i Harvest
 acl bad_bot hdr_sub(User-Agent) -i Hatena
+acl bad_bot hdr_sub(User-Agent) -i Havij
+acl bad_bot hdr_sub(User-Agent) -i HaxerMen
 acl bad_bot hdr_sub(User-Agent) -i HeadlessChrome
+acl bad_bot hdr_sub(User-Agent) -i HeartRails_Capture
+acl bad_bot hdr_sub(User-Agent) -i Heritrix
+acl bad_bot hdr_sub(User-Agent) -i Hexometer
+acl bad_bot hdr_sub(User-Agent) -i Hloader
+acl bad_bot hdr_sub(User-Agent) -i Holmes
+acl bad_bot hdr_sub(User-Agent) -i HonesoSearchEngine
+acl bad_bot hdr_sub(User-Agent) -i HonoluluBot
+acl bad_bot hdr_sub(User-Agent) -i HootSuite Image proxy
+acl bad_bot hdr_sub(User-Agent) -i Hootsuite-WebFeed
+acl bad_bot hdr_sub(User-Agent) -i HostTracker
+acl bad_bot hdr_sub(User-Agent) -i HttpComponents
 acl bad_bot hdr_sub(User-Agent) -i HttpUrlConnection
-acl bad_bot hdr_sub(User-Agent) -i HubSpot
-acl bad_bot hdr_sub(User-Agent) -i IAS crawler
-acl bad_bot hdr_sub(User-Agent) -i ICBot\/
-acl bad_bot hdr_sub(User-Agent) -i ICC-Crawler
-acl bad_bot hdr_sub(User-Agent) -i INETDEX-BOT
+acl bad_bot hdr_sub(User-Agent) -i HubSpot 
+acl bad_bot hdr_sub(User-Agent) -i HubSpot-Link-Resolver
+acl bad_bot hdr_sub(User-Agent) -i Humanlinks
+acl bad_bot hdr_sub(User-Agent) -i HybridBot
+acl bad_bot hdr_sub(User-Agent) -i IDBTE4M
+acl bad_bot hdr_sub(User-Agent) -i IDBot
+acl bad_bot hdr_sub(User-Agent) -i IDG Twitter Links Resolver
+acl bad_bot hdr_sub(User-Agent) -i IDwhois\/
+acl bad_bot hdr_sub(User-Agent) -i IODC
+acl bad_bot hdr_sub(User-Agent) -i IPS\/[0-9]
+acl bad_bot hdr_sub(User-Agent) -i IPWorks HTTP\/S Component
+acl bad_bot hdr_sub(User-Agent) -i IRLbot
+acl bad_bot hdr_sub(User-Agent) -i IZaBEE
+acl bad_bot hdr_sub(User-Agent) -i Iblog
+acl bad_bot hdr_sub(User-Agent) -i Id-search
+acl bad_bot hdr_sub(User-Agent) -i IdeelaborPlagiaat
 acl bad_bot hdr_sub(User-Agent) -i Iframely
+acl bad_bot hdr_sub(User-Agent) -i IlTrovatore
+acl bad_bot hdr_sub(User-Agent) -i IlseBot
+acl bad_bot hdr_sub(User-Agent) -i Image Fetch
+acl bad_bot hdr_sub(User-Agent) -i Image Sucker
+acl bad_bot hdr_sub(User-Agent) -i ImageEngine\/
+acl bad_bot hdr_sub(User-Agent) -i ImageVisu\/
+acl bad_bot hdr_sub(User-Agent) -i Image\ Fetch
+acl bad_bot hdr_sub(User-Agent) -i Image\ Sucker
 acl bad_bot hdr_sub(User-Agent) -i ImagesiftBot
+acl bad_bot hdr_sub(User-Agent) -i Imagga
+acl bad_bot hdr_sub(User-Agent) -i InAGist
+acl bad_bot hdr_sub(User-Agent) -i InDesign%20CC
+acl bad_bot hdr_sub(User-Agent) -i Inboxb0t
 acl bad_bot hdr_sub(User-Agent) -i IndeedBot
-acl bad_bot hdr_sub(User-Agent) -i InterfaxScanBot
+acl bad_bot hdr_sub(User-Agent) -i Indy Library
+acl bad_bot hdr_sub(User-Agent) -i Indy\ Library
+acl bad_bot hdr_sub(User-Agent) -i InetURL
+acl bad_bot hdr_sub(User-Agent) -i InfoNaviRobot
+acl bad_bot hdr_sub(User-Agent) -i InfoTekies
+acl bad_bot hdr_sub(User-Agent) -i InfoWizards Reciprocal Link
+acl bad_bot hdr_sub(User-Agent) -i Information\ Security\ Team\ InfraSec\ Scanner
+acl bad_bot hdr_sub(User-Agent) -i InfraSec\ Scanner
+acl bad_bot hdr_sub(User-Agent) -i Instapaper
+acl bad_bot hdr_sub(User-Agent) -i Integrity
+acl bad_bot hdr_sub(User-Agent) -i Intelliseek
+acl bad_bot hdr_sub(User-Agent) -i InterGET
+acl bad_bot hdr_sub(User-Agent) -i Internet Ninja
 acl bad_bot hdr_sub(User-Agent) -i InternetMeasurement
-acl bad_bot hdr_sub(User-Agent) -i IonCrawl
+acl bad_bot hdr_sub(User-Agent) -i InternetSeer
+acl bad_bot hdr_sub(User-Agent) -i Internet\ Ninja
+acl bad_bot hdr_sub(User-Agent) -i Iria
+acl bad_bot hdr_sub(User-Agent) -i Irokez
+acl bad_bot hdr_sub(User-Agent) -i Iskanie
 acl bad_bot hdr_sub(User-Agent) -i IstellaBot
-acl bad_bot hdr_sub(User-Agent) -i James BOT
-acl bad_bot hdr_sub(User-Agent) -i Jamie's Spider
-acl bad_bot hdr_sub(User-Agent) -i Jetslide
+acl bad_bot hdr_sub(User-Agent) -i JAHHO
+acl bad_bot hdr_sub(User-Agent) -i JOC\ Web\ Spider
+acl bad_bot hdr_sub(User-Agent) -i JS-Kit
+acl bad_bot hdr_sub(User-Agent) -i JamesBOT
+acl bad_bot hdr_sub(User-Agent) -i Jaunt\/
+acl bad_bot hdr_sub(User-Agent) -i Java.*outbrain
+acl bad_bot hdr_sub(User-Agent) -i Jbrofuzz
+acl bad_bot hdr_sub(User-Agent) -i JennyBot
+acl bad_bot hdr_sub(User-Agent) -i Jersey\/
+acl bad_bot hdr_sub(User-Agent) -i JetCar
 acl bad_bot hdr_sub(User-Agent) -i Jetty
-acl bad_bot hdr_sub(User-Agent) -i JobboerseBot
-acl bad_bot hdr_sub(User-Agent) -i Jooblebot
-acl bad_bot hdr_sub(User-Agent) -i Jugendschutzprogramm-Crawler
-acl bad_bot hdr_sub(User-Agent) -i K7MLWCBot
-acl bad_bot hdr_sub(User-Agent) -i KStandBot
-acl bad_bot hdr_sub(User-Agent) -i Kemvibot
-acl bad_bot hdr_sub(User-Agent) -i KeybaseBot
-acl bad_bot hdr_sub(User-Agent) -i KomodiaBot
-acl bad_bot hdr_sub(User-Agent) -i KosmioBot
-acl bad_bot hdr_sub(User-Agent) -i Landau-Media-Spider
-acl bad_bot hdr_sub(User-Agent) -i Laserlikebot
-acl bad_bot hdr_sub(User-Agent) -i Leikibot
-acl bad_bot hdr_sub(User-Agent) -i LightspeedSystemsCrawler
-acl bad_bot hdr_sub(User-Agent) -i Linespider
-acl bad_bot hdr_sub(User-Agent) -i Linguee Bot
-acl bad_bot hdr_sub(User-Agent) -i LinkArchiver
-acl bad_bot hdr_sub(User-Agent) -i LinkedInBot
-acl bad_bot hdr_sub(User-Agent) -i LinkisBot
-acl bad_bot hdr_sub(User-Agent) -i Livelap[bB]ot
-acl bad_bot hdr_sub(User-Agent) -i Luminator-robots
-acl bad_bot hdr_sub(User-Agent) -i MBCrawler
+acl bad_bot hdr_sub(User-Agent) -i Jigsaw
+acl bad_bot hdr_sub(User-Agent) -i JikeSpider
+acl bad_bot hdr_sub(User-Agent) -i JobFeed discovery
+acl bad_bot hdr_sub(User-Agent) -i Jobboerse
+acl bad_bot hdr_sub(User-Agent) -i Jobg8 URL Monitor
+acl bad_bot hdr_sub(User-Agent) -i Jobrapido
+acl bad_bot hdr_sub(User-Agent) -i Jobsearch1\.5
+acl bad_bot hdr_sub(User-Agent) -i JoinVision Generic
+acl bad_bot hdr_sub(User-Agent) -i JolokiaPwn
+acl bad_bot hdr_sub(User-Agent) -i Joomla
+acl bad_bot hdr_sub(User-Agent) -i Jorgee
+acl bad_bot hdr_sub(User-Agent) -i JungleKeyThumbnail
+acl bad_bot hdr_sub(User-Agent) -i JustView
+acl bad_bot hdr_sub(User-Agent) -i Jyxobot
+acl bad_bot hdr_sub(User-Agent) -i KOCMOHABT
+acl bad_bot hdr_sub(User-Agent) -i Kaspersky Lab CFR link resolver
+acl bad_bot hdr_sub(User-Agent) -i Kelny\/
+acl bad_bot hdr_sub(User-Agent) -i Kenjin\ Spider
+acl bad_bot hdr_sub(User-Agent) -i Kerrigan\/
+acl bad_bot hdr_sub(User-Agent) -i KeyCDN
+acl bad_bot hdr_sub(User-Agent) -i Keybot\ Translation-Search-Machine
+acl bad_bot hdr_sub(User-Agent) -i Keyword Density
+acl bad_bot hdr_sub(User-Agent) -i Keyword\ Density
+acl bad_bot hdr_sub(User-Agent) -i Keywords Research
+acl bad_bot hdr_sub(User-Agent) -i KickFire
+acl bad_bot hdr_sub(User-Agent) -i KimonoLabs\/
+acl bad_bot hdr_sub(User-Agent) -i Kinza
+acl bad_bot hdr_sub(User-Agent) -i Kml-Google
+acl bad_bot hdr_sub(User-Agent) -i Kozmosbot
+acl bad_bot hdr_sub(User-Agent) -i KumKie
+acl bad_bot hdr_sub(User-Agent) -i LNSpiderguy
+acl bad_bot hdr_sub(User-Agent) -i LWP::Simple
+acl bad_bot hdr_sub(User-Agent) -i LYT\.SR
+acl bad_bot hdr_sub(User-Agent) -i L\.webis
+acl bad_bot hdr_sub(User-Agent) -i Lanshanbot
+acl bad_bot hdr_sub(User-Agent) -i Larbin
+acl bad_bot hdr_sub(User-Agent) -i Lavf\/
+acl bad_bot hdr_sub(User-Agent) -i Leap
+acl bad_bot hdr_sub(User-Agent) -i LeechFTP
+acl bad_bot hdr_sub(User-Agent) -i LeechGet
+acl bad_bot hdr_sub(User-Agent) -i LexiBot
+acl bad_bot hdr_sub(User-Agent) -i Lftp
+acl bad_bot hdr_sub(User-Agent) -i LibVLC
+acl bad_bot hdr_sub(User-Agent) -i LibWeb
+acl bad_bot hdr_sub(User-Agent) -i Libwhisker
+acl bad_bot hdr_sub(User-Agent) -i Licorne
+acl bad_bot hdr_sub(User-Agent) -i LieBaoFast
+acl bad_bot hdr_sub(User-Agent) -i Liferea\/
+acl bad_bot hdr_sub(User-Agent) -i Lighthouse
+acl bad_bot hdr_sub(User-Agent) -i Lightspeedsystems
+acl bad_bot hdr_sub(User-Agent) -i Likse
+acl bad_bot hdr_sub(User-Agent) -i Link Valet
+acl bad_bot hdr_sub(User-Agent) -i LinkAlarm\/
+acl bad_bot hdr_sub(User-Agent) -i LinkAnalyser
+acl bad_bot hdr_sub(User-Agent) -i LinkExaminer
+acl bad_bot hdr_sub(User-Agent) -i LinkPreview
+acl bad_bot hdr_sub(User-Agent) -i LinkScan
+acl bad_bot hdr_sub(User-Agent) -i LinkTiger
+acl bad_bot hdr_sub(User-Agent) -i LinkWalker
+acl bad_bot hdr_sub(User-Agent) -i Linkbot
+acl bad_bot hdr_sub(User-Agent) -i LinkextractorPro
+acl bad_bot hdr_sub(User-Agent) -i LinkpadBot
+acl bad_bot hdr_sub(User-Agent) -i LinksManager
+acl bad_bot hdr_sub(User-Agent) -i LinqiaMetadataDownloaderBot
+acl bad_bot hdr_sub(User-Agent) -i LinqiaRSSBot
+acl bad_bot hdr_sub(User-Agent) -i LinqiaScrapeBot
+acl bad_bot hdr_sub(User-Agent) -i Lipperhey
+acl bad_bot hdr_sub(User-Agent) -i Lipperhey\ Spider
+acl bad_bot hdr_sub(User-Agent) -i Litemage_walker
+acl bad_bot hdr_sub(User-Agent) -i Lmspider
+acl bad_bot hdr_sub(User-Agent) -i LoadImpactRload
+acl bad_bot hdr_sub(User-Agent) -i LongURL API
+acl bad_bot hdr_sub(User-Agent) -i Ltx71
+acl bad_bot hdr_sub(User-Agent) -i Lucee \(CFML Engine\)
+acl bad_bot hdr_sub(User-Agent) -i Lush Http Client
+acl bad_bot hdr_sub(User-Agent) -i MFC_Tear_Sample
+acl bad_bot hdr_sub(User-Agent) -i MIDown tool
+acl bad_bot hdr_sub(User-Agent) -i MIDown\ tool
+acl bad_bot hdr_sub(User-Agent) -i MIIxpc
 acl bad_bot hdr_sub(User-Agent) -i MJ12bot
+acl bad_bot hdr_sub(User-Agent) -i MQQBrowser
+acl bad_bot hdr_sub(User-Agent) -i MS Web Services Client Protocol
+acl bad_bot hdr_sub(User-Agent) -i MSFrontPage
+acl bad_bot hdr_sub(User-Agent) -i MSIECrawler
 acl bad_bot hdr_sub(User-Agent) -i MTRobot
-acl bad_bot hdr_sub(User-Agent) -i MaCoCu
-acl bad_bot hdr_sub(User-Agent) -i Mail\.RU_Bot
-acl bad_bot hdr_sub(User-Agent) -i Mastodon
+acl bad_bot hdr_sub(User-Agent) -i MVAClient
+acl bad_bot hdr_sub(User-Agent) -i MacOutlook\/
+acl bad_bot hdr_sub(User-Agent) -i Mag-Net
+acl bad_bot hdr_sub(User-Agent) -i Magnet
+acl bad_bot hdr_sub(User-Agent) -i MagpieRSS
+acl bad_bot hdr_sub(User-Agent) -i Mail.RU_Bot
+acl bad_bot hdr_sub(User-Agent) -i Mail::STS
+acl bad_bot hdr_sub(User-Agent) -i MailChimp
+acl bad_bot hdr_sub(User-Agent) -i Mail\.Ru
+acl bad_bot hdr_sub(User-Agent) -i Majestic-SEO
+acl bad_bot hdr_sub(User-Agent) -i Majestic12
+acl bad_bot hdr_sub(User-Agent) -i Majestic\ SEO
+acl bad_bot hdr_sub(User-Agent) -i Mandrill
+acl bad_bot hdr_sub(User-Agent) -i MapperCmd
+acl bad_bot hdr_sub(User-Agent) -i MarkMonitor
+acl bad_bot hdr_sub(User-Agent) -i MarkWatch
+acl bad_bot hdr_sub(User-Agent) -i Mass Downloader
+acl bad_bot hdr_sub(User-Agent) -i Mass\ Downloader
+acl bad_bot hdr_sub(User-Agent) -i Masscan
+acl bad_bot hdr_sub(User-Agent) -i Mata Hari
+acl bad_bot hdr_sub(User-Agent) -i Mata\ Hari
 acl bad_bot hdr_sub(User-Agent) -i MauiBot
-acl bad_bot hdr_sub(User-Agent) -i Mediapartners \(Googlebot\)
+acl bad_bot hdr_sub(User-Agent) -i Mb2345Browser
+acl bad_bot hdr_sub(User-Agent) -i MeanPath\ Bot
+acl bad_bot hdr_sub(User-Agent) -i Meanpathbot
+acl bad_bot hdr_sub(User-Agent) -i Mediametric
 acl bad_bot hdr_sub(User-Agent) -i Mediapartners-Google
 acl bad_bot hdr_sub(User-Agent) -i Mediatoolkitbot
-acl bad_bot hdr_sub(User-Agent) -i MegaIndex
+acl bad_bot hdr_sub(User-Agent) -i MegaIndex\.ru
 acl bad_bot hdr_sub(User-Agent) -i MeltwaterNews
-acl bad_bot hdr_sub(User-Agent) -i MetaInspector
-acl bad_bot hdr_sub(User-Agent) -i MetaJobBot
+acl bad_bot hdr_sub(User-Agent) -i Melvil Rawi
+acl bad_bot hdr_sub(User-Agent) -i MemGator
 acl bad_bot hdr_sub(User-Agent) -i MetaURI
-acl bad_bot hdr_sub(User-Agent) -i Miniflux\/
-acl bad_bot hdr_sub(User-Agent) -i MixnodeCache\/
-acl bad_bot hdr_sub(User-Agent) -i MojeekBot\/
-acl bad_bot hdr_sub(User-Agent) -i Monsidobot
-acl bad_bot hdr_sub(User-Agent) -i MoodleBot
+acl bad_bot hdr_sub(User-Agent) -i Metaspinner
+acl bad_bot hdr_sub(User-Agent) -i Metauri
+acl bad_bot hdr_sub(User-Agent) -i MicroMessenger
+acl bad_bot hdr_sub(User-Agent) -i Microsearch
+acl bad_bot hdr_sub(User-Agent) -i Microsoft Data Access
+acl bad_bot hdr_sub(User-Agent) -i Microsoft Office
+acl bad_bot hdr_sub(User-Agent) -i Microsoft Outlook
+acl bad_bot hdr_sub(User-Agent) -i Microsoft Windows Network Diagnostics
+acl bad_bot hdr_sub(User-Agent) -i Microsoft-WebDAV-MiniRedir
+acl bad_bot hdr_sub(User-Agent) -i MicrosoftPreview
+acl bad_bot hdr_sub(User-Agent) -i Microsoft\ Data\ Access
+acl bad_bot hdr_sub(User-Agent) -i Microsoft\ URL\ Control
+acl bad_bot hdr_sub(User-Agent) -i Microsoft\.Data\.Mashup
+acl bad_bot hdr_sub(User-Agent) -i Mindjet
+acl bad_bot hdr_sub(User-Agent) -i Minefield
+acl bad_bot hdr_sub(User-Agent) -i Miniature\.io
+acl bad_bot hdr_sub(User-Agent) -i Miniflux
+acl bad_bot hdr_sub(User-Agent) -i Miro-HttpClient
+acl bad_bot hdr_sub(User-Agent) -i Mister PiX
+acl bad_bot hdr_sub(User-Agent) -i Mister\ PiX
+acl bad_bot hdr_sub(User-Agent) -i Mnogosearch
+acl bad_bot hdr_sub(User-Agent) -i Moblie\ Safari
+acl bad_bot hdr_sub(User-Agent) -i Mojeek
+acl bad_bot hdr_sub(User-Agent) -i Mojolicious
+acl bad_bot hdr_sub(User-Agent) -i Mojolicious \(Perl\)
+acl bad_bot hdr_sub(User-Agent) -i Mollie
+acl bad_bot hdr_sub(User-Agent) -i MolokaiBot
+acl bad_bot hdr_sub(User-Agent) -i MonTools
+acl bad_bot hdr_sub(User-Agent) -i Monit\/
+acl bad_bot hdr_sub(User-Agent) -i Monitority\/
 acl bad_bot hdr_sub(User-Agent) -i Moreover
-acl bad_bot hdr_sub(User-Agent) -i MuckRack
-acl bad_bot hdr_sub(User-Agent) -i Multiviewbot
-acl bad_bot hdr_sub(User-Agent) -i NAVER Blog Rssbot
-acl bad_bot hdr_sub(User-Agent) -i NING\/
-acl bad_bot hdr_sub(User-Agent) -i NINJA bot
-acl bad_bot hdr_sub(User-Agent) -i NIXStatsbot
-acl bad_bot hdr_sub(User-Agent) -i NTENTbot
-acl bad_bot hdr_sub(User-Agent) -i Neevabot
-acl bad_bot hdr_sub(User-Agent) -i NerdByNature\.Bot
+acl bad_bot hdr_sub(User-Agent) -i Morfeus Fucking Scanner
+acl bad_bot hdr_sub(User-Agent) -i Morfeus\ Fucking\ Scanner
+acl bad_bot hdr_sub(User-Agent) -i Morning Paper
+acl bad_bot hdr_sub(User-Agent) -i MovableType
+acl bad_bot hdr_sub(User-Agent) -i Mozlila
+acl bad_bot hdr_sub(User-Agent) -i Mr.4x3
+acl bad_bot hdr_sub(User-Agent) -i Mr\.4x3 Powered
+acl bad_bot hdr_sub(User-Agent) -i Mrcgiguy
+acl bad_bot hdr_sub(User-Agent) -i Msrabot
+acl bad_bot hdr_sub(User-Agent) -i MuckRack\/
+acl bad_bot hdr_sub(User-Agent) -i Musobot
+acl bad_bot hdr_sub(User-Agent) -i MxToolbox\/
+acl bad_bot hdr_sub(User-Agent) -i NETCRAFT
+acl bad_bot hdr_sub(User-Agent) -i NG-Search
+acl bad_bot hdr_sub(User-Agent) -i NICErsPRO
+acl bad_bot hdr_sub(User-Agent) -i NLNZ_IAHarvester
+acl bad_bot hdr_sub(User-Agent) -i NPbot
+acl bad_bot hdr_sub(User-Agent) -i Najdi\.si
+acl bad_bot hdr_sub(User-Agent) -i Name Intelligence
+acl bad_bot hdr_sub(User-Agent) -i NameFo\.com
+acl bad_bot hdr_sub(User-Agent) -i Name\ Intelligence
+acl bad_bot hdr_sub(User-Agent) -i Nameprotect
+acl bad_bot hdr_sub(User-Agent) -i Navroad
+acl bad_bot hdr_sub(User-Agent) -i NearSite
+acl bad_bot hdr_sub(User-Agent) -i Needle
+acl bad_bot hdr_sub(User-Agent) -i Nessus
+acl bad_bot hdr_sub(User-Agent) -i Net Vampire
+acl bad_bot hdr_sub(User-Agent) -i NetAnts
+acl bad_bot hdr_sub(User-Agent) -i NetLyzer
+acl bad_bot hdr_sub(User-Agent) -i NetMechanic
+acl bad_bot hdr_sub(User-Agent) -i NetNewsWire
+acl bad_bot hdr_sub(User-Agent) -i NetShelter ContentScan
+acl bad_bot hdr_sub(User-Agent) -i NetSpider
 acl bad_bot hdr_sub(User-Agent) -i NetSystemsResearch
-acl bad_bot hdr_sub(User-Agent) -i NetcraftSurveyAgent
-acl bad_bot hdr_sub(User-Agent) -i Neticle Crawler
+acl bad_bot hdr_sub(User-Agent) -i NetTrack
+acl bad_bot hdr_sub(User-Agent) -i NetZIP
+acl bad_bot hdr_sub(User-Agent) -i Net\ Vampire
+acl bad_bot hdr_sub(User-Agent) -i Netcraft
+acl bad_bot hdr_sub(User-Agent) -i Netpursual
+acl bad_bot hdr_sub(User-Agent) -i Netsparker
+acl bad_bot hdr_sub(User-Agent) -i Nettrack
 acl bad_bot hdr_sub(User-Agent) -i Netvibes
-acl bad_bot hdr_sub(User-Agent) -i NewsBlur
-acl bad_bot hdr_sub(User-Agent) -i NextCloud
-acl bad_bot hdr_sub(User-Agent) -i Nicecrawler
-acl bad_bot hdr_sub(User-Agent) -i Nimbostratus-Bot
+acl bad_bot hdr_sub(User-Agent) -i Neustar WPM
+acl bad_bot hdr_sub(User-Agent) -i NeutrinoAPI
+acl bad_bot hdr_sub(User-Agent) -i NewRelicPinger
+acl bad_bot hdr_sub(User-Agent) -i NewsBlur .*Finder
+acl bad_bot hdr_sub(User-Agent) -i NewsGator
+acl bad_bot hdr_sub(User-Agent) -i Nexgate Ruby Client
+acl bad_bot hdr_sub(User-Agent) -i NextGenSearchBot
+acl bad_bot hdr_sub(User-Agent) -i Nibbler
+acl bad_bot hdr_sub(User-Agent) -i NihilScio
+acl bad_bot hdr_sub(User-Agent) -i Niki-bot
+acl bad_bot hdr_sub(User-Agent) -i Nikto
+acl bad_bot hdr_sub(User-Agent) -i NimbleCrawler
+acl bad_bot hdr_sub(User-Agent) -i Nimbostratus
+acl bad_bot hdr_sub(User-Agent) -i Ninja
+acl bad_bot hdr_sub(User-Agent) -i Nmap
 acl bad_bot hdr_sub(User-Agent) -i Nmap Scripting Engine
+acl bad_bot hdr_sub(User-Agent) -i NodePing
+acl bad_bot hdr_sub(User-Agent) -i Nodemeter
+acl bad_bot hdr_sub(User-Agent) -i Norton-Safeweb
+acl bad_bot hdr_sub(User-Agent) -i Notifixious
+acl bad_bot hdr_sub(User-Agent) -i NotionEmbedder
+acl bad_bot hdr_sub(User-Agent) -i Nuclei
 acl bad_bot hdr_sub(User-Agent) -i Nutch
 acl bad_bot hdr_sub(User-Agent) -i Nuzzel
-acl bad_bot hdr_sub(User-Agent) -i OAI-SearchBot
-acl bad_bot hdr_sub(User-Agent) -i Ocarinabot
-acl bad_bot hdr_sub(User-Agent) -i OdklBot\/
-acl bad_bot hdr_sub(User-Agent) -i OpenGraphCheck
-acl bad_bot hdr_sub(User-Agent) -i OpenHoseBot
-acl bad_bot hdr_sub(User-Agent) -i OrangeBot\/
+acl bad_bot hdr_sub(User-Agent) -i Nymesis
+acl bad_bot hdr_sub(User-Agent) -i OMSC
+acl bad_bot hdr_sub(User-Agent) -i OPPO A33
+acl bad_bot hdr_sub(User-Agent) -i Observatory\/
+acl bad_bot hdr_sub(User-Agent) -i Ocelli\/
+acl bad_bot hdr_sub(User-Agent) -i Octopus
+acl bad_bot hdr_sub(User-Agent) -i Offline Explorer
+acl bad_bot hdr_sub(User-Agent) -i Offline Navigator
+acl bad_bot hdr_sub(User-Agent) -i Offline\ Explorer
+acl bad_bot hdr_sub(User-Agent) -i Offline\ Navigator
+acl bad_bot hdr_sub(User-Agent) -i OgScrper
+acl bad_bot hdr_sub(User-Agent) -i OnCrawl
+acl bad_bot hdr_sub(User-Agent) -i Online Domain Tools
+acl bad_bot hdr_sub(User-Agent) -i Open Source RSS
+acl bad_bot hdr_sub(User-Agent) -i OpenCalaisSemanticProxy
+acl bad_bot hdr_sub(User-Agent) -i OpenLinkProfiler
+acl bad_bot hdr_sub(User-Agent) -i OpenVAS
+acl bad_bot hdr_sub(User-Agent) -i Openfind
+acl bad_bot hdr_sub(User-Agent) -i Openstat\/
+acl bad_bot hdr_sub(User-Agent) -i Openvas
+acl bad_bot hdr_sub(User-Agent) -i Optimizer
+acl bad_bot hdr_sub(User-Agent) -i OrangeBot
+acl bad_bot hdr_sub(User-Agent) -i OrangeSpider
+acl bad_bot hdr_sub(User-Agent) -i Orbiter
+acl bad_bot hdr_sub(User-Agent) -i OrgProbe\/
 acl bad_bot hdr_sub(User-Agent) -i OutclicksBot
-acl bad_bot hdr_sub(User-Agent) -i PR-CY\.RU
-acl bad_bot hdr_sub(User-Agent) -i PagePeeker\/
+acl bad_bot hdr_sub(User-Agent) -i OutfoxBot
+acl bad_bot hdr_sub(User-Agent) -i Outlook-Express
+acl bad_bot hdr_sub(User-Agent) -i Outlook-iOS
+acl bad_bot hdr_sub(User-Agent) -i Owler
+acl bad_bot hdr_sub(User-Agent) -i Owlin
+acl bad_bot hdr_sub(User-Agent) -i OxfordCloudService
+acl bad_bot hdr_sub(User-Agent) -i PDF24 URL To PDF
+acl bad_bot hdr_sub(User-Agent) -i PECL::HTTP
+acl bad_bot hdr_sub(User-Agent) -i PHPCrawl
+acl bad_bot hdr_sub(User-Agent) -i POE-Component-Client-HTTP
+acl bad_bot hdr_sub(User-Agent) -i PRTG Network Monitor
+acl bad_bot hdr_sub(User-Agent) -i PTST 
+acl bad_bot hdr_sub(User-Agent) -i PTST\/[0-9]+
+acl bad_bot hdr_sub(User-Agent) -i Page Valet
+acl bad_bot hdr_sub(User-Agent) -i PageAnalyzer
+acl bad_bot hdr_sub(User-Agent) -i PageFreezer
+acl bad_bot hdr_sub(User-Agent) -i PageGrabber
+acl bad_bot hdr_sub(User-Agent) -i PagePeeker
+acl bad_bot hdr_sub(User-Agent) -i PageScorer
 acl bad_bot hdr_sub(User-Agent) -i PageThing
+acl bad_bot hdr_sub(User-Agent) -i Page\ Analyzer
+acl bad_bot hdr_sub(User-Agent) -i Pagespeed\/
 acl bad_bot hdr_sub(User-Agent) -i Pandalytics
-acl bad_bot hdr_sub(User-Agent) -i PaperLiBot
+acl bad_bot hdr_sub(User-Agent) -i Panopta
+acl bad_bot hdr_sub(User-Agent) -i Panscient
+acl bad_bot hdr_sub(User-Agent) -i Papa Foto
+acl bad_bot hdr_sub(User-Agent) -i Papa\ Foto
+acl bad_bot hdr_sub(User-Agent) -i Pavuk
+acl bad_bot hdr_sub(User-Agent) -i PayPal IPN
 acl bad_bot hdr_sub(User-Agent) -i Pcore-HTTP
-acl bad_bot hdr_sub(User-Agent) -i PerplexityBot\/
-acl bad_bot hdr_sub(User-Agent) -i PetalBot
-acl bad_bot hdr_sub(User-Agent) -i PhantomJS
-acl bad_bot hdr_sub(User-Agent) -i PhxBot
-acl bad_bot hdr_sub(User-Agent) -i PiplBot
+acl bad_bot hdr_sub(User-Agent) -i Pearltrees
+acl bad_bot hdr_sub(User-Agent) -i Peew
+acl bad_bot hdr_sub(User-Agent) -i PeoplePal
+acl bad_bot hdr_sub(User-Agent) -i Perlu -
+acl bad_bot hdr_sub(User-Agent) -i Petalbot
+acl bad_bot hdr_sub(User-Agent) -i PhantomJS Screenshoter
+acl bad_bot hdr_sub(User-Agent) -i PhantomJS\/
+acl bad_bot hdr_sub(User-Agent) -i Photon\/
+acl bad_bot hdr_sub(User-Agent) -i Pi-Monster
+acl bad_bot hdr_sub(User-Agent) -i Picscout
+acl bad_bot hdr_sub(User-Agent) -i Picsearch
+acl bad_bot hdr_sub(User-Agent) -i PictureFinder
+acl bad_bot hdr_sub(User-Agent) -i Piepmatz
+acl bad_bot hdr_sub(User-Agent) -i Pimonster
+acl bad_bot hdr_sub(User-Agent) -i PingAdmin\.Ru
+acl bad_bot hdr_sub(User-Agent) -i PingSpot
+acl bad_bot hdr_sub(User-Agent) -i Pingability
+acl bad_bot hdr_sub(User-Agent) -i Pingdom
+acl bad_bot hdr_sub(User-Agent) -i Pingoscope
+acl bad_bot hdr_sub(User-Agent) -i Pixray
+acl bad_bot hdr_sub(User-Agent) -i Pizilla
+acl bad_bot hdr_sub(User-Agent) -i Plagger\/
+acl bad_bot hdr_sub(User-Agent) -i PleaseCrawl
+acl bad_bot hdr_sub(User-Agent) -i Pleroma 
+acl bad_bot hdr_sub(User-Agent) -i Ploetz \+ Zeller
+acl bad_bot hdr_sub(User-Agent) -i Plukkie
+acl bad_bot hdr_sub(User-Agent) -i PocketImageCache
 acl bad_bot hdr_sub(User-Agent) -i PocketParser
-acl bad_bot hdr_sub(User-Agent) -i Primalbot
-acl bad_bot hdr_sub(User-Agent) -i PrivacyAwareBot
-acl bad_bot hdr_sub(User-Agent) -i Pulsepoint
+acl bad_bot hdr_sub(User-Agent) -i Pockey
+acl bad_bot hdr_sub(User-Agent) -i PodcastAddict\/
+acl bad_bot hdr_sub(User-Agent) -i Polymail\/
+acl bad_bot hdr_sub(User-Agent) -i Pompos
+acl bad_bot hdr_sub(User-Agent) -i Porkbun
+acl bad_bot hdr_sub(User-Agent) -i Port Monitor
+acl bad_bot hdr_sub(User-Agent) -i PostPost
+acl bad_bot hdr_sub(User-Agent) -i PostmanRuntime
+acl bad_bot hdr_sub(User-Agent) -i PowerPoint\/
+acl bad_bot hdr_sub(User-Agent) -i Prebid
+acl bad_bot hdr_sub(User-Agent) -i Prerender
+acl bad_bot hdr_sub(User-Agent) -i Priceonomics Analysis Engine
+acl bad_bot hdr_sub(User-Agent) -i PrintFriendly
+acl bad_bot hdr_sub(User-Agent) -i PritTorrent
+acl bad_bot hdr_sub(User-Agent) -i Prlog
+acl bad_bot hdr_sub(User-Agent) -i ProPowerBot
+acl bad_bot hdr_sub(User-Agent) -i ProWebWalker
+acl bad_bot hdr_sub(User-Agent) -i Probethenet
+acl bad_bot hdr_sub(User-Agent) -i Project ?25499
+acl bad_bot hdr_sub(User-Agent) -i Project-Resonance
+acl bad_bot hdr_sub(User-Agent) -i Protopage
+acl bad_bot hdr_sub(User-Agent) -i Proximic
+acl bad_bot hdr_sub(User-Agent) -i Psbot
+acl bad_bot hdr_sub(User-Agent) -i Pu_iN
+acl bad_bot hdr_sub(User-Agent) -i Pump
+acl bad_bot hdr_sub(User-Agent) -i PxBroker
+acl bad_bot hdr_sub(User-Agent) -i PyCurl
+acl bad_bot hdr_sub(User-Agent) -i Python-httplib2
 acl bad_bot hdr_sub(User-Agent) -i Python-urllib
+acl bad_bot hdr_sub(User-Agent) -i QQDownload
+acl bad_bot hdr_sub(User-Agent) -i Qirina Hurdler
+acl bad_bot hdr_sub(User-Agent) -i QrafterPro
+acl bad_bot hdr_sub(User-Agent) -i Qseero
+acl bad_bot hdr_sub(User-Agent) -i Qualidator
+acl bad_bot hdr_sub(User-Agent) -i QueryN Metasearch
+acl bad_bot hdr_sub(User-Agent) -i QueryN\ Metasearch
+acl bad_bot hdr_sub(User-Agent) -i Quick-Crawler
+acl bad_bot hdr_sub(User-Agent) -i QuiteRSS
+acl bad_bot hdr_sub(User-Agent) -i Quora Link Preview
 acl bad_bot hdr_sub(User-Agent) -i Qwantify
+acl bad_bot hdr_sub(User-Agent) -i ROI Hunter
+acl bad_bot hdr_sub(User-Agent) -i RPT-HTTPClient
+acl bad_bot hdr_sub(User-Agent) -i RSSMix\/
+acl bad_bot hdr_sub(User-Agent) -i RSSOwl
 acl bad_bot hdr_sub(User-Agent) -i RSSingBot
+acl bad_bot hdr_sub(User-Agent) -i Radian6
+acl bad_bot hdr_sub(User-Agent) -i RadioPublicImageResizer
+acl bad_bot hdr_sub(User-Agent) -i Railgun\/
+acl bad_bot hdr_sub(User-Agent) -i Rainbot
+acl bad_bot hdr_sub(User-Agent) -i RankActive
 acl bad_bot hdr_sub(User-Agent) -i RankActiveLinkBot
-acl bad_bot hdr_sub(User-Agent) -i Refindbot
-acl bad_bot hdr_sub(User-Agent) -i RegionStuttgartBot
-acl bad_bot hdr_sub(User-Agent) -i RetrevoPageAnalyzer
-acl bad_bot hdr_sub(User-Agent) -i ReverseEngineeringBot
-acl bad_bot hdr_sub(User-Agent) -i RewriteCond %{HTTP_USER_AGENT} ^$|\&lt;|\&gt;|\&#039;|\%|\_iRc|\_Works|\@\$x|\&lt;\?|\$x0e|\+select\+|\+union\+|1\,\1\,1\,|2icommerce|3GSE|4all|59\.64\.153\.|88\.0\.106\.|98|85\.17\.|A\_Browser|ABAC|Abont|abot|Accept|Access|Accoo|AceFTP|Acme|ActiveTouristBot|Address|Adopt|adress|adressendeutschland|ADSARobot|agent|ah\-ha|Ahead|AESOP\_com\_SpiderMan|aipbot|Alarm|Albert|Alek|Alexibot|Alligator|AllSubmitter|alma|almaden|ALot|Alpha|aktuelles|Akregat|Amfi|amzn\_assoc|Anal|Anarchie|andit|Anon|AnotherBot|Ansearch|AnswerBus|antivirx|Apexoo|appie|Aqua_Products|Arachmo|archive|arian|ASPSe|ASSORT|aster|Atari|ATHENS|AtHome|Atlocal|Atomic_Email_Hunter|Atomz|Atrop|^attach|attrib|autoemailspider|autohttp|axod|batch|b2w|Back|BackDoorBot|BackStreet|BackWeb|Badass|Baid|Bali|Bandit|Baidu|Barry|BasicHTTP|BatchFTP|bdfetch|beat|Become|Beij|BenchMark|berts|bew|big.brother|Bigfoot|Bilgi|Bison|Bitacle|Biz360|Black|Black.Hole|BlackWidow|bladder.fusion|Blaiz|Blog.Checker|Blogl|BlogPeople|Blogshares.Spiders|Bloodhound|Blow|bmclient|Board|BOI|boitho|Bond|Bookmark.search.tool|boris|Bost|Boston.Project|BotRightHere|Bot.mailto:craftbot@yahoo.com|BotALot|botpaidtoclick|botw|brandwatch|BravoBrian|Brok|Bropwers|Broth|browseabit|BrowseX|Browsezilla|Bruin|bsalsa|Buddy|Build|Built|Bulls|bumblebee|Bunny|Busca|Busi|Buy|bwh3|c\-spider|CafeK|Cafi|camel|Cand|captu|Catch|cd34|Ceg|CFNetwork|cgichk|Cha0s|Chang|chaos|Char|char\(32\,35\)|charlotte|CheeseBot|Chek|CherryPicker|chill|ChinaClaw|CICC|Cisco|Cita|Clam|Claw|Click.Bot|clipping|clshttp|Clush|COAST|ColdFusion|Coll|Comb|commentreader|Compan|contact|Control|contype|Conc|Conv|Copernic|Copi|Copy|Coral|Corn|core-project|cosmos|costa|cr4nk|crank|craft|Crap|Crawler0|Crazy|Cres|cs\-CZ|cuill|Curl|Custo|Cute|CSHttp|Cyber|cyberalert|^DA$|daoBot|DARK|Data|Daten|Daum|dcbot|dcs|Deep|DepS|Detect|Deweb|Diam|Digger|Digimarc|digout4uagent|DIIbot|Dillo|Ding|DISC|discobot|Disp|Ditto|DLC|DnloadMage|DotBot|Doubanbot|Download|Download.Demon|Download.Devil|Download.Wonder|Downloader|drag|DreamPassport|Drec|Drip|dsdl|dsok|DSurf|DTAAgent|DTS|Dual|dumb|DynaWeb|e\-collector|eag|earn|EARTHCOM|EasyDL|ebin|EBM-APPLE|EBrowse|eCatch|echo|ecollector|Edco|edgeio|efp\@gmx\.net|EirGrabber|email|Email.Extractor|EmailCollector|EmailSearch|EmailSiphon|EmailWolf|Emer|empas|Enfi|Enhan|Enterprise\_Search|envolk|erck|EroCr|ESurf|Eval|Evil|Evere|EWH|Exabot|Exact|EXPLOITER|Expre|Extra|ExtractorPro|EyeN|FairAd|Fake|FANG|FAST|fastlwspider|FavOrg|Favorites.Sweeper|Faxo|FDM\_1|FDSE|fetch|FEZhead|Filan|FileHound|find|Firebat|Firefox.2\.0|Firs|Flam|Flash|FlickBot|Flip|fluffy|flunky|focus|Foob|Fooky|Forex|Forum|ForV|Fost|Foto|Foun|Franklin.Locator|freefind|FreshDownload|FrontPage|FSurf|Fuck|Fuer|futile|Fyber|Gais|GalaxyBot|Galbot|Gamespy\_Arcade|GbPl|Gener|geni|Geona|Get|gigabaz|Gira|Ginxbot|gluc|glx.?v|gnome|Go.Zilla|Goldfire|Google.Wireless.Transcoder|Googlebot\-Image|Got\-It|GOFORIT|gonzo|GornKer|GoSearch|^gotit$|gozilla|grab|Grabber|GrabNet|Grub|Grup|Graf|Green.Research|grub|grub\-client|gsa\-cra|GSearch|GT\:\:WWW|GuideBot|guruji|gvfs|Gyps|hack|haha|hailo|Harv|Hatena|Hax|Head|Helm|herit|hgre|hhjhj\@yahoo|Hippo|hloader|HMView|holm|holy|HomePageSearch|HooWWWer|HouxouCrawler|HMSE|HPPrint|htdig|HTTPConnect|httpdown|http.generic|HTTPGet|httplib|HTTPRetriever|HTTrack|human|Huron|hverify|Hybrid|Hyper|ia\_archiver|iaskspi|IBM\_Planetwide|iCCra|ichiro|ID\-Search|IDA|IDBot|IEAuto|IEMPT|iexplore\.exe|iGetter|Ilse|Iltrov|Image|Image.Stripper|Image.Sucker|imagefetch|iimds\_monitor|Incutio|IncyWincy|Indexer|Industry.Program|Indy|InetURL|informant|InfoNav|InfoTekies|Ingelin|Innerpr|Inspect|InstallShield.DigitalWizard|Insuran\.|Intellig|Intelliseek|InterGET|Internet.Ninja|Internet.x|Internet\_Explorer|InternetLinkagent|InternetSeer.com|Intraf|IP2|Ipsel|Iria|IRLbot|Iron33|Irvine|ISC\_Sys|iSilo|ISRCCrawler|ISSpi|IUPUI.Research.Bot|Jady|Jaka|Jam|^Java|java\/|Java\(tm\)|JBH.agent|Jenny|JetB|JetC|jeteye|jiro|JoBo|JOC|jupit|Just|Jyx|Kapere|kash|Kazo|KBee|Kenjin|Kernel|Keywo|KFSW|KKma|Know|kosmix|KRAE|KRetrieve|Krug|ksibot|ksoap|Kum|KWebGet|Lachesis|lanshan|Lapo|larbin|leacher|leech|LeechFTP|LeechGet|leipzig\.de|Lets|Lexi|lftp|Libby|libcrawl|libcurl|libfetch|libghttp|libWeb|libwhisker|libwww|libwww\-FM|libwww\-perl|LightningDownload|likse|Linc|Link|Link.Sleuth|LinkextractorPro|Linkie|LINKS.ARoMATIZED|LinkScan|linktiger|LinkWalker|Lint|List|lmcrawler|LMQ|LNSpiderguy|loader|LocalcomBot|Locu|London|lone|looksmart|loop|Lork|LTH\_|lwp\-request|LWP|lwp-request|lwp-trivial|Mac.Finder|Macintosh\;.I\;.PPC|Mac\_F|magi|Mag\-Net|Magnet|Magp|Mail.Sweeper|main|majest|Mam|Mana|MarcoPolo|mark.blonin|MarkWatch|MaSagool|Mass|Mass.Downloader|Mata|mavi|McBot|Mecha|MCspider|mediapartners|^Memo|MEGAUPLOAD|MetaProducts.Download.Express|Metaspin|Mete|Microsoft.Data.Access|Microsoft.URL|Microsoft\_Internet\_Explorer|MIDo|MIIx|miner|Mira|MIRE|Mirror|Miss|Missauga|Missigua.Locator|Missouri.College.Browse|Mist|Mizz|MJ12|mkdb|mlbot|MLM|MMMoCrawl|MnoG|moge|Moje|Monster|Monza.Browser|Mooz|Moreoverbot|MOT\-MPx220|mothra\/netscan|mouse|MovableType|Mozdex|Mozi\!|^Mozilla$|Mozilla\/1\.22|Mozilla\/22|^Mozilla\/3\.0.\(compatible|Mozilla\/3\.Mozilla\/2\.01|Mozilla\/4\.0\(compatible|Mozilla\/4\.08|Mozilla\/4\.61.\(Macintosh|Mozilla\/5\.0|Mozilla\/7\.0|Mozilla\/8|Mozilla\/9|Mozilla\:|Mozilla\/Firefox|^Mozilla.*Indy|^Mozilla.*NEWT|^Mozilla*MSIECrawler|Mp3Bot|MPF|MRA|MS.FrontPage|MS.?Search|MSFrontPage|MSIE\_6\.0|MSIE6|MSIECrawler|msnbot\-media|msnbot\-Products|MSNPTC|MSProxy|MSRBOT|multithreaddb|musc|MVAC|MWM|My\_age|MyApp|MyDog|MyEng|MyFamilyBot|MyGetRight|MyIE2|mysearch|myurl|NAG|NAMEPROTECT|NASA.Search|nationaldirectory|Naver|Navr|Near|NetAnts|netattache|Netcach|NetCarta|Netcraft|NetCrawl|NetMech|netprospector|NetResearchServer|NetSp|Net.Vampire|netX|NetZ|Neut|newLISP|NewsGatorInbox|NEWT|NEWT.ActiveX|Next|^NG|NICE|nikto|Nimb|Ninja|Ninte|NIPGCrawler|Noga|nogo|Noko|Nomad|Norb|noxtrumbot|NPbot|NuSe|Nutch|Nutex|NWSp|Obje|Ocel|Octo|ODI3|oegp|Offline|Offline.Explorer|Offline.Navigator|OK.Mozilla|omg|Omni|Onfo|onyx|OpaL|OpenBot|Openf|OpenTextSiteCrawler|OpenU|Orac|OrangeBot|Orbit|Oreg|osis|Outf|Owl|P3P|PackRat|PageGrabber|PagmIEDownload|pansci|Papa|Pars|Patw|pavu|Pb2Pb|pcBrow|PEAR|PEER|PECL|pepe|Perl|PerMan|PersonaPilot|Persuader|petit|PHP|PHP.vers|PHPot|Phras|PicaLo|Piff|Pige|pigs|^Ping|Pingd|PingALink|Pipe|Plag|Plant|playstarmusic|Pluck|Pockey|POE\-Com|Poirot|Pomp|Port.Huron|Post|powerset|Preload|press|Privoxy|Probe|Program.Shareware|Progressive.Download|ProPowerBot|prospector|Provider.Protocol.Discover|ProWebWalker|Prowl|Proxy|Prozilla|psbot|PSurf|psycheclone|^puf$|Pulse|Pump|PushSite|PussyCat|PuxaRapido|PycURL|Pyth|PyQ|QuepasaCreep|Query|Quest|QRVA|Qweer|radian|Radiation|Rambler|RAMP|RealDownload|Reap|Recorder|RedCarpet|RedKernel|ReGet|relevantnoise|replacer|Repo|requ|Rese|Retrieve|Rip|Rix|RMA|Roboz|Rogue|Rover|RPT\-HTTP|Rsync|RTG30|.ru\)|ruby|Rufus|Salt|Sample|SAPO|Sauger|savvy|SBIder|SBP|SCAgent|scan|SCEJ\_|Sched|Schizo|Schlong|Schmo|Scout|Scooter|Scorp|ScoutOut|SCrawl|screen|script|SearchExpress|searchhippo|Searchme|searchpreview|searchterms|Second.Street.Research|Security.Kol|Seekbot|Seeker|Sega|Sensis|Sept|Serious|Sezn|Shai|Share|Sharp|Shaz|shell|shelo|Sherl|Shim|Shiretoko|ShopWiki|SickleBot|Simple|Siph|sitecheck|SiteCrawler|SiteSnagger|Site.Sniper|SiteSucker|sitevigil|SiteX|Sleip|Slide|Slurpy.Verifier|Sly|Smag|SmartDownload|Smurf|sna\-|snag|Snake|Snapbot|Snip|Snoop|So\-net|SocSci|sogou|Sohu|solr|sootle|Soso|SpaceBison|Spad|Span|spanner|Speed|Spegla|Sphere|Sphider|spider|SpiderBot|SpiderEngine|SpiderView|Spin|sproose|Spurl|Spyder|Squi|SQ.Webscanner|sqwid|Sqworm|SSM\_Ag|Stack|Stamina|stamp|Stanford|Statbot|State|Steel|Strateg|Stress|Strip|studybot|Style|subot|Suck|Sume|sun4m|Sunrise|SuperBot|SuperBro|Supervi|Surf4Me|SuperHTTP|Surfbot|SurfWalker|Susi|suza|suzu|Sweep|sygol|syncrisis|Systems|Szukacz|Tagger|Tagyu|tAke|Talkro|TALWinHttpClient|tamu|Tandem|Tarantula|tarspider|tBot|TCF|Tcs\/1|TeamSoft|Tecomi|Teleport|Telesoft|Templeton|Tencent|Terrawiz|Test|TexNut|trivial|Turnitin|The.Intraformant|TheNomad|Thomas|TightTwatBot|Timely|Titan|TMCrawler|TMhtload|toCrawl|Todobr|Tongco|topic|Torrent|Track|translate|Traveler|TREEVIEW|True|Tunnel|turing|Turnitin|TutorGig|TV33\_Mercator|Twat|Tweak|Twice|Twisted.PageGetter|Tygo|ubee|UCmore|UdmSearch|UIowaCrawler|Ultraseek|UMBC|unf|UniversalFeedParser|unknown|UPG1|UtilMind|URLBase|URL.Control|URL\_Spider\_Pro|urldispatcher|URLGetFile|urllib|URLSpiderPro|URLy|User\-Agent|UserAgent|USyd|Vacuum|vagabo|Valet|Valid|Vamp|vayala|VB\_|VCI|VERI\~LI|verif|versus|via|Viewer|virtual|visibilitygap|Visual|vobsub|Void|VoilaBot|voyager|vspider|VSyn|w\:PACBHO60|w0000t|W3C|w3m|w3search|walhello|Walker|Wand|WAOL|WAPT|Watch|Wavefire|wbdbot|Weather|web.by.mail|Web.Data.Extractor|Web.Downloader|Web.Ima|Web.Mole|Web.Sucker|Web2Mal|Web2WAP|WebaltBot|WebAuto|WebBandit|Webbot|WebCapture|WebCat|webcraft\@bea|Webclip|webcollage|WebCollector|WebCopier|WebCopy|WebCor|webcrawl|WebDat|WebDav|webdevil|webdownloader|Webdup|WebEMail|WebEMailExtrac|WebEnhancer|WebFetch|WebGo|WebHook|Webinator|WebInd|webitpr|WebFilter|WebFountain|WebLea|Webmaster|WebmasterWorldForumBot|WebMin|WebMirror|webmole|webpic|WebPin|WebPix|WebReaper|WebRipper|WebRobot|WebSauger|WebSite|Website.eXtractor|Website.Quester|WebSnake|webspider|Webster|WebStripper|websucker|WebTre|WebVac|webwalk|WebWasher|WebWeasel|WebWhacker|WebZIP|Wells|WEP\_S|WEP.Search.00|WeRelateBot|wget|Whack|Whacker|whiz|WhosTalking|Widow|Win67|window.location|Windows.95\;|Windows.95\)|Windows.98\;|Windows.98\)|Winodws|Wildsoft.Surfer|WinHT|winhttp|WinHttpRequest|WinHTTrack|Winnie.Poh|wire|WISEbot|wisenutbot|wish|Wizz|WordP|Works|world|WUMPUS|Wweb|WWWC|WWWOFFLE|WWW\-Collector|WWW.Mechanize|www.ranks.nl|wwwster|^x$|X12R1|x\-Tractor|Xaldon|Xenu|XGET|xirq|Y\!OASIS|Y\!Tunnel|yacy|YaDirectBot|Yahoo\-MMAudVid|YahooSeeker|YahooYSMcm|Yamm|Yand|yang|Yeti|Yoono|yori|Yotta|YTunnel|Zade|zagre|ZBot|Zeal|ZeBot|zerx|Zeus|ZIPCode|Zixy|zmao|Zyborg [NC]
-acl bad_bot hdr_sub(User-Agent) -i RidderBot
-acl bad_bot hdr_sub(User-Agent) -i Rivva
+acl bad_bot hdr_sub(User-Agent) -i RankFlex
+acl bad_bot hdr_sub(User-Agent) -i RankSonicSiteAuditor
+acl bad_bot hdr_sub(User-Agent) -i RankingBot
+acl bad_bot hdr_sub(User-Agent) -i RankingBot2
+acl bad_bot hdr_sub(User-Agent) -i Rankivabot
+acl bad_bot hdr_sub(User-Agent) -i RankurBot
+acl bad_bot hdr_sub(User-Agent) -i RapidLoad\/
+acl bad_bot hdr_sub(User-Agent) -i Re-re
+acl bad_bot hdr_sub(User-Agent) -i Re-re Studio
+acl bad_bot hdr_sub(User-Agent) -i ReGet
+acl bad_bot hdr_sub(User-Agent) -i ReactorNetty
+acl bad_bot hdr_sub(User-Agent) -i Readability
+acl bad_bot hdr_sub(User-Agent) -i RealDownload
+acl bad_bot hdr_sub(User-Agent) -i RealPlayer%20Downloader
+acl bad_bot hdr_sub(User-Agent) -i Reaper
+acl bad_bot hdr_sub(User-Agent) -i RebelMouse
+acl bad_bot hdr_sub(User-Agent) -i Recorder
+acl bad_bot hdr_sub(User-Agent) -i RecurPost\/
+acl bad_bot hdr_sub(User-Agent) -i RedesScrapy
+acl bad_bot hdr_sub(User-Agent) -i ReederForMac
+acl bad_bot hdr_sub(User-Agent) -i Reeder\/
+acl bad_bot hdr_sub(User-Agent) -i RepoMonkey
+acl bad_bot hdr_sub(User-Agent) -i ResponseCodeTest
+acl bad_bot hdr_sub(User-Agent) -i RestSharp
+acl bad_bot hdr_sub(User-Agent) -i Riddler
+acl bad_bot hdr_sub(User-Agent) -i Ripper
+acl bad_bot hdr_sub(User-Agent) -i Rival IQ
+acl bad_bot hdr_sub(User-Agent) -i Robosourcer
+acl bad_bot hdr_sub(User-Agent) -i Robozilla
+acl bad_bot hdr_sub(User-Agent) -i RocketCrawler
+acl bad_bot hdr_sub(User-Agent) -i Rogerbot
 acl bad_bot hdr_sub(User-Agent) -i RuxitSynthetic
-acl bad_bot hdr_sub(User-Agent) -i RyteBot
-acl bad_bot hdr_sub(User-Agent) -i SBL-BOT
+acl bad_bot hdr_sub(User-Agent) -i RyowlEngine
+acl bad_bot hdr_sub(User-Agent) -i SAP NetWeaver Application Server
+acl bad_bot hdr_sub(User-Agent) -i SBIder
+acl bad_bot hdr_sub(User-Agent) -i SEO Browser
+acl bad_bot hdr_sub(User-Agent) -i SEOCentro
 acl bad_bot hdr_sub(User-Agent) -i SEOkicks
+acl bad_bot hdr_sub(User-Agent) -i SEOkicks-Robot
 acl bad_bot hdr_sub(User-Agent) -i SEOlizer
-acl bad_bot hdr_sub(User-Agent) -i SWIMGBot
-acl bad_bot hdr_sub(User-Agent) -i S[eE][mM]rushBot
-acl bad_bot hdr_sub(User-Agent) -i SafeDNSBot
-acl bad_bot hdr_sub(User-Agent) -i SafeSearch microdata crawler
+acl bad_bot hdr_sub(User-Agent) -i SEOlyt
+acl bad_bot hdr_sub(User-Agent) -i SEOlyticsCrawler
+acl bad_bot hdr_sub(User-Agent) -i SEOprofiler
+acl bad_bot hdr_sub(User-Agent) -i SEOsearch
+acl bad_bot hdr_sub(User-Agent) -i SEOstats
+acl bad_bot hdr_sub(User-Agent) -i SISTRIX
+acl bad_bot hdr_sub(User-Agent) -i SMRF URL Expander
+acl bad_bot hdr_sub(User-Agent) -i SMTBot
+acl bad_bot hdr_sub(User-Agent) -i SMUrlExpander
+acl bad_bot hdr_sub(User-Agent) -i SPDYCheck
+acl bad_bot hdr_sub(User-Agent) -i SPEng
+acl bad_bot hdr_sub(User-Agent) -i SSL Labs
+acl bad_bot hdr_sub(User-Agent) -i SalesIntelligent
+acl bad_bot hdr_sub(User-Agent) -i Saleslift
+acl bad_bot hdr_sub(User-Agent) -i SauceNAO
+acl bad_bot hdr_sub(User-Agent) -i Scamadviser-Frontend
+acl bad_bot hdr_sub(User-Agent) -i ScanAlert
+acl bad_bot hdr_sub(User-Agent) -i Scanbot
+acl bad_bot hdr_sub(User-Agent) -i Scoop
+acl bad_bot hdr_sub(User-Agent) -i ScopeContentAG-HTTP-Client
 acl bad_bot hdr_sub(User-Agent) -i ScoutJet
+acl bad_bot hdr_sub(User-Agent) -i ScoutURLMonitor
+acl bad_bot hdr_sub(User-Agent) -i ScrapeBox Page Scanner
 acl bad_bot hdr_sub(User-Agent) -i Scrapy
-acl bad_bot hdr_sub(User-Agent) -i Screaming Frog SEO Spider
-acl bad_bot hdr_sub(User-Agent) -i SearchAtlas
+acl bad_bot hdr_sub(User-Agent) -i Screaming
+acl bad_bot hdr_sub(User-Agent) -i ScreenShotService
+acl bad_bot hdr_sub(User-Agent) -i ScreenerBot
+acl bad_bot hdr_sub(User-Agent) -i ScrepyBot
+acl bad_bot hdr_sub(User-Agent) -i Scrubby
+acl bad_bot hdr_sub(User-Agent) -i Scrutiny\/
+acl bad_bot hdr_sub(User-Agent) -i Search37
+acl bad_bot hdr_sub(User-Agent) -i SearchExpress
+acl bad_bot hdr_sub(User-Agent) -i SearchSight
+acl bad_bot hdr_sub(User-Agent) -i SearchWP
+acl bad_bot hdr_sub(User-Agent) -i Searchestate
+acl bad_bot hdr_sub(User-Agent) -i SearchmetricsBot
+acl bad_bot hdr_sub(User-Agent) -i Seeker
 acl bad_bot hdr_sub(User-Agent) -i Seekport
-acl bad_bot hdr_sub(User-Agent) -i SemanticScholarBot
+acl bad_bot hdr_sub(User-Agent) -i SeekportBot
+acl bad_bot hdr_sub(User-Agent) -i SemanticJuice
+acl bad_bot hdr_sub(User-Agent) -i Semiocast HTTP client
+acl bad_bot hdr_sub(User-Agent) -i Semrush
+acl bad_bot hdr_sub(User-Agent) -i SemrushBot
+acl bad_bot hdr_sub(User-Agent) -i Sendsay\.Ru
 acl bad_bot hdr_sub(User-Agent) -i SentiBot
 acl bad_bot hdr_sub(User-Agent) -i SenutoBot
+acl bad_bot hdr_sub(User-Agent) -i Seo Servis
+acl bad_bot hdr_sub(User-Agent) -i SeoCheck
+acl bad_bot hdr_sub(User-Agent) -i SeoCherryBot
+acl bad_bot hdr_sub(User-Agent) -i SeoSiteCheckup
+acl bad_bot hdr_sub(User-Agent) -i Seobility
 acl bad_bot hdr_sub(User-Agent) -i SeobilityBot
-acl bad_bot hdr_sub(User-Agent) -i SerendeputyBot
-acl bad_bot hdr_sub(User-Agent) -i SeznamBot
-acl bad_bot hdr_sub(User-Agent) -i SimpleCrawler
+acl bad_bot hdr_sub(User-Agent) -i Seomoz
+acl bad_bot hdr_sub(User-Agent) -i Seznam
+acl bad_bot hdr_sub(User-Agent) -i Shelob
+acl bad_bot hdr_sub(User-Agent) -i Shodan
+acl bad_bot hdr_sub(User-Agent) -i ShopWiki
+acl bad_bot hdr_sub(User-Agent) -i Shoppimon
+acl bad_bot hdr_sub(User-Agent) -i ShortLinkTranslate
+acl bad_bot hdr_sub(User-Agent) -i Sideqik
+acl bad_bot hdr_sub(User-Agent) -i Siege
 acl bad_bot hdr_sub(User-Agent) -i SimplePie
-acl bad_bot hdr_sub(User-Agent) -i SimpleScraper
+acl bad_bot hdr_sub(User-Agent) -i SimplyFast
+acl bad_bot hdr_sub(User-Agent) -i Siphon
+acl bad_bot hdr_sub(User-Agent) -i Site Sucker
+acl bad_bot hdr_sub(User-Agent) -i Site-Shot\/
+acl bad_bot hdr_sub(User-Agent) -i Site24x7
+acl bad_bot hdr_sub(User-Agent) -i SiteBar
 acl bad_bot hdr_sub(User-Agent) -i SiteCheckerBotCrawler
-acl bad_bot hdr_sub(User-Agent) -i Siteimprove\.com
+acl bad_bot hdr_sub(User-Agent) -i SiteCondor
+acl bad_bot hdr_sub(User-Agent) -i SiteExplorer
+acl bad_bot hdr_sub(User-Agent) -i SiteGuardian
+acl bad_bot hdr_sub(User-Agent) -i SiteIndexed
+acl bad_bot hdr_sub(User-Agent) -i SiteLockSpider
+acl bad_bot hdr_sub(User-Agent) -i SiteMonitor
+acl bad_bot hdr_sub(User-Agent) -i SiteSnagger
+acl bad_bot hdr_sub(User-Agent) -i SiteSucker
+acl bad_bot hdr_sub(User-Agent) -i SiteTruth
+acl bad_bot hdr_sub(User-Agent) -i Site\ Sucker
+acl bad_bot hdr_sub(User-Agent) -i Sitebeam
+acl bad_bot hdr_sub(User-Agent) -i Sitebulb\/
+acl bad_bot hdr_sub(User-Agent) -i Siteimprove
+acl bad_bot hdr_sub(User-Agent) -i Sitemap(s)? Generator
+acl bad_bot hdr_sub(User-Agent) -i SitemapGenerator
+acl bad_bot hdr_sub(User-Agent) -i Siteshooter B0t
+acl bad_bot hdr_sub(User-Agent) -i Sitevigil
 acl bad_bot hdr_sub(User-Agent) -i SkypeUriPreview
-acl bad_bot hdr_sub(User-Agent) -i Slack-ImgProxy
-acl bad_bot hdr_sub(User-Agent) -i Slackbot
-acl bad_bot hdr_sub(User-Agent) -i Slurp
-acl bad_bot hdr_sub(User-Agent) -i Snacktory
-acl bad_bot hdr_sub(User-Agent) -i Snap URL Preview Service
+acl bad_bot hdr_sub(User-Agent) -i Slack\/
+acl bad_bot hdr_sub(User-Agent) -i SlySearch
+acl bad_bot hdr_sub(User-Agent) -i SmartDownload
+acl bad_bot hdr_sub(User-Agent) -i Snake
+acl bad_bot hdr_sub(User-Agent) -i SnapSearch
+acl bad_bot hdr_sub(User-Agent) -i Snapbot
+acl bad_bot hdr_sub(User-Agent) -i Snappy
+acl bad_bot hdr_sub(User-Agent) -i Snarfer\/
+acl bad_bot hdr_sub(User-Agent) -i SniffRSS
+acl bad_bot hdr_sub(User-Agent) -i Snoopy
+acl bad_bot hdr_sub(User-Agent) -i SnowHaze Search
 acl bad_bot hdr_sub(User-Agent) -i SocialRankIOBot
-acl bad_bot hdr_sub(User-Agent) -i Sogou
-acl bad_bot hdr_sub(User-Agent) -i Sonic
-acl bad_bot hdr_sub(User-Agent) -i Storebot-Google
-acl bad_bot hdr_sub(User-Agent) -i StorygizeBot
-acl bad_bot hdr_sub(User-Agent) -i StractBot
-acl bad_bot hdr_sub(User-Agent) -i Streamline3Bot\/
-acl bad_bot hdr_sub(User-Agent) -i Superfeedr
-acl bad_bot hdr_sub(User-Agent) -i SurdotlyBot
+acl bad_bot hdr_sub(User-Agent) -i Sociscraper
+acl bad_bot hdr_sub(User-Agent) -i Sogou\ web\ spider
+acl bad_bot hdr_sub(User-Agent) -i SortSite
+acl bad_bot hdr_sub(User-Agent) -i Sosospider
+acl bad_bot hdr_sub(User-Agent) -i Sottopop
+acl bad_bot hdr_sub(User-Agent) -i SpaceBison
+acl bad_bot hdr_sub(User-Agent) -i SpamExperts
+acl bad_bot hdr_sub(User-Agent) -i Spammen
+acl bad_bot hdr_sub(User-Agent) -i SpankBot
+acl bad_bot hdr_sub(User-Agent) -i Spanner
+acl bad_bot hdr_sub(User-Agent) -i Spawning-AI
+acl bad_bot hdr_sub(User-Agent) -i Spbot
+acl bad_bot hdr_sub(User-Agent) -i Specificfeeds
+acl bad_bot hdr_sub(User-Agent) -i SpeedKit
+acl bad_bot hdr_sub(User-Agent) -i Spider_Bot
+acl bad_bot hdr_sub(User-Agent) -i Spider_Bot/3.0
+acl bad_bot hdr_sub(User-Agent) -i Spinn3r
+acl bad_bot hdr_sub(User-Agent) -i Sprinklr 
+acl bad_bot hdr_sub(User-Agent) -i SputnikBot
+acl bad_bot hdr_sub(User-Agent) -i Sqlmap
+acl bad_bot hdr_sub(User-Agent) -i Sqlworm
+acl bad_bot hdr_sub(User-Agent) -i Sqworm
+acl bad_bot hdr_sub(User-Agent) -i StackRambler
+acl bad_bot hdr_sub(User-Agent) -i Statastico\/
+acl bad_bot hdr_sub(User-Agent) -i Statically-
+acl bad_bot hdr_sub(User-Agent) -i StatusCake
+acl bad_bot hdr_sub(User-Agent) -i Steeler
+acl bad_bot hdr_sub(User-Agent) -i Stratagems Kumo
+acl bad_bot hdr_sub(User-Agent) -i Stripe\/
+acl bad_bot hdr_sub(User-Agent) -i Stripper
+acl bad_bot hdr_sub(User-Agent) -i Stroke\.cz
+acl bad_bot hdr_sub(User-Agent) -i StudioFACA
+acl bad_bot hdr_sub(User-Agent) -i StumbleUpon
+acl bad_bot hdr_sub(User-Agent) -i Sucker
+acl bad_bot hdr_sub(User-Agent) -i Sucuri
+acl bad_bot hdr_sub(User-Agent) -i SuperBot
+acl bad_bot hdr_sub(User-Agent) -i SuperHTTP
+acl bad_bot hdr_sub(User-Agent) -i Surfbot
+acl bad_bot hdr_sub(User-Agent) -i Surphace Scout
 acl bad_bot hdr_sub(User-Agent) -i SurveyBot
-acl bad_bot hdr_sub(User-Agent) -i Synapse
+acl bad_bot hdr_sub(User-Agent) -i Suzuran
+acl bad_bot hdr_sub(User-Agent) -i Swiftbot
+acl bad_bot hdr_sub(User-Agent) -i Symfony BrowserKit
+acl bad_bot hdr_sub(User-Agent) -i Symfony2 BrowserKit
+acl bad_bot hdr_sub(User-Agent) -i SynHttpClient-Built
+acl bad_bot hdr_sub(User-Agent) -i Synapse\/
+acl bad_bot hdr_sub(User-Agent) -i Syndirella\/
 acl bad_bot hdr_sub(User-Agent) -i Sysomos
-acl bad_bot hdr_sub(User-Agent) -i Taboolabot
-acl bad_bot hdr_sub(User-Agent) -i TangibleeBot
-acl bad_bot hdr_sub(User-Agent) -i TelegramBot
-acl bad_bot hdr_sub(User-Agent) -i Teoma
+acl bad_bot hdr_sub(User-Agent) -i Szukacz
+acl bad_bot hdr_sub(User-Agent) -i T0PHackTeam
+acl bad_bot hdr_sub(User-Agent) -i T8Abot
+acl bad_bot hdr_sub(User-Agent) -i TLSProbe\/
+acl bad_bot hdr_sub(User-Agent) -i Tarantula\/
+acl bad_bot hdr_sub(User-Agent) -i Taringa UGC
+acl bad_bot hdr_sub(User-Agent) -i TarmotGezgin
+acl bad_bot hdr_sub(User-Agent) -i Teleport
+acl bad_bot hdr_sub(User-Agent) -i TeleportPro
+acl bad_bot hdr_sub(User-Agent) -i Telesoft
+acl bad_bot hdr_sub(User-Agent) -i Telesphoreo
+acl bad_bot hdr_sub(User-Agent) -i Telesphorep
+acl bad_bot hdr_sub(User-Agent) -i Tenon\.io
+acl bad_bot hdr_sub(User-Agent) -i Test Certificate Info
+acl bad_bot hdr_sub(User-Agent) -i Tetrahedron
+acl bad_bot hdr_sub(User-Agent) -i TextRazor Downloader
+acl bad_bot hdr_sub(User-Agent) -i The Drop Reaper
+acl bad_bot hdr_sub(User-Agent) -i The Expert HTML Source Viewer
+acl bad_bot hdr_sub(User-Agent) -i The Intraformant
+acl bad_bot hdr_sub(User-Agent) -i The Knowledge AI
+acl bad_bot hdr_sub(User-Agent) -i TheNomad
+acl bad_bot hdr_sub(User-Agent) -i The\ Intraformant
 acl bad_bot hdr_sub(User-Agent) -i Thinklab
+acl bad_bot hdr_sub(User-Agent) -i ThumbSniper
+acl bad_bot hdr_sub(User-Agent) -i Thumbor
+acl bad_bot hdr_sub(User-Agent) -i Thumbshots
+acl bad_bot hdr_sub(User-Agent) -i TightTwatBot
 acl bad_bot hdr_sub(User-Agent) -i TinEye
 acl bad_bot hdr_sub(User-Agent) -i Tiny Tiny RSS
-acl bad_bot hdr_sub(User-Agent) -i TombaPublicWebCrawler
-acl bad_bot hdr_sub(User-Agent) -i ToutiaoSpider
+acl bad_bot hdr_sub(User-Agent) -i TinyTestBot
+acl bad_bot hdr_sub(User-Agent) -i Titan
+acl bad_bot hdr_sub(User-Agent) -i Toata
+acl bad_bot hdr_sub(User-Agent) -i Toweyabot
 acl bad_bot hdr_sub(User-Agent) -i Traackr\.com
-acl bad_bot hdr_sub(User-Agent) -i TrendsmapResolver
-acl bad_bot hdr_sub(User-Agent) -i Trove
+acl bad_bot hdr_sub(User-Agent) -i Tracemyfile
+acl bad_bot hdr_sub(User-Agent) -i Trackuity
+acl bad_bot hdr_sub(User-Agent) -i TrapitAgent
+acl bad_bot hdr_sub(User-Agent) -i Trendiction
+acl bad_bot hdr_sub(User-Agent) -i Trendictionbot
+acl bad_bot hdr_sub(User-Agent) -i Trendsmap
+acl bad_bot hdr_sub(User-Agent) -i True_Robot
+acl bad_bot hdr_sub(User-Agent) -i TryJsoup
+acl bad_bot hdr_sub(User-Agent) -i TulipChain
+acl bad_bot hdr_sub(User-Agent) -i Turingos
 acl bad_bot hdr_sub(User-Agent) -i Turnitin
-acl bad_bot hdr_sub(User-Agent) -i TweetmemeBot
+acl bad_bot hdr_sub(User-Agent) -i TurnitinBot
+acl bad_bot hdr_sub(User-Agent) -i Tweetminster
+acl bad_bot hdr_sub(User-Agent) -i Tweezler\/
+acl bad_bot hdr_sub(User-Agent) -i TwengaBot
+acl bad_bot hdr_sub(User-Agent) -i Twice
+acl bad_bot hdr_sub(User-Agent) -i Twikle
 acl bad_bot hdr_sub(User-Agent) -i Twingly
-acl bad_bot hdr_sub(User-Agent) -i Twitterbot
-acl bad_bot hdr_sub(User-Agent) -i Twurly
-acl bad_bot hdr_sub(User-Agent) -i UT-Dorkbot
+acl bad_bot hdr_sub(User-Agent) -i Twisted PageGetter
+acl bad_bot hdr_sub(User-Agent) -i Typhoeus
+acl bad_bot hdr_sub(User-Agent) -i URL Verifier
+acl bad_bot hdr_sub(User-Agent) -i URLTester
+acl bad_bot hdr_sub(User-Agent) -i URL\/Emacs
+acl bad_bot hdr_sub(User-Agent) -i URLitor
+acl bad_bot hdr_sub(User-Agent) -i URLy Warning
+acl bad_bot hdr_sub(User-Agent) -i URLy\ Warning
+acl bad_bot hdr_sub(User-Agent) -i URLy\.Warning
+acl bad_bot hdr_sub(User-Agent) -i UdmSearch
+acl bad_bot hdr_sub(User-Agent) -i UnisterBot
+acl bad_bot hdr_sub(User-Agent) -i UniversalFeedParser
+acl bad_bot hdr_sub(User-Agent) -i Unshorten\.It
+acl bad_bot hdr_sub(User-Agent) -i Untiny
+acl bad_bot hdr_sub(User-Agent) -i UnwindFetchor
 acl bad_bot hdr_sub(User-Agent) -i Upflow
-acl bad_bot hdr_sub(User-Agent) -i Uptime-Kuma
-acl bad_bot hdr_sub(User-Agent) -i UptimeRobot
-acl bad_bot hdr_sub(User-Agent) -i Uptimebot\.org
-acl bad_bot hdr_sub(User-Agent) -i UsineNouvelleCrawler
-acl bad_bot hdr_sub(User-Agent) -i VKRobot
-acl bad_bot hdr_sub(User-Agent) -i Validator\.nu
-acl bad_bot hdr_sub(User-Agent) -i Valve\/Steam
+acl bad_bot hdr_sub(User-Agent) -i Uptimia
+acl bad_bot hdr_sub(User-Agent) -i UrlTrends Ranking Updater
+acl bad_bot hdr_sub(User-Agent) -i Urlcheckr
+acl bad_bot hdr_sub(User-Agent) -i Urlstat
+acl bad_bot hdr_sub(User-Agent) -i V-BOT
+acl bad_bot hdr_sub(User-Agent) -i VB Project
+acl bad_bot hdr_sub(User-Agent) -i VB\ Project
+acl bad_bot hdr_sub(User-Agent) -i VSAgent\/
+acl bad_bot hdr_sub(User-Agent) -i VSB-TUO\/
+acl bad_bot hdr_sub(User-Agent) -i VYU2
+acl bad_bot hdr_sub(User-Agent) -i Vacuum
+acl bad_bot hdr_sub(User-Agent) -i Vagabondo
 acl bad_bot hdr_sub(User-Agent) -i VelenPublicWebCrawler
-acl bad_bot hdr_sub(User-Agent) -i Veoozbot
-acl bad_bot hdr_sub(User-Agent) -i Vercelbot
-acl bad_bot hdr_sub(User-Agent) -i Viber
-acl bad_bot hdr_sub(User-Agent) -i Vigil\/
-acl bad_bot hdr_sub(User-Agent) -i VoluumDSP-content-bot
+acl bad_bot hdr_sub(User-Agent) -i VeriCiteCrawler
+acl bad_bot hdr_sub(User-Agent) -i Verity
+acl bad_bot hdr_sub(User-Agent) -i VidibleScraper
+acl bad_bot hdr_sub(User-Agent) -i Virusdie
+acl bad_bot hdr_sub(User-Agent) -i Visual Rights Group
+acl bad_bot hdr_sub(User-Agent) -i VoidEYE
+acl bad_bot hdr_sub(User-Agent) -i Voil
+acl bad_bot hdr_sub(User-Agent) -i Voltron
+acl bad_bot hdr_sub(User-Agent) -i Vulnbusters Meter
 acl bad_bot hdr_sub(User-Agent) -i W3C-checklink
 acl bad_bot hdr_sub(User-Agent) -i W3C-mobileOK
-acl bad_bot hdr_sub(User-Agent) -i W3C_CSS_Validator
-acl bad_bot hdr_sub(User-Agent) -i W3C_I18n-Checker
 acl bad_bot hdr_sub(User-Agent) -i W3C_Unicorn
-acl bad_bot hdr_sub(User-Agent) -i W3C_Validator
-acl bad_bot hdr_sub(User-Agent) -i WeSEE:Search
+acl bad_bot hdr_sub(User-Agent) -i WAC-OFU
+acl bad_bot hdr_sub(User-Agent) -i WASALive-Bot
+acl bad_bot hdr_sub(User-Agent) -i WBSearchBot
+acl bad_bot hdr_sub(User-Agent) -i WDT\.io
+acl bad_bot hdr_sub(User-Agent) -i WEBDAV
+acl bad_bot hdr_sub(User-Agent) -i WEPA
+acl bad_bot hdr_sub(User-Agent) -i WISENutbot
+acl bad_bot hdr_sub(User-Agent) -i WP Engine Install Performance API
+acl bad_bot hdr_sub(User-Agent) -i WP Rocket
+acl bad_bot hdr_sub(User-Agent) -i WPScan
+acl bad_bot hdr_sub(User-Agent) -i WWW-Collector-E
+acl bad_bot hdr_sub(User-Agent) -i WWW-Mechanize
+acl bad_bot hdr_sub(User-Agent) -i WWW::Document
+acl bad_bot hdr_sub(User-Agent) -i WWW::Mechanize
+acl bad_bot hdr_sub(User-Agent) -i WWWOFFLE
+acl bad_bot hdr_sub(User-Agent) -i WakeletLinkExpander
+acl bad_bot hdr_sub(User-Agent) -i Wallpapers
+acl bad_bot hdr_sub(User-Agent) -i Wallpapers/3.0
+acl bad_bot hdr_sub(User-Agent) -i WallpapersHD
+acl bad_bot hdr_sub(User-Agent) -i Wallpapers\/[0-9]+
+acl bad_bot hdr_sub(User-Agent) -i Wappalyzer
+acl bad_bot hdr_sub(User-Agent) -i WatchMouse
+acl bad_bot hdr_sub(User-Agent) -i WbSrch\/
+acl bad_bot hdr_sub(User-Agent) -i WeLikeLinks
+acl bad_bot hdr_sub(User-Agent) -i WeSEE
+acl bad_bot hdr_sub(User-Agent) -i Web Auto
+acl bad_bot hdr_sub(User-Agent) -i Web Collage
+acl bad_bot hdr_sub(User-Agent) -i Web Enhancer
+acl bad_bot hdr_sub(User-Agent) -i Web Fetch
+acl bad_bot hdr_sub(User-Agent) -i Web Fuck
+acl bad_bot hdr_sub(User-Agent) -i Web Pix
+acl bad_bot hdr_sub(User-Agent) -i Web Sauger
+acl bad_bot hdr_sub(User-Agent) -i Web Sucker
+acl bad_bot hdr_sub(User-Agent) -i Web spyder
+acl bad_bot hdr_sub(User-Agent) -i Web-sniffer
+acl bad_bot hdr_sub(User-Agent) -i WebAuto
+acl bad_bot hdr_sub(User-Agent) -i WebBandit
+acl bad_bot hdr_sub(User-Agent) -i WebCapture
+acl bad_bot hdr_sub(User-Agent) -i WebClient\/
+acl bad_bot hdr_sub(User-Agent) -i WebCollage
+acl bad_bot hdr_sub(User-Agent) -i WebCookies
+acl bad_bot hdr_sub(User-Agent) -i WebCopier
+acl bad_bot hdr_sub(User-Agent) -i WebCorp
 acl bad_bot hdr_sub(User-Agent) -i WebDataStats
-acl bad_bot hdr_sub(User-Agent) -i WellKnownBot
+acl bad_bot hdr_sub(User-Agent) -i WebDoc
+acl bad_bot hdr_sub(User-Agent) -i WebEnhancer
+acl bad_bot hdr_sub(User-Agent) -i WebFetch
+acl bad_bot hdr_sub(User-Agent) -i WebFuck
+acl bad_bot hdr_sub(User-Agent) -i WebGazer
+acl bad_bot hdr_sub(User-Agent) -i WebGo IS
+acl bad_bot hdr_sub(User-Agent) -i WebGo\ IS
+acl bad_bot hdr_sub(User-Agent) -i WebImageCollector
+acl bad_bot hdr_sub(User-Agent) -i WebImages
+acl bad_bot hdr_sub(User-Agent) -i WebIndex
+acl bad_bot hdr_sub(User-Agent) -i WebLeacher
+acl bad_bot hdr_sub(User-Agent) -i WebPix
+acl bad_bot hdr_sub(User-Agent) -i WebReaper
+acl bad_bot hdr_sub(User-Agent) -i WebSauger
+acl bad_bot hdr_sub(User-Agent) -i WebSniffer
+acl bad_bot hdr_sub(User-Agent) -i WebStripper
+acl bad_bot hdr_sub(User-Agent) -i WebSucker
+acl bad_bot hdr_sub(User-Agent) -i WebThumbnail
+acl bad_bot hdr_sub(User-Agent) -i WebWhacker
+acl bad_bot hdr_sub(User-Agent) -i WebZIP
+acl bad_bot hdr_sub(User-Agent) -i Web\ Auto
+acl bad_bot hdr_sub(User-Agent) -i Web\ Collage
+acl bad_bot hdr_sub(User-Agent) -i Web\ Enhancer
+acl bad_bot hdr_sub(User-Agent) -i Web\ Fetch
+acl bad_bot hdr_sub(User-Agent) -i Web\ Fuck
+acl bad_bot hdr_sub(User-Agent) -i Web\ Pix
+acl bad_bot hdr_sub(User-Agent) -i Web\ Sauger
+acl bad_bot hdr_sub(User-Agent) -i Web\ Sucker
+acl bad_bot hdr_sub(User-Agent) -i Webalta
+acl bad_bot hdr_sub(User-Agent) -i Webauskunft
+acl bad_bot hdr_sub(User-Agent) -i WebmasterWorldForumBot
+acl bad_bot hdr_sub(User-Agent) -i Webshag
+acl bad_bot hdr_sub(User-Agent) -i Webshot
+acl bad_bot hdr_sub(User-Agent) -i Website Quester
+acl bad_bot hdr_sub(User-Agent) -i WebsiteExtractor
+acl bad_bot hdr_sub(User-Agent) -i WebsiteQuester
+acl bad_bot hdr_sub(User-Agent) -i Website\ Quester
+acl bad_bot hdr_sub(User-Agent) -i Websnapr
+acl bad_bot hdr_sub(User-Agent) -i Webster
+acl bad_bot hdr_sub(User-Agent) -i Webthumb\/
+acl bad_bot hdr_sub(User-Agent) -i Wfuzz\/
+acl bad_bot hdr_sub(User-Agent) -i Whack
+acl bad_bot hdr_sub(User-Agent) -i Whacker
+acl bad_bot hdr_sub(User-Agent) -i WhatCMS
+acl bad_bot hdr_sub(User-Agent) -i WhatWeb
 acl bad_bot hdr_sub(User-Agent) -i WhatsApp
+acl bad_bot hdr_sub(User-Agent) -i WhatsMyIP
+acl bad_bot hdr_sub(User-Agent) -i Whatweb
+acl bad_bot hdr_sub(User-Agent) -i WhereGoes\?
+acl bad_bot hdr_sub(User-Agent) -i Whibse
+acl bad_bot hdr_sub(User-Agent) -i WhoAPI\/
+acl bad_bot hdr_sub(User-Agent) -i WhoRunsCoinHive
+acl bad_bot hdr_sub(User-Agent) -i Whynder Magnet
+acl bad_bot hdr_sub(User-Agent) -i Widow
+acl bad_bot hdr_sub(User-Agent) -i WinHTTP\/
+acl bad_bot hdr_sub(User-Agent) -i WinHTTrack
+acl bad_bot hdr_sub(User-Agent) -i WinHttp-Autoproxy-Service
+acl bad_bot hdr_sub(User-Agent) -i WinPodder
+acl bad_bot hdr_sub(User-Agent) -i Windows-RSS-Platform
+acl bad_bot hdr_sub(User-Agent) -i WiseGuys\ Robot
+acl bad_bot hdr_sub(User-Agent) -i Woko
+acl bad_bot hdr_sub(User-Agent) -i Wolfram HTTPClient
+acl bad_bot hdr_sub(User-Agent) -i Wonderbot
+acl bad_bot hdr_sub(User-Agent) -i Woobot
 acl bad_bot hdr_sub(User-Agent) -i WordPress\/
-acl bad_bot hdr_sub(User-Agent) -i WordupInfoSearch
+acl bad_bot hdr_sub(User-Agent) -i Word\/
+acl bad_bot hdr_sub(User-Agent) -i WordupinfoSearch
+acl bad_bot hdr_sub(User-Agent) -i Wotbox
+acl bad_bot hdr_sub(User-Agent) -i Wprecon
+acl bad_bot hdr_sub(User-Agent) -i Wtrace
+acl bad_bot hdr_sub(User-Agent) -i XING-contenttabreceiver
+acl bad_bot hdr_sub(User-Agent) -i Xaldon\ WebSpider
+acl bad_bot hdr_sub(User-Agent) -i Xaldon_WebSpider
+acl bad_bot hdr_sub(User-Agent) -i XaxisSemanticsClassifier
+acl bad_bot hdr_sub(User-Agent) -i XenForo\/
+acl bad_bot hdr_sub(User-Agent) -i Xenu
 acl bad_bot hdr_sub(User-Agent) -i Xenu Link Sleuth
-acl bad_bot hdr_sub(User-Agent) -i Y!J
-acl bad_bot hdr_sub(User-Agent) -i YaK\/
+acl bad_bot hdr_sub(User-Agent) -i Y!J-[A-Z][A-Z][A-Z]
+acl bad_bot hdr_sub(User-Agent) -i YP\.PL
+acl bad_bot hdr_sub(User-Agent) -i Yaanb
 acl bad_bot hdr_sub(User-Agent) -i Yahoo Link Preview
-acl bad_bot hdr_sub(User-Agent) -i YandexRenderResourcesBot\/
-acl bad_bot hdr_sub(User-Agent) -i Yellowbrandprotectionbot
-acl bad_bot hdr_sub(User-Agent) -i Yeti
-acl bad_bot hdr_sub(User-Agent) -i YisouSpider
-acl bad_bot hdr_sub(User-Agent) -i YouBot
+acl bad_bot hdr_sub(User-Agent) -i YahooCacheSystem
+acl bad_bot hdr_sub(User-Agent) -i YahooMailProxy
+acl bad_bot hdr_sub(User-Agent) -i YahooYSMcm
+acl bad_bot hdr_sub(User-Agent) -i YandeG
+acl bad_bot hdr_sub(User-Agent) -i Yandex(?!Search)
+acl bad_bot hdr_sub(User-Agent) -i Yo-yo
+acl bad_bot hdr_sub(User-Agent) -i YoYs\.net
+acl bad_bot hdr_sub(User-Agent) -i Yoleo Consumer
+acl bad_bot hdr_sub(User-Agent) -i YottaaMonitor
+acl bad_bot hdr_sub(User-Agent) -i YoudaoBot
+acl bad_bot hdr_sub(User-Agent) -i Your-Website-Sucks
 acl bad_bot hdr_sub(User-Agent) -i Zabbix
+acl bad_bot hdr_sub(User-Agent) -i Zade
+acl bad_bot hdr_sub(User-Agent) -i Zapier
+acl bad_bot hdr_sub(User-Agent) -i Zauba
+acl bad_bot hdr_sub(User-Agent) -i Zemanta Aggregator
+acl bad_bot hdr_sub(User-Agent) -i Zend\\Http\\Client
+acl bad_bot hdr_sub(User-Agent) -i Zend_Http_Client
+acl bad_bot hdr_sub(User-Agent) -i Zermelo
+acl bad_bot hdr_sub(User-Agent) -i Zeus
+acl bad_bot hdr_sub(User-Agent) -i Zeus 
+acl bad_bot hdr_sub(User-Agent) -i Zitebot
+acl bad_bot hdr_sub(User-Agent) -i ZmEu
+acl bad_bot hdr_sub(User-Agent) -i ZnHTTP
+acl bad_bot hdr_sub(User-Agent) -i ZnajdzFoto
+acl bad_bot hdr_sub(User-Agent) -i Zombie\.js
 acl bad_bot hdr_sub(User-Agent) -i ZoomBot
+acl bad_bot hdr_sub(User-Agent) -i Zoom\.Mac
 acl bad_bot hdr_sub(User-Agent) -i ZoominfoBot
+acl bad_bot hdr_sub(User-Agent) -i ZoteroTranslationServer
 acl bad_bot hdr_sub(User-Agent) -i ZumBot
-acl bad_bot hdr_sub(User-Agent) -i ZuperlistBot\/
-acl bad_bot hdr_sub(User-Agent) -i [Cc]urebot
-acl bad_bot hdr_sub(User-Agent) -i [cC]laude[bB]ot
-acl bad_bot hdr_sub(User-Agent) -i [pP]ingdom
-acl bad_bot hdr_sub(User-Agent) -i [wW]get
-acl bad_bot hdr_sub(User-Agent) -i ^Apache-HttpClient
-acl bad_bot hdr_sub(User-Agent) -i ^BW\/
-acl bad_bot hdr_sub(User-Agent) -i ^LCC 
-acl bad_bot hdr_sub(User-Agent) -i ^PHP-Curl-Class
-acl bad_bot hdr_sub(User-Agent) -i ^curl
-acl bad_bot hdr_sub(User-Agent) -i acapbot
-acl bad_bot hdr_sub(User-Agent) -i acoonbot
-acl bad_bot hdr_sub(User-Agent) -i adbeat_bot
+acl bad_bot hdr_sub(User-Agent) -i ZyBorg
+acl bad_bot hdr_sub(User-Agent) -i [a-z0-9\-_]*(bot|crawl|archiver|transcoder|spider|uptime|validator|fetcher|cron|checker|reader|extractor|monitoring|analyzer|scraper)
+acl bad_bot hdr_sub(User-Agent) -i ^Aether
+acl bad_bot hdr_sub(User-Agent) -i ^Amazon CloudFront
+acl bad_bot hdr_sub(User-Agent) -i ^Amazon Simple Notification Service Agent$
+acl bad_bot hdr_sub(User-Agent) -i ^Amazon-Route53-Health-Check-Service
+acl bad_bot hdr_sub(User-Agent) -i ^COMODO DCV
+acl bad_bot hdr_sub(User-Agent) -i ^Calypso v\/
+acl bad_bot hdr_sub(User-Agent) -i ^Corax
+acl bad_bot hdr_sub(User-Agent) -i ^DHSH
+acl bad_bot hdr_sub(User-Agent) -i ^DangDang
+acl bad_bot hdr_sub(User-Agent) -i ^DavClnt
+acl bad_bot hdr_sub(User-Agent) -i ^Expanse
+acl bad_bot hdr_sub(User-Agent) -i ^FDM 
+acl bad_bot hdr_sub(User-Agent) -i ^Goose\/
+acl bad_bot hdr_sub(User-Agent) -i ^Grabber
+acl bad_bot hdr_sub(User-Agent) -i ^Gradle\/
+acl bad_bot hdr_sub(User-Agent) -i ^HTTPClient\/
+acl bad_bot hdr_sub(User-Agent) -i ^HTTPing
+acl bad_bot hdr_sub(User-Agent) -i ^Java\/
+acl bad_bot hdr_sub(User-Agent) -i ^Jeode\/
+acl bad_bot hdr_sub(User-Agent) -i ^Jetty\/
+acl bad_bot hdr_sub(User-Agent) -i ^Mail\/
+acl bad_bot hdr_sub(User-Agent) -i ^Mget
+acl bad_bot hdr_sub(User-Agent) -i ^Microsoft URL Control
+acl bad_bot hdr_sub(User-Agent) -i ^Mikrotik\/
+acl bad_bot hdr_sub(User-Agent) -i ^NG\/[0-9\.]
+acl bad_bot hdr_sub(User-Agent) -i ^NING\/
+acl bad_bot hdr_sub(User-Agent) -i ^Netlab360
+acl bad_bot hdr_sub(User-Agent) -i ^Nuclei
+acl bad_bot hdr_sub(User-Agent) -i ^PHP-AYMAPI\/
+acl bad_bot hdr_sub(User-Agent) -i ^PHP\/
+acl bad_bot hdr_sub(User-Agent) -i ^RMA\/
+acl bad_bot hdr_sub(User-Agent) -i ^Ruby|Ruby\/[0-9]
+acl bad_bot hdr_sub(User-Agent) -i ^Swurl 
+acl bad_bot hdr_sub(User-Agent) -i ^TLS tester 
+acl bad_bot hdr_sub(User-Agent) -i ^VSE\/[0-9]
+acl bad_bot hdr_sub(User-Agent) -i ^WordPress\.com
+acl bad_bot hdr_sub(User-Agent) -i ^XRL\/[0-9]
+acl bad_bot hdr_sub(User-Agent) -i ^ZmEu
+acl bad_bot hdr_sub(User-Agent) -i ^b0t$
+acl bad_bot hdr_sub(User-Agent) -i ^bluefish 
+acl bad_bot hdr_sub(User-Agent) -i ^docker\/[0-9]
+acl bad_bot hdr_sub(User-Agent) -i ^git\/
+acl bad_bot hdr_sub(User-Agent) -i ^npm\/
+acl bad_bot hdr_sub(User-Agent) -i ^pip\/
+acl bad_bot hdr_sub(User-Agent) -i ^pnpm\/
+acl bad_bot hdr_sub(User-Agent) -i ^twine\/
+acl bad_bot hdr_sub(User-Agent) -i ^ureq
+acl bad_bot hdr_sub(User-Agent) -i a3logics\.in
+acl bad_bot hdr_sub(User-Agent) -i a\.pr-cy\.ru
+acl bad_bot hdr_sub(User-Agent) -i aboutthedomain
+acl bad_bot hdr_sub(User-Agent) -i acebookexternalhit\/
+acl bad_bot hdr_sub(User-Agent) -i acoon
+acl bad_bot hdr_sub(User-Agent) -i acrylicapps\.com\/pulp
+acl bad_bot hdr_sub(User-Agent) -i adbeat
+acl bad_bot hdr_sub(User-Agent) -i adressendeutschland
+acl bad_bot hdr_sub(User-Agent) -i adreview\/
 acl bad_bot hdr_sub(User-Agent) -i adscanner
-acl bad_bot hdr_sub(User-Agent) -i aiHitBot
-acl bad_bot hdr_sub(User-Agent) -i aiohttp
-acl bad_bot hdr_sub(User-Agent) -i antibot
-acl bad_bot hdr_sub(User-Agent) -i arabot
-acl bad_bot hdr_sub(User-Agent) -i archive\.org_bot
-acl bad_bot hdr_sub(User-Agent) -i awesomecrawler
-acl bad_bot hdr_sub(User-Agent) -i axios
-acl bad_bot hdr_sub(User-Agent) -i backlinkcrawler
-acl bad_bot hdr_sub(User-Agent) -i betaBot
-acl bad_bot hdr_sub(User-Agent) -i bidswitchbot
-acl bad_bot hdr_sub(User-Agent) -i bingbot
+acl bad_bot hdr_sub(User-Agent) -i adstxt-worker
+acl bad_bot hdr_sub(User-Agent) -i adstxt\.com
+acl bad_bot hdr_sub(User-Agent) -i affilimate-puppeteer
+acl bad_bot hdr_sub(User-Agent) -i agentslug
+acl bad_bot hdr_sub(User-Agent) -i aihit
+acl bad_bot hdr_sub(User-Agent) -i aiohttp\/
+acl bad_bot hdr_sub(User-Agent) -i akka-http\/
+acl bad_bot hdr_sub(User-Agent) -i akula\/
+acl bad_bot hdr_sub(User-Agent) -i alertra
+acl bad_bot hdr_sub(User-Agent) -i alexa site audit
+acl bad_bot hdr_sub(User-Agent) -i allloadin
+acl bad_bot hdr_sub(User-Agent) -i alyze\.info
+acl bad_bot hdr_sub(User-Agent) -i amagit
+acl bad_bot hdr_sub(User-Agent) -i annotate_google
+acl bad_bot hdr_sub(User-Agent) -i anthropic-ai
+acl bad_bot hdr_sub(User-Agent) -i apimon\.de
+acl bad_bot hdr_sub(User-Agent) -i arachnode
+acl bad_bot hdr_sub(User-Agent) -i archive.org_bot
+acl bad_bot hdr_sub(User-Agent) -i aria2
+acl bad_bot hdr_sub(User-Agent) -i arquivo-web-crawler
+acl bad_bot hdr_sub(User-Agent) -i asafaweb
+acl bad_bot hdr_sub(User-Agent) -i asynchttp
+acl bad_bot hdr_sub(User-Agent) -i attohttpc
+acl bad_bot hdr_sub(User-Agent) -i autocite
+acl bad_bot hdr_sub(User-Agent) -i autoemailspider
+acl bad_bot hdr_sub(User-Agent) -i awin\.com
+acl bad_bot hdr_sub(User-Agent) -i axios\/
+acl bad_bot hdr_sub(User-Agent) -i backlink-check
+acl bad_bot hdr_sub(User-Agent) -i baidu\.com
+acl bad_bot hdr_sub(User-Agent) -i basicstate
+acl bad_bot hdr_sub(User-Agent) -i baypup\/
+acl bad_bot hdr_sub(User-Agent) -i biNu image cacher
+acl bad_bot hdr_sub(User-Agent) -i biglotron
 acl bad_bot hdr_sub(User-Agent) -i binlar
-acl bad_bot hdr_sub(User-Agent) -i bitlybot
-acl bad_bot hdr_sub(User-Agent) -i blogmuraBot
-acl bad_bot hdr_sub(User-Agent) -i bnf\.fr_bot
-acl bad_bot hdr_sub(User-Agent) -i bot-pge\.chlooe\.com
-acl bad_bot hdr_sub(User-Agent) -i botify
-acl bad_bot hdr_sub(User-Agent) -i brainobot
-acl bad_bot hdr_sub(User-Agent) -i buzzbot
-acl bad_bot hdr_sub(User-Agent) -i cXensebot
-acl bad_bot hdr_sub(User-Agent) -i careerbot
-acl bad_bot hdr_sub(User-Agent) -i centurybot
+acl bad_bot hdr_sub(User-Agent) -i biz_Directory
+acl bad_bot hdr_sub(User-Agent) -i boitho\.com-dc
+acl bad_bot hdr_sub(User-Agent) -i caam dot crwlr at gmail dot com
+acl bad_bot hdr_sub(User-Agent) -i catexplorador
+acl bad_bot hdr_sub(User-Agent) -i censys
+acl bad_bot hdr_sub(User-Agent) -i cf-facebook
+acl bad_bot hdr_sub(User-Agent) -i cg-eye
 acl bad_bot hdr_sub(User-Agent) -i changedetection
-acl bad_bot hdr_sub(User-Agent) -i check_http
-acl bad_bot hdr_sub(User-Agent) -i citeseerxbot
+acl bad_bot hdr_sub(User-Agent) -i chatterino-api-cache
+acl bad_bot hdr_sub(User-Agent) -i checkprivacy
+acl bad_bot hdr_sub(User-Agent) -i chkme\.com
+acl bad_bot hdr_sub(User-Agent) -i clark-crawler
+acl bad_bot hdr_sub(User-Agent) -i clips\.ua\.ac\.be
+acl bad_bot hdr_sub(User-Agent) -i cmcm\.com
 acl bad_bot hdr_sub(User-Agent) -i coccoc
-acl bad_bot hdr_sub(User-Agent) -i collection@infegy\.com
-acl bad_bot hdr_sub(User-Agent) -i content crawler spider
-acl bad_bot hdr_sub(User-Agent) -i contxbot
+acl bad_bot hdr_sub(User-Agent) -i coccocbot
+acl bad_bot hdr_sub(User-Agent) -i cognitiveseo
+acl bad_bot hdr_sub(User-Agent) -i cohere-ai
+acl bad_bot hdr_sub(User-Agent) -i colly -
+acl bad_bot hdr_sub(User-Agent) -i commonscan
+acl bad_bot hdr_sub(User-Agent) -i contactbigdatafr
+acl bad_bot hdr_sub(User-Agent) -i contentkingapp
 acl bad_bot hdr_sub(User-Agent) -i convera
+acl bad_bot hdr_sub(User-Agent) -i copyright sheriff
+acl bad_bot hdr_sub(User-Agent) -i cortex\/
 acl bad_bot hdr_sub(User-Agent) -i crawler4j
-acl bad_bot hdr_sub(User-Agent) -i datagnionbot
-acl bad_bot hdr_sub(User-Agent) -i dcrawl
-acl bad_bot hdr_sub(User-Agent) -i deadlinkchecker
-acl bad_bot hdr_sub(User-Agent) -i deepnoc
-acl bad_bot hdr_sub(User-Agent) -i developers\.google\.com\/\+\/web\/snippet
-acl bad_bot hdr_sub(User-Agent) -i discobot
-acl bad_bot hdr_sub(User-Agent) -i domaincrawler
-acl bad_bot hdr_sub(User-Agent) -i dotbot
+acl bad_bot hdr_sub(User-Agent) -i curb
+acl bad_bot hdr_sub(User-Agent) -i curl
+acl bad_bot hdr_sub(User-Agent) -i cuwhois\/
+acl bad_bot hdr_sub(User-Agent) -i cybo\.com
+acl bad_bot hdr_sub(User-Agent) -i dBpoweramp
+acl bad_bot hdr_sub(User-Agent) -i dataforseobot
+acl bad_bot hdr_sub(User-Agent) -i dataprovider
+acl bad_bot hdr_sub(User-Agent) -i ddline
+acl bad_bot hdr_sub(User-Agent) -i deeris
+acl bad_bot hdr_sub(User-Agent) -i delve\.ai
+acl bad_bot hdr_sub(User-Agent) -i demandbase-bot
+acl bad_bot hdr_sub(User-Agent) -i developers\.google\.com\/\+\/web\/snippet\/
+acl bad_bot hdr_sub(User-Agent) -i dlvr
+acl bad_bot hdr_sub(User-Agent) -i docoloc
+acl bad_bot hdr_sub(User-Agent) -i dotMailer content retrieval
+acl bad_bot hdr_sub(User-Agent) -i dotSemantic
+acl bad_bot hdr_sub(User-Agent) -i downforeveryoneorjustme
+acl bad_bot hdr_sub(User-Agent) -i downnotifier
 acl bad_bot hdr_sub(User-Agent) -i drupact
-acl bad_bot hdr_sub(User-Agent) -i e\.ventures Investment Crawler
+acl bad_bot hdr_sub(User-Agent) -i dubaiindex
+acl bad_bot hdr_sub(User-Agent) -i eCairn-Grabber
+acl bad_bot hdr_sub(User-Agent) -i eCatch
+acl bad_bot hdr_sub(User-Agent) -i eContext\/
 acl bad_bot hdr_sub(User-Agent) -i ec2linkfinder
-acl bad_bot hdr_sub(User-Agent) -i edisterbot
-acl bad_bot hdr_sub(User-Agent) -i electricmonk
-acl bad_bot hdr_sub(User-Agent) -i elisabot
-acl bad_bot hdr_sub(User-Agent) -i epicbot
-acl bad_bot hdr_sub(User-Agent) -i eright
+acl bad_bot hdr_sub(User-Agent) -i elefent
+acl bad_bot hdr_sub(User-Agent) -i endo\/
 acl bad_bot hdr_sub(User-Agent) -i europarchive\.org
-acl bad_bot hdr_sub(User-Agent) -i ev-crawler\/
 acl bad_bot hdr_sub(User-Agent) -i evc-batch
-acl bad_bot hdr_sub(User-Agent) -i exabot
+acl bad_bot hdr_sub(User-Agent) -i everyfeed-spider
+acl bad_bot hdr_sub(User-Agent) -i exif
 acl bad_bot hdr_sub(User-Agent) -i ezooms
-acl bad_bot hdr_sub(User-Agent) -i facebookcatalog\/
+acl bad_bot hdr_sub(User-Agent) -i facebookcatalog
 acl bad_bot hdr_sub(User-Agent) -i facebookexternalhit
-acl bad_bot hdr_sub(User-Agent) -i fedoraplanet
-acl bad_bot hdr_sub(User-Agent) -i feedbot
-acl bad_bot hdr_sub(User-Agent) -i filterdb\.iss\.net\/crawler
+acl bad_bot hdr_sub(User-Agent) -i facebookexternalua
+acl bad_bot hdr_sub(User-Agent) -i facebookplatform
+acl bad_bot hdr_sub(User-Agent) -i facebookscraper
+acl bad_bot hdr_sub(User-Agent) -i fairshare
+acl bad_bot hdr_sub(User-Agent) -i fasthttp
+acl bad_bot hdr_sub(User-Agent) -i faviconarchive
+acl bad_bot hdr_sub(User-Agent) -i faviconkit
+acl bad_bot hdr_sub(User-Agent) -i feeder
+acl bad_bot hdr_sub(User-Agent) -i feeltiptop
 acl bad_bot hdr_sub(User-Agent) -i findlink
 acl bad_bot hdr_sub(User-Agent) -i findthatfile
-acl bad_bot hdr_sub(User-Agent) -i findxbot
 acl bad_bot hdr_sub(User-Agent) -i fluffy
-acl bad_bot hdr_sub(User-Agent) -i fr-crawler
-acl bad_bot hdr_sub(User-Agent) -i fuelbot
+acl bad_bot hdr_sub(User-Agent) -i flynxapp
+acl bad_bot hdr_sub(User-Agent) -i forensiq
+acl bad_bot hdr_sub(User-Agent) -i fragFINN\.de
+acl bad_bot hdr_sub(User-Agent) -i free thumbnails
+acl bad_bot hdr_sub(User-Agent) -i frontman
 acl bad_bot hdr_sub(User-Agent) -i g00g1e\.net
-acl bad_bot hdr_sub(User-Agent) -i g2reader-bot
-acl bad_bot hdr_sub(User-Agent) -i gnam gnam spider
+acl bad_bot hdr_sub(User-Agent) -i gSOAP\/
+acl bad_bot hdr_sub(User-Agent) -i ganarvisitas
+acl bad_bot hdr_sub(User-Agent) -i gdnplus\.com
+acl bad_bot hdr_sub(User-Agent) -i geek-tools
+acl bad_bot hdr_sub(User-Agent) -i getprismatic
+acl bad_bot hdr_sub(User-Agent) -i getroot
+acl bad_bot hdr_sub(User-Agent) -i github-camo
+acl bad_bot hdr_sub(User-Agent) -i github\.com
+acl bad_bot hdr_sub(User-Agent) -i go-mtasts\/
+acl bad_bot hdr_sub(User-Agent) -i gobuster
+acl bad_bot hdr_sub(User-Agent) -i gobyus
+acl bad_bot hdr_sub(User-Agent) -i gofetch
+acl bad_bot hdr_sub(User-Agent) -i gooblog
 acl bad_bot hdr_sub(User-Agent) -i google-xrawler
-acl bad_bot hdr_sub(User-Agent) -i grub\.org
-acl bad_bot hdr_sub(User-Agent) -i gslfbot
+acl bad_bot hdr_sub(User-Agent) -i gopher
+acl bad_bot hdr_sub(User-Agent) -i gosquared-thumbnailer
+acl bad_bot hdr_sub(User-Agent) -i grabify
+acl bad_bot hdr_sub(User-Agent) -i grokkit
+acl bad_bot hdr_sub(User-Agent) -i grouphigh
+acl bad_bot hdr_sub(User-Agent) -i grub-client
+acl bad_bot hdr_sub(User-Agent) -i gvfs\/
+acl bad_bot hdr_sub(User-Agent) -i hackney\/
+acl bad_bot hdr_sub(User-Agent) -i help@dataminr\.com
 acl bad_bot hdr_sub(User-Agent) -i heritrix
+acl bad_bot hdr_sub(User-Agent) -i historious
+acl bad_bot hdr_sub(User-Agent) -i hkedcity
+acl bad_bot hdr_sub(User-Agent) -i hledejLevne\.cz
+acl bad_bot hdr_sub(User-Agent) -i hosterstats
+acl bad_bot hdr_sub(User-Agent) -i ht:\/\/check
+acl bad_bot hdr_sub(User-Agent) -i htdig
+acl bad_bot hdr_sub(User-Agent) -i htmlyse
+acl bad_bot hdr_sub(User-Agent) -i http-get
+acl bad_bot hdr_sub(User-Agent) -i http-kit
+acl bad_bot hdr_sub(User-Agent) -i http-request\/
+acl bad_bot hdr_sub(User-Agent) -i httpRequest
+acl bad_bot hdr_sub(User-Agent) -i http\.rb\/
 acl bad_bot hdr_sub(User-Agent) -i http_get
-acl bad_bot hdr_sub(User-Agent) -i https:\/\/developers\.cloudflare\.com\/security-center\/
+acl bad_bot hdr_sub(User-Agent) -i http_request2
+acl bad_bot hdr_sub(User-Agent) -i http_requester
+acl bad_bot hdr_sub(User-Agent) -i httphr
+acl bad_bot hdr_sub(User-Agent) -i httpscheck
+acl bad_bot hdr_sub(User-Agent) -i httpssites_power
 acl bad_bot hdr_sub(User-Agent) -i httpunit
-acl bad_bot hdr_sub(User-Agent) -i httpx
-acl bad_bot hdr_sub(User-Agent) -i hypestat
-acl bad_bot hdr_sub(User-Agent) -i hyscore\.io
-acl bad_bot hdr_sub(User-Agent) -i ia_archiver
+acl bad_bot hdr_sub(User-Agent) -i httrack
+acl bad_bot hdr_sub(User-Agent) -i huaweisymantec
+acl bad_bot hdr_sub(User-Agent) -i i2kconnect\/
+acl bad_bot hdr_sub(User-Agent) -i iGooglePortal
+acl bad_bot hdr_sub(User-Agent) -i iThemes Sync\/
+acl bad_bot hdr_sub(User-Agent) -i iZSearch
 acl bad_bot hdr_sub(User-Agent) -i ichiro
-acl bad_bot hdr_sub(User-Agent) -i imrbot
-acl bad_bot hdr_sub(User-Agent) -i infoobot
-acl bad_bot hdr_sub(User-Agent) -i inoreader
+acl bad_bot hdr_sub(User-Agent) -i igdeSpyder
+acl bad_bot hdr_sub(User-Agent) -i imagineeasy
+acl bad_bot hdr_sub(User-Agent) -i imgsizer
+acl bad_bot hdr_sub(User-Agent) -i inbound\.li parser
+acl bad_bot hdr_sub(User-Agent) -i infegy
+acl bad_bot hdr_sub(User-Agent) -i infohelfer
+acl bad_bot hdr_sub(User-Agent) -i inpwrd\.com
+acl bad_bot hdr_sub(User-Agent) -i instabid
 acl bad_bot hdr_sub(User-Agent) -i integromedb
-acl bad_bot hdr_sub(User-Agent) -i intelium_bot
-acl bad_bot hdr_sub(User-Agent) -i ip-web-crawler\.com
+acl bad_bot hdr_sub(User-Agent) -i internetVista monitor
+acl bad_bot hdr_sub(User-Agent) -i internetVista\ monitor
+acl bad_bot hdr_sub(User-Agent) -i internet_archive
+acl bad_bot hdr_sub(User-Agent) -i internetwache
+acl bad_bot hdr_sub(User-Agent) -i intraVnews
+acl bad_bot hdr_sub(User-Agent) -i iplabel
 acl bad_bot hdr_sub(User-Agent) -i ips-agent
+acl bad_bot hdr_sub(User-Agent) -i iqdb\/
+acl bad_bot hdr_sub(User-Agent) -i isUp\.li
+acl bad_bot hdr_sub(User-Agent) -i isitup\.org
 acl bad_bot hdr_sub(User-Agent) -i iskanie
-acl bad_bot hdr_sub(User-Agent) -i it2media-domain-crawler
-acl bad_bot hdr_sub(User-Agent) -i jpg-newsbot
-acl bad_bot hdr_sub(User-Agent) -i jyxobot
-acl bad_bot hdr_sub(User-Agent) -i lb-spider
-acl bad_bot hdr_sub(User-Agent) -i libwww-perl
-acl bad_bot hdr_sub(User-Agent) -i linkapediabot
+acl bad_bot hdr_sub(User-Agent) -i iubenda-radar
+acl bad_bot hdr_sub(User-Agent) -i janforman
+acl bad_bot hdr_sub(User-Agent) -i javelin\.io
+acl bad_bot hdr_sub(User-Agent) -i jobo
+acl bad_bot hdr_sub(User-Agent) -i khttp\/
+acl bad_bot hdr_sub(User-Agent) -i knows\.is
+acl bad_bot hdr_sub(User-Agent) -i kouio
+acl bad_bot hdr_sub(User-Agent) -i kube-probe
+acl bad_bot hdr_sub(User-Agent) -i kubectl
+acl bad_bot hdr_sub(User-Agent) -i kulturarw3
+acl bad_bot hdr_sub(User-Agent) -i leakix\.net
+acl bad_bot hdr_sub(User-Agent) -i letsencrypt
+acl bad_bot hdr_sub(User-Agent) -i libwww
+acl bad_bot hdr_sub(User-Agent) -i limber\.io
+acl bad_bot hdr_sub(User-Agent) -i link-check
+acl bad_bot hdr_sub(User-Agent) -i linkCheck
+acl bad_bot hdr_sub(User-Agent) -i link_thumbnailer
 acl bad_bot hdr_sub(User-Agent) -i linkdex
-acl bad_bot hdr_sub(User-Agent) -i lipperhey
-acl bad_bot hdr_sub(User-Agent) -i lkxscan
-acl bad_bot hdr_sub(User-Agent) -i lssbot
-acl bad_bot hdr_sub(User-Agent) -i lssrocketcrawler
+acl bad_bot hdr_sub(User-Agent) -i linkdexbot
+acl bad_bot hdr_sub(User-Agent) -i linkfluence
+acl bad_bot hdr_sub(User-Agent) -i linkpeek
+acl bad_bot hdr_sub(User-Agent) -i livedoor ScreenShot
+acl bad_bot hdr_sub(User-Agent) -i localsearch-web
+acl bad_bot hdr_sub(User-Agent) -i longurl-r-package
+acl bad_bot hdr_sub(User-Agent) -i looid\.com
+acl bad_bot hdr_sub(User-Agent) -i looksystems\.net
+acl bad_bot hdr_sub(User-Agent) -i lscache_runner
 acl bad_bot hdr_sub(User-Agent) -i ltx71
+acl bad_bot hdr_sub(User-Agent) -i lua-resty-http
+acl bad_bot hdr_sub(User-Agent) -i lwp-request
+acl bad_bot hdr_sub(User-Agent) -i lwp-trivial
+acl bad_bot hdr_sub(User-Agent) -i lycos
+acl bad_bot hdr_sub(User-Agent) -i mShots
+acl bad_bot hdr_sub(User-Agent) -i mabontland
 acl bad_bot hdr_sub(User-Agent) -i magpie-crawler
-acl bad_bot hdr_sub(User-Agent) -i mappydata
-acl bad_bot hdr_sub(User-Agent) -i memorybot
-acl bad_bot hdr_sub(User-Agent) -i meta-externalagent\/
-acl bad_bot hdr_sub(User-Agent) -i meta-externalfetcher\/
-acl bad_bot hdr_sub(User-Agent) -i mindUpBot
-acl bad_bot hdr_sub(User-Agent) -i minicrawler
-acl bad_bot hdr_sub(User-Agent) -i mlbot
-acl bad_bot hdr_sub(User-Agent) -i moatbot
-acl bad_bot hdr_sub(User-Agent) -i msnbot
-acl bad_bot hdr_sub(User-Agent) -i msrbot
-acl bad_bot hdr_sub(User-Agent) -i nerdybot
-acl bad_bot hdr_sub(User-Agent) -i netEstate NE Crawler
-acl bad_bot hdr_sub(User-Agent) -i netresearchserver
-acl bad_bot hdr_sub(User-Agent) -i newsharecounts
+acl bad_bot hdr_sub(User-Agent) -i makecontact\/
+acl bad_bot hdr_sub(User-Agent) -i marketinggrader
+acl bad_bot hdr_sub(User-Agent) -i masscan\/
+acl bad_bot hdr_sub(User-Agent) -i mattermost
+acl bad_bot hdr_sub(User-Agent) -i meanpathbot
+acl bad_bot hdr_sub(User-Agent) -i mediawords
+acl bad_bot hdr_sub(User-Agent) -i mio_httpc
+acl bad_bot hdr_sub(User-Agent) -i mixdata dot com
+acl bad_bot hdr_sub(User-Agent) -i mixed-content-scan
+acl bad_bot hdr_sub(User-Agent) -i mixnode
+acl bad_bot hdr_sub(User-Agent) -i mogimogi
+acl bad_bot hdr_sub(User-Agent) -i monitis
+acl bad_bot hdr_sub(User-Agent) -i montastic
+acl bad_bot hdr_sub(User-Agent) -i mowser
+acl bad_bot hdr_sub(User-Agent) -i muhstik-scan
+acl bad_bot hdr_sub(User-Agent) -i myseosnapshot
+acl bad_bot hdr_sub(User-Agent) -i nWormFeedFinder
+acl bad_bot hdr_sub(User-Agent) -i nagios
+acl bad_bot hdr_sub(User-Agent) -i nationalarchives
+acl bad_bot hdr_sub(User-Agent) -i nbertaupete95
+acl bad_bot hdr_sub(User-Agent) -i netEstate\ NE\ Crawler
+acl bad_bot hdr_sub(User-Agent) -i netresearch
+acl bad_bot hdr_sub(User-Agent) -i nettle
+acl bad_bot hdr_sub(User-Agent) -i newsme
 acl bad_bot hdr_sub(User-Agent) -i newspaper\/
-acl bad_bot hdr_sub(User-Agent) -i niki-bot
+acl bad_bot hdr_sub(User-Agent) -i nghttp2
+acl bad_bot hdr_sub(User-Agent) -i nineconnections
 acl bad_bot hdr_sub(User-Agent) -i node-fetch
-acl bad_bot hdr_sub(User-Agent) -i officestorebot
+acl bad_bot hdr_sub(User-Agent) -i node-superagent
+acl bad_bot hdr_sub(User-Agent) -i node-urllib
+acl bad_bot hdr_sub(User-Agent) -i node\.io
+acl bad_bot hdr_sub(User-Agent) -i nominet\.org\.uk
+acl bad_bot hdr_sub(User-Agent) -i nominet\.uk
+acl bad_bot hdr_sub(User-Agent) -i notifyninja
+acl bad_bot hdr_sub(User-Agent) -i nuhk
+acl bad_bot hdr_sub(User-Agent) -i nutch
+acl bad_bot hdr_sub(User-Agent) -i nyawc\/
+acl bad_bot hdr_sub(User-Agent) -i oBot
+acl bad_bot hdr_sub(User-Agent) -i oegp
 acl bad_bot hdr_sub(User-Agent) -i okhttp
 acl bad_bot hdr_sub(User-Agent) -i omgili
-acl bad_bot hdr_sub(User-Agent) -i online-webceo-bot
-acl bad_bot hdr_sub(User-Agent) -i openindexspider
-acl bad_bot hdr_sub(User-Agent) -i outbrain
+acl bad_bot hdr_sub(User-Agent) -i openai
+acl bad_bot hdr_sub(User-Agent) -i orion-semantics
+acl bad_bot hdr_sub(User-Agent) -i ow\.ly
+acl bad_bot hdr_sub(User-Agent) -i ownCloud News
+acl bad_bot hdr_sub(User-Agent) -i page scorer
 acl bad_bot hdr_sub(User-Agent) -i page2rss
+acl bad_bot hdr_sub(User-Agent) -i page\ scorer
+acl bad_bot hdr_sub(User-Agent) -i page_verifier
 acl bad_bot hdr_sub(User-Agent) -i panscient
-acl bad_bot hdr_sub(User-Agent) -i phpcrawl
-acl bad_bot hdr_sub(User-Agent) -i pinterest\.com\/bot
+acl bad_bot hdr_sub(User-Agent) -i parsijoo
+acl bad_bot hdr_sub(User-Agent) -i pcBrowser
+acl bad_bot hdr_sub(User-Agent) -i peerindex
+acl bad_bot hdr_sub(User-Agent) -i php-requests
+acl bad_bot hdr_sub(User-Agent) -i phpservermon
+acl bad_bot hdr_sub(User-Agent) -i ping\.blo\.gs
+acl bad_bot hdr_sub(User-Agent) -i pinterest\.com
+acl bad_bot hdr_sub(User-Agent) -i plumanalytics
+acl bad_bot hdr_sub(User-Agent) -i polaris\ version
+acl bad_bot hdr_sub(User-Agent) -i postano
+acl bad_bot hdr_sub(User-Agent) -i postfix-mta-sts-resolver
+acl bad_bot hdr_sub(User-Agent) -i postplanner\.com
 acl bad_bot hdr_sub(User-Agent) -i postrank
+acl bad_bot hdr_sub(User-Agent) -i probe-image-size
+acl bad_bot hdr_sub(User-Agent) -i probely\.com
+acl bad_bot hdr_sub(User-Agent) -i probethenet
+acl bad_bot hdr_sub(User-Agent) -i prospectb2b
 acl bad_bot hdr_sub(User-Agent) -i proximic
-acl bad_bot hdr_sub(User-Agent) -i psbot
-acl bad_bot hdr_sub(User-Agent) -i purebot
-acl bad_bot hdr_sub(User-Agent) -i python-opengraph
+acl bad_bot hdr_sub(User-Agent) -i pshtt, https scanning
+acl bad_bot hdr_sub(User-Agent) -i pulsetic\.com
+acl bad_bot hdr_sub(User-Agent) -i python-httpx
 acl bad_bot hdr_sub(User-Agent) -i python-requests
-acl bad_bot hdr_sub(User-Agent) -i redditbot
-acl bad_bot hdr_sub(User-Agent) -i rogerbot
-acl bad_bot hdr_sub(User-Agent) -i rssbot\/
-acl bad_bot hdr_sub(User-Agent) -i scribdbot
-acl bad_bot hdr_sub(User-Agent) -i search\.marginalia\.nu
-acl bad_bot hdr_sub(User-Agent) -i seekbot
-acl bad_bot hdr_sub(User-Agent) -i seewithkids
-acl bad_bot hdr_sub(User-Agent) -i semanticbot
-acl bad_bot hdr_sub(User-Agent) -i sempi\.tech
+acl bad_bot hdr_sub(User-Agent) -i queuedriver
+acl bad_bot hdr_sub(User-Agent) -i quic-go-HTTP\/
+acl bad_bot hdr_sub(User-Agent) -i redback\/
+acl bad_bot hdr_sub(User-Agent) -i request\.js
+acl bad_bot hdr_sub(User-Agent) -i reqwest\/
+acl bad_bot hdr_sub(User-Agent) -i ripz
+acl bad_bot hdr_sub(User-Agent) -i safe-agent-scanner
+acl bad_bot hdr_sub(User-Agent) -i sc-downloader
+acl bad_bot hdr_sub(User-Agent) -i scalaj-http
+acl bad_bot hdr_sub(User-Agent) -i scan\.lol
+acl bad_bot hdr_sub(User-Agent) -i scooter
+acl bad_bot hdr_sub(User-Agent) -i search\.thunderstone
+acl bad_bot hdr_sub(User-Agent) -i searchenginepromotionhelp
+acl bad_bot hdr_sub(User-Agent) -i semanticdiscovery
+acl bad_bot hdr_sub(User-Agent) -i semanticjuice
+acl bad_bot hdr_sub(User-Agent) -i sentry\/
+acl bad_bot hdr_sub(User-Agent) -i seo-nastroj\.cz
+acl bad_bot hdr_sub(User-Agent) -i seo4ajax
+acl bad_bot hdr_sub(User-Agent) -i seobility
+acl bad_bot hdr_sub(User-Agent) -i seocompany
 acl bad_bot hdr_sub(User-Agent) -i seoscanners
-acl bad_bot hdr_sub(User-Agent) -i seostar\.co
-acl bad_bot hdr_sub(User-Agent) -i serpstatbot\/
-acl bad_bot hdr_sub(User-Agent) -i sitebot
-acl bad_bot hdr_sub(User-Agent) -i siteexplorer\.info
-acl bad_bot hdr_sub(User-Agent) -i smtbot
-acl bad_bot hdr_sub(User-Agent) -i spbot
+acl bad_bot hdr_sub(User-Agent) -i seositecheckup
+acl bad_bot hdr_sub(User-Agent) -i seostar
+acl bad_bot hdr_sub(User-Agent) -i serpstatbot
+acl bad_bot hdr_sub(User-Agent) -i servernfo
+acl bad_bot hdr_sub(User-Agent) -i sexsearcher
+acl bad_bot hdr_sub(User-Agent) -i shortURL lengthener
+acl bad_bot hdr_sub(User-Agent) -i shrinktheweb
+acl bad_bot hdr_sub(User-Agent) -i siteripz
+acl bad_bot hdr_sub(User-Agent) -i sitexy\.com
+acl bad_bot hdr_sub(User-Agent) -i sli-systems\.com
+acl bad_bot hdr_sub(User-Agent) -i slider\.com
+acl bad_bot hdr_sub(User-Agent) -i slurp
+acl bad_bot hdr_sub(User-Agent) -i sniptracker
+acl bad_bot hdr_sub(User-Agent) -i sogou web
+acl bad_bot hdr_sub(User-Agent) -i sogouspider
+acl bad_bot hdr_sub(User-Agent) -i sovereign\.ai
+acl bad_bot hdr_sub(User-Agent) -i sp_auditbot
+acl bad_bot hdr_sub(User-Agent) -i spaziodati
 acl bad_bot hdr_sub(User-Agent) -i speedy
-acl bad_bot hdr_sub(User-Agent) -i startmebot\/
+acl bad_bot hdr_sub(User-Agent) -i spray-can
+acl bad_bot hdr_sub(User-Agent) -i spyfu
+acl bad_bot hdr_sub(User-Agent) -i spyonweb
+acl bad_bot hdr_sub(User-Agent) -i sqlmap
+acl bad_bot hdr_sub(User-Agent) -i ssl-tools
+acl bad_bot hdr_sub(User-Agent) -i suchen
 acl bad_bot hdr_sub(User-Agent) -i summify
-acl bad_bot hdr_sub(User-Agent) -i t3versionsBot
-acl bad_bot hdr_sub(User-Agent) -i tagoobot
-acl bad_bot hdr_sub(User-Agent) -i theoldreader\.com
-acl bad_bot hdr_sub(User-Agent) -i tigerbot
-acl bad_bot hdr_sub(User-Agent) -i toplistbot
+acl bad_bot hdr_sub(User-Agent) -i swcd 
+acl bad_bot hdr_sub(User-Agent) -i sysscan
+acl bad_bot hdr_sub(User-Agent) -i tAkeOut
+acl bad_bot hdr_sub(User-Agent) -i tchelebi\.io
+acl bad_bot hdr_sub(User-Agent) -i techiaith\.cymru
+acl bad_bot hdr_sub(User-Agent) -i teoma
+acl bad_bot hdr_sub(User-Agent) -i terrainformatica
+acl bad_bot hdr_sub(User-Agent) -i testuri
+acl bad_bot hdr_sub(User-Agent) -i theinternetrules
+acl bad_bot hdr_sub(User-Agent) -i timewe\.net
+acl bad_bot hdr_sub(User-Agent) -i topster
+acl bad_bot hdr_sub(User-Agent) -i touche\.com
 acl bad_bot hdr_sub(User-Agent) -i tracemyfile
-acl bad_bot hdr_sub(User-Agent) -i trendictionbot
-acl bad_bot hdr_sub(User-Agent) -i trovitBot
+acl bad_bot hdr_sub(User-Agent) -i trendspottr
+acl bad_bot hdr_sub(User-Agent) -i truwoGPS
 acl bad_bot hdr_sub(User-Agent) -i tweetedtimes
-acl bad_bot hdr_sub(User-Agent) -i twengabot
-acl bad_bot hdr_sub(User-Agent) -i um-LN
-acl bad_bot hdr_sub(User-Agent) -i urlappendbot
-acl bad_bot hdr_sub(User-Agent) -i vebidoobot
-acl bad_bot hdr_sub(User-Agent) -i vercel-screenshot
-acl bad_bot hdr_sub(User-Agent) -i virustotal
+acl bad_bot hdr_sub(User-Agent) -i twibble
+acl bad_bot hdr_sub(User-Agent) -i ubermetrics-technologies
+acl bad_bot hdr_sub(User-Agent) -i uclassify
+acl bad_bot hdr_sub(User-Agent) -i ultimate_sitemap_parser
+acl bad_bot hdr_sub(User-Agent) -i unchaos
+acl bad_bot hdr_sub(User-Agent) -i unirest-java
+acl bad_bot hdr_sub(User-Agent) -i unshortenit
+acl bad_bot hdr_sub(User-Agent) -i updated
+acl bad_bot hdr_sub(User-Agent) -i updown\.io daemon
+acl bad_bot hdr_sub(User-Agent) -i urlresolver
+acl bad_bot hdr_sub(User-Agent) -i vBSEO
+acl bad_bot hdr_sub(User-Agent) -i via ggpht\.com GoogleImageProxy
+acl bad_bot hdr_sub(User-Agent) -i visionutils
 acl bad_bot hdr_sub(User-Agent) -i vkShare
-acl bad_bot hdr_sub(User-Agent) -i voilabot
-acl bad_bot hdr_sub(User-Agent) -i vuhuvBot
-acl bad_bot hdr_sub(User-Agent) -i wbsearchbot
-acl bad_bot hdr_sub(User-Agent) -i web-archive-net\.com\.bot
-acl bad_bot hdr_sub(User-Agent) -i webcompanycrawler
+acl bad_bot hdr_sub(User-Agent) -i voltron
+acl bad_bot hdr_sub(User-Agent) -i voyager\/
+acl bad_bot hdr_sub(User-Agent) -i w3af\.org
+acl bad_bot hdr_sub(User-Agent) -i wangling
+acl bad_bot hdr_sub(User-Agent) -i web-capture\.net
+acl bad_bot hdr_sub(User-Agent) -i webcollage
+acl bad_bot hdr_sub(User-Agent) -i webgains-bot
+acl bad_bot hdr_sub(User-Agent) -i webkit2png
+acl bad_bot hdr_sub(User-Agent) -i webmastercoffee
+acl bad_bot hdr_sub(User-Agent) -i webmeup-crawler
 acl bad_bot hdr_sub(User-Agent) -i webmon 
-acl bad_bot hdr_sub(User-Agent) -i wocbot
-acl bad_bot hdr_sub(User-Agent) -i woobot
-acl bad_bot hdr_sub(User-Agent) -i woorankreview\/
-acl bad_bot hdr_sub(User-Agent) -i woriobot
+acl bad_bot hdr_sub(User-Agent) -i webprosbot
+acl bad_bot hdr_sub(User-Agent) -i webscreenie
+acl bad_bot hdr_sub(User-Agent) -i websitepulse agent
+acl bad_bot hdr_sub(User-Agent) -i webtech\/
+acl bad_bot hdr_sub(User-Agent) -i wf84
+acl bad_bot hdr_sub(User-Agent) -i wget
+acl bad_bot hdr_sub(User-Agent) -i wkhtmlto
+acl bad_bot hdr_sub(User-Agent) -i wmtips
+acl bad_bot hdr_sub(User-Agent) -i woorankreview
+acl bad_bot hdr_sub(User-Agent) -i worldping-api
 acl bad_bot hdr_sub(User-Agent) -i wotbox
-acl bad_bot hdr_sub(User-Agent) -i www\.uptime\.com
+acl bad_bot hdr_sub(User-Agent) -i wpif
+acl bad_bot hdr_sub(User-Agent) -i wprecon\.com survey
+acl bad_bot hdr_sub(User-Agent) -i wscheck
+acl bad_bot hdr_sub(User-Agent) -i www\.monitor\.us
 acl bad_bot hdr_sub(User-Agent) -i x09Mozilla
 acl bad_bot hdr_sub(User-Agent) -i x22Mozilla
-acl bad_bot hdr_sub(User-Agent) -i xovibot
-acl bad_bot hdr_sub(User-Agent) -i yacybot
-acl bad_bot hdr_sub(User-Agent) -i yandex\.com\/bots
+acl bad_bot hdr_sub(User-Agent) -i xpymep([0-9]?)\.exe
+acl bad_bot hdr_sub(User-Agent) -i yacy
 acl bad_bot hdr_sub(User-Agent) -i yanga
-acl bad_bot hdr_sub(User-Agent) -i yoozBot
-acl bad_bot hdr_sub(User-Agent) -i zenback bot
+acl bad_bot hdr_sub(User-Agent) -i yeti
+acl bad_bot hdr_sub(User-Agent) -i yomins\.com
+acl bad_bot hdr_sub(User-Agent) -i yoogliFetchAgent
+acl bad_bot hdr_sub(User-Agent) -i yourls\.org
 acl bad_bot hdr_sub(User-Agent) -i zgrab
 http-request deny if bad_bot
diff --git a/waf_patterns/haproxy/waf.acl b/waf_patterns/haproxy/waf.acl
index 80aea7f..91a919c 100644
--- a/waf_patterns/haproxy/waf.acl
+++ b/waf_patterns/haproxy/waf.acl
@@ -90,47 +90,44 @@ http-request deny if block_INITIALIZATION
 acl block_INITIALIZATION hdr_sub(User-Agent) -i @lt %{tx.blocking_paranoia_level}
 http-request deny if block_INITIALIZATION
 
-acl block_EXCEPTIONS hdr_sub(User-Agent) -i @streq GET /
-http-request deny if block_EXCEPTIONS
-
-acl block_EXCEPTIONS hdr_sub(User-Agent) -i @ipMatch 127.0.0.1,::1
-http-request deny if block_EXCEPTIONS
+acl block_LFI hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_LFI
 
-acl block_EXCEPTIONS hdr_sub(User-Agent) -i @ipMatch 127.0.0.1,::1
-http-request deny if block_EXCEPTIONS
+acl block_LFI hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_LFI
 
-acl block_EXCEPTIONS hdr_sub(User-Agent) -i @endsWith (internal dummy connection)
-http-request deny if block_EXCEPTIONS
+acl block_LFI hdr_sub(User-Agent) -i @rx (?i)(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:.(?:%0[0-1]|?)?|?.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:.|%[25-6ae-f]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))
+http-request deny if block_LFI
 
-acl block_EXCEPTIONS hdr_sub(User-Agent) -i @rx ^(?:GET /|OPTIONS *) HTTP/[12].[01]$
-http-request deny if block_EXCEPTIONS
+acl block_LFI hdr_sub(User-Agent) -i @rx (?:(?:^|[x5c/;]).{2,3}[x5c/;]|[x5c/;].{2,3}(?:[x5c/;]|$))
+http-request deny if block_LFI
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_ENFORCEMENT
+acl block_LFI hdr_sub(User-Agent) -i @pmFromFile lfi-os-files.data
+http-request deny if block_LFI
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_ENFORCEMENT
+acl block_LFI hdr_sub(User-Agent) -i @pmFromFile restricted-files.data
+http-request deny if block_LFI
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@within %{tx.allowed_methods}
-http-request deny if block_ENFORCEMENT
+acl block_LFI hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_LFI
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_ENFORCEMENT
+acl block_LFI hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_LFI
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_ENFORCEMENT
+acl block_LFI hdr_sub(User-Agent) -i @pmFromFile lfi-os-files.data
+http-request deny if block_LFI
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_ENFORCEMENT
+acl block_LFI hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_LFI
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_ENFORCEMENT
+acl block_LFI hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_LFI
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_ENFORCEMENT
+acl block_LFI hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_LFI
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_ENFORCEMENT
+acl block_LFI hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_LFI
 
 acl block_DETECTION hdr_sub(User-Agent) -i @lt 1
 http-request deny if block_DETECTION
@@ -159,467 +156,359 @@ http-request deny if block_DETECTION
 acl block_DETECTION hdr_sub(User-Agent) -i @lt 4
 http-request deny if block_DETECTION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 1
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 1
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx (?i)^(?:get /[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?|(?:connect (?:(?:[0-9]{1,3}.){3}[0-9]{1,3}.?(?::[0-9]+)?|[--9A-Z_a-z]+:[0-9]+)|options *|[a-z]{3,10}[sv]+(?:[0-9A-Z_a-z]{3,7}?://[--9A-Z_a-z]*(?::[0-9]+)?)?/[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?)[sv]+[.-9A-Z_a-z]+)$
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 2
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx (?i)^(?:&(?:(?:[acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|(?:[cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^"';=])*$
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 2
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^d+$
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 3
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^(?:GET|HEAD)$
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 3
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^0?$
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 4
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^(?:GET|HEAD)$
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 4
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@eq 0
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 1
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 1
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @streq POST
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 2
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 2
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 3
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@eq 0
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 3
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@eq 0
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 4
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx (d+)-(d+)
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge 4
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt %{tx.1}
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge %{tx.inbound_anomaly_score_threshold}
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx b(?:keep-alive|close),s?(?:keep-alive|close)b
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @eq 1
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx x25
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @ge %{tx.inbound_anomaly_score_threshold}
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateUrlEncoding
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^(?i)application/x-www-form-urlencoded
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx x25
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateUrlEncoding
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateUtf8Encoding
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx %u[fF]{2}[0-9a-fA-F]{2}
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateByteRange 1-255
-http-request deny if block_ENFORCEMENT
+acl block_EVALUATION hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_EVALUATION
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^$
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^$
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx (?:<?(?:[^x]|x[^m]|xm[^l]|xml[^s]|xml$|$)|<?php|[(?:/|x5c)?php])
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^OPTIONS$
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx .*.ph(?:pd*|tml|ar|ps|t|pt).*$
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@pm AppleWebKit Android Business Enterprise Entreprise
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-config-directives.data
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^$
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @pm =
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^OPTIONS$
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-variables.data
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^$
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx (?:bzip2|expect|glob|ogg|(?:ph|r)ar|ssh2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?|z(?:ip|lib))://
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^0$
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-function-names-933150.data
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx (?i)b(?["']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:*.**/|/.*)|#.*[sv]|")*["']*)?[sv]*(.*)
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx (?:^([d.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$)
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx [oOcC]:d+:".+?":d+:{.*}
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx $+(?:[a-zA-Z_x7f-xff][a-zA-Z0-9_x7f-xff]*|s*{.+})(?:s|[.+]|{.+}|/*.**/|//.*|#.*)*(.*)
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.max_num_args}
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx (?:((?:.+)(?:["'][-0-9A-Z_a-z]+["'])?(.+|[^)]*string[^)]*)[sv"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|["'][-0-9A-Zx5c_a-z]+["'])(.+));
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.arg_name_length}
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-function-names-933151.data
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.arg_length}
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @pm (
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.total_arg_length}
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^(?i)multipart/form-data
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx (?i)b(?:a(?:bs|s(?:in|sert(?:_options)?))|basename|c(?:h(?:eckdate|r(?:oot)?)|o(?:(?:mpac|(?:nsta|u)n)t|py|sh?)|r(?:eate_function|ypt)|urrent)|d(?:ate|e(?:coct|fined?)|ir)|e(?:nd|val|x(?:ec|p(?:lode)?|tract))|f(?:ile(?:(?:[acm]tim|inod|siz|typ)e|group|owner|perms)?|l(?:o(?:ck|or)|ush))|glob|h(?:ash|eader)|i(?:date|m(?:age(?:gif|(?:jpe|pn)g|wbmp|xbm)|plode)|s_a)|key|l(?:ink|og)|m(?:a(?:il|x)|d5|in)|n(?:ame|ext)|o(?:pendir|rd)|p(?:a(?:ck|ss(?:thru)?)|i|o(?:pen|w)|rev)|r(?:an(?:d|ge)|e(?:(?:adfil|nam)e|set)|ound)|s(?:(?:erializ|huffl)e|in|leep|(?:or|ta)t|ubstr|y(?:mlink|s(?:log|tem)))|t(?:an|(?:im|mpfil)e|ouch|rim)|u(?:cfirst|n(?:lin|pac)k)|virtual)(?:[sv]|/*.**/|(?:#|//).*)*(.*)
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.max_file_size}
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx .*.(?:phpd*|phtml)..*$
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
-http-request deny if block_ENFORCEMENT
-
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.combined_file_sizes}
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @pm ?>
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^[w/.+*-]+(?:s?;s?(?:action|boundary|charset|component|start(?:-info)?|type|version)s?=s?['"w.()+,/:=?<>@#*-]+)*$
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @rx (?:((?:.+)(?:["'][-0-9A-Z_a-z]+["'])?(.+|[^)]*string[^)]*)[sv"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|["'][-0-9A-Zx5c_a-z]+["'])(.+))(?:;|$)?
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^[^;s]+
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@within %{tx.allowed_request_content_type}
-http-request deny if block_ENFORCEMENT
+acl block_PHP hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_PHP
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx charsets*=s*["']?([^;"'s]+)
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 1
 http-request deny if block_ENFORCEMENT
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@within %{tx.allowed_request_content_type_charset}
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 1
 http-request deny if block_ENFORCEMENT
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx charset.*?charset
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@within %{tx.allowed_methods}
 http-request deny if block_ENFORCEMENT
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@within %{tx.allowed_http_versions}
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 2
 http-request deny if block_ENFORCEMENT
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx .([^.]+)$
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 2
 http-request deny if block_ENFORCEMENT
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @within %{tx.restricted_extensions}
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 3
 http-request deny if block_ENFORCEMENT
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx .[^.~]+~(?:/.*|)$
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 3
 http-request deny if block_ENFORCEMENT
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^.*$
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 4
 http-request deny if block_ENFORCEMENT
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @within %{tx.restricted_headers_basic}
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 4
 http-request deny if block_ENFORCEMENT
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt 50
-http-request deny if block_ENFORCEMENT
+acl block_ATTACK hdr_sub(User-Agent) -i !@eq 0
+http-request deny if block_ATTACK
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$
-http-request deny if block_ENFORCEMENT
+acl block_ATTACK hdr_sub(User-Agent) -i !@within |%{tx.allowed_request_content_type_charset}|
+http-request deny if block_ATTACK
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@streq JSON
-http-request deny if block_ENFORCEMENT
+acl block_ATTACK hdr_sub(User-Agent) -i @rx ^content-types*:s*(.*)$
+http-request deny if block_ATTACK
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx (?i)x5cu[0-9a-f]{4}
-http-request deny if block_ENFORCEMENT
+acl block_ATTACK hdr_sub(User-Agent) -i !@rx ^(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$
+http-request deny if block_ATTACK
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @contains #
-http-request deny if block_ENFORCEMENT
+acl block_ATTACK hdr_sub(User-Agent) -i @rx content-transfer-encoding:(.*)
+http-request deny if block_ATTACK
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt 1
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i !@pmFromFile sql-errors.data
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@endsWith .pdf
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @endsWith .pdf
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i:DB2 SQL error:|[IBM][CLI Driver][DB2/6000]|CLI Driver.*DB2|DB2 SQL error|db2_w+()
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){63}
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx %[0-9a-fA-F]{2}
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i)Dynamic SQL Error
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateByteRange 9,10,13,32-126,128-255
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i)Exception (?:condition )?d+. Transaction rollback.
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i)org.hsqldb.jdbc
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ['";=]
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception.*Informix)
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^0$
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i:Warning.*ingres_|Ingres SQLSTATE|IngresW.*Driver)
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^.*$
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @within %{tx.restricted_headers_extended}
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i)(?:System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*WSystem.Data.SqlClient.|Conversion failed when converting the varchar value .*? to data type int.)
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array()|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient.)|[MySQL][ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[(-)_a-z]{1,26})?|(?:ERROR [0-9]{4} ([0-9a-z]{5})|XPATH syntax error):
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|pg_(?:query|exec)() [:|Warning.{1,20}bpg_.*|valid PostgreSQL result|Npgsql.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateByteRange 32-36,38-126
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*Server message.*)
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^(?:OPTIONS|CONNECT)$
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@pm AppleWebKit Android
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @ge 1
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^(?i)up
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt 0
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:s*,s*|$)){1,7}$
-http-request deny if block_ENFORCEMENT
+acl block_SQL hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_SQL
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx br|compress|deflate|(?:pack200-)?gzip|identity|*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)
-http-request deny if block_ENFORCEMENT
+acl block_GENERIC hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_GENERIC
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_ENFORCEMENT
+acl block_GENERIC hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_GENERIC
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_ENFORCEMENT
+acl block_GENERIC hdr_sub(User-Agent) -i @rx _(?:$$ND_FUNC$$_|_js_function)|(?:beval|new[sv]+Function[sv]*)(|String.fromCharCode|function(){|this.constructor|module.exports=|([sv]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][sv]*)|process(?:.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:.call)?(|binding|constructor|env|global|main(?:Module)?|process|require)|[["'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)["'`]])|(?:binding|constructor|env|global|main(?:Module)?|process|require)[|console(?:.(?:debug|error|info|trace|warn)(?:.call)?(|[["'`](?:debug|error|info|trace|warn)["'`]])|require(?:.(?:resolve(?:.call)?(|main|extensions|cache)|[["'`](?:(?:resolv|cach)e|main|extensions)["'`]])
+http-request deny if block_GENERIC
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @endsWith .pdf
-http-request deny if block_ENFORCEMENT
+acl block_GENERIC hdr_sub(User-Agent) -i @rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[sv]*(
+http-request deny if block_GENERIC
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}
-http-request deny if block_ENFORCEMENT
+acl block_GENERIC hdr_sub(User-Agent) -i @pmFromFile ssrf.data
+http-request deny if block_GENERIC
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateByteRange 38,44-46,48-58,61,65-90,95,97-122
-http-request deny if block_ENFORCEMENT
+acl block_GENERIC hdr_sub(User-Agent) -i @rx (?:__proto__|constructors*(?:.|[)s*prototype)
+http-request deny if block_GENERIC
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateByteRange 32,34,38,42-59,61,65-90,95,97-122
-http-request deny if block_ENFORCEMENT
+acl block_GENERIC hdr_sub(User-Agent) -i @rx Process[sv]*.[sv]*spawn[sv]*(
+http-request deny if block_GENERIC
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^(?:?[01])?$
-http-request deny if block_ENFORCEMENT
+acl block_GENERIC hdr_sub(User-Agent) -i @rx while[sv]*([sv(]*(?:!+(?:false|null|undefined|NaN|[+-]?0|"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[+-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)b|{.*}|[.*]|"[^"]+"|'[^']+'|`[^`]+`)).*)
+http-request deny if block_GENERIC
 
-acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx (?:^|[^x5c])x5c[cdeghijklmpqwxyz123456789]
-http-request deny if block_ENFORCEMENT
+acl block_GENERIC hdr_sub(User-Agent) -i @rx ^data:(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*
+http-request deny if block_GENERIC
 
-acl block_ATTACK hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_ATTACK
+acl block_GENERIC hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_GENERIC
 
-acl block_ATTACK hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_ATTACK
+acl block_GENERIC hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_GENERIC
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d
-http-request deny if block_ATTACK
+acl block_GENERIC hdr_sub(User-Agent) -i @rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}.(?:[0-9]{1,3}.[0-9]{5}|[0-9]{8})|(?:x5cx5c[-0-9a-z].?_?)+|[[0-:a-f]+(?:[.0-9]+|%[0-9A-Z_a-z]+)?]|[a-z][--.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[sv]*&?@(?:(?:[0-9]{1,3}.){3}[0-9]{1,3}|[a-z][--.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[.0-9]{0,11}(?:xe2(?:x91[xa0-xbf]|x92[x80-xbf]|x93[x80-xa9xab-xbf])|xe3x80x82)+))
+http-request deny if block_GENERIC
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx [rn]W*?(?:content-(?:type|length)|set-cookie|location):s*w
-http-request deny if block_ATTACK
+acl block_GENERIC hdr_sub(User-Agent) -i @rx [s*constructors*]
+http-request deny if block_GENERIC
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx (?:bhttp/d|<(?:html|meta)b)
-http-request deny if block_ATTACK
+acl block_GENERIC hdr_sub(User-Agent) -i @rx @{.*}
+http-request deny if block_GENERIC
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx [nr]
-http-request deny if block_ATTACK
+acl block_GENERIC hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_GENERIC
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx [nr]
-http-request deny if block_ATTACK
+acl block_GENERIC hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_GENERIC
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx [nr]+(?:s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*:
-http-request deny if block_ATTACK
+acl block_GENERIC hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_GENERIC
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx [nr]
-http-request deny if block_ATTACK
+acl block_GENERIC hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_GENERIC
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx ^[^:()&|!<>~]*)s*(?:((?:[^,()=&|!<>~]+[><~]?=|s*[&!|]s*(?:)|()?s*)|)s*(s*[&|!]s*|[&!|]s*([^()=&|!<>~]+[><~]?=[^:()&|!<>~]*)
-http-request deny if block_ATTACK
+acl block_RFI hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_RFI
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx ^[^sv,;]+[sv,;].*?(?:application/(?:.++)?json|(?:application/(?:soap+)?|text/)xml)
-http-request deny if block_ATTACK
+acl block_RFI hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_RFI
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx unix:[^|]*|
-http-request deny if block_ATTACK
+acl block_RFI hdr_sub(User-Agent) -i @rx ^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})
+http-request deny if block_RFI
 
-acl block_ATTACK hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_ATTACK
+acl block_RFI hdr_sub(User-Agent) -i @rx (?i)(?:bincludes*([^)]*|mosConfig_absolute_path|_CONF[path]|_SERVER[DOCUMENT_ROOT]|GALLERY_BASEDIR|path[docroot]|appserv_root|config[root_dir])=(?:file|ftps?|https?)://
+http-request deny if block_RFI
 
-acl block_ATTACK hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_ATTACK
+acl block_RFI hdr_sub(User-Agent) -i @rx ^(?i:file|ftps?|https?).*??+$
+http-request deny if block_RFI
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx [nr]
-http-request deny if block_ATTACK
+acl block_RFI hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_RFI
 
-acl block_ATTACK hdr_sub(User-Agent) -i @rx ^[^sv,;]+[sv,;].*?b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([+/]))b
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @gt 0
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @rx .
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @gt 1
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @rx TX:paramcounter_(.*)
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @rx (][^]]+$|][^]]+[)
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @rx [
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i !@eq 0
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i !@within |%{tx.allowed_request_content_type_charset}|
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @rx ^content-types*:s*(.*)$
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i !@rx ^(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$
-http-request deny if block_ATTACK
-
-acl block_ATTACK hdr_sub(User-Agent) -i @rx content-transfer-encoding:(.*)
-http-request deny if block_ATTACK
-
-acl block_LFI hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @rx (?i)(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:.(?:%0[0-1]|?)?|?.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:.|%[25-6ae-f]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @rx (?:(?:^|[x5c/;]).{2,3}[x5c/;]|[x5c/;].{2,3}(?:[x5c/;]|$))
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @pmFromFile lfi-os-files.data
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @pmFromFile restricted-files.data
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @pmFromFile lfi-os-files.data
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_LFI
-
-acl block_LFI hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_LFI
-
-acl block_RFI hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_RFI
-
-acl block_RFI hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_RFI
-
-acl block_RFI hdr_sub(User-Agent) -i @rx ^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})
-http-request deny if block_RFI
-
-acl block_RFI hdr_sub(User-Agent) -i @rx (?i)(?:bincludes*([^)]*|mosConfig_absolute_path|_CONF[path]|_SERVER[DOCUMENT_ROOT]|GALLERY_BASEDIR|path[docroot]|appserv_root|config[root_dir])=(?:file|ftps?|https?)://
-http-request deny if block_RFI
-
-acl block_RFI hdr_sub(User-Agent) -i @rx ^(?i:file|ftps?|https?).*??+$
-http-request deny if block_RFI
-
-acl block_RFI hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_RFI
-
-acl block_RFI hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_RFI
+acl block_RFI hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_RFI
 
 acl block_RFI hdr_sub(User-Agent) -i @rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)
 http-request deny if block_RFI
@@ -645,302 +534,38 @@ http-request deny if block_RFI
 acl block_RFI hdr_sub(User-Agent) -i @lt 4
 http-request deny if block_RFI
 
-acl block_RCE hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:(?:b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|[ckz]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[&,<>|]|(?:[--.0-9A-Z_a-z]["'[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#*-0-9?-@_a-{]*)?x5c?)+[sv&,<>|]).*|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:4|[sv&),<>|].*))|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*)?|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|(?:e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)b
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[sv&)<>|]|a(?:dd(?:group|user)|getty|l(?:ias|pine)[sv&)<>|]|nsible-playbook|pt(?:-get|itude[sv&)<>|])|r(?:ch[sv&)<>|]|ia2c)|s(?:cii(?:-xfr|85)|pell)|tobm|xel)|b(?:a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu)|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:a(?:ncel|psh)[sv&)<>|]|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|p(?:an|io|ulimit)|r(?:ash[sv&)<>|]|on(?:tab)?)|s(?:plit|vtool)|u(?:psfilter|rl[sv&)<>|]))|d(?:(?:a(?:sh|te)|i(?:alog|ff))[sv&)<>|]|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:2fsck|(?:asy_instal|va)l|cho[sv&)<>|]|fax|grep|macs|n(?:d(?:if|sw)|v-update)|sac|x(?:ec[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r)))|f(?:acter|(?:etch|lock|unction)[sv&)<>|]|grep|i(?:le(?:[sv&)<>|]|test)|(?:n(?:d|ger)|sh)[sv&)<>|])|o(?:ld[sv&)<>|]|reach)|ping|tp(?:stats|who))|g(?:awk[sv&)<>|]|core|e(?:ni(?:e[sv&)<>|]|soimage)|tfacl[sv&)<>|])|hci|i(?:mp[sv&)<>|]|nsh)|r(?:ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:conv|f(?:config|top)|nstall[sv&)<>|]|onice|p(?:6?tables|config)|spell)|j(?:ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:ill(?:[sv&)<>|]|all)|nife[sv&)<>|]|sshell)|l(?:a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|dconfig|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|(?:inks|ynx)[sv&)<>|]|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:il(?:[sv&)<>q|]|x[sv&)<>|])|ke[sv&)<>|]|ster.passwd|wk)|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|utt[sv&)<>|]|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:a(?:no[sv&)<>|]|sm|wk)|c(?:.(?:openbsd|traditional)|at)|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan))|(?:ice|ull)[sv&)<>|]|map|o(?:de[sv&)<>|]|hup)|ping|roff|s(?:enter|lookup|tat))|o(?:ctave[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:f(?:la)?tex|ksh)|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|(?:ft|gre)p|hp(?:-cgi|[57])|i(?:(?:co|ng)[sv&)<>|]|dstat|gz)|k(?:exec|g_?info|ill)|opd|rint(?:env|f[sv&)<>|])|s(?:ed|ftp|ql)|tar(?:diff|grep)?|u(?:ppet[sv&)<>|]|shd)|wd.db|ython[^sv])|r(?:ak(?:e[sv&)<>|]|u)|bash|e(?:a(?:delf|lpath)|(?:dcarpet|name|p(?:eat|lace))[sv&)<>|]|stic)|l(?:ogin|wrap)|m(?:dir[sv&)<>|]|user)|nano|oute[sv&)<>|]|pm(?:db|(?:quer|verif)y)|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:(?:ash|nap)[sv&)<>|]|c(?:hed|r(?:een|ipt)[sv&)<>|])|diff|e(?:(?:lf|rvice)[sv&)<>|]|ndmail|t(?:arch|env|facl[sv&)<>|]|sid))|ftp|h(?:.distrib|(?:adow|ells)[sv&)<>|]|u(?:f|tdown[sv&)<>|]))|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|sh(?:-key(?:ge|sca)n|pass)|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|udo|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|c(?:l?sh|p(?:dump|ing|traceroute))|elnet|ftp|ime(?:(?:out)?[sv&)<>|]|datectl)|mux|ouch[sv&)<>|]|r(?:aceroute6?|off)|shark)|u(?:limit[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:ew[sv&)<>|]|gr|mdiff|pw|rsh)|olatility[sv&)<>|])|w(?:a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:args|e(?:la)?tex|mo(?:dmap|re)|pad|term|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|s(?:oelim|td(?:(?:ca|m)t|grep|less)?)|ypper))
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @pmFromFile windows-powershell-commands.data
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:(?:a["^]*(?:c|s["^]*n["^]*p)|e["^]*(?:b["^]*p|p["^]*(?:a["^]*l|c["^]*s["^]*v|s["^]*n)|[tx]["^]*s["^]*n)|f["^]*(?:[cltw]|o["^]*r["^]*e["^]*a["^]*c["^]*h)|i["^]*(?:[cr]["^]*m|e["^]*x|h["^]*y|i|p["^]*(?:a["^]*l|c["^]*s["^]*v|m["^]*o|s["^]*n)|s["^]*e|w["^]*(?:m["^]*i|r))|m["^]*(?:a["^]*n|[dipv]|o["^]*u["^]*n["^]*t)|o["^]*g["^]*v|p["^]*(?:o["^]*p|u["^]*s["^]*h)["^]*d|t["^]*r["^]*c["^]*m|w["^]*j["^]*b)["^]*[sv,.-/;-<>].*|c["^]*(?:(?:(?:d|h["^]*d["^]*i["^]*r|v["^]*p["^]*a)["^]*|p["^]*(?:[ip]["^]*)?)[sv,.-/;-<>].*|l["^]*(?:(?:[cipv]|h["^]*y)["^]*[sv,.-/;-<>].*|s)|n["^]*s["^]*n)|d["^]*(?:(?:b["^]*p|e["^]*l|i["^]*(?:f["^]*f|r))["^]*[sv,.-/;-<>].*|n["^]*s["^]*n)|g["^]*(?:(?:(?:(?:a["^]*)?l|b["^]*p|d["^]*r|h["^]*y|(?:w["^]*m["^]*)?i|j["^]*b|[u-v])["^]*|c["^]*(?:[ims]["^]*)?|m["^]*(?:o["^]*)?|s["^]*(?:n["^]*(?:p["^]*)?|v["^]*))[sv,.-/;-<>].*|e["^]*r["^]*r|p["^]*(?:(?:s["^]*)?[sv,.-/;-<>].*|v))|l["^]*s|n["^]*(?:(?:a["^]*l|d["^]*r|[iv]|m["^]*o|s["^]*n)["^]*[sv,.-/;-<>].*|p["^]*s["^]*s["^]*c)|r["^]*(?:(?:(?:(?:b["^]*)?p|e["^]*n|(?:w["^]*m["^]*)?i|j["^]*b|n["^]*[ip])["^]*|d["^]*(?:r["^]*)?|m["^]*(?:(?:d["^]*i["^]*r|o)["^]*)?|s["^]*n["^]*(?:p["^]*)?|v["^]*(?:p["^]*a["^]*)?)[sv,.-/;-<>].*|c["^]*(?:j["^]*b["^]*[sv,.-/;-<>].*|s["^]*n)|u["^]*j["^]*b)|s["^]*(?:(?:(?:a["^]*(?:j["^]*b|l|p["^]*s|s["^]*v)|b["^]*p|[civ]|w["^]*m["^]*i)["^]*|l["^]*(?:s["^]*)?|p["^]*(?:(?:j["^]*b|p["^]*s|s["^]*v)["^]*)?)[sv,.-/;-<>].*|h["^]*c["^]*m|u["^]*j["^]*b))(?:.["^]*[0-9A-Z_a-z]+)?b
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx $(?:((?:.*|(.*)))|{.*})|[<>](.*)|/[0-9A-Z_a-z]*[!?.+]
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx b(?:for(?:/[dflr].*)? %+[^ ]+ in(.*)[sv]?do|if(?:/i)?(?: not)?(?: (?:e(?:xist|rrorlevel)|defined|cmdextversion)b|[ (].*(?:b(?:g(?:eq|tr)|equ|neq|l(?:eq|ss))b|==)))
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|[ckz]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)[sv&)<>|]
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:a(?:ddgroup|xel)|b(?:ase(?:32|64|nc)|lkid|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|yobu|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:h(?:g(?:passwd|rp)|pass|sh)|lang++|oproc|ron)|d(?:iff[sv&)<>|]|mesg|oas)|e(?:2fsck|grep)|f(?:grep|iletest|tp(?:stats|who))|g(?:r(?:ep[sv&)<>|]|oupmod)|unzip|z(?:cat|exe|ip))|htop|l(?:ast(?:comm|log(?:in)?)|ess(?:echo|(?:fil|pip)e)|ftp(?:get)?|osetup|s(?:-F|b_release|cpu|mod|of|pci|usb)|wp-download|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:ilq|ster.passwd)|k(?:fifo|nod|temp)|locate|ysql(?:admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:.(?:openbsd|traditional)|at)|et(?:(?:c|st)at|kit-ftp|plan)|ohup|ping|stat)|onintr|p(?:dksh|erl5?|(?:ft|gre)p|hp(?:-cgi|[57])|igz|k(?:exec|ill)|(?:op|se)d|rint(?:env|f[sv&)<>|])|tar(?:diff|grep)?|wd.db|ython[2-3])|r(?:(?:bas|ealpat)h|m(?:dir[sv&)<>|]|user)|nano|sync)|s(?:diff|e(?:ndmail|t(?:env|sid))|ftp|(?:h.distri|pwd.d)b|ocat|td(?:err|in|out)|udo|ysctl)|t(?:ailf|c(?:p(?:ing|traceroute)|sh)|elnet|imeout[sv&)<>|]|raceroute6?)|u(?:n(?:ame|lz(?:4|ma)|(?:pig|x)z|rar|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:gr|pw)|w(?:get|hoami)|x(?:args|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:c(?:at|mp)|diff|[e-f]?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|std(?:(?:ca|m)t|grep|less)?))
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i !@rx [0-9]s*'s*[0-9]
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx !-d
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @pmFromFile unix-shell.data
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx ^(s*)s+{
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx ^(s*)s+{
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx ba["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?sb[sv]+[!-"%',0-9@-Z_a-z]+=[^sv]
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @pmFromFile restricted-upload.data
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:t["^]*i["^]*m["^]*e|[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:a["^]*(?:c["^]*c["^]*c["^]*h["^]*e["^]*c["^]*k["^]*c["^]*o["^]*n["^]*s["^]*o["^]*l["^]*e|d["^]*(?:p["^]*l["^]*u["^]*s|v["^]*p["^]*a["^]*c["^]*k)|(?:g["^]*e["^]*n["^]*t["^]*e["^]*x["^]*e["^]*c["^]*u["^]*t["^]*o|s["^]*p["^]*n["^]*e["^]*t["^]*_["^]*c["^]*o["^]*m["^]*p["^]*i["^]*l["^]*e)["^]*r|p["^]*p["^]*(?:i["^]*n["^]*s["^]*t["^]*a["^]*l["^]*l["^]*e["^]*r|v["^]*l["^]*p)|t["^]*(?:[sv,.-/;-<>].*|b["^]*r["^]*o["^]*k["^]*e["^]*r))|b["^]*(?:a["^]*s["^]*h|g["^]*i["^]*n["^]*f["^]*o|i["^]*t["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|c["^]*(?:d["^]*b|e["^]*r["^]*t["^]*(?:o["^]*c|r["^]*e["^]*q|u["^]*t["^]*i["^]*l)|l["^]*_["^]*(?:i["^]*n["^]*v["^]*o["^]*c["^]*a["^]*t["^]*i["^]*o["^]*n|l["^]*o["^]*a["^]*d["^]*a["^]*s["^]*s["^]*e["^]*m["^]*b["^]*l["^]*y|m["^]*u["^]*t["^]*e["^]*x["^]*v["^]*e["^]*r["^]*i["^]*f["^]*i["^]*e["^]*r["^]*s)|m["^]*(?:d(?:["^]*(?:k["^]*e["^]*y|l["^]*3["^]*2))?|s["^]*t["^]*p)|o["^]*(?:m["^]*s["^]*v["^]*c["^]*s|n["^]*(?:f["^]*i["^]*g["^]*s["^]*e["^]*c["^]*u["^]*r["^]*i["^]*t["^]*y["^]*p["^]*o["^]*l["^]*i["^]*c["^]*y|h["^]*o["^]*s["^]*t|t["^]*r["^]*o["^]*l)|r["^]*e["^]*g["^]*e["^]*n)|r["^]*e["^]*a["^]*t["^]*e["^]*d["^]*u["^]*m["^]*p|s["^]*(?:c(?:["^]*r["^]*i["^]*p["^]*t)?|i)|u["^]*s["^]*t["^]*o["^]*m["^]*s["^]*h["^]*e["^]*l["^]*l["^]*h["^]*o["^]*s["^]*t)|d["^]*(?:a["^]*t["^]*a["^]*s["^]*v["^]*c["^]*u["^]*t["^]*i["^]*l|e["^]*(?:f["^]*a["^]*u["^]*l["^]*t["^]*p["^]*a["^]*c["^]*k|s["^]*k(?:["^]*t["^]*o["^]*p["^]*i["^]*m["^]*g["^]*d["^]*o["^]*w["^]*n["^]*l["^]*d["^]*r)?|v["^]*(?:i["^]*c["^]*e["^]*c["^]*r["^]*e["^]*d["^]*e["^]*n["^]*t["^]*i["^]*a["^]*l["^]*d["^]*e["^]*p["^]*l["^]*o["^]*y["^]*m["^]*e["^]*n["^]*t|t["^]*o["^]*o["^]*l["^]*s["^]*l["^]*a["^]*u["^]*n["^]*c["^]*h["^]*e["^]*r))|f["^]*s["^]*(?:h["^]*i["^]*m|v["^]*c)|i["^]*(?:a["^]*n["^]*t["^]*z|s["^]*k["^]*s["^]*h["^]*a["^]*d["^]*o["^]*w)|n["^]*(?:s["^]*c["^]*m["^]*d|x)|o["^]*t["^]*n["^]*e["^]*t|u["^]*m["^]*p["^]*6["^]*4|x["^]*c["^]*a["^]*p)|e["^]*(?:s["^]*e["^]*n["^]*t["^]*u["^]*t["^]*l|v["^]*e["^]*n["^]*t["^]*v["^]*w["^]*r|x["^]*(?:c["^]*e["^]*l|p["^]*(?:a["^]*n["^]*d|l["^]*o["^]*r["^]*e["^]*r)|t["^]*(?:e["^]*x["^]*p["^]*o["^]*r["^]*t|r["^]*a["^]*c["^]*3["^]*2)))|f["^]*(?:i["^]*n["^]*(?:d["^]*s["^]*t|g["^]*e)["^]*r|l["^]*t["^]*m["^]*c|o["^]*r["^]*f["^]*i["^]*l["^]*e["^]*s|s["^]*(?:i(?:["^]*a["^]*n["^]*y["^]*c["^]*p["^]*u)?|u["^]*t["^]*i["^]*l)|t["^]*p)|g["^]*(?:f["^]*x["^]*d["^]*o["^]*w["^]*n["^]*l["^]*o["^]*a["^]*d["^]*w["^]*r["^]*a["^]*p["^]*p["^]*e["^]*r|p["^]*s["^]*c["^]*r["^]*i["^]*p["^]*t)|h["^]*h|i["^]*(?:e["^]*(?:4["^]*u["^]*i["^]*n["^]*i["^]*t|a["^]*d["^]*v["^]*p["^]*a["^]*c["^]*k|e["^]*x["^]*e["^]*c|f["^]*r["^]*a["^]*m["^]*e)|l["^]*a["^]*s["^]*m|m["^]*e["^]*w["^]*d["^]*b["^]*l["^]*d|n["^]*(?:f["^]*d["^]*e["^]*f["^]*a["^]*u["^]*l["^]*t["^]*i["^]*n["^]*s["^]*t["^]*a["^]*l|s["^]*t["^]*a["^]*l["^]*l["^]*u["^]*t["^]*i)["^]*l)|j["^]*s["^]*c|l["^]*(?:a["^]*u["^]*n["^]*c["^]*h["^]*-["^]*v["^]*s["^]*d["^]*e["^]*v["^]*s["^]*h["^]*e["^]*l["^]*l|d["^]*i["^]*f["^]*d["^]*e)|m["^]*(?:a["^]*(?:k["^]*e["^]*c["^]*a["^]*b|n["^]*a["^]*g["^]*e["^]*-["^]*b["^]*d["^]*e|v["^]*i["^]*n["^]*j["^]*e["^]*c["^]*t)|f["^]*t["^]*r["^]*a["^]*c["^]*e|i["^]*c["^]*r["^]*o["^]*s["^]*o["^]*f["^]*t|m["^]*c|p["^]*c["^]*m["^]*d["^]*r["^]*u["^]*n|s["^]*(?:(?:b["^]*u["^]*i["^]*l|o["^]*h["^]*t["^]*m["^]*e)["^]*d|c["^]*o["^]*n["^]*f["^]*i["^]*g|d["^]*(?:e["^]*p["^]*l["^]*o["^]*y|t)|h["^]*t["^]*(?:a|m["^]*l)|i["^]*e["^]*x["^]*e["^]*c|p["^]*u["^]*b|x["^]*s["^]*l))|n["^]*(?:e["^]*t["^]*s["^]*h|t["^]*d["^]*s["^]*u["^]*t["^]*i["^]*l)|o["^]*(?:d["^]*b["^]*c["^]*c["^]*o["^]*n["^]*f|f["^]*f["^]*l["^]*i["^]*n["^]*e["^]*s["^]*c["^]*a["^]*n["^]*n["^]*e["^]*r["^]*s["^]*h["^]*e["^]*l["^]*l|n["^]*e["^]*d["^]*r["^]*i["^]*v["^]*e["^]*s["^]*t["^]*a["^]*n["^]*d["^]*a["^]*l["^]*o["^]*n["^]*e["^]*u["^]*p["^]*d["^]*a["^]*t["^]*e["^]*r|p["^]*e["^]*n["^]*c["^]*o["^]*n["^]*s["^]*o["^]*l["^]*e)|p["^]*(?:c["^]*(?:a["^]*l["^]*u["^]*a|w["^]*(?:r["^]*u["^]*n|u["^]*t["^]*l))|(?:e["^]*s["^]*t["^]*e|s)["^]*r|(?:k["^]*t["^]*m["^]*o|u["^]*b["^]*p["^]*r)["^]*n|n["^]*p["^]*u["^]*t["^]*i["^]*l|o["^]*w["^]*e["^]*r["^]*p["^]*n["^]*t|r["^]*(?:e["^]*s["^]*e["^]*n["^]*t["^]*a["^]*t["^]*i["^]*o["^]*n["^]*h["^]*o["^]*s["^]*t|i["^]*n["^]*t(?:["^]*b["^]*r["^]*m)?|o["^]*(?:c["^]*d["^]*u["^]*m["^]*p|t["^]*o["^]*c["^]*o["^]*l["^]*h["^]*a["^]*n["^]*d["^]*l["^]*e["^]*r)))|r["^]*(?:a["^]*s["^]*a["^]*u["^]*t["^]*o["^]*u|c["^]*s["^]*i|(?:d["^]*r["^]*l["^]*e["^]*a["^]*k["^]*d["^]*i["^]*a|p["^]*c["^]*p["^]*i["^]*n)["^]*g|e["^]*(?:g(?:["^]*(?:a["^]*s["^]*m|e["^]*d["^]*i["^]*t|i["^]*(?:n["^]*i|s["^]*t["^]*e["^]*r["^]*-["^]*c["^]*i["^]*m["^]*p["^]*r["^]*o["^]*v["^]*i["^]*d["^]*e["^]*r)|s["^]*v["^]*(?:c["^]*s|r["^]*3["^]*2)))?|(?:m["^]*o["^]*t|p["^]*l["^]*a["^]*c)["^]*e)|u["^]*n["^]*(?:d["^]*l["^]*l["^]*3["^]*2|(?:e["^]*x["^]*e|s["^]*c["^]*r["^]*i["^]*p["^]*t)["^]*h["^]*e["^]*l["^]*p["^]*e["^]*r|o["^]*n["^]*c["^]*e))|s["^]*(?:c["^]*(?:[sv,.-/;-<>].*|h["^]*t["^]*a["^]*s["^]*k["^]*s|r["^]*i["^]*p["^]*t["^]*r["^]*u["^]*n["^]*n["^]*e["^]*r)|e["^]*t["^]*(?:r["^]*e["^]*s|t["^]*i["^]*n["^]*g["^]*s["^]*y["^]*n["^]*c["^]*h["^]*o["^]*s["^]*t|u["^]*p["^]*a["^]*p["^]*i)|h["^]*(?:d["^]*o["^]*c["^]*v["^]*w|e["^]*l["^]*l["^]*3["^]*2)|q["^]*(?:l["^]*(?:d["^]*u["^]*m["^]*p["^]*e["^]*r|(?:t["^]*o["^]*o["^]*l["^]*s["^]*)?p["^]*s)|u["^]*i["^]*r["^]*r["^]*e["^]*l)|s["^]*h|t["^]*o["^]*r["^]*d["^]*i["^]*a["^]*g|y["^]*(?:n["^]*c["^]*a["^]*p["^]*p["^]*v["^]*p["^]*u["^]*b["^]*l["^]*i["^]*s["^]*h["^]*i["^]*n["^]*g["^]*s["^]*e["^]*r["^]*v["^]*e["^]*r|s["^]*s["^]*e["^]*t["^]*u["^]*p))|t["^]*(?:e["^]*[sv,.-/;-<>].*|r["^]*a["^]*c["^]*k["^]*e["^]*r|t["^]*(?:d["^]*i["^]*n["^]*j["^]*e["^]*c["^]*t|t["^]*r["^]*a["^]*c["^]*e["^]*r))|u["^]*(?:n["^]*r["^]*e["^]*g["^]*m["^]*p["^]*2|p["^]*d["^]*a["^]*t["^]*e|r["^]*l|t["^]*i["^]*l["^]*i["^]*t["^]*y["^]*f["^]*u["^]*n["^]*c["^]*t["^]*i["^]*o["^]*n["^]*s)|v["^]*(?:b["^]*c|e["^]*r["^]*c["^]*l["^]*s["^]*i["^]*d|i["^]*s["^]*u["^]*a["^]*l["^]*u["^]*i["^]*a["^]*v["^]*e["^]*r["^]*i["^]*f["^]*y["^]*n["^]*a["^]*t["^]*i["^]*v["^]*e|s["^]*(?:i["^]*i["^]*s["^]*e["^]*x["^]*e["^]*l["^]*a["^]*u["^]*n["^]*c["^]*h|j["^]*i["^]*t["^]*d["^]*e["^]*b["^]*u["^]*g["^]*g)["^]*e["^]*r)|w["^]*(?:a["^]*b|(?:f|m["^]*i)["^]*c|i["^]*n["^]*(?:g["^]*e["^]*t|r["^]*m|w["^]*o["^]*r["^]*d)|l["^]*r["^]*m["^]*d["^]*r|o["^]*r["^]*k["^]*f["^]*o["^]*l["^]*d["^]*e["^]*r["^]*s|s["^]*(?:(?:c["^]*r["^]*i["^]*p|r["^]*e["^]*s["^]*e)["^]*t|l)|t["^]*[sv,.-/;-<>].*|u["^]*a["^]*u["^]*c["^]*l["^]*t)|x["^]*w["^]*i["^]*z["^]*a["^]*r["^]*d|z["^]*i["^]*p["^]*f["^]*l["^]*d["^]*r)(?:.["^]*[0-9A-Z_a-z]+)?b
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:t["^]*i["^]*m["^]*e|[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:a["^]*(?:s["^]*s["^]*o["^]*c|t["^]*(?:m["^]*a["^]*d["^]*m|t["^]*r["^]*i["^]*b)|u["^]*(?:d["^]*i["^]*t["^]*p["^]*o["^]*l|t["^]*o["^]*(?:c["^]*(?:h["^]*k|o["^]*n["^]*v)|(?:f["^]*m|m["^]*o["^]*u["^]*n)["^]*t)))|b["^]*(?:c["^]*d["^]*(?:b["^]*o["^]*o|e["^]*d["^]*i)["^]*t|(?:d["^]*e["^]*h["^]*d|o["^]*o["^]*t)["^]*c["^]*f["^]*g|i["^]*t["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|c["^]*(?:a["^]*c["^]*l["^]*s|e["^]*r["^]*t["^]*(?:r["^]*e["^]*q|u["^]*t["^]*i["^]*l)|h["^]*(?:c["^]*p|d["^]*i["^]*r|g["^]*(?:l["^]*o["^]*g["^]*o["^]*n|p["^]*o["^]*r["^]*t|u["^]*s["^]*r)|k["^]*(?:d["^]*s["^]*k|n["^]*t["^]*f["^]*s))|l["^]*e["^]*a["^]*n["^]*m["^]*g["^]*r|m["^]*(?:d(?:["^]*k["^]*e["^]*y)?|s["^]*t["^]*p)|s["^]*c["^]*r["^]*i["^]*p["^]*t)|d["^]*(?:c["^]*(?:d["^]*i["^]*a["^]*g|g["^]*p["^]*o["^]*f["^]*i["^]*x)|e["^]*(?:f["^]*r["^]*a["^]*g|l)|f["^]*s["^]*(?:d["^]*i["^]*a|r["^]*m["^]*i)["^]*g|i["^]*(?:a["^]*n["^]*t["^]*z|r|s["^]*(?:k["^]*(?:c["^]*o["^]*(?:m["^]*p|p["^]*y)|p["^]*(?:a["^]*r["^]*t|e["^]*r["^]*f)|r["^]*a["^]*i["^]*d|s["^]*h["^]*a["^]*d["^]*o["^]*w)|p["^]*d["^]*i["^]*a["^]*g))|n["^]*s["^]*c["^]*m["^]*d|(?:o["^]*s["^]*k["^]*e|r["^]*i["^]*v["^]*e["^]*r["^]*q["^]*u["^]*e["^]*r)["^]*y)|e["^]*(?:n["^]*d["^]*l["^]*o["^]*c["^]*a["^]*l|v["^]*e["^]*n["^]*t["^]*c["^]*r["^]*e["^]*a["^]*t["^]*e)|E["^]*v["^]*n["^]*t["^]*c["^]*m["^]*d|f["^]*(?:c|i["^]*(?:l["^]*e["^]*s["^]*y["^]*s["^]*t["^]*e["^]*m["^]*s|n["^]*d["^]*s["^]*t["^]*r)|l["^]*a["^]*t["^]*t["^]*e["^]*m["^]*p|o["^]*r(?:["^]*f["^]*i["^]*l["^]*e["^]*s)?|r["^]*e["^]*e["^]*d["^]*i["^]*s["^]*k|s["^]*u["^]*t["^]*i["^]*l|(?:t["^]*y["^]*p|v["^]*e["^]*u["^]*p["^]*d["^]*a["^]*t)["^]*e)|g["^]*(?:e["^]*t["^]*(?:m["^]*a["^]*c|t["^]*y["^]*p["^]*e)|o["^]*t["^]*o|p["^]*(?:f["^]*i["^]*x["^]*u["^]*p|(?:r["^]*e["^]*s["^]*u["^]*l["^]*)?t|u["^]*p["^]*d["^]*a["^]*t["^]*e)|r["^]*a["^]*f["^]*t["^]*a["^]*b["^]*l)|h["^]*(?:e["^]*l["^]*p["^]*c["^]*t["^]*r|o["^]*s["^]*t["^]*n["^]*a["^]*m["^]*e)|i["^]*(?:c["^]*a["^]*c["^]*l["^]*s|f|p["^]*(?:c["^]*o["^]*n["^]*f["^]*i["^]*g|x["^]*r["^]*o["^]*u["^]*t["^]*e)|r["^]*f["^]*t["^]*p)|j["^]*e["^]*t["^]*p["^]*a["^]*c["^]*k|k["^]*(?:l["^]*i["^]*s["^]*t|s["^]*e["^]*t["^]*u["^]*p|t["^]*(?:m["^]*u["^]*t["^]*i["^]*l|p["^]*a["^]*s["^]*s))|l["^]*(?:o["^]*(?:d["^]*c["^]*t["^]*r|g["^]*(?:m["^]*a["^]*n|o["^]*f["^]*f))|p["^]*[q-r])|m["^]*(?:a["^]*(?:c["^]*f["^]*i["^]*l["^]*e|k["^]*e["^]*c["^]*a["^]*b|p["^]*a["^]*d["^]*m["^]*i["^]*n)|k["^]*(?:d["^]*i["^]*r|l["^]*i["^]*n["^]*k)|m["^]*c|o["^]*u["^]*n["^]*t["^]*v["^]*o["^]*l|q["^]*(?:b["^]*k["^]*u["^]*p|(?:t["^]*g["^]*)?s["^]*v["^]*c)|s["^]*(?:d["^]*t|i["^]*(?:e["^]*x["^]*e["^]*c|n["^]*f["^]*o["^]*3["^]*2)|t["^]*s["^]*c))|n["^]*(?:b["^]*t["^]*s["^]*t["^]*a["^]*t|e["^]*t["^]*(?:c["^]*f["^]*g|d["^]*o["^]*m|s["^]*(?:h|t["^]*a["^]*t))|f["^]*s["^]*(?:a["^]*d["^]*m["^]*i["^]*n|s["^]*(?:h["^]*a["^]*r["^]*e|t["^]*a["^]*t))|l["^]*(?:b["^]*m["^]*g["^]*r|t["^]*e["^]*s["^]*t)|s["^]*l["^]*o["^]*o["^]*k["^]*u["^]*p|t["^]*(?:b["^]*a["^]*c["^]*k["^]*u["^]*p|c["^]*m["^]*d["^]*p["^]*r["^]*o["^]*m["^]*p["^]*t|f["^]*r["^]*s["^]*u["^]*t["^]*l))|o["^]*(?:f["^]*f["^]*l["^]*i["^]*n["^]*e|p["^]*e["^]*n["^]*f["^]*i["^]*l["^]*e["^]*s)|p["^]*(?:a["^]*(?:g["^]*e["^]*f["^]*i["^]*l["^]*e["^]*c["^]*o["^]*n["^]*f["^]*i|t["^]*h["^]*p["^]*i["^]*n)["^]*g|(?:b["^]*a["^]*d["^]*m["^]*i|k["^]*t["^]*m["^]*o)["^]*n|e["^]*(?:n["^]*t["^]*n["^]*t|r["^]*f["^]*m["^]*o["^]*n)|n["^]*p["^]*u["^]*(?:n["^]*a["^]*t["^]*t["^]*e["^]*n["^]*d|t["^]*i["^]*l)|o["^]*(?:p["^]*d|w["^]*e["^]*r["^]*s["^]*h["^]*e["^]*l["^]*l)|r["^]*n["^]*(?:c["^]*n["^]*f["^]*g|(?:d["^]*r["^]*v|m["^]*n["^]*g)["^]*r|j["^]*o["^]*b["^]*s|p["^]*o["^]*r["^]*t|q["^]*c["^]*t["^]*l)|u["^]*(?:b["^]*p["^]*r["^]*n|s["^]*h["^]*(?:d|p["^]*r["^]*i["^]*n["^]*t["^]*e["^]*r["^]*c["^]*o["^]*n["^]*n["^]*e["^]*c["^]*t["^]*i["^]*o["^]*n["^]*s))|w["^]*(?:l["^]*a["^]*u["^]*n["^]*c["^]*h["^]*e["^]*r|s["^]*h))|q["^]*(?:a["^]*p["^]*p["^]*s["^]*r["^]*v|p["^]*r["^]*o["^]*c["^]*e["^]*s["^]*s|u["^]*s["^]*e["^]*r|w["^]*i["^]*n["^]*s["^]*t["^]*a)|r["^]*(?:d(?:["^]*p["^]*s["^]*i["^]*g["^]*n)?|e["^]*(?:f["^]*s["^]*u["^]*t["^]*i["^]*l|g(?:["^]*(?:i["^]*n["^]*i|s["^]*v["^]*r["^]*3["^]*2))?|l["^]*o["^]*g|(?:(?:p["^]*a["^]*d["^]*m["^]*i|s["^]*c["^]*a)["^]*)?n|x["^]*e["^]*c)|i["^]*s["^]*e["^]*t["^]*u["^]*p|m["^]*d["^]*i["^]*r|o["^]*b["^]*o["^]*c["^]*o["^]*p["^]*y|p["^]*c["^]*(?:i["^]*n["^]*f["^]*o|p["^]*i["^]*n["^]*g)|s["^]*h|u["^]*n["^]*d["^]*l["^]*l["^]*3["^]*2|w["^]*i["^]*n["^]*s["^]*t["^]*a)|s["^]*(?:a["^]*n|c["^]*(?:h["^]*t["^]*a["^]*s["^]*k["^]*s|w["^]*c["^]*m["^]*d)|e["^]*(?:c["^]*e["^]*d["^]*i["^]*t|r["^]*v["^]*e["^]*r["^]*(?:(?:c["^]*e["^]*i["^]*p|w["^]*e["^]*r)["^]*o["^]*p["^]*t["^]*i["^]*n|m["^]*a["^]*n["^]*a["^]*g["^]*e["^]*r["^]*c["^]*m["^]*d)|t["^]*x)|f["^]*c|(?:h["^]*o["^]*w["^]*m["^]*o["^]*u["^]*n|u["^]*b["^]*s)["^]*t|x["^]*s["^]*t["^]*r["^]*a["^]*c["^]*e|y["^]*s["^]*(?:o["^]*c["^]*m["^]*g["^]*r|t["^]*e["^]*m["^]*i["^]*n["^]*f["^]*o))|t["^]*(?:a["^]*(?:k["^]*e["^]*o["^]*w["^]*n|p["^]*i["^]*c["^]*f["^]*g|s["^]*k["^]*(?:k["^]*i["^]*l["^]*l|l["^]*i["^]*s["^]*t))|(?:c["^]*m["^]*s["^]*e["^]*t["^]*u|f["^]*t)["^]*p|(?:(?:e["^]*l["^]*n["^]*e|i["^]*m["^]*e["^]*o["^]*u)["^]*|r["^]*a["^]*c["^]*e["^]*r["^]*(?:p["^]*)?)t|l["^]*n["^]*t["^]*a["^]*d["^]*m["^]*n|p["^]*m["^]*(?:t["^]*o["^]*o["^]*l|v["^]*s["^]*c["^]*m["^]*g["^]*r)|s["^]*(?:(?:d["^]*i["^]*s["^]*)?c["^]*o["^]*n|e["^]*c["^]*i["^]*m["^]*p|k["^]*i["^]*l["^]*l|p["^]*r["^]*o["^]*f)|y["^]*p["^]*e["^]*p["^]*e["^]*r["^]*f|z["^]*u["^]*t["^]*i["^]*l)|u["^]*n["^]*(?:e["^]*x["^]*p["^]*o["^]*s["^]*e|i["^]*q["^]*u["^]*e["^]*i["^]*d|l["^]*o["^]*d["^]*c["^]*t["^]*r)|v["^]*(?:o["^]*l|s["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|w["^]*(?:a["^]*i["^]*t["^]*f["^]*o["^]*r|b["^]*a["^]*d["^]*m["^]*i["^]*n|(?:d["^]*s|e["^]*(?:c|v["^]*t))["^]*u["^]*t["^]*i["^]*l|h["^]*(?:e["^]*r["^]*e|o["^]*a["^]*m["^]*i)|i["^]*n["^]*(?:n["^]*t(?:["^]*3["^]*2)?|r["^]*s)|m["^]*i["^]*c|s["^]*c["^]*r["^]*i["^]*p["^]*t)|x["^]*c["^]*o["^]*p["^]*y)(?:.["^]*[0-9A-Z_a-z]+)?b
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*.[sv].*b
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?:$(?:((?:(.*)|.*))|{.*})|[<>](.*)|[!?.+])
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx ['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx /
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx s
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx ^[^.]+.[^;?]+[;?](.*(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]))
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx /
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx s
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx ^[^.]*?(?:['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{])
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx /
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx s
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i).|(?:[sv]*|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|G["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?E["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?T|a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:b|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?t|r(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[jp])?|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ks])|b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[8-9]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?9|[au]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|c|(?:m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?p|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dfu]|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[gr])|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[bdx]|n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|q["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[c-dgi]|m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[chr]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|o|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dp]|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b)|j["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:j["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|q)|k["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)?|[nps]|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a|z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|v)|n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[cl]|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|o["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[at]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?x|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|f|(?:k["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?g|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cp]|r(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?y)?|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dv]|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dt]|[g-hu]|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cr]|b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l|[co]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ex]|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c)|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|l)|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|c)|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|z)|y["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)|z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h))
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)[-0-9_a-z]+(?:["'[-]]+|$+[!#*-0-9?-@x5c_a-{]+|``|[$<>]())[sv]*[-0-9_a-z]+
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i !@rx [0-9]s*'s*[0-9]
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx ;[sv]*.[sv]*["']?(?:a(?:rchive|uth)|b(?:a(?:ckup|il)|inary)|c(?:d|h(?:anges|eck)|lone|onnection)|d(?:atabases|b(?:config|info)|ump)|e(?:cho|qp|x(?:cel|it|p(?:ert|lain)))|f(?:ilectrl|ullschema)|he(?:aders|lp)|i(?:mpo(?:rt|ster)|ndexes|otrace)|l(?:i(?:mi|n)t|o(?:ad|g))|(?:mod|n(?:onc|ullvalu)|unmodul)e|o(?:nce|pen|utput)|p(?:arameter|r(?:int|o(?:gress|mpt)))|quit|re(?:ad|cover|store)|s(?:ave|c(?:anstats|hema)|e(?:lftest|parator|ssion)|h(?:a3sum|ell|ow)?|tats|ystem)|t(?:ables|estc(?:ase|trl)|ime(?:out|r)|race)|vfs(?:info|list|name)|width)
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx rn(?s:.)*?b(?:(?i:E)(?:HLO [--.A-Za-zx17fx212a]{1,255}|XPN .{1,64})|HELO [--.A-Za-zx17fx212a]{1,255}|MAIL FROM:<.{1,64}(?i:@).{1,255}(?i:>)|(?i:R)(?:CPT TO:(?:(?i:<).{1,64}(?i:@).{1,255}(?i:>)|(?i: ))?(?i:<).{1,64}(?i:>)|SETb)|VRFY .{1,64}(?: <.{1,64}(?i:@).{1,255}(?i:>)|(?i:@).{1,255})|AUTH [-0-9A-Z_a-zx17fx212a]{1,20}(?i: )(?:(?:[+/-9A-Z_a-zx17fx212a]{4})*(?:[+/-9A-Z_a-zx17fx212a]{2}(?i:=)|[+/-9A-Z_a-zx17fx212a]{3}))?(?i:=)|STARTTLSb|NOOPb(?:(?i: ).{1,255})?)
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:A(?:PPEND (?:["-#%-&*--9A-Zx5c_a-z]+)?(?: ([ x5ca-z]+))?(?: "?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [+-][0-9]{4}"?)? {[0-9]{1,20}+?}|UTHENTICATE [-0-9_a-z]{1,20}rn)|L(?:SUB (?:["-#*.-9A-Z_a-z~]+)? (?:["%-&*.-9A-Zx5c_a-z]+)?|ISTRIGHTS (?:["%-&*--9A-Zx5c_a-z]+)?)|S(?:TATUS (?:["%-&*--9A-Zx5c_a-z]+)? ((?:U(?:NSEEN|IDNEXT)|MESSAGES|UIDVALIDITY|RECENT| )+)|ETACL (?:["%-&*--9A-Zx5c_a-z]+)? [+-][ac-eik-lpr-tw-x]+?)|UID (?:COPY|FETCH|STORE) (?:[*,0-:]+)?|(?:(?:DELETE|GET)ACL|MYRIGHTS) (?:["%-&*--9A-Zx5c_a-z]+)?)
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?is)rn.*?b(?:(?:LIST|TOP [0-9]+)(?: [0-9]+)?|U(?:SER .+?|IDL(?: [0-9]+)?)|PASS .+?|(?:RETR|DELE) [0-9]+?|A(?:POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [-0-9A-Z_]{1,20} (?:(?:[+/-9A-Z_a-z]{4})*(?:[+/-9A-Z_a-z]{2}=|[+/-9A-Z_a-z]{3}))?=))
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|an|io|ulimit)|s(?:h|plit|vtool)|u(?:(?:t|rl)[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|inks|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[^sv])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash|nap)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:3m|c|a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:c|a(?:ll|tch)[sv&)<>|]|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @pmFromFile unix-shell.data
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))b
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)b(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:(?:itude)?[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|n?f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|s(?:[sv&)<>|]|ed|ftp|ql)?|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:ew)?[sv&)<>|]|m(?:[sv&)<>|]|diff)|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:[sv&)<>c|]|h(?:o(?:[sv&)<>|]|ami|is)?|iptail[sv&)<>|])|a(?:ll|tch)[sv&)<>|]|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))b
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx /(?:[?*]+[a-z/]+|[a-z/]+[?*]+)
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx rn(?s:.)*?b(?:DATA|QUIT|HELP(?: .{1,255})?)
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:C(?:(?:REATE|OPY [*,0-:]+) ["-#%-&*--9A-Zx5c_a-z]+|APABILITY|HECK|LOSE)|DELETE ["-#%-&*--.0-9A-Zx5c_a-z]+|EX(?:AMINE ["-#%-&*--.0-9A-Zx5c_a-z]+|PUNGE)|FETCH [*,0-:]+|L(?:IST ["-#*--9A-Zx5c_a-z~]+? ["-#%-&*--9A-Zx5c_a-z]+|OG(?:IN [--.0-9@_a-z]{1,40} .*?|OUT))|RENAME ["-#%-&*--9A-Zx5c_a-z]+? ["-#%-&*--9A-Zx5c_a-z]+|S(?:E(?:LECT ["-#%-&*--9A-Zx5c_a-z]+|ARCH(?: CHARSET [--.0-9A-Z_a-z]{1,40})? (?:(KEYWORD x5c)?(?:A(?:LL|NSWERED)|BCC|D(?:ELETED|RAFT)|(?:FLAGGE|OL)D|RECENT|SEEN|UN(?:(?:ANSWER|FLAGG)ED|D(?:ELETED|RAFT)|SEEN)|NEW)|(?:BODY|CC|FROM|HEADER .{1,100}|NOT|OR .{1,255}|T(?:EXT|O)) .{1,255}|LARGER [0-9]{1,20}|[*,0-:]+|(?:BEFORE|ON|S(?:ENT(?:(?:BEFOR|SINC)E|ON)|INCE)) "?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4}"?|S(?:MALLER [0-9]{1,20}|UBJECT .{1,255})|U(?:ID [*,0-:]+?|NKEYWORD x5c(Seen|(?:Answer|Flagg)ed|D(?:eleted|raft)|Recent))))|T(?:ORE [*,0-:]+? [+-]?FLAGS(?:.SILENT)? (?:(x5c[a-z]{1,20}))?|ARTTLS)|UBSCRIBE ["-#%-&*--9A-Zx5c_a-z]+)|UN(?:SUBSCRIBE ["-#%-&*--9A-Zx5c_a-z]+|AUTHENTICATE)|NOOP)
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx rn(?s:.)*?b(?:(?:QUI|STA|RSE)(?i:T)|NOOP|CAPA)
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @rx !(?:d|!)
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_RCE
-
-acl block_RCE hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_RCE
-
-acl block_PHP hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx (?:<?(?:[^x]|x[^m]|xm[^l]|xml[^s]|xml$|$)|<?php|[(?:/|x5c)?php])
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx .*.ph(?:pd*|tml|ar|ps|t|pt).*$
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-config-directives.data
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @pm =
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-variables.data
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx (?:bzip2|expect|glob|ogg|(?:ph|r)ar|ssh2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?|z(?:ip|lib))://
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-function-names-933150.data
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx (?i)b(?["']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:*.**/|/.*)|#.*[sv]|")*["']*)?[sv]*(.*)
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx [oOcC]:d+:".+?":d+:{.*}
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx $+(?:[a-zA-Z_x7f-xff][a-zA-Z0-9_x7f-xff]*|s*{.+})(?:s|[.+]|{.+}|/*.**/|//.*|#.*)*(.*)
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx (?:((?:.+)(?:["'][-0-9A-Z_a-z]+["'])?(.+|[^)]*string[^)]*)[sv"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|["'][-0-9A-Zx5c_a-z]+["'])(.+));
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-function-names-933151.data
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @pm (
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx (?i)b(?:a(?:bs|s(?:in|sert(?:_options)?))|basename|c(?:h(?:eckdate|r(?:oot)?)|o(?:(?:mpac|(?:nsta|u)n)t|py|sh?)|r(?:eate_function|ypt)|urrent)|d(?:ate|e(?:coct|fined?)|ir)|e(?:nd|val|x(?:ec|p(?:lode)?|tract))|f(?:ile(?:(?:[acm]tim|inod|siz|typ)e|group|owner|perms)?|l(?:o(?:ck|or)|ush))|glob|h(?:ash|eader)|i(?:date|m(?:age(?:gif|(?:jpe|pn)g|wbmp|xbm)|plode)|s_a)|key|l(?:ink|og)|m(?:a(?:il|x)|d5|in)|n(?:ame|ext)|o(?:pendir|rd)|p(?:a(?:ck|ss(?:thru)?)|i|o(?:pen|w)|rev)|r(?:an(?:d|ge)|e(?:(?:adfil|nam)e|set)|ound)|s(?:(?:erializ|huffl)e|in|leep|(?:or|ta)t|ubstr|y(?:mlink|s(?:log|tem)))|t(?:an|(?:im|mpfil)e|ouch|rim)|u(?:cfirst|n(?:lin|pac)k)|virtual)(?:[sv]|/*.**/|(?:#|//).*)*(.*)
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx .*.(?:phpd*|phtml)..*$
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @pm ?>
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @rx (?:((?:.+)(?:["'][-0-9A-Z_a-z]+["'])?(.+|[^)]*string[^)]*)[sv"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|["'][-0-9A-Zx5c_a-z]+["'])(.+))(?:;|$)?
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_PHP
-
-acl block_PHP hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_PHP
-
-acl block_GENERIC hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_GENERIC
-
-acl block_GENERIC hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_GENERIC
-
-acl block_GENERIC hdr_sub(User-Agent) -i @rx _(?:$$ND_FUNC$$_|_js_function)|(?:beval|new[sv]+Function[sv]*)(|String.fromCharCode|function(){|this.constructor|module.exports=|([sv]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][sv]*)|process(?:.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:.call)?(|binding|constructor|env|global|main(?:Module)?|process|require)|[["'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)["'`]])|(?:binding|constructor|env|global|main(?:Module)?|process|require)[|console(?:.(?:debug|error|info|trace|warn)(?:.call)?(|[["'`](?:debug|error|info|trace|warn)["'`]])|require(?:.(?:resolve(?:.call)?(|main|extensions|cache)|[["'`](?:(?:resolv|cach)e|main|extensions)["'`]])
-http-request deny if block_GENERIC
-
-acl block_GENERIC hdr_sub(User-Agent) -i @rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[sv]*(
-http-request deny if block_GENERIC
-
-acl block_GENERIC hdr_sub(User-Agent) -i @pmFromFile ssrf.data
-http-request deny if block_GENERIC
-
-acl block_GENERIC hdr_sub(User-Agent) -i @rx (?:__proto__|constructors*(?:.|[)s*prototype)
-http-request deny if block_GENERIC
-
-acl block_GENERIC hdr_sub(User-Agent) -i @rx Process[sv]*.[sv]*spawn[sv]*(
-http-request deny if block_GENERIC
-
-acl block_GENERIC hdr_sub(User-Agent) -i @rx while[sv]*([sv(]*(?:!+(?:false|null|undefined|NaN|[+-]?0|"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[+-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)b|{.*}|[.*]|"[^"]+"|'[^']+'|`[^`]+`)).*)
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_LEAKAGES
 
-acl block_GENERIC hdr_sub(User-Agent) -i @rx ^data:(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_LEAKAGES
 
-acl block_GENERIC hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>[To Parent Directory]</[Aa]><br>)
+http-request deny if block_LEAKAGES
 
-acl block_GENERIC hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @rx ^#!s?/
+http-request deny if block_LEAKAGES
 
-acl block_GENERIC hdr_sub(User-Agent) -i @rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}.(?:[0-9]{1,3}.[0-9]{5}|[0-9]{8})|(?:x5cx5c[-0-9a-z].?_?)+|[[0-:a-f]+(?:[.0-9]+|%[0-9A-Z_a-z]+)?]|[a-z][--.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[sv]*&?@(?:(?:[0-9]{1,3}.){3}[0-9]{1,3}|[a-z][--.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[.0-9]{0,11}(?:xe2(?:x91[xa0-xbf]|x92[x80-xbf]|x93[x80-xa9xab-xbf])|xe3x80x82)+))
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_LEAKAGES
 
-acl block_GENERIC hdr_sub(User-Agent) -i @rx [s*constructors*]
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_LEAKAGES
 
-acl block_GENERIC hdr_sub(User-Agent) -i @rx @{.*}
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @rx ^5d{2}$
+http-request deny if block_LEAKAGES
 
-acl block_GENERIC hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_LEAKAGES
 
-acl block_GENERIC hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_LEAKAGES
 
-acl block_GENERIC hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_LEAKAGES
 
-acl block_GENERIC hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_GENERIC
+acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_LEAKAGES
 
 acl block_XSS hdr_sub(User-Agent) -i @lt 1
 http-request deny if block_XSS
@@ -1065,11 +690,83 @@ http-request deny if block_XSS
 acl block_XSS hdr_sub(User-Agent) -i @lt 3
 http-request deny if block_XSS
 
-acl block_XSS hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_XSS
+acl block_XSS hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_XSS
+
+acl block_XSS hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_XSS
+
+acl block_JAVA hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx java.lang.(?:runtime|processbuilder)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?:runtime|processbuilder)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?:unmarshaller|base64data|java.)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?:runtime|processbuilder)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @pmFromFile java-classes.data
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx .*.(?:jsp|jspx).*$
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx xacxedx00x05
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?:rO0ABQ|KztAAU|Cs7QAF)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx javab.+(?:runtime|processbuilder)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_JAVA
+
+acl block_JAVA hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_JAVA
 
-acl block_XSS hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_XSS
+acl block_JAVA hdr_sub(User-Agent) -i @rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)
+http-request deny if block_JAVA
 
 acl block_SQLI hdr_sub(User-Agent) -i @lt 1
 http-request deny if block_SQLI
@@ -1146,220 +843,469 @@ http-request deny if block_SQLI
 acl block_SQLI hdr_sub(User-Agent) -i @rx (?:^s*["'`;]+|["'`]+s*$)
 http-request deny if block_SQLI
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)!=|&&||||>[=->]|<(?:<|=>?|>(?:[sv]+binary)?)|b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?["'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)b|[0-9A-Z_a-z]*?_))|(?:likel(?:ihood|y)|unlikely)[sv]*()|r(?:egexp|like)[sv]+binary|not[sv]+between[sv]+(?:0[sv]+and|(?:'[^']*'|"[^"]*")[sv]+and[sv]+(?:'[^']*'|"[^"]*"))|is[sv]+null|like[sv]+(?:null|[0-9A-Z_a-z]+[sv]+escapeb)|(?:^|[^0-9A-Z_a-z])in[sv+]*([sv"0-9]+[^(-)]*)|[!<->]{1,2}[sv]*allb
-http-request deny if block_SQLI
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)!=|&&||||>[=->]|<(?:<|=>?|>(?:[sv]+binary)?)|b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?["'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)b|[0-9A-Z_a-z]*?_))|(?:likel(?:ihood|y)|unlikely)[sv]*()|r(?:egexp|like)[sv]+binary|not[sv]+between[sv]+(?:0[sv]+and|(?:'[^']*'|"[^"]*")[sv]+and[sv]+(?:'[^']*'|"[^"]*"))|is[sv]+null|like[sv]+(?:null|[0-9A-Z_a-z]+[sv]+escapeb)|(?:^|[^0-9A-Z_a-z])in[sv+]*([sv"0-9]+[^(-)]*)|[!<->]{1,2}[sv]*allb
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)[sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(?:=|<=>|(?:sounds[sv]+)?like|glob|r(?:like|egexp))[sv"'-)`]*?b([0-9A-Z_a-z]+)b
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @streq %{TX.2}
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)[sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(?:![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(?:like|r(?:like|egexp)))[sv"'-)`]*?b([0-9A-Z_a-z]+)b
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i !@streq %{TX.2}
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|g(?:lob|roup_concat)|h(?:ex|our)|i(?:f(?:null)?|if|n(?:str)?)|l(?:ast(?:_insert_rowid)?|ength|ike(?:l(?:ihood|y))?|n|o(?:ad_extension|g(?:10|2)?|wer(?:pi)?|cal)|trim)|m(?:ax|in(?:ute)?|o(?:d|nth))|n(?:ullif|ow)|p(?:i|ow(?:er)?|rintf|assword)|quote|r(?:a(?:dians|ndom(?:blob)?)|e(?:p(?:lace|eat)|verse)|ound|trim|ight)|s(?:i(?:gn|nh?)|oundex|q(?:lite_(?:compileoption_(?:get|used)|offset|source_id|version)|rt)|u(?:bstr(?:ing)?|m)|econd|leep)|t(?:anh?|otal(?:_changes)?|r(?:im|unc)|ypeof|ime)|u(?:n(?:icode|likely)|(?:pp|s)er)|zeroblob|bin|v(?:alues|ersion)|week|year)[^0-9A-Z_a-z]*(
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)(?:/*)+["'`]+[sv]?(?:--|[#{]|/*)?|["'`](?:[sv]*(?:(?:x?or|and|div|like|between)[sv-0-9A-Z_a-z]+[(-)+--<->][sv]*["'0-9`]|[!=|](?:[sv -!+-0-9=]+.*?["'-(`].*?|[sv -!0-9=]+.*?[0-9]+)$|(?:like|print)[^0-9A-Z_a-z]+["'-(0-9A-Z_-z]|;)|(?:[<>~]+|[sv]*[^sv0-9A-Z_a-z]?=[sv]*|[^0-9A-Z_a-z]*?[+=]+[^0-9A-Z_a-z]*?)["'`])|[0-9]["'`][sv]+["'`][sv]+[0-9]|^admin[sv]*?["'`]|[sv"'-(`][sv]*?glob[^0-9A-Z_a-z]+["'-(0-9A-Z_-z]|[sv]is[sv]*?0[^0-9A-Z_a-z]|where[sv][sv,-.0-9A-Z_a-z]+[sv]=
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i),.*?["')0-9`-f]["'`](?:["'`].*?["'`]|(?:r?n)?z|[^"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]*?([sv]*?space[sv]*?(
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)(?:&&||||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[sv(]+[0-9A-Z_a-z]+[sv)]*?[!+=]+[sv0-9]*?["'-)=`]|[0-9](?:[sv]*?(?:and|between|div|like|x?or)[sv]*?[0-9]+[sv]*?[+-]|[sv]+group[sv]+by.+()|/[0-9A-Z_a-z]+;?[sv]+(?:and|between|div|having|like|x?or|select)[^0-9A-Z_a-z]|(?:[#;]|--)[sv]*?(?:alter|drop|(?:insert|update)[sv]*?[0-9A-Z_a-z]{2,})|@.+=[sv]*?([sv]*?select|[^0-9A-Z_a-z]SET[sv]*?@[0-9A-Z_a-z]+
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)["'`][sv]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?["'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+["'`]|like[sv]*?["'`]%|select[sv]+?[sv"'-),-.0-9A-[]_-z]+from[sv]+
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i))[sv]*?when[sv]*?[0-9]+[sv]*?then|["'`][sv]*?(?:[#{]|--)|/*![sv]?[0-9]+|b(?:(?:binary|cha?r)[sv]*?([sv]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:egexp|like))[sv]+[0-9A-Z_a-z]+()|(?:|||&&)[sv]*?[0-9A-Z_a-z]+(
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)(?:([sv]*?select[sv]*?[0-9A-Z_a-z]+|coalesce|order[sv]+by[sv]+if[0-9A-Z_a-z]*?)[sv]*?(|*/from|+[sv]*?[0-9]+[sv]*?+[sv]*?@|[0-9A-Z_a-z]["'`][sv]*?(?:(?:[+-=@|]+[sv]+?)+|[+-=@|]+)[(0-9]|@@[0-9A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]|[^0-9A-Z_a-z]!+["'`][0-9A-Z_a-z]|["'`](?:;[sv]*?(?:if|while|begin)|[sv0-9]+=[sv]*?[0-9])|[sv(]+case[0-9]*?[^0-9A-Z_a-z].+[tw]hen[sv(]
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)["'`][sv]*?b(?:x?or|div|like|between|and)b[sv]*?["'`]?[0-9]|x5cx(?:2[37]|3d)|^(?:.?["'`]$|["'x5c`]*?(?:["'0-9`]+|[^"'`]+["'`])[sv]*?b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)b[sv]*?["'0-9A-Z_-z][!&(-)+-.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?["'`][sv]*?[0-9A-Z_a-z]|@(?:[0-9A-Z_a-z]+[sv]+(?:and|x?or|div|like|between)b[sv]*?["'0-9`]+|[-0-9A-Z_a-z]+[sv](?:and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?["'`].|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)in[sv]*?(+[sv]*?select|(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)[sv+0-9A-Z_a-z]+(?:regexp[sv]*?(|sounds[sv]+like[sv]*?["'`]|[0-9=]+x)|["'`](?:[sv]*?(?:[0-9][sv]*?(?:--|#)|is[sv]*?(?:[0-9].+["'`]?[0-9A-Z_a-z]|[.0-9]+[sv]*?[^0-9A-Z_a-z].*?["'`]))|[%-&<->^]+[0-9][sv]*?(?:=|x?or|div|like|between|and)|(?:[^0-9A-Z_a-z]+[+-0-9A-Z_a-z]+[sv]*?=[sv]*?[0-9][^0-9A-Z_a-z]+||?[-0-9A-Z_a-z]{3,}[^sv,.0-9A-Z_a-z]+)["'`]|[sv]*(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)(?:array[sv]*[|[0-9A-Z_a-z]+(?:[sv]*!?~|[sv]+(?:not[sv]+)?similar[sv]+to[sv]+)|(?:tru|fals)eb))|bexcept[sv]+(?:selectb|values[sv]*?()
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i:^[Wd]+s*?(?:alter|union)b)
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)[sv]?(?|end[sv]*?);|[sv(]load_file[sv]*?(|["'`][sv]+regexp[^0-9A-Z_a-z]|[^A-Z_a-z][sv]+asb[sv]*["'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:create[sv]+[0-9A-Z_a-z]+|(?:d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load|(?:renam|truncat)e|u(?:pdate|nion[sv]*(?:all|(?:sele|distin)ct))|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject)))b)
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)["'`](?:[sv]*?(?:(?:*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?["'`]|(?:x?or|div|like|between|and)[sv][^0-9]+[-0-9A-Z_a-z]+.*?)[0-9]|[^sv0-9?A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]+[sv]*?["'`]|[^sv0-9A-Z_a-z]+[sv]*?[^A-Z_a-z].*?(?:#|--))|.*?*[sv]*?[0-9])|^["'`]|[%(-+-<>][-0-9A-Z_a-z]+[^sv0-9A-Z_a-z]+["'`][^,]
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:havingb(?:[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')[sv]*?[<->]| ?(?:[0-9]{1,10} ?[<->]+|["'][^=]{1,10}[ "'<-?[]+))|ex(?:ecute(?:(|[sv]{1,5}[$.0-9A-Z_a-z]{1,5}[sv]{0,3})|ists[sv]*?([sv]*?selectb)|(?:create[sv]+?table.{0,20}?|like[^0-9A-Z_a-z]*?char[^0-9A-Z_a-z]*?)()|select.*?case|from.*?limit|order[sv]by|exists[sv](?:[sv]select|s(?:elect[^sv](?:if(?:null)?[sv](|top|concat)|ystem[sv]()|bhavingb[sv]+[0-9]{1,10}|'[^=]{1,10}')
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:orb(?:[sv]?(?:[0-9]{1,10}|["'][^=]{1,10}["'])[sv]?[<->]+|[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|xorb[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|'[sv]+x?or[sv]+.{1,20}[!+-<->]
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)bandb(?:[sv]+(?:[0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|["'][^=]{1,10}["']) ?[<->]+)
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:a(?:(?:b|co)s|dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:in|cii(?:str)?)|tan2?|vg)|b(?:enchmark|i(?:n(?:_to_num)?|t_(?:and|count|length|x?or)))|c(?:ast|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|o(?:alesce|ercibility|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|(?:un)?t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|time(?:stamp)?|user)))|d(?:a(?:t(?:abase|e(?:_(?:add|format|sub)|diff)?)|y(?:name|of(?:month|week|year))?)|count|e(?:code|(?:faul|s_(?:de|en)cryp)t|grees)|ump)|e(?:lt|nc(?:ode|rypt)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:eld(?:_in_set)?|nd_in_set)|loor|o(?:rmat|und_rows)|rom_(?:base64|days|unixtime))|g(?:et_(?:format|lock)|r(?:eates|oup_conca)t)|h(?:ex(?:toraw)?|our)|i(?:f(?:null)?|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)?|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull))|null)?)|l(?:ast(?:_(?:day|insert_id))?|case|e(?:(?:as|f)t|ngth)|n|o(?:ad_file|ca(?:l(?:timestamp)?|te)|g(?:10|2)?|wer)|pad|trim)|m(?:a(?:ke(?:date|_set)|ster_pos_wait|x)|d5|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:d|nth(?:name)?))|n(?:ame_const|o(?:t_in|w)|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:assword|eriod_(?:add|diff)|g_sleep|i|o(?:sition|w(?:er)?)|rocedure_analyse)|qu(?:arter|ote)|r(?:a(?:dians|nd|wto(?:hex|nhex(?:toraw)?))|e(?:lease_lock|p(?:eat|lace)|verse)|ight|o(?:und|w_count)|pad|trim)|s(?:chema|e(?:c(?:ond|_to_time)|ssion_user)|ha[1-2]?|ig?n|leep|oundex|pace|qrt|t(?:d(?:dev(?:_(?:po|sam)p)?)?|r(?:cmp|_to_date))|u(?:b(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|m)|ys(?:date|tem_user))|t(?:an|ime(?:diff|_(?:format|to_sec)|stamp(?:add|diff)?)?|o_(?:base64|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|ix_timestamp)|p(?:datexml|per)|ser|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|v(?:a(?:lues|r(?:iance|_(?:po|sam)p))|ersion)|we(?:ek(?:day|ofyear)?|ight_string)|xmltype|year(?:week)?)[^0-9A-Z_a-z]*?(
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|oacreate|p(?:assword|repare)|replwritetovarbin)|ql_(?:longvarchar|variant))|utl_(?:file|http)|xp_(?:availablemedia|(?:cmdshel|servicecontro)l|dirtree|e(?:numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(?:_enumdomains)?|reg(?:addmultistring|delete(?:key|value)|enum(?:key|value)s|re(?:ad|movemultistring)|write)|terminate(?:_process)?)
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:(?:d(?:bms_[0-9A-Z_a-z]+.|eleteb[^0-9A-Z_a-z]*?bfrom)|(?:groupb.*?bbyb.{1,100}?bhav|overlayb[^0-9A-Z_a-z]*?(.*?b[^0-9A-Z_a-z]*?plac)ing|in(?:nerb[^0-9A-Z_a-z]*?bjoin|sertb[^0-9A-Z_a-z]*?binto|tob[^0-9A-Z_a-z]*?b(?:dump|out)file)|loadb[^0-9A-Z_a-z]*?bdatab.*?binfile|s(?:electb.{1,100}?b(?:(?:.*?bdumpb.*|(?:count|length)b.{1,100}?)bfrom|(?:data_typ|fromb.{1,100}?bwher)e|instr|to(?:_(?:cha|numbe)r|pb.{1,100}?bfrom))|ys_context)|u(?:nionb.{1,100}?bselect|tl_inaddr))b|printb[^0-9A-Z_a-z]*?@@)|(?:collation[^0-9A-Z_a-z]*?(a|@@version|;[^0-9A-Z_a-z]*?b(?:drop|shutdown))b|'(?:dbo|msdasql|s(?:a|qloledb))'
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){12})
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx /*!?|*/|[';]--|--(?:[sv]|[^-]*?-)|[^&-]#.*?[sv]|;?x00
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i !@rx ^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+.[-0-9A-Z_a-z]+$
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i:b0x[a-fd]{3,})
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?:`(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)`)
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)["'`][sv]*?(?:(?:is[sv]+not|not[sv]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|])
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^"]*?(?:"[^"]*?"[^"]*?)*?"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx ^(?:and|or)$
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx ^.*?x5c['"`](?:.*?['"`])?s*(?:and|or)b
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @detectSQLi
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*(
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)W+d*?s*?bhavingbs*?[^s-]
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx ["'`][sd]*?[^ws]W*?dW*?.*?["'`d]
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){8})
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){6})
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx W{4}
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx (?:'(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)')
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx ';
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){3})
+http-request deny if block_SQLI
+
+acl block_SQLI hdr_sub(User-Agent) -i @rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){2})
+http-request deny if block_SQLI
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx (?i)^(?:get /[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?|(?:connect (?:(?:[0-9]{1,3}.){3}[0-9]{1,3}.?(?::[0-9]+)?|[--9A-Z_a-z]+:[0-9]+)|options *|[a-z]{3,10}[sv]+(?:[0-9A-Z_a-z]{3,7}?://[--9A-Z_a-z]*(?::[0-9]+)?)?/[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?)[sv]+[.-9A-Z_a-z]+)$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx (?i)^(?:&(?:(?:[acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|(?:[cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^"';=])*$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^d+$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^(?:GET|HEAD)$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^0?$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^(?:GET|HEAD)$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@eq 0
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @streq POST
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@eq 0
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@eq 0
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx (d+)-(d+)
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt %{tx.1}
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx b(?:keep-alive|close),s?(?:keep-alive|close)b
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx x25
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateUrlEncoding
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^(?i)application/x-www-form-urlencoded
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx x25
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateUrlEncoding
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateUtf8Encoding
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx %u[fF]{2}[0-9a-fA-F]{2}
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateByteRange 1-255
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^OPTIONS$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@pm AppleWebKit Android Business Enterprise Entreprise
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^OPTIONS$
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
+http-request deny if block_ENFORCEMENT
+
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^$
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)[sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(?:=|<=>|(?:sounds[sv]+)?like|glob|r(?:like|egexp))[sv"'-)`]*?b([0-9A-Z_a-z]+)b
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^0$
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @streq %{TX.2}
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)[sv"'-)`]*?b([0-9A-Z_a-z]+)b[sv"'-)`]*?(?:![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(?:like|r(?:like|egexp)))[sv"'-)`]*?b([0-9A-Z_a-z]+)b
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx (?:^([d.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$)
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i !@streq %{TX.2}
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|g(?:lob|roup_concat)|h(?:ex|our)|i(?:f(?:null)?|if|n(?:str)?)|l(?:ast(?:_insert_rowid)?|ength|ike(?:l(?:ihood|y))?|n|o(?:ad_extension|g(?:10|2)?|wer(?:pi)?|cal)|trim)|m(?:ax|in(?:ute)?|o(?:d|nth))|n(?:ullif|ow)|p(?:i|ow(?:er)?|rintf|assword)|quote|r(?:a(?:dians|ndom(?:blob)?)|e(?:p(?:lace|eat)|verse)|ound|trim|ight)|s(?:i(?:gn|nh?)|oundex|q(?:lite_(?:compileoption_(?:get|used)|offset|source_id|version)|rt)|u(?:bstr(?:ing)?|m)|econd|leep)|t(?:anh?|otal(?:_changes)?|r(?:im|unc)|ypeof|ime)|u(?:n(?:icode|likely)|(?:pp|s)er)|zeroblob|bin|v(?:alues|ersion)|week|year)[^0-9A-Z_a-z]*(
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.max_num_args}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)(?:/*)+["'`]+[sv]?(?:--|[#{]|/*)?|["'`](?:[sv]*(?:(?:x?or|and|div|like|between)[sv-0-9A-Z_a-z]+[(-)+--<->][sv]*["'0-9`]|[!=|](?:[sv -!+-0-9=]+.*?["'-(`].*?|[sv -!0-9=]+.*?[0-9]+)$|(?:like|print)[^0-9A-Z_a-z]+["'-(0-9A-Z_-z]|;)|(?:[<>~]+|[sv]*[^sv0-9A-Z_a-z]?=[sv]*|[^0-9A-Z_a-z]*?[+=]+[^0-9A-Z_a-z]*?)["'`])|[0-9]["'`][sv]+["'`][sv]+[0-9]|^admin[sv]*?["'`]|[sv"'-(`][sv]*?glob[^0-9A-Z_a-z]+["'-(0-9A-Z_-z]|[sv]is[sv]*?0[^0-9A-Z_a-z]|where[sv][sv,-.0-9A-Z_a-z]+[sv]=
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i),.*?["')0-9`-f]["'`](?:["'`].*?["'`]|(?:r?n)?z|[^"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]*?([sv]*?space[sv]*?(
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.arg_name_length}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)(?:&&||||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[sv(]+[0-9A-Z_a-z]+[sv)]*?[!+=]+[sv0-9]*?["'-)=`]|[0-9](?:[sv]*?(?:and|between|div|like|x?or)[sv]*?[0-9]+[sv]*?[+-]|[sv]+group[sv]+by.+()|/[0-9A-Z_a-z]+;?[sv]+(?:and|between|div|having|like|x?or|select)[^0-9A-Z_a-z]|(?:[#;]|--)[sv]*?(?:alter|drop|(?:insert|update)[sv]*?[0-9A-Z_a-z]{2,})|@.+=[sv]*?([sv]*?select|[^0-9A-Z_a-z]SET[sv]*?@[0-9A-Z_a-z]+
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)["'`][sv]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?["'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+["'`]|like[sv]*?["'`]%|select[sv]+?[sv"'-),-.0-9A-[]_-z]+from[sv]+
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.arg_length}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i))[sv]*?when[sv]*?[0-9]+[sv]*?then|["'`][sv]*?(?:[#{]|--)|/*![sv]?[0-9]+|b(?:(?:binary|cha?r)[sv]*?([sv]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:egexp|like))[sv]+[0-9A-Z_a-z]+()|(?:|||&&)[sv]*?[0-9A-Z_a-z]+(
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)(?:([sv]*?select[sv]*?[0-9A-Z_a-z]+|coalesce|order[sv]+by[sv]+if[0-9A-Z_a-z]*?)[sv]*?(|*/from|+[sv]*?[0-9]+[sv]*?+[sv]*?@|[0-9A-Z_a-z]["'`][sv]*?(?:(?:[+-=@|]+[sv]+?)+|[+-=@|]+)[(0-9]|@@[0-9A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]|[^0-9A-Z_a-z]!+["'`][0-9A-Z_a-z]|["'`](?:;[sv]*?(?:if|while|begin)|[sv0-9]+=[sv]*?[0-9])|[sv(]+case[0-9]*?[^0-9A-Z_a-z].+[tw]hen[sv(]
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.total_arg_length}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)["'`][sv]*?b(?:x?or|div|like|between|and)b[sv]*?["'`]?[0-9]|x5cx(?:2[37]|3d)|^(?:.?["'`]$|["'x5c`]*?(?:["'0-9`]+|[^"'`]+["'`])[sv]*?b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)b[sv]*?["'0-9A-Z_-z][!&(-)+-.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?["'`][sv]*?[0-9A-Z_a-z]|@(?:[0-9A-Z_a-z]+[sv]+(?:and|x?or|div|like|between)b[sv]*?["'0-9`]+|[-0-9A-Z_a-z]+[sv](?:and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?["'`].|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)in[sv]*?(+[sv]*?select|(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)[sv+0-9A-Z_a-z]+(?:regexp[sv]*?(|sounds[sv]+like[sv]*?["'`]|[0-9=]+x)|["'`](?:[sv]*?(?:[0-9][sv]*?(?:--|#)|is[sv]*?(?:[0-9].+["'`]?[0-9A-Z_a-z]|[.0-9]+[sv]*?[^0-9A-Z_a-z].*?["'`]))|[%-&<->^]+[0-9][sv]*?(?:=|x?or|div|like|between|and)|(?:[^0-9A-Z_a-z]+[+-0-9A-Z_a-z]+[sv]*?=[sv]*?[0-9][^0-9A-Z_a-z]+||?[-0-9A-Z_a-z]{3,}[^sv,.0-9A-Z_a-z]+)["'`]|[sv]*(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)(?:array[sv]*[|[0-9A-Z_a-z]+(?:[sv]*!?~|[sv]+(?:not[sv]+)?similar[sv]+to[sv]+)|(?:tru|fals)eb))|bexcept[sv]+(?:selectb|values[sv]*?()
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^(?i)multipart/form-data
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i:^[Wd]+s*?(?:alter|union)b)
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.max_file_size}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)[sv]?(?|end[sv]*?);|[sv(]load_file[sv]*?(|["'`][sv]+regexp[^0-9A-Z_a-z]|[^A-Z_a-z][sv]+asb[sv]*["'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:create[sv]+[0-9A-Z_a-z]+|(?:d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load|(?:renam|truncat)e|u(?:pdate|nion[sv]*(?:all|(?:sele|distin)ct))|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject)))b)
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 1
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)["'`](?:[sv]*?(?:(?:*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?["'`]|(?:x?or|div|like|between|and)[sv][^0-9]+[-0-9A-Z_a-z]+.*?)[0-9]|[^sv0-9?A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]+[sv]*?["'`]|[^sv0-9A-Z_a-z]+[sv]*?[^A-Z_a-z].*?(?:#|--))|.*?*[sv]*?[0-9])|^["'`]|[%(-+-<>][-0-9A-Z_a-z]+[^sv0-9A-Z_a-z]+["'`][^,]
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt %{tx.combined_file_sizes}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:havingb(?:[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')[sv]*?[<->]| ?(?:[0-9]{1,10} ?[<->]+|["'][^=]{1,10}[ "'<-?[]+))|ex(?:ecute(?:(|[sv]{1,5}[$.0-9A-Z_a-z]{1,5}[sv]{0,3})|ists[sv]*?([sv]*?selectb)|(?:create[sv]+?table.{0,20}?|like[^0-9A-Z_a-z]*?char[^0-9A-Z_a-z]*?)()|select.*?case|from.*?limit|order[sv]by|exists[sv](?:[sv]select|s(?:elect[^sv](?:if(?:null)?[sv](|top|concat)|ystem[sv]()|bhavingb[sv]+[0-9]{1,10}|'[^=]{1,10}')
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^[w/.+*-]+(?:s?;s?(?:action|boundary|charset|component|start(?:-info)?|type|version)s?=s?['"w.()+,/:=?<>@#*-]+)*$
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:orb(?:[sv]?(?:[0-9]{1,10}|["'][^=]{1,10}["'])[sv]?[<->]+|[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|xorb[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|'[sv]+x?or[sv]+.{1,20}[!+-<->]
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^[^;s]+
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)bandb(?:[sv]+(?:[0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|["'][^=]{1,10}["']) ?[<->]+)
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@within %{tx.allowed_request_content_type}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:a(?:(?:b|co)s|dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:in|cii(?:str)?)|tan2?|vg)|b(?:enchmark|i(?:n(?:_to_num)?|t_(?:and|count|length|x?or)))|c(?:ast|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|o(?:alesce|ercibility|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|(?:un)?t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|time(?:stamp)?|user)))|d(?:a(?:t(?:abase|e(?:_(?:add|format|sub)|diff)?)|y(?:name|of(?:month|week|year))?)|count|e(?:code|(?:faul|s_(?:de|en)cryp)t|grees)|ump)|e(?:lt|nc(?:ode|rypt)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:eld(?:_in_set)?|nd_in_set)|loor|o(?:rmat|und_rows)|rom_(?:base64|days|unixtime))|g(?:et_(?:format|lock)|r(?:eates|oup_conca)t)|h(?:ex(?:toraw)?|our)|i(?:f(?:null)?|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)?|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull))|null)?)|l(?:ast(?:_(?:day|insert_id))?|case|e(?:(?:as|f)t|ngth)|n|o(?:ad_file|ca(?:l(?:timestamp)?|te)|g(?:10|2)?|wer)|pad|trim)|m(?:a(?:ke(?:date|_set)|ster_pos_wait|x)|d5|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:d|nth(?:name)?))|n(?:ame_const|o(?:t_in|w)|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:assword|eriod_(?:add|diff)|g_sleep|i|o(?:sition|w(?:er)?)|rocedure_analyse)|qu(?:arter|ote)|r(?:a(?:dians|nd|wto(?:hex|nhex(?:toraw)?))|e(?:lease_lock|p(?:eat|lace)|verse)|ight|o(?:und|w_count)|pad|trim)|s(?:chema|e(?:c(?:ond|_to_time)|ssion_user)|ha[1-2]?|ig?n|leep|oundex|pace|qrt|t(?:d(?:dev(?:_(?:po|sam)p)?)?|r(?:cmp|_to_date))|u(?:b(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|m)|ys(?:date|tem_user))|t(?:an|ime(?:diff|_(?:format|to_sec)|stamp(?:add|diff)?)?|o_(?:base64|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|ix_timestamp)|p(?:datexml|per)|ser|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|v(?:a(?:lues|r(?:iance|_(?:po|sam)p))|ersion)|we(?:ek(?:day|ofyear)?|ight_string)|xmltype|year(?:week)?)[^0-9A-Z_a-z]*?(
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx charsets*=s*["']?([^;"'s]+)
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|oacreate|p(?:assword|repare)|replwritetovarbin)|ql_(?:longvarchar|variant))|utl_(?:file|http)|xp_(?:availablemedia|(?:cmdshel|servicecontro)l|dirtree|e(?:numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(?:_enumdomains)?|reg(?:addmultistring|delete(?:key|value)|enum(?:key|value)s|re(?:ad|movemultistring)|write)|terminate(?:_process)?)
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@within %{tx.allowed_request_content_type_charset}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:(?:d(?:bms_[0-9A-Z_a-z]+.|eleteb[^0-9A-Z_a-z]*?bfrom)|(?:groupb.*?bbyb.{1,100}?bhav|overlayb[^0-9A-Z_a-z]*?(.*?b[^0-9A-Z_a-z]*?plac)ing|in(?:nerb[^0-9A-Z_a-z]*?bjoin|sertb[^0-9A-Z_a-z]*?binto|tob[^0-9A-Z_a-z]*?b(?:dump|out)file)|loadb[^0-9A-Z_a-z]*?bdatab.*?binfile|s(?:electb.{1,100}?b(?:(?:.*?bdumpb.*|(?:count|length)b.{1,100}?)bfrom|(?:data_typ|fromb.{1,100}?bwher)e|instr|to(?:_(?:cha|numbe)r|pb.{1,100}?bfrom))|ys_context)|u(?:nionb.{1,100}?bselect|tl_inaddr))b|printb[^0-9A-Z_a-z]*?@@)|(?:collation[^0-9A-Z_a-z]*?(a|@@version|;[^0-9A-Z_a-z]*?b(?:drop|shutdown))b|'(?:dbo|msdasql|s(?:a|qloledb))'
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx charset.*?charset
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){12})
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@within %{tx.allowed_http_versions}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx /*!?|*/|[';]--|--(?:[sv]|[^-]*?-)|[^&-]#.*?[sv]|;?x00
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx .([^.]+)$
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i !@rx ^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+.[-0-9A-Z_a-z]+$
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @within %{tx.restricted_extensions}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i:b0x[a-fd]{3,})
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx .[^.~]+~(?:/.*|)$
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?:`(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)`)
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^.*$
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)["'`][sv]*?(?:(?:is[sv]+not|not[sv]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|])
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @within %{tx.restricted_headers_basic}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^"]*?(?:"[^"]*?"[^"]*?)*?"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt 50
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx ^(?:and|or)$
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx ^.*?x5c['"`](?:.*?['"`])?s*(?:and|or)b
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@streq JSON
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @detectSQLi
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx (?i)x5cu[0-9a-f]{4}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*(
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @contains #
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt 1
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?i)W+d*?s*?bhavingbs*?[^s-]
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx ["'`][sd]*?[^ws]W*?dW*?.*?["'`d]
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@endsWith .pdf
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){8})
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @endsWith .pdf
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){6})
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){63}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx W{4}
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx %[0-9a-fA-F]{2}
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx (?:'(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)')
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateByteRange 9,10,13,32-126,128-255
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx ';
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ['";=]
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^0$
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){3})
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
+http-request deny if block_ENFORCEMENT
 
-acl block_SQLI hdr_sub(User-Agent) -i @rx ((?:[~!@#$%^&*()-+={}[]|:;"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;"'´’‘`<>]*?){2})
-http-request deny if block_SQLI
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^.*$
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @within %{tx.restricted_headers_extended}
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @rx (?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateByteRange 32-36,38-126
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @rx ^(?:ht|f)tps?://(.*?)/
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @eq 0
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i !@endsWith %{request_headers.host}
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^(?:OPTIONS|CONNECT)$
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@pm AppleWebKit Android
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @eq 0
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @ge 1
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^(?i)up
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @gt 0
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:s*,s*|$)){1,7}$
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx br|compress|deflate|(?:pack200-)?gzip|identity|*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_ENFORCEMENT
 
-acl block_FIXATION hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_FIXATION
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_ENFORCEMENT
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_JAVA
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @endsWith .pdf
+http-request deny if block_ENFORCEMENT
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_JAVA
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}
+http-request deny if block_ENFORCEMENT
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx java.lang.(?:runtime|processbuilder)
-http-request deny if block_JAVA
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateByteRange 38,44-46,48-58,61,65-90,95,97-122
+http-request deny if block_ENFORCEMENT
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?:runtime|processbuilder)
-http-request deny if block_JAVA
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @validateByteRange 32,34,38,42-59,61,65-90,95,97-122
+http-request deny if block_ENFORCEMENT
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?:unmarshaller|base64data|java.)
-http-request deny if block_JAVA
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i !@rx ^(?:?[01])?$
+http-request deny if block_ENFORCEMENT
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)
-http-request deny if block_JAVA
+acl block_ENFORCEMENT hdr_sub(User-Agent) -i @rx (?:^|[^x5c])x5c[cdeghijklmpqwxyz123456789]
+http-request deny if block_ENFORCEMENT
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?:runtime|processbuilder)
+acl block_JAVA hdr_sub(User-Agent) -i @lt 1
 http-request deny if block_JAVA
 
-acl block_JAVA hdr_sub(User-Agent) -i @pmFromFile java-classes.data
+acl block_JAVA hdr_sub(User-Agent) -i @lt 1
 http-request deny if block_JAVA
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx .*.(?:jsp|jspx).*$
+acl block_JAVA hdr_sub(User-Agent) -i @pmFromFile java-code-leakages.data
 http-request deny if block_JAVA
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)
+acl block_JAVA hdr_sub(User-Agent) -i @pmFromFile java-errors.data
 http-request deny if block_JAVA
 
 acl block_JAVA hdr_sub(User-Agent) -i @lt 2
@@ -1368,335 +1314,335 @@ http-request deny if block_JAVA
 acl block_JAVA hdr_sub(User-Agent) -i @lt 2
 http-request deny if block_JAVA
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)
+acl block_JAVA hdr_sub(User-Agent) -i @lt 3
 http-request deny if block_JAVA
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx xacxedx00x05
+acl block_JAVA hdr_sub(User-Agent) -i @lt 3
 http-request deny if block_JAVA
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?:rO0ABQ|KztAAU|Cs7QAF)
+acl block_JAVA hdr_sub(User-Agent) -i @lt 4
 http-request deny if block_JAVA
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)
+acl block_JAVA hdr_sub(User-Agent) -i @lt 4
 http-request deny if block_JAVA
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx javab.+(?:runtime|processbuilder)
-http-request deny if block_JAVA
+acl block_ATTACK hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_ATTACK
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)
-http-request deny if block_JAVA
+acl block_ATTACK hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_ATTACK
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_JAVA
+acl block_ATTACK hdr_sub(User-Agent) -i @rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d
+http-request deny if block_ATTACK
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_JAVA
+acl block_ATTACK hdr_sub(User-Agent) -i @rx [rn]W*?(?:content-(?:type|length)|set-cookie|location):s*w
+http-request deny if block_ATTACK
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)
-http-request deny if block_JAVA
+acl block_ATTACK hdr_sub(User-Agent) -i @rx (?:bhttp/d|<(?:html|meta)b)
+http-request deny if block_ATTACK
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_JAVA
+acl block_ATTACK hdr_sub(User-Agent) -i @rx [nr]
+http-request deny if block_ATTACK
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_JAVA
+acl block_ATTACK hdr_sub(User-Agent) -i @rx [nr]
+http-request deny if block_ATTACK
 
-acl block_JAVA hdr_sub(User-Agent) -i @rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)
-http-request deny if block_JAVA
+acl block_ATTACK hdr_sub(User-Agent) -i @rx [nr]+(?:s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*:
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 1
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @rx [nr]
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 1
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @rx ^[^:()&|!<>~]*)s*(?:((?:[^,()=&|!<>~]+[><~]?=|s*[&!|]s*(?:)|()?s*)|)s*(s*[&|!]s*|[&!|]s*([^()=&|!<>~]+[><~]?=[^:()&|!<>~]*)
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 2
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @rx ^[^sv,;]+[sv,;].*?(?:application/(?:.++)?json|(?:application/(?:soap+)?|text/)xml)
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 2
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @rx unix:[^|]*|
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 3
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 3
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 4
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @rx [nr]
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 4
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @rx ^[^sv,;]+[sv,;].*?b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([+/]))b
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 1
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 1
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 2
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @gt 0
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 2
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @rx .
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 3
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @gt 1
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 3
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @rx TX:paramcounter_(.*)
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 4
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @rx (][^]]+$|][^]]+[)
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge 4
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge %{tx.inbound_anomaly_score_threshold}
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @eq 1
-http-request deny if block_EVALUATION
+acl block_ATTACK hdr_sub(User-Agent) -i @rx [
+http-request deny if block_ATTACK
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @ge %{tx.inbound_anomaly_score_threshold}
-http-request deny if block_EVALUATION
+acl block_PHP hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_PHP
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_EVALUATION
+acl block_PHP hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_PHP
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_EVALUATION
+acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-errors.data
+http-request deny if block_PHP
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_EVALUATION
+acl block_PHP hdr_sub(User-Agent) -i @rx (?:b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|$_(?:(?:pos|ge)t|session))b
+http-request deny if block_PHP
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_EVALUATION
+acl block_PHP hdr_sub(User-Agent) -i @rx (?i)<?(?:=|php)?s+
+http-request deny if block_PHP
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_EVALUATION
+acl block_PHP hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_PHP
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_EVALUATION
+acl block_PHP hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_PHP
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_EVALUATION
+acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-errors-pl2.data
+http-request deny if block_PHP
 
-acl block_EVALUATION hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_EVALUATION
+acl block_PHP hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_PHP
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_LEAKAGES
+acl block_PHP hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_PHP
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_LEAKAGES
+acl block_PHP hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_PHP
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>[To Parent Directory]</[Aa]><br>)
-http-request deny if block_LEAKAGES
+acl block_PHP hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_PHP
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @rx ^#!s?/
-http-request deny if block_LEAKAGES
+acl block_RCE hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_RCE
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_LEAKAGES
+acl block_RCE hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_RCE
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_LEAKAGES
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:(?:b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|[ckz]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[&,<>|]|(?:[--.0-9A-Z_a-z]["'[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#*-0-9?-@_a-{]*)?x5c?)+[sv&,<>|]).*|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:4|[sv&),<>|].*))|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*)?|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|(?:e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)b
+http-request deny if block_RCE
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @rx ^5d{2}$
-http-request deny if block_LEAKAGES
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[sv&)<>|]|a(?:dd(?:group|user)|getty|l(?:ias|pine)[sv&)<>|]|nsible-playbook|pt(?:-get|itude[sv&)<>|])|r(?:ch[sv&)<>|]|ia2c)|s(?:cii(?:-xfr|85)|pell)|tobm|xel)|b(?:a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu)|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:a(?:ncel|psh)[sv&)<>|]|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|p(?:an|io|ulimit)|r(?:ash[sv&)<>|]|on(?:tab)?)|s(?:plit|vtool)|u(?:psfilter|rl[sv&)<>|]))|d(?:(?:a(?:sh|te)|i(?:alog|ff))[sv&)<>|]|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:2fsck|(?:asy_instal|va)l|cho[sv&)<>|]|fax|grep|macs|n(?:d(?:if|sw)|v-update)|sac|x(?:ec[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r)))|f(?:acter|(?:etch|lock|unction)[sv&)<>|]|grep|i(?:le(?:[sv&)<>|]|test)|(?:n(?:d|ger)|sh)[sv&)<>|])|o(?:ld[sv&)<>|]|reach)|ping|tp(?:stats|who))|g(?:awk[sv&)<>|]|core|e(?:ni(?:e[sv&)<>|]|soimage)|tfacl[sv&)<>|])|hci|i(?:mp[sv&)<>|]|nsh)|r(?:ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:conv|f(?:config|top)|nstall[sv&)<>|]|onice|p(?:6?tables|config)|spell)|j(?:ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:ill(?:[sv&)<>|]|all)|nife[sv&)<>|]|sshell)|l(?:a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|dconfig|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|(?:inks|ynx)[sv&)<>|]|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:il(?:[sv&)<>q|]|x[sv&)<>|])|ke[sv&)<>|]|ster.passwd|wk)|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|utt[sv&)<>|]|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:a(?:no[sv&)<>|]|sm|wk)|c(?:.(?:openbsd|traditional)|at)|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan))|(?:ice|ull)[sv&)<>|]|map|o(?:de[sv&)<>|]|hup)|ping|roff|s(?:enter|lookup|tat))|o(?:ctave[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:f(?:la)?tex|ksh)|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|(?:ft|gre)p|hp(?:-cgi|[57])|i(?:(?:co|ng)[sv&)<>|]|dstat|gz)|k(?:exec|g_?info|ill)|opd|rint(?:env|f[sv&)<>|])|s(?:ed|ftp|ql)|tar(?:diff|grep)?|u(?:ppet[sv&)<>|]|shd)|wd.db|ython[^sv])|r(?:ak(?:e[sv&)<>|]|u)|bash|e(?:a(?:delf|lpath)|(?:dcarpet|name|p(?:eat|lace))[sv&)<>|]|stic)|l(?:ogin|wrap)|m(?:dir[sv&)<>|]|user)|nano|oute[sv&)<>|]|pm(?:db|(?:quer|verif)y)|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:(?:ash|nap)[sv&)<>|]|c(?:hed|r(?:een|ipt)[sv&)<>|])|diff|e(?:(?:lf|rvice)[sv&)<>|]|ndmail|t(?:arch|env|facl[sv&)<>|]|sid))|ftp|h(?:.distrib|(?:adow|ells)[sv&)<>|]|u(?:f|tdown[sv&)<>|]))|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|sh(?:-key(?:ge|sca)n|pass)|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|udo|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|c(?:l?sh|p(?:dump|ing|traceroute))|elnet|ftp|ime(?:(?:out)?[sv&)<>|]|datectl)|mux|ouch[sv&)<>|]|r(?:aceroute6?|off)|shark)|u(?:limit[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:ew[sv&)<>|]|gr|mdiff|pw|rsh)|olatility[sv&)<>|])|w(?:a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:args|e(?:la)?tex|mo(?:dmap|re)|pad|term|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|s(?:oelim|td(?:(?:ca|m)t|grep|less)?)|ypper))
+http-request deny if block_RCE
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_LEAKAGES
+acl block_RCE hdr_sub(User-Agent) -i @pmFromFile windows-powershell-commands.data
+http-request deny if block_RCE
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_LEAKAGES
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:(?:a["^]*(?:c|s["^]*n["^]*p)|e["^]*(?:b["^]*p|p["^]*(?:a["^]*l|c["^]*s["^]*v|s["^]*n)|[tx]["^]*s["^]*n)|f["^]*(?:[cltw]|o["^]*r["^]*e["^]*a["^]*c["^]*h)|i["^]*(?:[cr]["^]*m|e["^]*x|h["^]*y|i|p["^]*(?:a["^]*l|c["^]*s["^]*v|m["^]*o|s["^]*n)|s["^]*e|w["^]*(?:m["^]*i|r))|m["^]*(?:a["^]*n|[dipv]|o["^]*u["^]*n["^]*t)|o["^]*g["^]*v|p["^]*(?:o["^]*p|u["^]*s["^]*h)["^]*d|t["^]*r["^]*c["^]*m|w["^]*j["^]*b)["^]*[sv,.-/;-<>].*|c["^]*(?:(?:(?:d|h["^]*d["^]*i["^]*r|v["^]*p["^]*a)["^]*|p["^]*(?:[ip]["^]*)?)[sv,.-/;-<>].*|l["^]*(?:(?:[cipv]|h["^]*y)["^]*[sv,.-/;-<>].*|s)|n["^]*s["^]*n)|d["^]*(?:(?:b["^]*p|e["^]*l|i["^]*(?:f["^]*f|r))["^]*[sv,.-/;-<>].*|n["^]*s["^]*n)|g["^]*(?:(?:(?:(?:a["^]*)?l|b["^]*p|d["^]*r|h["^]*y|(?:w["^]*m["^]*)?i|j["^]*b|[u-v])["^]*|c["^]*(?:[ims]["^]*)?|m["^]*(?:o["^]*)?|s["^]*(?:n["^]*(?:p["^]*)?|v["^]*))[sv,.-/;-<>].*|e["^]*r["^]*r|p["^]*(?:(?:s["^]*)?[sv,.-/;-<>].*|v))|l["^]*s|n["^]*(?:(?:a["^]*l|d["^]*r|[iv]|m["^]*o|s["^]*n)["^]*[sv,.-/;-<>].*|p["^]*s["^]*s["^]*c)|r["^]*(?:(?:(?:(?:b["^]*)?p|e["^]*n|(?:w["^]*m["^]*)?i|j["^]*b|n["^]*[ip])["^]*|d["^]*(?:r["^]*)?|m["^]*(?:(?:d["^]*i["^]*r|o)["^]*)?|s["^]*n["^]*(?:p["^]*)?|v["^]*(?:p["^]*a["^]*)?)[sv,.-/;-<>].*|c["^]*(?:j["^]*b["^]*[sv,.-/;-<>].*|s["^]*n)|u["^]*j["^]*b)|s["^]*(?:(?:(?:a["^]*(?:j["^]*b|l|p["^]*s|s["^]*v)|b["^]*p|[civ]|w["^]*m["^]*i)["^]*|l["^]*(?:s["^]*)?|p["^]*(?:(?:j["^]*b|p["^]*s|s["^]*v)["^]*)?)[sv,.-/;-<>].*|h["^]*c["^]*m|u["^]*j["^]*b))(?:.["^]*[0-9A-Z_a-z]+)?b
+http-request deny if block_RCE
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_LEAKAGES
+acl block_RCE hdr_sub(User-Agent) -i @rx $(?:((?:.*|(.*)))|{.*})|[<>](.*)|/[0-9A-Z_a-z]*[!?.+]
+http-request deny if block_RCE
 
-acl block_LEAKAGES hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_LEAKAGES
+acl block_RCE hdr_sub(User-Agent) -i @rx b(?:for(?:/[dflr].*)? %+[^ ]+ in(.*)[sv]?do|if(?:/i)?(?: not)?(?: (?:e(?:xist|rrorlevel)|defined|cmdextversion)b|[ (].*(?:b(?:g(?:eq|tr)|equ|neq|l(?:eq|ss))b|==)))
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|[ckz]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)[sv&)<>|]
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:a(?:ddgroup|xel)|b(?:ase(?:32|64|nc)|lkid|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|yobu|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:h(?:g(?:passwd|rp)|pass|sh)|lang++|oproc|ron)|d(?:iff[sv&)<>|]|mesg|oas)|e(?:2fsck|grep)|f(?:grep|iletest|tp(?:stats|who))|g(?:r(?:ep[sv&)<>|]|oupmod)|unzip|z(?:cat|exe|ip))|htop|l(?:ast(?:comm|log(?:in)?)|ess(?:echo|(?:fil|pip)e)|ftp(?:get)?|osetup|s(?:-F|b_release|cpu|mod|of|pci|usb)|wp-download|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:ilq|ster.passwd)|k(?:fifo|nod|temp)|locate|ysql(?:admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:.(?:openbsd|traditional)|at)|et(?:(?:c|st)at|kit-ftp|plan)|ohup|ping|stat)|onintr|p(?:dksh|erl5?|(?:ft|gre)p|hp(?:-cgi|[57])|igz|k(?:exec|ill)|(?:op|se)d|rint(?:env|f[sv&)<>|])|tar(?:diff|grep)?|wd.db|ython[2-3])|r(?:(?:bas|ealpat)h|m(?:dir[sv&)<>|]|user)|nano|sync)|s(?:diff|e(?:ndmail|t(?:env|sid))|ftp|(?:h.distri|pwd.d)b|ocat|td(?:err|in|out)|udo|ysctl)|t(?:ailf|c(?:p(?:ing|traceroute)|sh)|elnet|imeout[sv&)<>|]|raceroute6?)|u(?:n(?:ame|lz(?:4|ma)|(?:pig|x)z|rar|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:gr|pw)|w(?:get|hoami)|x(?:args|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:c(?:at|mp)|diff|[e-f]?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|std(?:(?:ca|m)t|grep|less)?))
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i !@pmFromFile sql-errors.data
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i !@rx [0-9]s*'s*[0-9]
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx !-d
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @pmFromFile unix-shell.data
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i:DB2 SQL error:|[IBM][CLI Driver][DB2/6000]|CLI Driver.*DB2|DB2 SQL error|db2_w+()
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx ^(s*)s+{
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx ^(s*)s+{
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i)Dynamic SQL Error
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx ba["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?sb[sv]+[!-"%',0-9@-Z_a-z]+=[^sv]
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i)Exception (?:condition )?d+. Transaction rollback.
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @pmFromFile restricted-upload.data
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i)org.hsqldb.jdbc
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:t["^]*i["^]*m["^]*e|[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:a["^]*(?:c["^]*c["^]*c["^]*h["^]*e["^]*c["^]*k["^]*c["^]*o["^]*n["^]*s["^]*o["^]*l["^]*e|d["^]*(?:p["^]*l["^]*u["^]*s|v["^]*p["^]*a["^]*c["^]*k)|(?:g["^]*e["^]*n["^]*t["^]*e["^]*x["^]*e["^]*c["^]*u["^]*t["^]*o|s["^]*p["^]*n["^]*e["^]*t["^]*_["^]*c["^]*o["^]*m["^]*p["^]*i["^]*l["^]*e)["^]*r|p["^]*p["^]*(?:i["^]*n["^]*s["^]*t["^]*a["^]*l["^]*l["^]*e["^]*r|v["^]*l["^]*p)|t["^]*(?:[sv,.-/;-<>].*|b["^]*r["^]*o["^]*k["^]*e["^]*r))|b["^]*(?:a["^]*s["^]*h|g["^]*i["^]*n["^]*f["^]*o|i["^]*t["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|c["^]*(?:d["^]*b|e["^]*r["^]*t["^]*(?:o["^]*c|r["^]*e["^]*q|u["^]*t["^]*i["^]*l)|l["^]*_["^]*(?:i["^]*n["^]*v["^]*o["^]*c["^]*a["^]*t["^]*i["^]*o["^]*n|l["^]*o["^]*a["^]*d["^]*a["^]*s["^]*s["^]*e["^]*m["^]*b["^]*l["^]*y|m["^]*u["^]*t["^]*e["^]*x["^]*v["^]*e["^]*r["^]*i["^]*f["^]*i["^]*e["^]*r["^]*s)|m["^]*(?:d(?:["^]*(?:k["^]*e["^]*y|l["^]*3["^]*2))?|s["^]*t["^]*p)|o["^]*(?:m["^]*s["^]*v["^]*c["^]*s|n["^]*(?:f["^]*i["^]*g["^]*s["^]*e["^]*c["^]*u["^]*r["^]*i["^]*t["^]*y["^]*p["^]*o["^]*l["^]*i["^]*c["^]*y|h["^]*o["^]*s["^]*t|t["^]*r["^]*o["^]*l)|r["^]*e["^]*g["^]*e["^]*n)|r["^]*e["^]*a["^]*t["^]*e["^]*d["^]*u["^]*m["^]*p|s["^]*(?:c(?:["^]*r["^]*i["^]*p["^]*t)?|i)|u["^]*s["^]*t["^]*o["^]*m["^]*s["^]*h["^]*e["^]*l["^]*l["^]*h["^]*o["^]*s["^]*t)|d["^]*(?:a["^]*t["^]*a["^]*s["^]*v["^]*c["^]*u["^]*t["^]*i["^]*l|e["^]*(?:f["^]*a["^]*u["^]*l["^]*t["^]*p["^]*a["^]*c["^]*k|s["^]*k(?:["^]*t["^]*o["^]*p["^]*i["^]*m["^]*g["^]*d["^]*o["^]*w["^]*n["^]*l["^]*d["^]*r)?|v["^]*(?:i["^]*c["^]*e["^]*c["^]*r["^]*e["^]*d["^]*e["^]*n["^]*t["^]*i["^]*a["^]*l["^]*d["^]*e["^]*p["^]*l["^]*o["^]*y["^]*m["^]*e["^]*n["^]*t|t["^]*o["^]*o["^]*l["^]*s["^]*l["^]*a["^]*u["^]*n["^]*c["^]*h["^]*e["^]*r))|f["^]*s["^]*(?:h["^]*i["^]*m|v["^]*c)|i["^]*(?:a["^]*n["^]*t["^]*z|s["^]*k["^]*s["^]*h["^]*a["^]*d["^]*o["^]*w)|n["^]*(?:s["^]*c["^]*m["^]*d|x)|o["^]*t["^]*n["^]*e["^]*t|u["^]*m["^]*p["^]*6["^]*4|x["^]*c["^]*a["^]*p)|e["^]*(?:s["^]*e["^]*n["^]*t["^]*u["^]*t["^]*l|v["^]*e["^]*n["^]*t["^]*v["^]*w["^]*r|x["^]*(?:c["^]*e["^]*l|p["^]*(?:a["^]*n["^]*d|l["^]*o["^]*r["^]*e["^]*r)|t["^]*(?:e["^]*x["^]*p["^]*o["^]*r["^]*t|r["^]*a["^]*c["^]*3["^]*2)))|f["^]*(?:i["^]*n["^]*(?:d["^]*s["^]*t|g["^]*e)["^]*r|l["^]*t["^]*m["^]*c|o["^]*r["^]*f["^]*i["^]*l["^]*e["^]*s|s["^]*(?:i(?:["^]*a["^]*n["^]*y["^]*c["^]*p["^]*u)?|u["^]*t["^]*i["^]*l)|t["^]*p)|g["^]*(?:f["^]*x["^]*d["^]*o["^]*w["^]*n["^]*l["^]*o["^]*a["^]*d["^]*w["^]*r["^]*a["^]*p["^]*p["^]*e["^]*r|p["^]*s["^]*c["^]*r["^]*i["^]*p["^]*t)|h["^]*h|i["^]*(?:e["^]*(?:4["^]*u["^]*i["^]*n["^]*i["^]*t|a["^]*d["^]*v["^]*p["^]*a["^]*c["^]*k|e["^]*x["^]*e["^]*c|f["^]*r["^]*a["^]*m["^]*e)|l["^]*a["^]*s["^]*m|m["^]*e["^]*w["^]*d["^]*b["^]*l["^]*d|n["^]*(?:f["^]*d["^]*e["^]*f["^]*a["^]*u["^]*l["^]*t["^]*i["^]*n["^]*s["^]*t["^]*a["^]*l|s["^]*t["^]*a["^]*l["^]*l["^]*u["^]*t["^]*i)["^]*l)|j["^]*s["^]*c|l["^]*(?:a["^]*u["^]*n["^]*c["^]*h["^]*-["^]*v["^]*s["^]*d["^]*e["^]*v["^]*s["^]*h["^]*e["^]*l["^]*l|d["^]*i["^]*f["^]*d["^]*e)|m["^]*(?:a["^]*(?:k["^]*e["^]*c["^]*a["^]*b|n["^]*a["^]*g["^]*e["^]*-["^]*b["^]*d["^]*e|v["^]*i["^]*n["^]*j["^]*e["^]*c["^]*t)|f["^]*t["^]*r["^]*a["^]*c["^]*e|i["^]*c["^]*r["^]*o["^]*s["^]*o["^]*f["^]*t|m["^]*c|p["^]*c["^]*m["^]*d["^]*r["^]*u["^]*n|s["^]*(?:(?:b["^]*u["^]*i["^]*l|o["^]*h["^]*t["^]*m["^]*e)["^]*d|c["^]*o["^]*n["^]*f["^]*i["^]*g|d["^]*(?:e["^]*p["^]*l["^]*o["^]*y|t)|h["^]*t["^]*(?:a|m["^]*l)|i["^]*e["^]*x["^]*e["^]*c|p["^]*u["^]*b|x["^]*s["^]*l))|n["^]*(?:e["^]*t["^]*s["^]*h|t["^]*d["^]*s["^]*u["^]*t["^]*i["^]*l)|o["^]*(?:d["^]*b["^]*c["^]*c["^]*o["^]*n["^]*f|f["^]*f["^]*l["^]*i["^]*n["^]*e["^]*s["^]*c["^]*a["^]*n["^]*n["^]*e["^]*r["^]*s["^]*h["^]*e["^]*l["^]*l|n["^]*e["^]*d["^]*r["^]*i["^]*v["^]*e["^]*s["^]*t["^]*a["^]*n["^]*d["^]*a["^]*l["^]*o["^]*n["^]*e["^]*u["^]*p["^]*d["^]*a["^]*t["^]*e["^]*r|p["^]*e["^]*n["^]*c["^]*o["^]*n["^]*s["^]*o["^]*l["^]*e)|p["^]*(?:c["^]*(?:a["^]*l["^]*u["^]*a|w["^]*(?:r["^]*u["^]*n|u["^]*t["^]*l))|(?:e["^]*s["^]*t["^]*e|s)["^]*r|(?:k["^]*t["^]*m["^]*o|u["^]*b["^]*p["^]*r)["^]*n|n["^]*p["^]*u["^]*t["^]*i["^]*l|o["^]*w["^]*e["^]*r["^]*p["^]*n["^]*t|r["^]*(?:e["^]*s["^]*e["^]*n["^]*t["^]*a["^]*t["^]*i["^]*o["^]*n["^]*h["^]*o["^]*s["^]*t|i["^]*n["^]*t(?:["^]*b["^]*r["^]*m)?|o["^]*(?:c["^]*d["^]*u["^]*m["^]*p|t["^]*o["^]*c["^]*o["^]*l["^]*h["^]*a["^]*n["^]*d["^]*l["^]*e["^]*r)))|r["^]*(?:a["^]*s["^]*a["^]*u["^]*t["^]*o["^]*u|c["^]*s["^]*i|(?:d["^]*r["^]*l["^]*e["^]*a["^]*k["^]*d["^]*i["^]*a|p["^]*c["^]*p["^]*i["^]*n)["^]*g|e["^]*(?:g(?:["^]*(?:a["^]*s["^]*m|e["^]*d["^]*i["^]*t|i["^]*(?:n["^]*i|s["^]*t["^]*e["^]*r["^]*-["^]*c["^]*i["^]*m["^]*p["^]*r["^]*o["^]*v["^]*i["^]*d["^]*e["^]*r)|s["^]*v["^]*(?:c["^]*s|r["^]*3["^]*2)))?|(?:m["^]*o["^]*t|p["^]*l["^]*a["^]*c)["^]*e)|u["^]*n["^]*(?:d["^]*l["^]*l["^]*3["^]*2|(?:e["^]*x["^]*e|s["^]*c["^]*r["^]*i["^]*p["^]*t)["^]*h["^]*e["^]*l["^]*p["^]*e["^]*r|o["^]*n["^]*c["^]*e))|s["^]*(?:c["^]*(?:[sv,.-/;-<>].*|h["^]*t["^]*a["^]*s["^]*k["^]*s|r["^]*i["^]*p["^]*t["^]*r["^]*u["^]*n["^]*n["^]*e["^]*r)|e["^]*t["^]*(?:r["^]*e["^]*s|t["^]*i["^]*n["^]*g["^]*s["^]*y["^]*n["^]*c["^]*h["^]*o["^]*s["^]*t|u["^]*p["^]*a["^]*p["^]*i)|h["^]*(?:d["^]*o["^]*c["^]*v["^]*w|e["^]*l["^]*l["^]*3["^]*2)|q["^]*(?:l["^]*(?:d["^]*u["^]*m["^]*p["^]*e["^]*r|(?:t["^]*o["^]*o["^]*l["^]*s["^]*)?p["^]*s)|u["^]*i["^]*r["^]*r["^]*e["^]*l)|s["^]*h|t["^]*o["^]*r["^]*d["^]*i["^]*a["^]*g|y["^]*(?:n["^]*c["^]*a["^]*p["^]*p["^]*v["^]*p["^]*u["^]*b["^]*l["^]*i["^]*s["^]*h["^]*i["^]*n["^]*g["^]*s["^]*e["^]*r["^]*v["^]*e["^]*r|s["^]*s["^]*e["^]*t["^]*u["^]*p))|t["^]*(?:e["^]*[sv,.-/;-<>].*|r["^]*a["^]*c["^]*k["^]*e["^]*r|t["^]*(?:d["^]*i["^]*n["^]*j["^]*e["^]*c["^]*t|t["^]*r["^]*a["^]*c["^]*e["^]*r))|u["^]*(?:n["^]*r["^]*e["^]*g["^]*m["^]*p["^]*2|p["^]*d["^]*a["^]*t["^]*e|r["^]*l|t["^]*i["^]*l["^]*i["^]*t["^]*y["^]*f["^]*u["^]*n["^]*c["^]*t["^]*i["^]*o["^]*n["^]*s)|v["^]*(?:b["^]*c|e["^]*r["^]*c["^]*l["^]*s["^]*i["^]*d|i["^]*s["^]*u["^]*a["^]*l["^]*u["^]*i["^]*a["^]*v["^]*e["^]*r["^]*i["^]*f["^]*y["^]*n["^]*a["^]*t["^]*i["^]*v["^]*e|s["^]*(?:i["^]*i["^]*s["^]*e["^]*x["^]*e["^]*l["^]*a["^]*u["^]*n["^]*c["^]*h|j["^]*i["^]*t["^]*d["^]*e["^]*b["^]*u["^]*g["^]*g)["^]*e["^]*r)|w["^]*(?:a["^]*b|(?:f|m["^]*i)["^]*c|i["^]*n["^]*(?:g["^]*e["^]*t|r["^]*m|w["^]*o["^]*r["^]*d)|l["^]*r["^]*m["^]*d["^]*r|o["^]*r["^]*k["^]*f["^]*o["^]*l["^]*d["^]*e["^]*r["^]*s|s["^]*(?:(?:c["^]*r["^]*i["^]*p|r["^]*e["^]*s["^]*e)["^]*t|l)|t["^]*[sv,.-/;-<>].*|u["^]*a["^]*u["^]*c["^]*l["^]*t)|x["^]*w["^]*i["^]*z["^]*a["^]*r["^]*d|z["^]*i["^]*p["^]*f["^]*l["^]*d["^]*r)(?:.["^]*[0-9A-Z_a-z]+)?b
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception.*Informix)
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:t["^]*i["^]*m["^]*e|[nr;`{]|||?|&&?)[sv]*[sv"'-(,@]*(?:["'.-9A-Z_a-z]+/|(?:["'x5c^]*[0-9A-Z_a-z]["'x5c^]*:.*|[ "'.-9A-Zx5c^-_a-z]*)x5c)?["^]*(?:a["^]*(?:s["^]*s["^]*o["^]*c|t["^]*(?:m["^]*a["^]*d["^]*m|t["^]*r["^]*i["^]*b)|u["^]*(?:d["^]*i["^]*t["^]*p["^]*o["^]*l|t["^]*o["^]*(?:c["^]*(?:h["^]*k|o["^]*n["^]*v)|(?:f["^]*m|m["^]*o["^]*u["^]*n)["^]*t)))|b["^]*(?:c["^]*d["^]*(?:b["^]*o["^]*o|e["^]*d["^]*i)["^]*t|(?:d["^]*e["^]*h["^]*d|o["^]*o["^]*t)["^]*c["^]*f["^]*g|i["^]*t["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|c["^]*(?:a["^]*c["^]*l["^]*s|e["^]*r["^]*t["^]*(?:r["^]*e["^]*q|u["^]*t["^]*i["^]*l)|h["^]*(?:c["^]*p|d["^]*i["^]*r|g["^]*(?:l["^]*o["^]*g["^]*o["^]*n|p["^]*o["^]*r["^]*t|u["^]*s["^]*r)|k["^]*(?:d["^]*s["^]*k|n["^]*t["^]*f["^]*s))|l["^]*e["^]*a["^]*n["^]*m["^]*g["^]*r|m["^]*(?:d(?:["^]*k["^]*e["^]*y)?|s["^]*t["^]*p)|s["^]*c["^]*r["^]*i["^]*p["^]*t)|d["^]*(?:c["^]*(?:d["^]*i["^]*a["^]*g|g["^]*p["^]*o["^]*f["^]*i["^]*x)|e["^]*(?:f["^]*r["^]*a["^]*g|l)|f["^]*s["^]*(?:d["^]*i["^]*a|r["^]*m["^]*i)["^]*g|i["^]*(?:a["^]*n["^]*t["^]*z|r|s["^]*(?:k["^]*(?:c["^]*o["^]*(?:m["^]*p|p["^]*y)|p["^]*(?:a["^]*r["^]*t|e["^]*r["^]*f)|r["^]*a["^]*i["^]*d|s["^]*h["^]*a["^]*d["^]*o["^]*w)|p["^]*d["^]*i["^]*a["^]*g))|n["^]*s["^]*c["^]*m["^]*d|(?:o["^]*s["^]*k["^]*e|r["^]*i["^]*v["^]*e["^]*r["^]*q["^]*u["^]*e["^]*r)["^]*y)|e["^]*(?:n["^]*d["^]*l["^]*o["^]*c["^]*a["^]*l|v["^]*e["^]*n["^]*t["^]*c["^]*r["^]*e["^]*a["^]*t["^]*e)|E["^]*v["^]*n["^]*t["^]*c["^]*m["^]*d|f["^]*(?:c|i["^]*(?:l["^]*e["^]*s["^]*y["^]*s["^]*t["^]*e["^]*m["^]*s|n["^]*d["^]*s["^]*t["^]*r)|l["^]*a["^]*t["^]*t["^]*e["^]*m["^]*p|o["^]*r(?:["^]*f["^]*i["^]*l["^]*e["^]*s)?|r["^]*e["^]*e["^]*d["^]*i["^]*s["^]*k|s["^]*u["^]*t["^]*i["^]*l|(?:t["^]*y["^]*p|v["^]*e["^]*u["^]*p["^]*d["^]*a["^]*t)["^]*e)|g["^]*(?:e["^]*t["^]*(?:m["^]*a["^]*c|t["^]*y["^]*p["^]*e)|o["^]*t["^]*o|p["^]*(?:f["^]*i["^]*x["^]*u["^]*p|(?:r["^]*e["^]*s["^]*u["^]*l["^]*)?t|u["^]*p["^]*d["^]*a["^]*t["^]*e)|r["^]*a["^]*f["^]*t["^]*a["^]*b["^]*l)|h["^]*(?:e["^]*l["^]*p["^]*c["^]*t["^]*r|o["^]*s["^]*t["^]*n["^]*a["^]*m["^]*e)|i["^]*(?:c["^]*a["^]*c["^]*l["^]*s|f|p["^]*(?:c["^]*o["^]*n["^]*f["^]*i["^]*g|x["^]*r["^]*o["^]*u["^]*t["^]*e)|r["^]*f["^]*t["^]*p)|j["^]*e["^]*t["^]*p["^]*a["^]*c["^]*k|k["^]*(?:l["^]*i["^]*s["^]*t|s["^]*e["^]*t["^]*u["^]*p|t["^]*(?:m["^]*u["^]*t["^]*i["^]*l|p["^]*a["^]*s["^]*s))|l["^]*(?:o["^]*(?:d["^]*c["^]*t["^]*r|g["^]*(?:m["^]*a["^]*n|o["^]*f["^]*f))|p["^]*[q-r])|m["^]*(?:a["^]*(?:c["^]*f["^]*i["^]*l["^]*e|k["^]*e["^]*c["^]*a["^]*b|p["^]*a["^]*d["^]*m["^]*i["^]*n)|k["^]*(?:d["^]*i["^]*r|l["^]*i["^]*n["^]*k)|m["^]*c|o["^]*u["^]*n["^]*t["^]*v["^]*o["^]*l|q["^]*(?:b["^]*k["^]*u["^]*p|(?:t["^]*g["^]*)?s["^]*v["^]*c)|s["^]*(?:d["^]*t|i["^]*(?:e["^]*x["^]*e["^]*c|n["^]*f["^]*o["^]*3["^]*2)|t["^]*s["^]*c))|n["^]*(?:b["^]*t["^]*s["^]*t["^]*a["^]*t|e["^]*t["^]*(?:c["^]*f["^]*g|d["^]*o["^]*m|s["^]*(?:h|t["^]*a["^]*t))|f["^]*s["^]*(?:a["^]*d["^]*m["^]*i["^]*n|s["^]*(?:h["^]*a["^]*r["^]*e|t["^]*a["^]*t))|l["^]*(?:b["^]*m["^]*g["^]*r|t["^]*e["^]*s["^]*t)|s["^]*l["^]*o["^]*o["^]*k["^]*u["^]*p|t["^]*(?:b["^]*a["^]*c["^]*k["^]*u["^]*p|c["^]*m["^]*d["^]*p["^]*r["^]*o["^]*m["^]*p["^]*t|f["^]*r["^]*s["^]*u["^]*t["^]*l))|o["^]*(?:f["^]*f["^]*l["^]*i["^]*n["^]*e|p["^]*e["^]*n["^]*f["^]*i["^]*l["^]*e["^]*s)|p["^]*(?:a["^]*(?:g["^]*e["^]*f["^]*i["^]*l["^]*e["^]*c["^]*o["^]*n["^]*f["^]*i|t["^]*h["^]*p["^]*i["^]*n)["^]*g|(?:b["^]*a["^]*d["^]*m["^]*i|k["^]*t["^]*m["^]*o)["^]*n|e["^]*(?:n["^]*t["^]*n["^]*t|r["^]*f["^]*m["^]*o["^]*n)|n["^]*p["^]*u["^]*(?:n["^]*a["^]*t["^]*t["^]*e["^]*n["^]*d|t["^]*i["^]*l)|o["^]*(?:p["^]*d|w["^]*e["^]*r["^]*s["^]*h["^]*e["^]*l["^]*l)|r["^]*n["^]*(?:c["^]*n["^]*f["^]*g|(?:d["^]*r["^]*v|m["^]*n["^]*g)["^]*r|j["^]*o["^]*b["^]*s|p["^]*o["^]*r["^]*t|q["^]*c["^]*t["^]*l)|u["^]*(?:b["^]*p["^]*r["^]*n|s["^]*h["^]*(?:d|p["^]*r["^]*i["^]*n["^]*t["^]*e["^]*r["^]*c["^]*o["^]*n["^]*n["^]*e["^]*c["^]*t["^]*i["^]*o["^]*n["^]*s))|w["^]*(?:l["^]*a["^]*u["^]*n["^]*c["^]*h["^]*e["^]*r|s["^]*h))|q["^]*(?:a["^]*p["^]*p["^]*s["^]*r["^]*v|p["^]*r["^]*o["^]*c["^]*e["^]*s["^]*s|u["^]*s["^]*e["^]*r|w["^]*i["^]*n["^]*s["^]*t["^]*a)|r["^]*(?:d(?:["^]*p["^]*s["^]*i["^]*g["^]*n)?|e["^]*(?:f["^]*s["^]*u["^]*t["^]*i["^]*l|g(?:["^]*(?:i["^]*n["^]*i|s["^]*v["^]*r["^]*3["^]*2))?|l["^]*o["^]*g|(?:(?:p["^]*a["^]*d["^]*m["^]*i|s["^]*c["^]*a)["^]*)?n|x["^]*e["^]*c)|i["^]*s["^]*e["^]*t["^]*u["^]*p|m["^]*d["^]*i["^]*r|o["^]*b["^]*o["^]*c["^]*o["^]*p["^]*y|p["^]*c["^]*(?:i["^]*n["^]*f["^]*o|p["^]*i["^]*n["^]*g)|s["^]*h|u["^]*n["^]*d["^]*l["^]*l["^]*3["^]*2|w["^]*i["^]*n["^]*s["^]*t["^]*a)|s["^]*(?:a["^]*n|c["^]*(?:h["^]*t["^]*a["^]*s["^]*k["^]*s|w["^]*c["^]*m["^]*d)|e["^]*(?:c["^]*e["^]*d["^]*i["^]*t|r["^]*v["^]*e["^]*r["^]*(?:(?:c["^]*e["^]*i["^]*p|w["^]*e["^]*r)["^]*o["^]*p["^]*t["^]*i["^]*n|m["^]*a["^]*n["^]*a["^]*g["^]*e["^]*r["^]*c["^]*m["^]*d)|t["^]*x)|f["^]*c|(?:h["^]*o["^]*w["^]*m["^]*o["^]*u["^]*n|u["^]*b["^]*s)["^]*t|x["^]*s["^]*t["^]*r["^]*a["^]*c["^]*e|y["^]*s["^]*(?:o["^]*c["^]*m["^]*g["^]*r|t["^]*e["^]*m["^]*i["^]*n["^]*f["^]*o))|t["^]*(?:a["^]*(?:k["^]*e["^]*o["^]*w["^]*n|p["^]*i["^]*c["^]*f["^]*g|s["^]*k["^]*(?:k["^]*i["^]*l["^]*l|l["^]*i["^]*s["^]*t))|(?:c["^]*m["^]*s["^]*e["^]*t["^]*u|f["^]*t)["^]*p|(?:(?:e["^]*l["^]*n["^]*e|i["^]*m["^]*e["^]*o["^]*u)["^]*|r["^]*a["^]*c["^]*e["^]*r["^]*(?:p["^]*)?)t|l["^]*n["^]*t["^]*a["^]*d["^]*m["^]*n|p["^]*m["^]*(?:t["^]*o["^]*o["^]*l|v["^]*s["^]*c["^]*m["^]*g["^]*r)|s["^]*(?:(?:d["^]*i["^]*s["^]*)?c["^]*o["^]*n|e["^]*c["^]*i["^]*m["^]*p|k["^]*i["^]*l["^]*l|p["^]*r["^]*o["^]*f)|y["^]*p["^]*e["^]*p["^]*e["^]*r["^]*f|z["^]*u["^]*t["^]*i["^]*l)|u["^]*n["^]*(?:e["^]*x["^]*p["^]*o["^]*s["^]*e|i["^]*q["^]*u["^]*e["^]*i["^]*d|l["^]*o["^]*d["^]*c["^]*t["^]*r)|v["^]*(?:o["^]*l|s["^]*s["^]*a["^]*d["^]*m["^]*i["^]*n)|w["^]*(?:a["^]*i["^]*t["^]*f["^]*o["^]*r|b["^]*a["^]*d["^]*m["^]*i["^]*n|(?:d["^]*s|e["^]*(?:c|v["^]*t))["^]*u["^]*t["^]*i["^]*l|h["^]*(?:e["^]*r["^]*e|o["^]*a["^]*m["^]*i)|i["^]*n["^]*(?:n["^]*t(?:["^]*3["^]*2)?|r["^]*s)|m["^]*i["^]*c|s["^]*c["^]*r["^]*i["^]*p["^]*t)|x["^]*c["^]*o["^]*p["^]*y)(?:.["^]*[0-9A-Z_a-z]+)?b
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i:Warning.*ingres_|Ingres SQLSTATE|IngresW.*Driver)
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx (?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*.[sv].*b
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i)(?:System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*WSystem.Data.SqlClient.|Conversion failed when converting the varchar value .*? to data type int.)
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx (?:$(?:((?:(.*)|.*))|{.*})|[<>](.*)|[!?.+])
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array()|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient.)|[MySQL][ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[(-)_a-z]{1,26})?|(?:ERROR [0-9]{4} ([0-9a-z]{5})|XPATH syntax error):
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx ['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|pg_(?:query|exec)() [:|Warning.{1,20}bpg_.*|valid PostgreSQL result|Npgsql.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx /
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx s
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*Server message.*)
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx ^[^.]+.[^;?]+[;?](.*(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]))
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx /
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx s
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx ^[^.]*?(?:['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{])
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx /
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx s
+http-request deny if block_RCE
 
-acl block_SQL hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_SQL
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i).|(?:[sv]*|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|G["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?E["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?T|a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:b|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?t|r(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[jp])?|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ks])|b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[8-9]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?9|[au]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|c|(?:m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?p|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dfu]|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[gr])|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[bdx]|n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|q["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?)|f["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[c-dgi]|m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|g["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[chr]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|o|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dp]|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b)|j["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:j["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|q)|k["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|l["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)?|[nps]|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a|z(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|v)|n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[cl]|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|o["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[at]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?x|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|f|(?:k["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?g|h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cp]|r(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?y)?|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|c(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dv]|(?:p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dt]|[g-hu]|s(?:["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cr]|b["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l|[co]["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ex]|i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c)|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|l)|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:3["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|c)|x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:x["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|z)|y["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:e["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)|z["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|s["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h))
+http-request deny if block_RCE
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_JAVA
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)[-0-9_a-z]+(?:["'[-]]+|$+[!#*-0-9?-@x5c_a-{]+|``|[$<>]())[sv]*[-0-9_a-z]+
+http-request deny if block_RCE
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_JAVA
+acl block_RCE hdr_sub(User-Agent) -i !@rx [0-9]s*'s*[0-9]
+http-request deny if block_RCE
 
-acl block_JAVA hdr_sub(User-Agent) -i @pmFromFile java-code-leakages.data
-http-request deny if block_JAVA
+acl block_RCE hdr_sub(User-Agent) -i @rx ;[sv]*.[sv]*["']?(?:a(?:rchive|uth)|b(?:a(?:ckup|il)|inary)|c(?:d|h(?:anges|eck)|lone|onnection)|d(?:atabases|b(?:config|info)|ump)|e(?:cho|qp|x(?:cel|it|p(?:ert|lain)))|f(?:ilectrl|ullschema)|he(?:aders|lp)|i(?:mpo(?:rt|ster)|ndexes|otrace)|l(?:i(?:mi|n)t|o(?:ad|g))|(?:mod|n(?:onc|ullvalu)|unmodul)e|o(?:nce|pen|utput)|p(?:arameter|r(?:int|o(?:gress|mpt)))|quit|re(?:ad|cover|store)|s(?:ave|c(?:anstats|hema)|e(?:lftest|parator|ssion)|h(?:a3sum|ell|ow)?|tats|ystem)|t(?:ables|estc(?:ase|trl)|ime(?:out|r)|race)|vfs(?:info|list|name)|width)
+http-request deny if block_RCE
 
-acl block_JAVA hdr_sub(User-Agent) -i @pmFromFile java-errors.data
-http-request deny if block_JAVA
+acl block_RCE hdr_sub(User-Agent) -i @rx rn(?s:.)*?b(?:(?i:E)(?:HLO [--.A-Za-zx17fx212a]{1,255}|XPN .{1,64})|HELO [--.A-Za-zx17fx212a]{1,255}|MAIL FROM:<.{1,64}(?i:@).{1,255}(?i:>)|(?i:R)(?:CPT TO:(?:(?i:<).{1,64}(?i:@).{1,255}(?i:>)|(?i: ))?(?i:<).{1,64}(?i:>)|SETb)|VRFY .{1,64}(?: <.{1,64}(?i:@).{1,255}(?i:>)|(?i:@).{1,255})|AUTH [-0-9A-Z_a-zx17fx212a]{1,20}(?i: )(?:(?:[+/-9A-Z_a-zx17fx212a]{4})*(?:[+/-9A-Z_a-zx17fx212a]{2}(?i:=)|[+/-9A-Z_a-zx17fx212a]{3}))?(?i:=)|STARTTLSb|NOOPb(?:(?i: ).{1,255})?)
+http-request deny if block_RCE
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_JAVA
+acl block_RCE hdr_sub(User-Agent) -i @rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:A(?:PPEND (?:["-#%-&*--9A-Zx5c_a-z]+)?(?: ([ x5ca-z]+))?(?: "?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [+-][0-9]{4}"?)? {[0-9]{1,20}+?}|UTHENTICATE [-0-9_a-z]{1,20}rn)|L(?:SUB (?:["-#*.-9A-Z_a-z~]+)? (?:["%-&*.-9A-Zx5c_a-z]+)?|ISTRIGHTS (?:["%-&*--9A-Zx5c_a-z]+)?)|S(?:TATUS (?:["%-&*--9A-Zx5c_a-z]+)? ((?:U(?:NSEEN|IDNEXT)|MESSAGES|UIDVALIDITY|RECENT| )+)|ETACL (?:["%-&*--9A-Zx5c_a-z]+)? [+-][ac-eik-lpr-tw-x]+?)|UID (?:COPY|FETCH|STORE) (?:[*,0-:]+)?|(?:(?:DELETE|GET)ACL|MYRIGHTS) (?:["%-&*--9A-Zx5c_a-z]+)?)
+http-request deny if block_RCE
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_JAVA
+acl block_RCE hdr_sub(User-Agent) -i @rx (?is)rn.*?b(?:(?:LIST|TOP [0-9]+)(?: [0-9]+)?|U(?:SER .+?|IDL(?: [0-9]+)?)|PASS .+?|(?:RETR|DELE) [0-9]+?|A(?:POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [-0-9A-Z_]{1,20} (?:(?:[+/-9A-Z_a-z]{4})*(?:[+/-9A-Z_a-z]{2}=|[+/-9A-Z_a-z]{3}))?=))
+http-request deny if block_RCE
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_JAVA
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|an|io|ulimit)|s(?:h|plit|vtool)|u(?:(?:t|rl)[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|inks|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[^sv])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash|nap)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:3m|c|a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))
+http-request deny if block_RCE
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_JAVA
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:c|a(?:ll|tch)[sv&)<>|]|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))
+http-request deny if block_RCE
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_JAVA
+acl block_RCE hdr_sub(User-Agent) -i @pmFromFile unix-shell.data
+http-request deny if block_RCE
 
-acl block_JAVA hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_JAVA
+acl block_RCE hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @rx (?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))b
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-errors.data
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)b(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:(?:itude)?[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|n?f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|s(?:[sv&)<>|]|ed|ftp|ql)?|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:ew)?[sv&)<>|]|m(?:[sv&)<>|]|diff)|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:[sv&)<>c|]|h(?:o(?:[sv&)<>|]|ami|is)?|iptail[sv&)<>|])|a(?:ll|tch)[sv&)<>|]|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))b
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @rx (?:b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|$_(?:(?:pos|ge)t|session))b
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @rx (?i)(?:(?:^|=)[sv]*(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*|(?:t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|".*")[sv]+)*)[sv]*["']*(?:["'-+--9?A-]_a-z|]+/)?["'x5c]*(?:(?:(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h["')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @rx (?i)<?(?:=|php)?s+
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @rx /(?:[?*]+[a-z/]+|[a-z/]+[?*]+)
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @rx rn(?s:.)*?b(?:DATA|QUIT|HELP(?: .{1,255})?)
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:C(?:(?:REATE|OPY [*,0-:]+) ["-#%-&*--9A-Zx5c_a-z]+|APABILITY|HECK|LOSE)|DELETE ["-#%-&*--.0-9A-Zx5c_a-z]+|EX(?:AMINE ["-#%-&*--.0-9A-Zx5c_a-z]+|PUNGE)|FETCH [*,0-:]+|L(?:IST ["-#*--9A-Zx5c_a-z~]+? ["-#%-&*--9A-Zx5c_a-z]+|OG(?:IN [--.0-9@_a-z]{1,40} .*?|OUT))|RENAME ["-#%-&*--9A-Zx5c_a-z]+? ["-#%-&*--9A-Zx5c_a-z]+|S(?:E(?:LECT ["-#%-&*--9A-Zx5c_a-z]+|ARCH(?: CHARSET [--.0-9A-Z_a-z]{1,40})? (?:(KEYWORD x5c)?(?:A(?:LL|NSWERED)|BCC|D(?:ELETED|RAFT)|(?:FLAGGE|OL)D|RECENT|SEEN|UN(?:(?:ANSWER|FLAGG)ED|D(?:ELETED|RAFT)|SEEN)|NEW)|(?:BODY|CC|FROM|HEADER .{1,100}|NOT|OR .{1,255}|T(?:EXT|O)) .{1,255}|LARGER [0-9]{1,20}|[*,0-:]+|(?:BEFORE|ON|S(?:ENT(?:(?:BEFOR|SINC)E|ON)|INCE)) "?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4}"?|S(?:MALLER [0-9]{1,20}|UBJECT .{1,255})|U(?:ID [*,0-:]+?|NKEYWORD x5c(Seen|(?:Answer|Flagg)ed|D(?:eleted|raft)|Recent))))|T(?:ORE [*,0-:]+? [+-]?FLAGS(?:.SILENT)? (?:(x5c[a-z]{1,20}))?|ARTTLS)|UBSCRIBE ["-#%-&*--9A-Zx5c_a-z]+)|UN(?:SUBSCRIBE ["-#%-&*--9A-Zx5c_a-z]+|AUTHENTICATE)|NOOP)
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @pmFromFile php-errors-pl2.data
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @rx rn(?s:.)*?b(?:(?:QUI|STA|RSE)(?i:T)|NOOP|CAPA)
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @rx !(?:d|!)
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_PHP
+acl block_RCE hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_RCE
 
-acl block_PHP hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_PHP
+acl block_FIXATION hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @lt 1
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @rx (?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @rx [a-z]:x5cinetpubb
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error.</h2>|cannot connect to the server: timed out)
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @rx ^(?:ht|f)tps?://(.*?)/
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @pmFromFile iis-errors.data
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i !@endsWith %{request_headers.host}
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i !@rx ^404$
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @rx bServer Error in.{0,50}?bApplicationb
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @eq 0
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @lt 2
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @lt 3
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_FIXATION
 
-acl block_IIS hdr_sub(User-Agent) -i @lt 4
-http-request deny if block_IIS
+acl block_FIXATION hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_FIXATION
 
 acl block_SHELLS hdr_sub(User-Agent) -i @lt 1
 http-request deny if block_SHELLS
@@ -1881,6 +1827,60 @@ http-request deny if block_EVALUATION
 acl block_EVALUATION hdr_sub(User-Agent) -i @lt 4
 http-request deny if block_EVALUATION
 
+acl block_EXCEPTIONS hdr_sub(User-Agent) -i @streq GET /
+http-request deny if block_EXCEPTIONS
+
+acl block_EXCEPTIONS hdr_sub(User-Agent) -i @ipMatch 127.0.0.1,::1
+http-request deny if block_EXCEPTIONS
+
+acl block_EXCEPTIONS hdr_sub(User-Agent) -i @ipMatch 127.0.0.1,::1
+http-request deny if block_EXCEPTIONS
+
+acl block_EXCEPTIONS hdr_sub(User-Agent) -i @endsWith (internal dummy connection)
+http-request deny if block_EXCEPTIONS
+
+acl block_EXCEPTIONS hdr_sub(User-Agent) -i @rx ^(?:GET /|OPTIONS *) HTTP/[12].[01]$
+http-request deny if block_EXCEPTIONS
+
+acl block_IIS hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @lt 1
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @rx [a-z]:x5cinetpubb
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error.</h2>|cannot connect to the server: timed out)
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @pmFromFile iis-errors.data
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i !@rx ^404$
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @rx bServer Error in.{0,50}?bApplicationb
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @lt 2
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @lt 3
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_IIS
+
+acl block_IIS hdr_sub(User-Agent) -i @lt 4
+http-request deny if block_IIS
+
 acl block_CORRELATION hdr_sub(User-Agent) -i @eq 0
 http-request deny if block_CORRELATION
 
diff --git a/waf_patterns/nginx/attack.conf b/waf_patterns/nginx/attack.conf
index f7619c4..7512956 100644
--- a/waf_patterns/nginx/attack.conf
+++ b/waf_patterns/nginx/attack.conf
@@ -2,6 +2,26 @@
 location / {
     set $attack_detected 0;
 
+    if ($request_uri ~* "!@eq 0") {
+        set $attack_detected 1;
+    }
+
+    if ($request_uri ~* "!@within |%{tx.allowed_request_content_type_charset}|") {
+        set $attack_detected 1;
+    }
+
+    if ($request_uri ~* "@rx ^content-types*:s*(.*)$") {
+        set $attack_detected 1;
+    }
+
+    if ($request_uri ~* "!@rx ^(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$") {
+        set $attack_detected 1;
+    }
+
+    if ($request_uri ~* "@rx content-transfer-encoding:(.*)") {
+        set $attack_detected 1;
+    }
+
     if ($request_uri ~* "@lt 1") {
         set $attack_detected 1;
     }
@@ -106,26 +126,6 @@ location / {
         set $attack_detected 1;
     }
 
-    if ($request_uri ~* "!@eq 0") {
-        set $attack_detected 1;
-    }
-
-    if ($request_uri ~* "!@within |%{tx.allowed_request_content_type_charset}|") {
-        set $attack_detected 1;
-    }
-
-    if ($request_uri ~* "@rx ^content-types*:s*(.*)$") {
-        set $attack_detected 1;
-    }
-
-    if ($request_uri ~* "!@rx ^(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-"(-),/:-?[-]{}]+)/(?:*|[^!-"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*"?(?:iso-8859-15?|utf-8|windows-1252)b"?|(?:[^sv -"(-),/:-?[-]c{}]|c(?:[^!-"(-),/:-?[-]h{}]|h(?:[^!-"(-),/:-?[-]a{}]|a(?:[^!-"(-),/:-?[-]r{}]|r(?:[^!-"(-),/:-?[-]s{}]|s(?:[^!-"(-),/:-?[-]e{}]|e[^!-"(-),/:-?[-]t{}]))))))[^!-"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$") {
-        set $attack_detected 1;
-    }
-
-    if ($request_uri ~* "@rx content-transfer-encoding:(.*)") {
-        set $attack_detected 1;
-    }
-
     if ($attack_detected = 1) {
         return 403;
     }
diff --git a/waf_patterns/nginx/bots.conf b/waf_patterns/nginx/bots.conf
index 89e6fe1..5af1f42 100644
--- a/waf_patterns/nginx/bots.conf
+++ b/waf_patterns/nginx/bots.conf
@@ -1,593 +1,1779 @@
 map $http_user_agent $bad_bot {
-    "~*(^| )PTST\/" 1;
-    "~*(^| )sentry\/" 1;
-    "~*(sistrix|SISTRIX) [cC]rawler" 1;
-    "~*007ac9 Crawler" 1;
-    "~*2ip bot" 1;
+    "~* YLT" 1;
+    "~*008\/" 1;
+    "~*13TABS" 1;
+    "~*192\.comAgent" 1;
+    "~*2GDPR\/" 1;
     "~*2ip\.ru" 1;
     "~*360Spider" 1;
-    "~*<li>Mozilla/5.0 (compatible; Ask Jeeves/Teoma; +http://about.ask.com/en/docs/about/webmasters.shtml)</li>" 1;
-    "~*A Patent Crawler" 1;
+    "~*404checker" 1;
+    "~*404enemy" 1;
+    "~*7Siters" 1;
+    "~*80legs" 1;
     "~*A6-Indexer" 1;
     "~*ADmantX" 1;
-    "~*AHC\/" 1;
-    "~*AISearchBot" 1;
+    "~*AIBOT" 1;
+    "~*ALittle\ Client" 1;
     "~*APIs-Google" 1;
+    "~*ASPSeek" 1;
+    "~*AWS Security Scanner" 1;
+    "~*Abonti" 1;
     "~*Aboundex" 1;
-    "~*AcademicBotRTU" 1;
-    "~*AddSearchBot" 1;
+    "~*Aboundexbot" 1;
+    "~*Accoona-AI-Agent" 1;
+    "~*Acunetix" 1;
+    "~*AdAuth\/" 1;
     "~*AddThis" 1;
-    "~*Adidxbot" 1;
-    "~*AdsBot-Google([^-]|$)" 1;
-    "~*AdsBot-Google-Mobile" 1;
-    "~*AdsTxtCrawler" 1;
-    "~*AdvBot" 1;
-    "~*Ahrefs(Bot|SiteAudit)" 1;
-    "~*AlexandriaOrgBot" 1;
+    "~*AdminLabs" 1;
+    "~*AdsTxtCrawlerTP" 1;
+    "~*Adstxtaggregator" 1;
+    "~*Adyen HttpClient" 1;
+    "~*AfD-Verbotsverfahren" 1;
+    "~*AffiliateLabz\/" 1;
+    "~*AhrefsBot" 1;
+    "~*AiHitBot" 1;
+    "~*Aipbot" 1;
+    "~*Airmail" 1;
+    "~*Alexibot" 1;
+    "~*Alibaba\.Security\.Heimdall" 1;
+    "~*AllSubmitter" 1;
+    "~*Alligator" 1;
     "~*AlphaBot" 1;
-    "~*Amazon CloudFront" 1;
-    "~*Amazonbot" 1;
-    "~*AndersPinkBot" 1;
-    "~*AnyEvent" 1;
-    "~*Apercite" 1;
+    "~*Anarchie" 1;
+    "~*Anarchy" 1;
+    "~*Anarchy99" 1;
+    "~*AndroidDownloadManager" 1;
+    "~*Anemone" 1;
+    "~*AngleSharp" 1;
+    "~*Ankit" 1;
+    "~*Ant\.com" 1;
+    "~*Anthill" 1;
+    "~*Anturis Agent" 1;
+    "~*AnyEvent-HTTP\/" 1;
+    "~*Apache Ant\/" 1;
+    "~*Apache Droid" 1;
+    "~*Apache OpenOffice" 1;
+    "~*Apache-HttpAsyncClient" 1;
+    "~*Apache-HttpClient" 1;
+    "~*ApacheBench" 1;
+    "~*Apexoo" 1;
+    "~*AportWorm\/" 1;
+    "~*AppBeat\/" 1;
     "~*AppEngine-Google" 1;
-    "~*AppInsights" 1;
-    "~*Applebot" 1;
-    "~*ArchiveBot" 1;
-    "~*AspiegelBot" 1;
-    "~*Atom Feed Robot" 1;
-    "~*Audisto Crawler" 1;
+    "~*AppleSyndication" 1;
+    "~*Aprc\/[0-9]" 1;
+    "~*Arachmo" 1;
+    "~*Arachnophilia" 1;
+    "~*Arukereso" 1;
+    "~*Asana\/" 1;
+    "~*Ask Jeeves" 1;
+    "~*AskQuickly" 1;
+    "~*Aspiegel" 1;
+    "~*Asterias" 1;
+    "~*Astute" 1;
+    "~*Atomseobot" 1;
+    "~*Attach" 1;
+    "~*AutomaticWPTester" 1;
+    "~*Autonomy" 1;
     "~*AwarioBot" 1;
     "~*AwarioRssBot" 1;
     "~*AwarioSmartBot" 1;
-    "~*B2B Bot" 1;
+    "~*B-l-i-t-z-B-O-T" 1;
+    "~*BBBike" 1;
+    "~*BCKLINKS" 1;
     "~*BDCbot" 1;
-    "~*BIGLOTRON" 1;
-    "~*BLEXBot\/" 1;
-    "~*BLP_bbot" 1;
-    "~*BTWebClient" 1;
+    "~*BDFetch" 1;
+    "~*BKCTwitterUnshortener\/" 1;
+    "~*BLEXBot" 1;
+    "~*BPImageWalker" 1;
     "~*BUbiNG" 1;
-    "~*Baidu-YunGuanCe" 1;
-    "~*Baiduspider" 1;
-    "~*Bark[rR]owler" 1;
+    "~*BackDoorBot" 1;
+    "~*BackStreet" 1;
+    "~*BackWeb" 1;
+    "~*Backlink-Ceck" 1;
+    "~*BacklinkCrawler" 1;
+    "~*BacklinkHttpStatus" 1;
+    "~*BacklinksExtendedBot" 1;
+    "~*BackupLand" 1;
+    "~*Bad-Neighborhood" 1;
+    "~*Badass" 1;
+    "~*Bandit" 1;
+    "~*Barkrowler" 1;
+    "~*BatchFTP" 1;
+    "~*Battleztar Bazinga" 1;
+    "~*Battleztar\ Bazinga" 1;
     "~*BazQux" 1;
-    "~*BehloolBot" 1;
-    "~*Better Uptime Bot" 1;
-    "~*BingPreview\/" 1;
-    "~*BitBot" 1;
-    "~*BitSightBot\/" 1;
+    "~*BegunAdvertising" 1;
+    "~*BetaBot" 1;
+    "~*Bewica-security-scan" 1;
+    "~*Bidtellect" 1;
+    "~*BigBozz" 1;
+    "~*Bigfoot" 1;
+    "~*BingLocalSearch" 1;
+    "~*BingPreview" 1;
+    "~*Bitacle" 1;
+    "~*Bitrix link preview" 1;
+    "~*Black Hole" 1;
+    "~*BlackWidow" 1;
+    "~*Black\ Hole" 1;
     "~*Blackboard" 1;
-    "~*BlogTraffic\/\d\.\d+ Feed-Fetcher" 1;
-    "~*BomboraBot" 1;
-    "~*Bot\.AraTurka\.com" 1;
-    "~*BoxcarBot" 1;
-    "~*BrandONbot" 1;
-    "~*BrandVerity" 1;
-    "~*BrightEdge Crawler" 1;
-    "~*BublupBot" 1;
+    "~*Blackboard Safeassign" 1;
+    "~*BlockNote\.Net" 1;
+    "~*BlogBridge" 1;
+    "~*BlogPulseLive" 1;
+    "~*BlogSearch" 1;
+    "~*Bloglines" 1;
+    "~*Bloglovin" 1;
+    "~*Blogtrottr" 1;
+    "~*Blow" 1;
+    "~*BlowFish" 1;
+    "~*Boardreader" 1;
+    "~*Bolt" 1;
+    "~*Boost\.Beast" 1;
+    "~*BotALot" 1;
+    "~*Braintree-Webhooks" 1;
+    "~*Branch Metrics API" 1;
+    "~*Branch-Passthrough" 1;
+    "~*Brandprotect" 1;
+    "~*Brandwatch" 1;
+    "~*Brodie\/" 1;
+    "~*Browsershots" 1;
+    "~*Buck" 1;
     "~*Buck\/" 1;
+    "~*Buddy" 1;
+    "~*BuiltBotTough" 1;
+    "~*BuiltWith" 1;
+    "~*Bullseye" 1;
+    "~*BunnySlippers" 1;
+    "~*Burf Search" 1;
+    "~*Butterfly\/" 1;
+    "~*BuzzSumo" 1;
     "~*Bytespider" 1;
+    "~*CAAM\/[0-9]" 1;
+    "~*CATExplorador" 1;
     "~*CC Metadata Scaper" 1;
     "~*CCBot" 1;
-    "~*CISPA Webcrawler" 1;
-    "~*Caliperbot" 1;
-    "~*CapsuleChecker" 1;
+    "~*CERT\.at-Statistics-Survey" 1;
+    "~*CISPA Vulnerability Notification" 1;
+    "~*CISPA Web Analyser" 1;
+    "~*CJNetworkQuality" 1;
+    "~*CODE87" 1;
+    "~*CSHttp" 1;
+    "~*CSSCheck" 1;
+    "~*CakePHP" 1;
+    "~*Calculon" 1;
+    "~*Canary%20Mail" 1;
+    "~*CaretNail" 1;
+    "~*CazoodleBot" 1;
+    "~*Cegbfeieh" 1;
+    "~*CensysInspect" 1;
+    "~*Cerberian Drtrs" 1;
+    "~*ChangesMeter" 1;
+    "~*Charlotte" 1;
     "~*ChatGPT-User" 1;
-    "~*CheckMarkNetwork\/" 1;
-    "~*Chrome-Lighthouse" 1;
-    "~*Cincraw" 1;
-    "~*Clickagy" 1;
-    "~*Cliqzbot\/" 1;
+    "~*CheTeam" 1;
+    "~*CheckHost" 1;
+    "~*CheeseBot" 1;
+    "~*CherryPicker" 1;
+    "~*ChinaClaw" 1;
+    "~*Chirp\/" 1;
+    "~*Chlooe" 1;
+    "~*Chromaxa" 1;
+    "~*CirrusExplorer" 1;
+    "~*Citoid" 1;
+    "~*Claritybot" 1;
+    "~*Clarsentia" 1;
+    "~*ClaudeBot" 1;
+    "~*Cliqzbot" 1;
+    "~*Cloud mapping" 1;
+    "~*CloudEndure" 1;
     "~*CloudFlare-AlwaysOnline" 1;
-    "~*CloudFlare-Prefetch" 1;
+    "~*Cloud\ mapping" 1;
     "~*Cloudflare-Healthchecks" 1;
-    "~*Cloudflare-SSLDetector" 1;
-    "~*Cloudflare-Traffic-Manager" 1;
+    "~*Cloudinary" 1;
     "~*Cocolyzebot" 1;
-    "~*Companybook-Crawler" 1;
-    "~*ContextAd Bot" 1;
-    "~*CookieHubScan" 1;
-    "~*Cookiebot" 1;
-    "~*CrawlyProjectCrawler" 1;
-    "~*CriteoBot" 1;
+    "~*Cogentbot" 1;
+    "~*ColdFusion" 1;
+    "~*Collector" 1;
+    "~*CommaFeed" 1;
+    "~*Commons-HttpClient" 1;
+    "~*Contextual Code Sites Explorer" 1;
+    "~*CookieReports" 1;
+    "~*Copier" 1;
+    "~*CopyRightCheck" 1;
+    "~*Copyscape" 1;
+    "~*Cosmos" 1;
+    "~*Cosmos4j\.feedback" 1;
+    "~*Covario-IDS" 1;
+    "~*Craftbot" 1;
+    "~*Craw\/" 1;
+    "~*Crawling\ at\ Home\ Project" 1;
+    "~*CrazyWebCrawler" 1;
+    "~*Crescent" 1;
+    "~*Criteo" 1;
+    "~*Crowsnest" 1;
     "~*CrunchBot" 1;
-    "~*CrystalSemanticsBot" 1;
-    "~*Cutbot" 1;
-    "~*CyberPatrol" 1;
+    "~*Cula\/" 1;
+    "~*Curious" 1;
+    "~*Curious George" 1;
+    "~*Custo" 1;
+    "~*CyotekWebCopy" 1;
+    "~*DAP\/NetHTTP" 1;
+    "~*DBLBot" 1;
+    "~*DIIbot" 1;
+    "~*DMBrowser" 1;
+    "~*DNSPod-reporting" 1;
+    "~*DSearch" 1;
+    "~*DTS Agent" 1;
+    "~*DTS\ Agent" 1;
     "~*DareBoost" 1;
-    "~*DataForSeoBot" 1;
+    "~*DataCha0s" 1;
+    "~*DataXu" 1;
+    "~*DatabaseDriverMysqli" 1;
+    "~*DatadogSynthetics" 1;
     "~*Datafeedwatch" 1;
     "~*Datanyze" 1;
-    "~*Dataprovider\.com" 1;
-    "~*Daum\/" 1;
-    "~*DeuSu\/" 1;
-    "~*Diffbot\/" 1;
-    "~*Digg Deeper" 1;
-    "~*Digincore bot" 1;
-    "~*Discordbot" 1;
-    "~*Disqus" 1;
+    "~*DataparkSearch" 1;
+    "~*Daum(oa)?[ \/][0-9]" 1;
+    "~*Demon" 1;
+    "~*DeuSu" 1;
+    "~*Deusu" 1;
+    "~*Devil" 1;
+    "~*Digg" 1;
+    "~*Digincore" 1;
+    "~*DigitalPebble" 1;
+    "~*Dirbuster" 1;
+    "~*Disco" 1;
+    "~*Discobot" 1;
+    "~*Discourse Forum Onebox" 1;
+    "~*Discoverybot" 1;
+    "~*Dispatch" 1;
+    "~*Dispatch\/" 1;
+    "~*Disqus\/" 1;
+    "~*DittoSpyder" 1;
+    "~*DnBCrawler-Analytics" 1;
     "~*DnyzBot" 1;
-    "~*Domain Re-Animator Bot" 1;
+    "~*Dolphin http client" 1;
+    "~*DomCopBot" 1;
+    "~*DomainAppender" 1;
+    "~*DomainCrawler" 1;
+    "~*DomainLabz" 1;
+    "~*DomainSigmaCrawler" 1;
     "~*DomainStatsBot" 1;
     "~*Domains Project\/" 1;
-    "~*Dragonbot" 1;
-    "~*Dubbotbot" 1;
-    "~*DuckDuckBot" 1;
-    "~*DuckDuckGo-Favicons-Bot" 1;
-    "~*EZID" 1;
+    "~*Domains\ Project" 1;
+    "~*Donuts Content Explorer" 1;
+    "~*Dotbot" 1;
+    "~*Download Wonder" 1;
+    "~*Download\ Wonder" 1;
+    "~*DowntimeDetector" 1;
+    "~*Dragonfly" 1;
+    "~*Drip" 1;
+    "~*Drupal \(\+http:\/\/drupal\.org\/\)" 1;
+    "~*DuplexWeb-Google" 1;
+    "~*DynatraceSynthetic" 1;
+    "~*EARTHCOM" 1;
+    "~*ECCP" 1;
+    "~*ECCP/1.0" 1;
+    "~*EMail Exractor" 1;
+    "~*EMail Wolf" 1;
+    "~*EMail\ Siphon" 1;
+    "~*EMail\ Wolf" 1;
+    "~*Easy-Thumb" 1;
+    "~*EasyDL" 1;
+    "~*Ebingbong" 1;
+    "~*Ecxi" 1;
+    "~*EirGrabber" 1;
+    "~*ElectricMonk" 1;
+    "~*EmailWolf" 1;
+    "~*Embarcadero" 1;
+    "~*Embed PHP Library" 1;
     "~*Embedly" 1;
-    "~*EveryoneSocialBot" 1;
-    "~*Expanse" 1;
-    "~*Experibot" 1;
+    "~*EroCrawler" 1;
+    "~*EventMachine HttpClient" 1;
+    "~*Everwall Link Expander" 1;
+    "~*Evidon" 1;
+    "~*Evil" 1;
+    "~*Evrinid" 1;
+    "~*Exabot" 1;
+    "~*ExactSearch" 1;
+    "~*ExaleadCloudview" 1;
+    "~*Excel\/" 1;
+    "~*ExoRank" 1;
+    "~*Exploratodo" 1;
+    "~*Express WebPictures" 1;
+    "~*Express\ WebPictures" 1;
     "~*ExtLinksBot" 1;
-    "~*Eyeotabot" 1;
-    "~*FAST Enterprise Crawler" 1;
-    "~*FAST-WebCrawler" 1;
-    "~*Facebot" 1;
-    "~*FeedValidator" 1;
+    "~*Extractor" 1;
+    "~*ExtractorPro" 1;
+    "~*Extreme Picture Finder" 1;
+    "~*Extreme\ Picture\ Finder" 1;
+    "~*EyeNetIE" 1;
+    "~*Ezooms" 1;
+    "~*FHscan" 1;
+    "~*FacebookBot" 1;
+    "~*Faraday v" 1;
+    "~*FavOrg" 1;
+    "~*Faveeo" 1;
+    "~*Favicon downloader" 1;
+    "~*Feed Wrangler" 1;
+    "~*FeedBooster" 1;
+    "~*FeedBucket" 1;
+    "~*FeedBunch\/" 1;
+    "~*FeedBurner" 1;
+    "~*FeedViewer\/" 1;
+    "~*FeedZcollector" 1;
+    "~*Feedable\/" 1;
     "~*Feedbin" 1;
-    "~*Feedfetcher-Google" 1;
     "~*Feedly" 1;
+    "~*FeedshowOnline" 1;
+    "~*Feedshow\/" 1;
     "~*Feedspot" 1;
+    "~*Feedwind\/" 1;
     "~*FemtosearchBot" 1;
-    "~*Fetch\/" 1;
-    "~*Fever" 1;
-    "~*FindITAnswersbot" 1;
-    "~*Flamingo_SearchEngine" 1;
+    "~*Fetch API" 1;
+    "~*Fetch\/[0-9]" 1;
+    "~*Fever\/[0-9]" 1;
+    "~*Fiery%20Feeds" 1;
+    "~*Filestack" 1;
+    "~*Fimap" 1;
+    "~*Firefox/7.0" 1;
+    "~*FlashGet" 1;
+    "~*FlipboardBrowserProxy" 1;
     "~*FlipboardProxy" 1;
-    "~*FreeWebMonitoring SiteChecker" 1;
+    "~*FlipboardRSS" 1;
+    "~*Flock\/" 1;
+    "~*Florienzh\/" 1;
+    "~*Flunky" 1;
+    "~*Foobot" 1;
+    "~*ForusP" 1;
+    "~*FoundSeoTool" 1;
+    "~*Freeuploader" 1;
     "~*FreshRSS" 1;
-    "~*FreshpingBot" 1;
-    "~*Friendica" 1;
+    "~*FrontPage" 1;
+    "~*Funnelback" 1;
+    "~*Fuzz" 1;
+    "~*Fuzz Faster U Fool" 1;
+    "~*FyberSpider" 1;
     "~*Fyrebot" 1;
-    "~*G2 Web Services" 1;
+    "~*G-i-g-a-b-o-t" 1;
+    "~*GIS-LABS" 1;
     "~*GPTBot" 1;
-    "~*GarlikCrawler" 1;
-    "~*GeedoBot" 1;
+    "~*GRequests" 1;
+    "~*GT::WWW" 1;
+    "~*GTmetrix" 1;
+    "~*GalaxyBot" 1;
+    "~*GeedoProductSearch" 1;
     "~*Genieo" 1;
-    "~*Gigablast" 1;
+    "~*GentleSource" 1;
+    "~*GermCrawler" 1;
+    "~*GetCode" 1;
+    "~*GetLinkInfo" 1;
+    "~*GetRight" 1;
+    "~*GetURLInfo\/" 1;
+    "~*GetWeb" 1;
+    "~*Getintent" 1;
+    "~*Geziyor" 1;
+    "~*Ghost Inspector" 1;
+    "~*GigablastOpenSource" 1;
     "~*Gigabot" 1;
-    "~*GingerCrawler" 1;
-    "~*Gluten Free Crawler\/" 1;
-    "~*GnowitNewsbot" 1;
+    "~*GitHub-Hookshot" 1;
+    "~*Go [\d\.]* package http" 1;
+    "~*Go http package" 1;
+    "~*Go!Zilla" 1;
+    "~*Go-Ahead-Got-It" 1;
     "~*Go-http-client" 1;
-    "~*Google Favicon" 1;
+    "~*GoSpotCheck" 1;
+    "~*GoZilla" 1;
+    "~*Gofeed" 1;
+    "~*Goldfire Server" 1;
+    "~*GomezAgent" 1;
+    "~*Goodzer\/" 1;
+    "~*Google AppsViewer" 1;
+    "~*Google Desktop" 1;
+    "~*Google Keyword Suggestion" 1;
+    "~*Google Keyword Tool" 1;
+    "~*Google PP Default" 1;
+    "~*Google Page Speed Insights" 1;
+    "~*Google Search Console" 1;
     "~*Google Web Preview" 1;
-    "~*Google-Adwords-Instant" 1;
-    "~*Google-Certificates-Bridge" 1;
+    "~*Google favicon" 1;
+    "~*Google-Ads" 1;
+    "~*Google-Adwords" 1;
+    "~*Google-Apps-Script" 1;
+    "~*Google-Calendar-Importer" 1;
+    "~*Google-HTTP-Java-Client" 1;
+    "~*Google-HotelAdsVerifier" 1;
     "~*Google-InspectionTool" 1;
-    "~*Google-PhysicalWeb" 1;
+    "~*Google-Podcast" 1;
+    "~*Google-Publisher-Plugin" 1;
     "~*Google-Read-Aloud" 1;
-    "~*Google-Safety" 1;
+    "~*Google-SMTP-STS" 1;
+    "~*Google-SearchByImage" 1;
     "~*Google-Site-Verification" 1;
     "~*Google-Structured-Data-Testing-Tool" 1;
+    "~*Google-Transparency-Report" 1;
+    "~*Google-Youtube-Links" 1;
+    "~*Google-speakr" 1;
+    "~*GoogleDocs" 1;
+    "~*GoogleHC\/" 1;
     "~*GoogleOther" 1;
-    "~*Googlebot-Image" 1;
-    "~*Googlebot-Mobile" 1;
-    "~*Googlebot-News" 1;
-    "~*Googlebot-Video" 1;
-    "~*Googlebot\/" 1;
-    "~*Gowikibot" 1;
+    "~*GoogleProber" 1;
+    "~*GoogleProducer" 1;
+    "~*GoogleSites" 1;
+    "~*Gookey" 1;
+    "~*Gotit" 1;
+    "~*GrabNet" 1;
+    "~*Grabber" 1;
+    "~*Grafula" 1;
+    "~*Grammarly" 1;
+    "~*GrapeFX" 1;
     "~*GrapeshotCrawler" 1;
-    "~*Grobbot" 1;
-    "~*GroupHigh\/" 1;
-    "~*GroupMeBot" 1;
-    "~*Gwene" 1;
+    "~*GreatNews" 1;
+    "~*Gregarius" 1;
+    "~*GridBot" 1;
+    "~*GuzzleHttp" 1;
+    "~*HAA(A)?RTLAND http client" 1;
+    "~*HEADMasterSEO" 1;
+    "~*HMView" 1;
+    "~*HTMLparser" 1;
+    "~*HTTP Banner Detection" 1;
+    "~*HTTP-Header-Abfrage" 1;
+    "~*HTTP-Tiny" 1;
+    "~*HTTP::Lite" 1;
+    "~*HTTPMon" 1;
+    "~*HTTP_Compression_Test" 1;
+    "~*HTTPie" 1;
     "~*HTTrack" 1;
+    "~*Haansoft" 1;
+    "~*Hadi Agent" 1;
+    "~*HaosouSpider" 1;
+    "~*HappyApps-WebCheck" 1;
+    "~*Hardenize" 1;
+    "~*Harvest" 1;
     "~*Hatena" 1;
+    "~*Havij" 1;
+    "~*HaxerMen" 1;
     "~*HeadlessChrome" 1;
+    "~*HeartRails_Capture" 1;
+    "~*Heritrix" 1;
+    "~*Hexometer" 1;
+    "~*Hloader" 1;
+    "~*Holmes" 1;
+    "~*HonesoSearchEngine" 1;
+    "~*HonoluluBot" 1;
+    "~*HootSuite Image proxy" 1;
+    "~*Hootsuite-WebFeed" 1;
+    "~*HostTracker" 1;
+    "~*HttpComponents" 1;
     "~*HttpUrlConnection" 1;
-    "~*HubSpot" 1;
-    "~*IAS crawler" 1;
-    "~*ICBot\/" 1;
-    "~*ICC-Crawler" 1;
-    "~*INETDEX-BOT" 1;
+    "~*HubSpot " 1;
+    "~*HubSpot-Link-Resolver" 1;
+    "~*Humanlinks" 1;
+    "~*HybridBot" 1;
+    "~*IDBTE4M" 1;
+    "~*IDBot" 1;
+    "~*IDG Twitter Links Resolver" 1;
+    "~*IDwhois\/" 1;
+    "~*IODC" 1;
+    "~*IPS\/[0-9]" 1;
+    "~*IPWorks HTTP\/S Component" 1;
+    "~*IRLbot" 1;
+    "~*IZaBEE" 1;
+    "~*Iblog" 1;
+    "~*Id-search" 1;
+    "~*IdeelaborPlagiaat" 1;
     "~*Iframely" 1;
+    "~*IlTrovatore" 1;
+    "~*IlseBot" 1;
+    "~*Image Fetch" 1;
+    "~*Image Sucker" 1;
+    "~*ImageEngine\/" 1;
+    "~*ImageVisu\/" 1;
+    "~*Image\ Fetch" 1;
+    "~*Image\ Sucker" 1;
     "~*ImagesiftBot" 1;
+    "~*Imagga" 1;
+    "~*InAGist" 1;
+    "~*InDesign%20CC" 1;
+    "~*Inboxb0t" 1;
     "~*IndeedBot" 1;
-    "~*InterfaxScanBot" 1;
+    "~*Indy Library" 1;
+    "~*Indy\ Library" 1;
+    "~*InetURL" 1;
+    "~*InfoNaviRobot" 1;
+    "~*InfoTekies" 1;
+    "~*InfoWizards Reciprocal Link" 1;
+    "~*Information\ Security\ Team\ InfraSec\ Scanner" 1;
+    "~*InfraSec\ Scanner" 1;
+    "~*Instapaper" 1;
+    "~*Integrity" 1;
+    "~*Intelliseek" 1;
+    "~*InterGET" 1;
+    "~*Internet Ninja" 1;
     "~*InternetMeasurement" 1;
-    "~*IonCrawl" 1;
+    "~*InternetSeer" 1;
+    "~*Internet\ Ninja" 1;
+    "~*Iria" 1;
+    "~*Irokez" 1;
+    "~*Iskanie" 1;
     "~*IstellaBot" 1;
-    "~*James BOT" 1;
-    "~*Jamie's Spider" 1;
-    "~*Jetslide" 1;
+    "~*JAHHO" 1;
+    "~*JOC\ Web\ Spider" 1;
+    "~*JS-Kit" 1;
+    "~*JamesBOT" 1;
+    "~*Jaunt\/" 1;
+    "~*Java.*outbrain" 1;
+    "~*Jbrofuzz" 1;
+    "~*JennyBot" 1;
+    "~*Jersey\/" 1;
+    "~*JetCar" 1;
     "~*Jetty" 1;
-    "~*JobboerseBot" 1;
-    "~*Jooblebot" 1;
-    "~*Jugendschutzprogramm-Crawler" 1;
-    "~*K7MLWCBot" 1;
-    "~*KStandBot" 1;
-    "~*Kemvibot" 1;
-    "~*KeybaseBot" 1;
-    "~*KomodiaBot" 1;
-    "~*KosmioBot" 1;
-    "~*Landau-Media-Spider" 1;
-    "~*Laserlikebot" 1;
-    "~*Leikibot" 1;
-    "~*LightspeedSystemsCrawler" 1;
-    "~*Linespider" 1;
-    "~*Linguee Bot" 1;
-    "~*LinkArchiver" 1;
-    "~*LinkedInBot" 1;
-    "~*LinkisBot" 1;
-    "~*Livelap[bB]ot" 1;
-    "~*Luminator-robots" 1;
-    "~*MBCrawler" 1;
+    "~*Jigsaw" 1;
+    "~*JikeSpider" 1;
+    "~*JobFeed discovery" 1;
+    "~*Jobboerse" 1;
+    "~*Jobg8 URL Monitor" 1;
+    "~*Jobrapido" 1;
+    "~*Jobsearch1\.5" 1;
+    "~*JoinVision Generic" 1;
+    "~*JolokiaPwn" 1;
+    "~*Joomla" 1;
+    "~*Jorgee" 1;
+    "~*JungleKeyThumbnail" 1;
+    "~*JustView" 1;
+    "~*Jyxobot" 1;
+    "~*KOCMOHABT" 1;
+    "~*Kaspersky Lab CFR link resolver" 1;
+    "~*Kelny\/" 1;
+    "~*Kenjin\ Spider" 1;
+    "~*Kerrigan\/" 1;
+    "~*KeyCDN" 1;
+    "~*Keybot\ Translation-Search-Machine" 1;
+    "~*Keyword Density" 1;
+    "~*Keyword\ Density" 1;
+    "~*Keywords Research" 1;
+    "~*KickFire" 1;
+    "~*KimonoLabs\/" 1;
+    "~*Kinza" 1;
+    "~*Kml-Google" 1;
+    "~*Kozmosbot" 1;
+    "~*KumKie" 1;
+    "~*LNSpiderguy" 1;
+    "~*LWP::Simple" 1;
+    "~*LYT\.SR" 1;
+    "~*L\.webis" 1;
+    "~*Lanshanbot" 1;
+    "~*Larbin" 1;
+    "~*Lavf\/" 1;
+    "~*Leap" 1;
+    "~*LeechFTP" 1;
+    "~*LeechGet" 1;
+    "~*LexiBot" 1;
+    "~*Lftp" 1;
+    "~*LibVLC" 1;
+    "~*LibWeb" 1;
+    "~*Libwhisker" 1;
+    "~*Licorne" 1;
+    "~*LieBaoFast" 1;
+    "~*Liferea\/" 1;
+    "~*Lighthouse" 1;
+    "~*Lightspeedsystems" 1;
+    "~*Likse" 1;
+    "~*Link Valet" 1;
+    "~*LinkAlarm\/" 1;
+    "~*LinkAnalyser" 1;
+    "~*LinkExaminer" 1;
+    "~*LinkPreview" 1;
+    "~*LinkScan" 1;
+    "~*LinkTiger" 1;
+    "~*LinkWalker" 1;
+    "~*Linkbot" 1;
+    "~*LinkextractorPro" 1;
+    "~*LinkpadBot" 1;
+    "~*LinksManager" 1;
+    "~*LinqiaMetadataDownloaderBot" 1;
+    "~*LinqiaRSSBot" 1;
+    "~*LinqiaScrapeBot" 1;
+    "~*Lipperhey" 1;
+    "~*Lipperhey\ Spider" 1;
+    "~*Litemage_walker" 1;
+    "~*Lmspider" 1;
+    "~*LoadImpactRload" 1;
+    "~*LongURL API" 1;
+    "~*Ltx71" 1;
+    "~*Lucee \(CFML Engine\)" 1;
+    "~*Lush Http Client" 1;
+    "~*MFC_Tear_Sample" 1;
+    "~*MIDown tool" 1;
+    "~*MIDown\ tool" 1;
+    "~*MIIxpc" 1;
     "~*MJ12bot" 1;
+    "~*MQQBrowser" 1;
+    "~*MS Web Services Client Protocol" 1;
+    "~*MSFrontPage" 1;
+    "~*MSIECrawler" 1;
     "~*MTRobot" 1;
-    "~*MaCoCu" 1;
-    "~*Mail\.RU_Bot" 1;
-    "~*Mastodon" 1;
+    "~*MVAClient" 1;
+    "~*MacOutlook\/" 1;
+    "~*Mag-Net" 1;
+    "~*Magnet" 1;
+    "~*MagpieRSS" 1;
+    "~*Mail.RU_Bot" 1;
+    "~*Mail::STS" 1;
+    "~*MailChimp" 1;
+    "~*Mail\.Ru" 1;
+    "~*Majestic-SEO" 1;
+    "~*Majestic12" 1;
+    "~*Majestic\ SEO" 1;
+    "~*Mandrill" 1;
+    "~*MapperCmd" 1;
+    "~*MarkMonitor" 1;
+    "~*MarkWatch" 1;
+    "~*Mass Downloader" 1;
+    "~*Mass\ Downloader" 1;
+    "~*Masscan" 1;
+    "~*Mata Hari" 1;
+    "~*Mata\ Hari" 1;
     "~*MauiBot" 1;
-    "~*Mediapartners \(Googlebot\)" 1;
+    "~*Mb2345Browser" 1;
+    "~*MeanPath\ Bot" 1;
+    "~*Meanpathbot" 1;
+    "~*Mediametric" 1;
     "~*Mediapartners-Google" 1;
     "~*Mediatoolkitbot" 1;
-    "~*MegaIndex" 1;
+    "~*MegaIndex\.ru" 1;
     "~*MeltwaterNews" 1;
-    "~*MetaInspector" 1;
-    "~*MetaJobBot" 1;
+    "~*Melvil Rawi" 1;
+    "~*MemGator" 1;
     "~*MetaURI" 1;
-    "~*Miniflux\/" 1;
-    "~*MixnodeCache\/" 1;
-    "~*MojeekBot\/" 1;
-    "~*Monsidobot" 1;
-    "~*MoodleBot" 1;
+    "~*Metaspinner" 1;
+    "~*Metauri" 1;
+    "~*MicroMessenger" 1;
+    "~*Microsearch" 1;
+    "~*Microsoft Data Access" 1;
+    "~*Microsoft Office" 1;
+    "~*Microsoft Outlook" 1;
+    "~*Microsoft Windows Network Diagnostics" 1;
+    "~*Microsoft-WebDAV-MiniRedir" 1;
+    "~*MicrosoftPreview" 1;
+    "~*Microsoft\ Data\ Access" 1;
+    "~*Microsoft\ URL\ Control" 1;
+    "~*Microsoft\.Data\.Mashup" 1;
+    "~*Mindjet" 1;
+    "~*Minefield" 1;
+    "~*Miniature\.io" 1;
+    "~*Miniflux" 1;
+    "~*Miro-HttpClient" 1;
+    "~*Mister PiX" 1;
+    "~*Mister\ PiX" 1;
+    "~*Mnogosearch" 1;
+    "~*Moblie\ Safari" 1;
+    "~*Mojeek" 1;
+    "~*Mojolicious" 1;
+    "~*Mojolicious \(Perl\)" 1;
+    "~*Mollie" 1;
+    "~*MolokaiBot" 1;
+    "~*MonTools" 1;
+    "~*Monit\/" 1;
+    "~*Monitority\/" 1;
     "~*Moreover" 1;
-    "~*MuckRack" 1;
-    "~*Multiviewbot" 1;
-    "~*NAVER Blog Rssbot" 1;
-    "~*NING\/" 1;
-    "~*NINJA bot" 1;
-    "~*NIXStatsbot" 1;
-    "~*NTENTbot" 1;
-    "~*Neevabot" 1;
-    "~*NerdByNature\.Bot" 1;
+    "~*Morfeus Fucking Scanner" 1;
+    "~*Morfeus\ Fucking\ Scanner" 1;
+    "~*Morning Paper" 1;
+    "~*MovableType" 1;
+    "~*Mozlila" 1;
+    "~*Mr.4x3" 1;
+    "~*Mr\.4x3 Powered" 1;
+    "~*Mrcgiguy" 1;
+    "~*Msrabot" 1;
+    "~*MuckRack\/" 1;
+    "~*Musobot" 1;
+    "~*MxToolbox\/" 1;
+    "~*NETCRAFT" 1;
+    "~*NG-Search" 1;
+    "~*NICErsPRO" 1;
+    "~*NLNZ_IAHarvester" 1;
+    "~*NPbot" 1;
+    "~*Najdi\.si" 1;
+    "~*Name Intelligence" 1;
+    "~*NameFo\.com" 1;
+    "~*Name\ Intelligence" 1;
+    "~*Nameprotect" 1;
+    "~*Navroad" 1;
+    "~*NearSite" 1;
+    "~*Needle" 1;
+    "~*Nessus" 1;
+    "~*Net Vampire" 1;
+    "~*NetAnts" 1;
+    "~*NetLyzer" 1;
+    "~*NetMechanic" 1;
+    "~*NetNewsWire" 1;
+    "~*NetShelter ContentScan" 1;
+    "~*NetSpider" 1;
     "~*NetSystemsResearch" 1;
-    "~*NetcraftSurveyAgent" 1;
-    "~*Neticle Crawler" 1;
+    "~*NetTrack" 1;
+    "~*NetZIP" 1;
+    "~*Net\ Vampire" 1;
+    "~*Netcraft" 1;
+    "~*Netpursual" 1;
+    "~*Netsparker" 1;
+    "~*Nettrack" 1;
     "~*Netvibes" 1;
-    "~*NewsBlur" 1;
-    "~*NextCloud" 1;
-    "~*Nicecrawler" 1;
-    "~*Nimbostratus-Bot" 1;
+    "~*Neustar WPM" 1;
+    "~*NeutrinoAPI" 1;
+    "~*NewRelicPinger" 1;
+    "~*NewsBlur .*Finder" 1;
+    "~*NewsGator" 1;
+    "~*Nexgate Ruby Client" 1;
+    "~*NextGenSearchBot" 1;
+    "~*Nibbler" 1;
+    "~*NihilScio" 1;
+    "~*Niki-bot" 1;
+    "~*Nikto" 1;
+    "~*NimbleCrawler" 1;
+    "~*Nimbostratus" 1;
+    "~*Ninja" 1;
+    "~*Nmap" 1;
     "~*Nmap Scripting Engine" 1;
+    "~*NodePing" 1;
+    "~*Nodemeter" 1;
+    "~*Norton-Safeweb" 1;
+    "~*Notifixious" 1;
+    "~*NotionEmbedder" 1;
+    "~*Nuclei" 1;
     "~*Nutch" 1;
     "~*Nuzzel" 1;
-    "~*OAI-SearchBot" 1;
-    "~*Ocarinabot" 1;
-    "~*OdklBot\/" 1;
-    "~*OpenGraphCheck" 1;
-    "~*OpenHoseBot" 1;
-    "~*OrangeBot\/" 1;
+    "~*Nymesis" 1;
+    "~*OMSC" 1;
+    "~*OPPO A33" 1;
+    "~*Observatory\/" 1;
+    "~*Ocelli\/" 1;
+    "~*Octopus" 1;
+    "~*Offline Explorer" 1;
+    "~*Offline Navigator" 1;
+    "~*Offline\ Explorer" 1;
+    "~*Offline\ Navigator" 1;
+    "~*OgScrper" 1;
+    "~*OnCrawl" 1;
+    "~*Online Domain Tools" 1;
+    "~*Open Source RSS" 1;
+    "~*OpenCalaisSemanticProxy" 1;
+    "~*OpenLinkProfiler" 1;
+    "~*OpenVAS" 1;
+    "~*Openfind" 1;
+    "~*Openstat\/" 1;
+    "~*Openvas" 1;
+    "~*Optimizer" 1;
+    "~*OrangeBot" 1;
+    "~*OrangeSpider" 1;
+    "~*Orbiter" 1;
+    "~*OrgProbe\/" 1;
     "~*OutclicksBot" 1;
-    "~*PR-CY\.RU" 1;
-    "~*PagePeeker\/" 1;
+    "~*OutfoxBot" 1;
+    "~*Outlook-Express" 1;
+    "~*Outlook-iOS" 1;
+    "~*Owler" 1;
+    "~*Owlin" 1;
+    "~*OxfordCloudService" 1;
+    "~*PDF24 URL To PDF" 1;
+    "~*PECL::HTTP" 1;
+    "~*PHPCrawl" 1;
+    "~*POE-Component-Client-HTTP" 1;
+    "~*PRTG Network Monitor" 1;
+    "~*PTST " 1;
+    "~*PTST\/[0-9]+" 1;
+    "~*Page Valet" 1;
+    "~*PageAnalyzer" 1;
+    "~*PageFreezer" 1;
+    "~*PageGrabber" 1;
+    "~*PagePeeker" 1;
+    "~*PageScorer" 1;
     "~*PageThing" 1;
+    "~*Page\ Analyzer" 1;
+    "~*Pagespeed\/" 1;
     "~*Pandalytics" 1;
-    "~*PaperLiBot" 1;
+    "~*Panopta" 1;
+    "~*Panscient" 1;
+    "~*Papa Foto" 1;
+    "~*Papa\ Foto" 1;
+    "~*Pavuk" 1;
+    "~*PayPal IPN" 1;
     "~*Pcore-HTTP" 1;
-    "~*PerplexityBot\/" 1;
-    "~*PetalBot" 1;
-    "~*PhantomJS" 1;
-    "~*PhxBot" 1;
-    "~*PiplBot" 1;
+    "~*Pearltrees" 1;
+    "~*Peew" 1;
+    "~*PeoplePal" 1;
+    "~*Perlu -" 1;
+    "~*Petalbot" 1;
+    "~*PhantomJS Screenshoter" 1;
+    "~*PhantomJS\/" 1;
+    "~*Photon\/" 1;
+    "~*Pi-Monster" 1;
+    "~*Picscout" 1;
+    "~*Picsearch" 1;
+    "~*PictureFinder" 1;
+    "~*Piepmatz" 1;
+    "~*Pimonster" 1;
+    "~*PingAdmin\.Ru" 1;
+    "~*PingSpot" 1;
+    "~*Pingability" 1;
+    "~*Pingdom" 1;
+    "~*Pingoscope" 1;
+    "~*Pixray" 1;
+    "~*Pizilla" 1;
+    "~*Plagger\/" 1;
+    "~*PleaseCrawl" 1;
+    "~*Pleroma " 1;
+    "~*Ploetz \+ Zeller" 1;
+    "~*Plukkie" 1;
+    "~*PocketImageCache" 1;
     "~*PocketParser" 1;
-    "~*Primalbot" 1;
-    "~*PrivacyAwareBot" 1;
-    "~*Pulsepoint" 1;
+    "~*Pockey" 1;
+    "~*PodcastAddict\/" 1;
+    "~*Polymail\/" 1;
+    "~*Pompos" 1;
+    "~*Porkbun" 1;
+    "~*Port Monitor" 1;
+    "~*PostPost" 1;
+    "~*PostmanRuntime" 1;
+    "~*PowerPoint\/" 1;
+    "~*Prebid" 1;
+    "~*Prerender" 1;
+    "~*Priceonomics Analysis Engine" 1;
+    "~*PrintFriendly" 1;
+    "~*PritTorrent" 1;
+    "~*Prlog" 1;
+    "~*ProPowerBot" 1;
+    "~*ProWebWalker" 1;
+    "~*Probethenet" 1;
+    "~*Project ?25499" 1;
+    "~*Project-Resonance" 1;
+    "~*Protopage" 1;
+    "~*Proximic" 1;
+    "~*Psbot" 1;
+    "~*Pu_iN" 1;
+    "~*Pump" 1;
+    "~*PxBroker" 1;
+    "~*PyCurl" 1;
+    "~*Python-httplib2" 1;
     "~*Python-urllib" 1;
+    "~*QQDownload" 1;
+    "~*Qirina Hurdler" 1;
+    "~*QrafterPro" 1;
+    "~*Qseero" 1;
+    "~*Qualidator" 1;
+    "~*QueryN Metasearch" 1;
+    "~*QueryN\ Metasearch" 1;
+    "~*Quick-Crawler" 1;
+    "~*QuiteRSS" 1;
+    "~*Quora Link Preview" 1;
     "~*Qwantify" 1;
+    "~*ROI Hunter" 1;
+    "~*RPT-HTTPClient" 1;
+    "~*RSSMix\/" 1;
+    "~*RSSOwl" 1;
     "~*RSSingBot" 1;
+    "~*Radian6" 1;
+    "~*RadioPublicImageResizer" 1;
+    "~*Railgun\/" 1;
+    "~*Rainbot" 1;
+    "~*RankActive" 1;
     "~*RankActiveLinkBot" 1;
-    "~*Refindbot" 1;
-    "~*RegionStuttgartBot" 1;
-    "~*RetrevoPageAnalyzer" 1;
-    "~*ReverseEngineeringBot" 1;
-    "~*RewriteCond %{HTTP_USER_AGENT} ^$|\&lt;|\&gt;|\&#039;|\%|\_iRc|\_Works|\@\$x|\&lt;\?|\$x0e|\+select\+|\+union\+|1\,\1\,1\,|2icommerce|3GSE|4all|59\.64\.153\.|88\.0\.106\.|98|85\.17\.|A\_Browser|ABAC|Abont|abot|Accept|Access|Accoo|AceFTP|Acme|ActiveTouristBot|Address|Adopt|adress|adressendeutschland|ADSARobot|agent|ah\-ha|Ahead|AESOP\_com\_SpiderMan|aipbot|Alarm|Albert|Alek|Alexibot|Alligator|AllSubmitter|alma|almaden|ALot|Alpha|aktuelles|Akregat|Amfi|amzn\_assoc|Anal|Anarchie|andit|Anon|AnotherBot|Ansearch|AnswerBus|antivirx|Apexoo|appie|Aqua_Products|Arachmo|archive|arian|ASPSe|ASSORT|aster|Atari|ATHENS|AtHome|Atlocal|Atomic_Email_Hunter|Atomz|Atrop|^attach|attrib|autoemailspider|autohttp|axod|batch|b2w|Back|BackDoorBot|BackStreet|BackWeb|Badass|Baid|Bali|Bandit|Baidu|Barry|BasicHTTP|BatchFTP|bdfetch|beat|Become|Beij|BenchMark|berts|bew|big.brother|Bigfoot|Bilgi|Bison|Bitacle|Biz360|Black|Black.Hole|BlackWidow|bladder.fusion|Blaiz|Blog.Checker|Blogl|BlogPeople|Blogshares.Spiders|Bloodhound|Blow|bmclient|Board|BOI|boitho|Bond|Bookmark.search.tool|boris|Bost|Boston.Project|BotRightHere|Bot.mailto:craftbot@yahoo.com|BotALot|botpaidtoclick|botw|brandwatch|BravoBrian|Brok|Bropwers|Broth|browseabit|BrowseX|Browsezilla|Bruin|bsalsa|Buddy|Build|Built|Bulls|bumblebee|Bunny|Busca|Busi|Buy|bwh3|c\-spider|CafeK|Cafi|camel|Cand|captu|Catch|cd34|Ceg|CFNetwork|cgichk|Cha0s|Chang|chaos|Char|char\(32\,35\)|charlotte|CheeseBot|Chek|CherryPicker|chill|ChinaClaw|CICC|Cisco|Cita|Clam|Claw|Click.Bot|clipping|clshttp|Clush|COAST|ColdFusion|Coll|Comb|commentreader|Compan|contact|Control|contype|Conc|Conv|Copernic|Copi|Copy|Coral|Corn|core-project|cosmos|costa|cr4nk|crank|craft|Crap|Crawler0|Crazy|Cres|cs\-CZ|cuill|Curl|Custo|Cute|CSHttp|Cyber|cyberalert|^DA$|daoBot|DARK|Data|Daten|Daum|dcbot|dcs|Deep|DepS|Detect|Deweb|Diam|Digger|Digimarc|digout4uagent|DIIbot|Dillo|Ding|DISC|discobot|Disp|Ditto|DLC|DnloadMage|DotBot|Doubanbot|Download|Download.Demon|Download.Devil|Download.Wonder|Downloader|drag|DreamPassport|Drec|Drip|dsdl|dsok|DSurf|DTAAgent|DTS|Dual|dumb|DynaWeb|e\-collector|eag|earn|EARTHCOM|EasyDL|ebin|EBM-APPLE|EBrowse|eCatch|echo|ecollector|Edco|edgeio|efp\@gmx\.net|EirGrabber|email|Email.Extractor|EmailCollector|EmailSearch|EmailSiphon|EmailWolf|Emer|empas|Enfi|Enhan|Enterprise\_Search|envolk|erck|EroCr|ESurf|Eval|Evil|Evere|EWH|Exabot|Exact|EXPLOITER|Expre|Extra|ExtractorPro|EyeN|FairAd|Fake|FANG|FAST|fastlwspider|FavOrg|Favorites.Sweeper|Faxo|FDM\_1|FDSE|fetch|FEZhead|Filan|FileHound|find|Firebat|Firefox.2\.0|Firs|Flam|Flash|FlickBot|Flip|fluffy|flunky|focus|Foob|Fooky|Forex|Forum|ForV|Fost|Foto|Foun|Franklin.Locator|freefind|FreshDownload|FrontPage|FSurf|Fuck|Fuer|futile|Fyber|Gais|GalaxyBot|Galbot|Gamespy\_Arcade|GbPl|Gener|geni|Geona|Get|gigabaz|Gira|Ginxbot|gluc|glx.?v|gnome|Go.Zilla|Goldfire|Google.Wireless.Transcoder|Googlebot\-Image|Got\-It|GOFORIT|gonzo|GornKer|GoSearch|^gotit$|gozilla|grab|Grabber|GrabNet|Grub|Grup|Graf|Green.Research|grub|grub\-client|gsa\-cra|GSearch|GT\:\:WWW|GuideBot|guruji|gvfs|Gyps|hack|haha|hailo|Harv|Hatena|Hax|Head|Helm|herit|hgre|hhjhj\@yahoo|Hippo|hloader|HMView|holm|holy|HomePageSearch|HooWWWer|HouxouCrawler|HMSE|HPPrint|htdig|HTTPConnect|httpdown|http.generic|HTTPGet|httplib|HTTPRetriever|HTTrack|human|Huron|hverify|Hybrid|Hyper|ia\_archiver|iaskspi|IBM\_Planetwide|iCCra|ichiro|ID\-Search|IDA|IDBot|IEAuto|IEMPT|iexplore\.exe|iGetter|Ilse|Iltrov|Image|Image.Stripper|Image.Sucker|imagefetch|iimds\_monitor|Incutio|IncyWincy|Indexer|Industry.Program|Indy|InetURL|informant|InfoNav|InfoTekies|Ingelin|Innerpr|Inspect|InstallShield.DigitalWizard|Insuran\.|Intellig|Intelliseek|InterGET|Internet.Ninja|Internet.x|Internet\_Explorer|InternetLinkagent|InternetSeer.com|Intraf|IP2|Ipsel|Iria|IRLbot|Iron33|Irvine|ISC\_Sys|iSilo|ISRCCrawler|ISSpi|IUPUI.Research.Bot|Jady|Jaka|Jam|^Java|java\/|Java\(tm\)|JBH.agent|Jenny|JetB|JetC|jeteye|jiro|JoBo|JOC|jupit|Just|Jyx|Kapere|kash|Kazo|KBee|Kenjin|Kernel|Keywo|KFSW|KKma|Know|kosmix|KRAE|KRetrieve|Krug|ksibot|ksoap|Kum|KWebGet|Lachesis|lanshan|Lapo|larbin|leacher|leech|LeechFTP|LeechGet|leipzig\.de|Lets|Lexi|lftp|Libby|libcrawl|libcurl|libfetch|libghttp|libWeb|libwhisker|libwww|libwww\-FM|libwww\-perl|LightningDownload|likse|Linc|Link|Link.Sleuth|LinkextractorPro|Linkie|LINKS.ARoMATIZED|LinkScan|linktiger|LinkWalker|Lint|List|lmcrawler|LMQ|LNSpiderguy|loader|LocalcomBot|Locu|London|lone|looksmart|loop|Lork|LTH\_|lwp\-request|LWP|lwp-request|lwp-trivial|Mac.Finder|Macintosh\;.I\;.PPC|Mac\_F|magi|Mag\-Net|Magnet|Magp|Mail.Sweeper|main|majest|Mam|Mana|MarcoPolo|mark.blonin|MarkWatch|MaSagool|Mass|Mass.Downloader|Mata|mavi|McBot|Mecha|MCspider|mediapartners|^Memo|MEGAUPLOAD|MetaProducts.Download.Express|Metaspin|Mete|Microsoft.Data.Access|Microsoft.URL|Microsoft\_Internet\_Explorer|MIDo|MIIx|miner|Mira|MIRE|Mirror|Miss|Missauga|Missigua.Locator|Missouri.College.Browse|Mist|Mizz|MJ12|mkdb|mlbot|MLM|MMMoCrawl|MnoG|moge|Moje|Monster|Monza.Browser|Mooz|Moreoverbot|MOT\-MPx220|mothra\/netscan|mouse|MovableType|Mozdex|Mozi\!|^Mozilla$|Mozilla\/1\.22|Mozilla\/22|^Mozilla\/3\.0.\(compatible|Mozilla\/3\.Mozilla\/2\.01|Mozilla\/4\.0\(compatible|Mozilla\/4\.08|Mozilla\/4\.61.\(Macintosh|Mozilla\/5\.0|Mozilla\/7\.0|Mozilla\/8|Mozilla\/9|Mozilla\:|Mozilla\/Firefox|^Mozilla.*Indy|^Mozilla.*NEWT|^Mozilla*MSIECrawler|Mp3Bot|MPF|MRA|MS.FrontPage|MS.?Search|MSFrontPage|MSIE\_6\.0|MSIE6|MSIECrawler|msnbot\-media|msnbot\-Products|MSNPTC|MSProxy|MSRBOT|multithreaddb|musc|MVAC|MWM|My\_age|MyApp|MyDog|MyEng|MyFamilyBot|MyGetRight|MyIE2|mysearch|myurl|NAG|NAMEPROTECT|NASA.Search|nationaldirectory|Naver|Navr|Near|NetAnts|netattache|Netcach|NetCarta|Netcraft|NetCrawl|NetMech|netprospector|NetResearchServer|NetSp|Net.Vampire|netX|NetZ|Neut|newLISP|NewsGatorInbox|NEWT|NEWT.ActiveX|Next|^NG|NICE|nikto|Nimb|Ninja|Ninte|NIPGCrawler|Noga|nogo|Noko|Nomad|Norb|noxtrumbot|NPbot|NuSe|Nutch|Nutex|NWSp|Obje|Ocel|Octo|ODI3|oegp|Offline|Offline.Explorer|Offline.Navigator|OK.Mozilla|omg|Omni|Onfo|onyx|OpaL|OpenBot|Openf|OpenTextSiteCrawler|OpenU|Orac|OrangeBot|Orbit|Oreg|osis|Outf|Owl|P3P|PackRat|PageGrabber|PagmIEDownload|pansci|Papa|Pars|Patw|pavu|Pb2Pb|pcBrow|PEAR|PEER|PECL|pepe|Perl|PerMan|PersonaPilot|Persuader|petit|PHP|PHP.vers|PHPot|Phras|PicaLo|Piff|Pige|pigs|^Ping|Pingd|PingALink|Pipe|Plag|Plant|playstarmusic|Pluck|Pockey|POE\-Com|Poirot|Pomp|Port.Huron|Post|powerset|Preload|press|Privoxy|Probe|Program.Shareware|Progressive.Download|ProPowerBot|prospector|Provider.Protocol.Discover|ProWebWalker|Prowl|Proxy|Prozilla|psbot|PSurf|psycheclone|^puf$|Pulse|Pump|PushSite|PussyCat|PuxaRapido|PycURL|Pyth|PyQ|QuepasaCreep|Query|Quest|QRVA|Qweer|radian|Radiation|Rambler|RAMP|RealDownload|Reap|Recorder|RedCarpet|RedKernel|ReGet|relevantnoise|replacer|Repo|requ|Rese|Retrieve|Rip|Rix|RMA|Roboz|Rogue|Rover|RPT\-HTTP|Rsync|RTG30|.ru\)|ruby|Rufus|Salt|Sample|SAPO|Sauger|savvy|SBIder|SBP|SCAgent|scan|SCEJ\_|Sched|Schizo|Schlong|Schmo|Scout|Scooter|Scorp|ScoutOut|SCrawl|screen|script|SearchExpress|searchhippo|Searchme|searchpreview|searchterms|Second.Street.Research|Security.Kol|Seekbot|Seeker|Sega|Sensis|Sept|Serious|Sezn|Shai|Share|Sharp|Shaz|shell|shelo|Sherl|Shim|Shiretoko|ShopWiki|SickleBot|Simple|Siph|sitecheck|SiteCrawler|SiteSnagger|Site.Sniper|SiteSucker|sitevigil|SiteX|Sleip|Slide|Slurpy.Verifier|Sly|Smag|SmartDownload|Smurf|sna\-|snag|Snake|Snapbot|Snip|Snoop|So\-net|SocSci|sogou|Sohu|solr|sootle|Soso|SpaceBison|Spad|Span|spanner|Speed|Spegla|Sphere|Sphider|spider|SpiderBot|SpiderEngine|SpiderView|Spin|sproose|Spurl|Spyder|Squi|SQ.Webscanner|sqwid|Sqworm|SSM\_Ag|Stack|Stamina|stamp|Stanford|Statbot|State|Steel|Strateg|Stress|Strip|studybot|Style|subot|Suck|Sume|sun4m|Sunrise|SuperBot|SuperBro|Supervi|Surf4Me|SuperHTTP|Surfbot|SurfWalker|Susi|suza|suzu|Sweep|sygol|syncrisis|Systems|Szukacz|Tagger|Tagyu|tAke|Talkro|TALWinHttpClient|tamu|Tandem|Tarantula|tarspider|tBot|TCF|Tcs\/1|TeamSoft|Tecomi|Teleport|Telesoft|Templeton|Tencent|Terrawiz|Test|TexNut|trivial|Turnitin|The.Intraformant|TheNomad|Thomas|TightTwatBot|Timely|Titan|TMCrawler|TMhtload|toCrawl|Todobr|Tongco|topic|Torrent|Track|translate|Traveler|TREEVIEW|True|Tunnel|turing|Turnitin|TutorGig|TV33\_Mercator|Twat|Tweak|Twice|Twisted.PageGetter|Tygo|ubee|UCmore|UdmSearch|UIowaCrawler|Ultraseek|UMBC|unf|UniversalFeedParser|unknown|UPG1|UtilMind|URLBase|URL.Control|URL\_Spider\_Pro|urldispatcher|URLGetFile|urllib|URLSpiderPro|URLy|User\-Agent|UserAgent|USyd|Vacuum|vagabo|Valet|Valid|Vamp|vayala|VB\_|VCI|VERI\~LI|verif|versus|via|Viewer|virtual|visibilitygap|Visual|vobsub|Void|VoilaBot|voyager|vspider|VSyn|w\:PACBHO60|w0000t|W3C|w3m|w3search|walhello|Walker|Wand|WAOL|WAPT|Watch|Wavefire|wbdbot|Weather|web.by.mail|Web.Data.Extractor|Web.Downloader|Web.Ima|Web.Mole|Web.Sucker|Web2Mal|Web2WAP|WebaltBot|WebAuto|WebBandit|Webbot|WebCapture|WebCat|webcraft\@bea|Webclip|webcollage|WebCollector|WebCopier|WebCopy|WebCor|webcrawl|WebDat|WebDav|webdevil|webdownloader|Webdup|WebEMail|WebEMailExtrac|WebEnhancer|WebFetch|WebGo|WebHook|Webinator|WebInd|webitpr|WebFilter|WebFountain|WebLea|Webmaster|WebmasterWorldForumBot|WebMin|WebMirror|webmole|webpic|WebPin|WebPix|WebReaper|WebRipper|WebRobot|WebSauger|WebSite|Website.eXtractor|Website.Quester|WebSnake|webspider|Webster|WebStripper|websucker|WebTre|WebVac|webwalk|WebWasher|WebWeasel|WebWhacker|WebZIP|Wells|WEP\_S|WEP.Search.00|WeRelateBot|wget|Whack|Whacker|whiz|WhosTalking|Widow|Win67|window.location|Windows.95\;|Windows.95\)|Windows.98\;|Windows.98\)|Winodws|Wildsoft.Surfer|WinHT|winhttp|WinHttpRequest|WinHTTrack|Winnie.Poh|wire|WISEbot|wisenutbot|wish|Wizz|WordP|Works|world|WUMPUS|Wweb|WWWC|WWWOFFLE|WWW\-Collector|WWW.Mechanize|www.ranks.nl|wwwster|^x$|X12R1|x\-Tractor|Xaldon|Xenu|XGET|xirq|Y\!OASIS|Y\!Tunnel|yacy|YaDirectBot|Yahoo\-MMAudVid|YahooSeeker|YahooYSMcm|Yamm|Yand|yang|Yeti|Yoono|yori|Yotta|YTunnel|Zade|zagre|ZBot|Zeal|ZeBot|zerx|Zeus|ZIPCode|Zixy|zmao|Zyborg [NC]" 1;
-    "~*RidderBot" 1;
-    "~*Rivva" 1;
+    "~*RankFlex" 1;
+    "~*RankSonicSiteAuditor" 1;
+    "~*RankingBot" 1;
+    "~*RankingBot2" 1;
+    "~*Rankivabot" 1;
+    "~*RankurBot" 1;
+    "~*RapidLoad\/" 1;
+    "~*Re-re" 1;
+    "~*Re-re Studio" 1;
+    "~*ReGet" 1;
+    "~*ReactorNetty" 1;
+    "~*Readability" 1;
+    "~*RealDownload" 1;
+    "~*RealPlayer%20Downloader" 1;
+    "~*Reaper" 1;
+    "~*RebelMouse" 1;
+    "~*Recorder" 1;
+    "~*RecurPost\/" 1;
+    "~*RedesScrapy" 1;
+    "~*ReederForMac" 1;
+    "~*Reeder\/" 1;
+    "~*RepoMonkey" 1;
+    "~*ResponseCodeTest" 1;
+    "~*RestSharp" 1;
+    "~*Riddler" 1;
+    "~*Ripper" 1;
+    "~*Rival IQ" 1;
+    "~*Robosourcer" 1;
+    "~*Robozilla" 1;
+    "~*RocketCrawler" 1;
+    "~*Rogerbot" 1;
     "~*RuxitSynthetic" 1;
-    "~*RyteBot" 1;
-    "~*SBL-BOT" 1;
+    "~*RyowlEngine" 1;
+    "~*SAP NetWeaver Application Server" 1;
+    "~*SBIder" 1;
+    "~*SEO Browser" 1;
+    "~*SEOCentro" 1;
     "~*SEOkicks" 1;
+    "~*SEOkicks-Robot" 1;
     "~*SEOlizer" 1;
-    "~*SWIMGBot" 1;
-    "~*S[eE][mM]rushBot" 1;
-    "~*SafeDNSBot" 1;
-    "~*SafeSearch microdata crawler" 1;
+    "~*SEOlyt" 1;
+    "~*SEOlyticsCrawler" 1;
+    "~*SEOprofiler" 1;
+    "~*SEOsearch" 1;
+    "~*SEOstats" 1;
+    "~*SISTRIX" 1;
+    "~*SMRF URL Expander" 1;
+    "~*SMTBot" 1;
+    "~*SMUrlExpander" 1;
+    "~*SPDYCheck" 1;
+    "~*SPEng" 1;
+    "~*SSL Labs" 1;
+    "~*SalesIntelligent" 1;
+    "~*Saleslift" 1;
+    "~*SauceNAO" 1;
+    "~*Scamadviser-Frontend" 1;
+    "~*ScanAlert" 1;
+    "~*Scanbot" 1;
+    "~*Scoop" 1;
+    "~*ScopeContentAG-HTTP-Client" 1;
     "~*ScoutJet" 1;
+    "~*ScoutURLMonitor" 1;
+    "~*ScrapeBox Page Scanner" 1;
     "~*Scrapy" 1;
-    "~*Screaming Frog SEO Spider" 1;
-    "~*SearchAtlas" 1;
+    "~*Screaming" 1;
+    "~*ScreenShotService" 1;
+    "~*ScreenerBot" 1;
+    "~*ScrepyBot" 1;
+    "~*Scrubby" 1;
+    "~*Scrutiny\/" 1;
+    "~*Search37" 1;
+    "~*SearchExpress" 1;
+    "~*SearchSight" 1;
+    "~*SearchWP" 1;
+    "~*Searchestate" 1;
+    "~*SearchmetricsBot" 1;
+    "~*Seeker" 1;
     "~*Seekport" 1;
-    "~*SemanticScholarBot" 1;
+    "~*SeekportBot" 1;
+    "~*SemanticJuice" 1;
+    "~*Semiocast HTTP client" 1;
+    "~*Semrush" 1;
+    "~*SemrushBot" 1;
+    "~*Sendsay\.Ru" 1;
     "~*SentiBot" 1;
     "~*SenutoBot" 1;
+    "~*Seo Servis" 1;
+    "~*SeoCheck" 1;
+    "~*SeoCherryBot" 1;
+    "~*SeoSiteCheckup" 1;
+    "~*Seobility" 1;
     "~*SeobilityBot" 1;
-    "~*SerendeputyBot" 1;
-    "~*SeznamBot" 1;
-    "~*SimpleCrawler" 1;
+    "~*Seomoz" 1;
+    "~*Seznam" 1;
+    "~*Shelob" 1;
+    "~*Shodan" 1;
+    "~*ShopWiki" 1;
+    "~*Shoppimon" 1;
+    "~*ShortLinkTranslate" 1;
+    "~*Sideqik" 1;
+    "~*Siege" 1;
     "~*SimplePie" 1;
-    "~*SimpleScraper" 1;
+    "~*SimplyFast" 1;
+    "~*Siphon" 1;
+    "~*Site Sucker" 1;
+    "~*Site-Shot\/" 1;
+    "~*Site24x7" 1;
+    "~*SiteBar" 1;
     "~*SiteCheckerBotCrawler" 1;
-    "~*Siteimprove\.com" 1;
+    "~*SiteCondor" 1;
+    "~*SiteExplorer" 1;
+    "~*SiteGuardian" 1;
+    "~*SiteIndexed" 1;
+    "~*SiteLockSpider" 1;
+    "~*SiteMonitor" 1;
+    "~*SiteSnagger" 1;
+    "~*SiteSucker" 1;
+    "~*SiteTruth" 1;
+    "~*Site\ Sucker" 1;
+    "~*Sitebeam" 1;
+    "~*Sitebulb\/" 1;
+    "~*Siteimprove" 1;
+    "~*Sitemap(s)? Generator" 1;
+    "~*SitemapGenerator" 1;
+    "~*Siteshooter B0t" 1;
+    "~*Sitevigil" 1;
     "~*SkypeUriPreview" 1;
-    "~*Slack-ImgProxy" 1;
-    "~*Slackbot" 1;
-    "~*Slurp" 1;
-    "~*Snacktory" 1;
-    "~*Snap URL Preview Service" 1;
+    "~*Slack\/" 1;
+    "~*SlySearch" 1;
+    "~*SmartDownload" 1;
+    "~*Snake" 1;
+    "~*SnapSearch" 1;
+    "~*Snapbot" 1;
+    "~*Snappy" 1;
+    "~*Snarfer\/" 1;
+    "~*SniffRSS" 1;
+    "~*Snoopy" 1;
+    "~*SnowHaze Search" 1;
     "~*SocialRankIOBot" 1;
-    "~*Sogou" 1;
-    "~*Sonic" 1;
-    "~*Storebot-Google" 1;
-    "~*StorygizeBot" 1;
-    "~*StractBot" 1;
-    "~*Streamline3Bot\/" 1;
-    "~*Superfeedr" 1;
-    "~*SurdotlyBot" 1;
+    "~*Sociscraper" 1;
+    "~*Sogou\ web\ spider" 1;
+    "~*SortSite" 1;
+    "~*Sosospider" 1;
+    "~*Sottopop" 1;
+    "~*SpaceBison" 1;
+    "~*SpamExperts" 1;
+    "~*Spammen" 1;
+    "~*SpankBot" 1;
+    "~*Spanner" 1;
+    "~*Spawning-AI" 1;
+    "~*Spbot" 1;
+    "~*Specificfeeds" 1;
+    "~*SpeedKit" 1;
+    "~*Spider_Bot" 1;
+    "~*Spider_Bot/3.0" 1;
+    "~*Spinn3r" 1;
+    "~*Sprinklr " 1;
+    "~*SputnikBot" 1;
+    "~*Sqlmap" 1;
+    "~*Sqlworm" 1;
+    "~*Sqworm" 1;
+    "~*StackRambler" 1;
+    "~*Statastico\/" 1;
+    "~*Statically-" 1;
+    "~*StatusCake" 1;
+    "~*Steeler" 1;
+    "~*Stratagems Kumo" 1;
+    "~*Stripe\/" 1;
+    "~*Stripper" 1;
+    "~*Stroke\.cz" 1;
+    "~*StudioFACA" 1;
+    "~*StumbleUpon" 1;
+    "~*Sucker" 1;
+    "~*Sucuri" 1;
+    "~*SuperBot" 1;
+    "~*SuperHTTP" 1;
+    "~*Surfbot" 1;
+    "~*Surphace Scout" 1;
     "~*SurveyBot" 1;
-    "~*Synapse" 1;
+    "~*Suzuran" 1;
+    "~*Swiftbot" 1;
+    "~*Symfony BrowserKit" 1;
+    "~*Symfony2 BrowserKit" 1;
+    "~*SynHttpClient-Built" 1;
+    "~*Synapse\/" 1;
+    "~*Syndirella\/" 1;
     "~*Sysomos" 1;
-    "~*Taboolabot" 1;
-    "~*TangibleeBot" 1;
-    "~*TelegramBot" 1;
-    "~*Teoma" 1;
+    "~*Szukacz" 1;
+    "~*T0PHackTeam" 1;
+    "~*T8Abot" 1;
+    "~*TLSProbe\/" 1;
+    "~*Tarantula\/" 1;
+    "~*Taringa UGC" 1;
+    "~*TarmotGezgin" 1;
+    "~*Teleport" 1;
+    "~*TeleportPro" 1;
+    "~*Telesoft" 1;
+    "~*Telesphoreo" 1;
+    "~*Telesphorep" 1;
+    "~*Tenon\.io" 1;
+    "~*Test Certificate Info" 1;
+    "~*Tetrahedron" 1;
+    "~*TextRazor Downloader" 1;
+    "~*The Drop Reaper" 1;
+    "~*The Expert HTML Source Viewer" 1;
+    "~*The Intraformant" 1;
+    "~*The Knowledge AI" 1;
+    "~*TheNomad" 1;
+    "~*The\ Intraformant" 1;
     "~*Thinklab" 1;
+    "~*ThumbSniper" 1;
+    "~*Thumbor" 1;
+    "~*Thumbshots" 1;
+    "~*TightTwatBot" 1;
     "~*TinEye" 1;
     "~*Tiny Tiny RSS" 1;
-    "~*TombaPublicWebCrawler" 1;
-    "~*ToutiaoSpider" 1;
+    "~*TinyTestBot" 1;
+    "~*Titan" 1;
+    "~*Toata" 1;
+    "~*Toweyabot" 1;
     "~*Traackr\.com" 1;
-    "~*TrendsmapResolver" 1;
-    "~*Trove" 1;
+    "~*Tracemyfile" 1;
+    "~*Trackuity" 1;
+    "~*TrapitAgent" 1;
+    "~*Trendiction" 1;
+    "~*Trendictionbot" 1;
+    "~*Trendsmap" 1;
+    "~*True_Robot" 1;
+    "~*TryJsoup" 1;
+    "~*TulipChain" 1;
+    "~*Turingos" 1;
     "~*Turnitin" 1;
-    "~*TweetmemeBot" 1;
+    "~*TurnitinBot" 1;
+    "~*Tweetminster" 1;
+    "~*Tweezler\/" 1;
+    "~*TwengaBot" 1;
+    "~*Twice" 1;
+    "~*Twikle" 1;
     "~*Twingly" 1;
-    "~*Twitterbot" 1;
-    "~*Twurly" 1;
-    "~*UT-Dorkbot" 1;
+    "~*Twisted PageGetter" 1;
+    "~*Typhoeus" 1;
+    "~*URL Verifier" 1;
+    "~*URLTester" 1;
+    "~*URL\/Emacs" 1;
+    "~*URLitor" 1;
+    "~*URLy Warning" 1;
+    "~*URLy\ Warning" 1;
+    "~*URLy\.Warning" 1;
+    "~*UdmSearch" 1;
+    "~*UnisterBot" 1;
+    "~*UniversalFeedParser" 1;
+    "~*Unshorten\.It" 1;
+    "~*Untiny" 1;
+    "~*UnwindFetchor" 1;
     "~*Upflow" 1;
-    "~*Uptime-Kuma" 1;
-    "~*UptimeRobot" 1;
-    "~*Uptimebot\.org" 1;
-    "~*UsineNouvelleCrawler" 1;
-    "~*VKRobot" 1;
-    "~*Validator\.nu" 1;
-    "~*Valve\/Steam" 1;
+    "~*Uptimia" 1;
+    "~*UrlTrends Ranking Updater" 1;
+    "~*Urlcheckr" 1;
+    "~*Urlstat" 1;
+    "~*V-BOT" 1;
+    "~*VB Project" 1;
+    "~*VB\ Project" 1;
+    "~*VSAgent\/" 1;
+    "~*VSB-TUO\/" 1;
+    "~*VYU2" 1;
+    "~*Vacuum" 1;
+    "~*Vagabondo" 1;
     "~*VelenPublicWebCrawler" 1;
-    "~*Veoozbot" 1;
-    "~*Vercelbot" 1;
-    "~*Viber" 1;
-    "~*Vigil\/" 1;
-    "~*VoluumDSP-content-bot" 1;
+    "~*VeriCiteCrawler" 1;
+    "~*Verity" 1;
+    "~*VidibleScraper" 1;
+    "~*Virusdie" 1;
+    "~*Visual Rights Group" 1;
+    "~*VoidEYE" 1;
+    "~*Voil" 1;
+    "~*Voltron" 1;
+    "~*Vulnbusters Meter" 1;
     "~*W3C-checklink" 1;
     "~*W3C-mobileOK" 1;
-    "~*W3C_CSS_Validator" 1;
-    "~*W3C_I18n-Checker" 1;
     "~*W3C_Unicorn" 1;
-    "~*W3C_Validator" 1;
-    "~*WeSEE:Search" 1;
+    "~*WAC-OFU" 1;
+    "~*WASALive-Bot" 1;
+    "~*WBSearchBot" 1;
+    "~*WDT\.io" 1;
+    "~*WEBDAV" 1;
+    "~*WEPA" 1;
+    "~*WISENutbot" 1;
+    "~*WP Engine Install Performance API" 1;
+    "~*WP Rocket" 1;
+    "~*WPScan" 1;
+    "~*WWW-Collector-E" 1;
+    "~*WWW-Mechanize" 1;
+    "~*WWW::Document" 1;
+    "~*WWW::Mechanize" 1;
+    "~*WWWOFFLE" 1;
+    "~*WakeletLinkExpander" 1;
+    "~*Wallpapers" 1;
+    "~*Wallpapers/3.0" 1;
+    "~*WallpapersHD" 1;
+    "~*Wallpapers\/[0-9]+" 1;
+    "~*Wappalyzer" 1;
+    "~*WatchMouse" 1;
+    "~*WbSrch\/" 1;
+    "~*WeLikeLinks" 1;
+    "~*WeSEE" 1;
+    "~*Web Auto" 1;
+    "~*Web Collage" 1;
+    "~*Web Enhancer" 1;
+    "~*Web Fetch" 1;
+    "~*Web Fuck" 1;
+    "~*Web Pix" 1;
+    "~*Web Sauger" 1;
+    "~*Web Sucker" 1;
+    "~*Web spyder" 1;
+    "~*Web-sniffer" 1;
+    "~*WebAuto" 1;
+    "~*WebBandit" 1;
+    "~*WebCapture" 1;
+    "~*WebClient\/" 1;
+    "~*WebCollage" 1;
+    "~*WebCookies" 1;
+    "~*WebCopier" 1;
+    "~*WebCorp" 1;
     "~*WebDataStats" 1;
-    "~*WellKnownBot" 1;
+    "~*WebDoc" 1;
+    "~*WebEnhancer" 1;
+    "~*WebFetch" 1;
+    "~*WebFuck" 1;
+    "~*WebGazer" 1;
+    "~*WebGo IS" 1;
+    "~*WebGo\ IS" 1;
+    "~*WebImageCollector" 1;
+    "~*WebImages" 1;
+    "~*WebIndex" 1;
+    "~*WebLeacher" 1;
+    "~*WebPix" 1;
+    "~*WebReaper" 1;
+    "~*WebSauger" 1;
+    "~*WebSniffer" 1;
+    "~*WebStripper" 1;
+    "~*WebSucker" 1;
+    "~*WebThumbnail" 1;
+    "~*WebWhacker" 1;
+    "~*WebZIP" 1;
+    "~*Web\ Auto" 1;
+    "~*Web\ Collage" 1;
+    "~*Web\ Enhancer" 1;
+    "~*Web\ Fetch" 1;
+    "~*Web\ Fuck" 1;
+    "~*Web\ Pix" 1;
+    "~*Web\ Sauger" 1;
+    "~*Web\ Sucker" 1;
+    "~*Webalta" 1;
+    "~*Webauskunft" 1;
+    "~*WebmasterWorldForumBot" 1;
+    "~*Webshag" 1;
+    "~*Webshot" 1;
+    "~*Website Quester" 1;
+    "~*WebsiteExtractor" 1;
+    "~*WebsiteQuester" 1;
+    "~*Website\ Quester" 1;
+    "~*Websnapr" 1;
+    "~*Webster" 1;
+    "~*Webthumb\/" 1;
+    "~*Wfuzz\/" 1;
+    "~*Whack" 1;
+    "~*Whacker" 1;
+    "~*WhatCMS" 1;
+    "~*WhatWeb" 1;
     "~*WhatsApp" 1;
+    "~*WhatsMyIP" 1;
+    "~*Whatweb" 1;
+    "~*WhereGoes\?" 1;
+    "~*Whibse" 1;
+    "~*WhoAPI\/" 1;
+    "~*WhoRunsCoinHive" 1;
+    "~*Whynder Magnet" 1;
+    "~*Widow" 1;
+    "~*WinHTTP\/" 1;
+    "~*WinHTTrack" 1;
+    "~*WinHttp-Autoproxy-Service" 1;
+    "~*WinPodder" 1;
+    "~*Windows-RSS-Platform" 1;
+    "~*WiseGuys\ Robot" 1;
+    "~*Woko" 1;
+    "~*Wolfram HTTPClient" 1;
+    "~*Wonderbot" 1;
+    "~*Woobot" 1;
     "~*WordPress\/" 1;
-    "~*WordupInfoSearch" 1;
+    "~*Word\/" 1;
+    "~*WordupinfoSearch" 1;
+    "~*Wotbox" 1;
+    "~*Wprecon" 1;
+    "~*Wtrace" 1;
+    "~*XING-contenttabreceiver" 1;
+    "~*Xaldon\ WebSpider" 1;
+    "~*Xaldon_WebSpider" 1;
+    "~*XaxisSemanticsClassifier" 1;
+    "~*XenForo\/" 1;
+    "~*Xenu" 1;
     "~*Xenu Link Sleuth" 1;
-    "~*Y!J" 1;
-    "~*YaK\/" 1;
+    "~*Y!J-[A-Z][A-Z][A-Z]" 1;
+    "~*YP\.PL" 1;
+    "~*Yaanb" 1;
     "~*Yahoo Link Preview" 1;
-    "~*YandexRenderResourcesBot\/" 1;
-    "~*Yellowbrandprotectionbot" 1;
-    "~*Yeti" 1;
-    "~*YisouSpider" 1;
-    "~*YouBot" 1;
+    "~*YahooCacheSystem" 1;
+    "~*YahooMailProxy" 1;
+    "~*YahooYSMcm" 1;
+    "~*YandeG" 1;
+    "~*Yandex(?!Search)" 1;
+    "~*Yo-yo" 1;
+    "~*YoYs\.net" 1;
+    "~*Yoleo Consumer" 1;
+    "~*YottaaMonitor" 1;
+    "~*YoudaoBot" 1;
+    "~*Your-Website-Sucks" 1;
     "~*Zabbix" 1;
+    "~*Zade" 1;
+    "~*Zapier" 1;
+    "~*Zauba" 1;
+    "~*Zemanta Aggregator" 1;
+    "~*Zend\\Http\\Client" 1;
+    "~*Zend_Http_Client" 1;
+    "~*Zermelo" 1;
+    "~*Zeus" 1;
+    "~*Zeus " 1;
+    "~*Zitebot" 1;
+    "~*ZmEu" 1;
+    "~*ZnHTTP" 1;
+    "~*ZnajdzFoto" 1;
+    "~*Zombie\.js" 1;
     "~*ZoomBot" 1;
+    "~*Zoom\.Mac" 1;
     "~*ZoominfoBot" 1;
+    "~*ZoteroTranslationServer" 1;
     "~*ZumBot" 1;
-    "~*ZuperlistBot\/" 1;
-    "~*[Cc]urebot" 1;
-    "~*[cC]laude[bB]ot" 1;
-    "~*[pP]ingdom" 1;
-    "~*[wW]get" 1;
-    "~*^Apache-HttpClient" 1;
-    "~*^BW\/" 1;
-    "~*^LCC " 1;
-    "~*^PHP-Curl-Class" 1;
-    "~*^curl" 1;
-    "~*acapbot" 1;
-    "~*acoonbot" 1;
-    "~*adbeat_bot" 1;
+    "~*ZyBorg" 1;
+    "~*[a-z0-9\-_]*(bot|crawl|archiver|transcoder|spider|uptime|validator|fetcher|cron|checker|reader|extractor|monitoring|analyzer|scraper)" 1;
+    "~*^Aether" 1;
+    "~*^Amazon CloudFront" 1;
+    "~*^Amazon Simple Notification Service Agent$" 1;
+    "~*^Amazon-Route53-Health-Check-Service" 1;
+    "~*^COMODO DCV" 1;
+    "~*^Calypso v\/" 1;
+    "~*^Corax" 1;
+    "~*^DHSH" 1;
+    "~*^DangDang" 1;
+    "~*^DavClnt" 1;
+    "~*^Expanse" 1;
+    "~*^FDM " 1;
+    "~*^Goose\/" 1;
+    "~*^Grabber" 1;
+    "~*^Gradle\/" 1;
+    "~*^HTTPClient\/" 1;
+    "~*^HTTPing" 1;
+    "~*^Java\/" 1;
+    "~*^Jeode\/" 1;
+    "~*^Jetty\/" 1;
+    "~*^Mail\/" 1;
+    "~*^Mget" 1;
+    "~*^Microsoft URL Control" 1;
+    "~*^Mikrotik\/" 1;
+    "~*^NG\/[0-9\.]" 1;
+    "~*^NING\/" 1;
+    "~*^Netlab360" 1;
+    "~*^Nuclei" 1;
+    "~*^PHP-AYMAPI\/" 1;
+    "~*^PHP\/" 1;
+    "~*^RMA\/" 1;
+    "~*^Ruby|Ruby\/[0-9]" 1;
+    "~*^Swurl " 1;
+    "~*^TLS tester " 1;
+    "~*^VSE\/[0-9]" 1;
+    "~*^WordPress\.com" 1;
+    "~*^XRL\/[0-9]" 1;
+    "~*^ZmEu" 1;
+    "~*^b0t$" 1;
+    "~*^bluefish " 1;
+    "~*^docker\/[0-9]" 1;
+    "~*^git\/" 1;
+    "~*^npm\/" 1;
+    "~*^pip\/" 1;
+    "~*^pnpm\/" 1;
+    "~*^twine\/" 1;
+    "~*^ureq" 1;
+    "~*a3logics\.in" 1;
+    "~*a\.pr-cy\.ru" 1;
+    "~*aboutthedomain" 1;
+    "~*acebookexternalhit\/" 1;
+    "~*acoon" 1;
+    "~*acrylicapps\.com\/pulp" 1;
+    "~*adbeat" 1;
+    "~*adressendeutschland" 1;
+    "~*adreview\/" 1;
     "~*adscanner" 1;
-    "~*aiHitBot" 1;
-    "~*aiohttp" 1;
-    "~*antibot" 1;
-    "~*arabot" 1;
-    "~*archive\.org_bot" 1;
-    "~*awesomecrawler" 1;
-    "~*axios" 1;
-    "~*backlinkcrawler" 1;
-    "~*betaBot" 1;
-    "~*bidswitchbot" 1;
-    "~*bingbot" 1;
+    "~*adstxt-worker" 1;
+    "~*adstxt\.com" 1;
+    "~*affilimate-puppeteer" 1;
+    "~*agentslug" 1;
+    "~*aihit" 1;
+    "~*aiohttp\/" 1;
+    "~*akka-http\/" 1;
+    "~*akula\/" 1;
+    "~*alertra" 1;
+    "~*alexa site audit" 1;
+    "~*allloadin" 1;
+    "~*alyze\.info" 1;
+    "~*amagit" 1;
+    "~*annotate_google" 1;
+    "~*anthropic-ai" 1;
+    "~*apimon\.de" 1;
+    "~*arachnode" 1;
+    "~*archive.org_bot" 1;
+    "~*aria2" 1;
+    "~*arquivo-web-crawler" 1;
+    "~*asafaweb" 1;
+    "~*asynchttp" 1;
+    "~*attohttpc" 1;
+    "~*autocite" 1;
+    "~*autoemailspider" 1;
+    "~*awin\.com" 1;
+    "~*axios\/" 1;
+    "~*backlink-check" 1;
+    "~*baidu\.com" 1;
+    "~*basicstate" 1;
+    "~*baypup\/" 1;
+    "~*biNu image cacher" 1;
+    "~*biglotron" 1;
     "~*binlar" 1;
-    "~*bitlybot" 1;
-    "~*blogmuraBot" 1;
-    "~*bnf\.fr_bot" 1;
-    "~*bot-pge\.chlooe\.com" 1;
-    "~*botify" 1;
-    "~*brainobot" 1;
-    "~*buzzbot" 1;
-    "~*cXensebot" 1;
-    "~*careerbot" 1;
-    "~*centurybot" 1;
+    "~*biz_Directory" 1;
+    "~*boitho\.com-dc" 1;
+    "~*caam dot crwlr at gmail dot com" 1;
+    "~*catexplorador" 1;
+    "~*censys" 1;
+    "~*cf-facebook" 1;
+    "~*cg-eye" 1;
     "~*changedetection" 1;
-    "~*check_http" 1;
-    "~*citeseerxbot" 1;
+    "~*chatterino-api-cache" 1;
+    "~*checkprivacy" 1;
+    "~*chkme\.com" 1;
+    "~*clark-crawler" 1;
+    "~*clips\.ua\.ac\.be" 1;
+    "~*cmcm\.com" 1;
     "~*coccoc" 1;
-    "~*collection@infegy\.com" 1;
-    "~*content crawler spider" 1;
-    "~*contxbot" 1;
+    "~*coccocbot" 1;
+    "~*cognitiveseo" 1;
+    "~*cohere-ai" 1;
+    "~*colly -" 1;
+    "~*commonscan" 1;
+    "~*contactbigdatafr" 1;
+    "~*contentkingapp" 1;
     "~*convera" 1;
+    "~*copyright sheriff" 1;
+    "~*cortex\/" 1;
     "~*crawler4j" 1;
-    "~*datagnionbot" 1;
-    "~*dcrawl" 1;
-    "~*deadlinkchecker" 1;
-    "~*deepnoc" 1;
-    "~*developers\.google\.com\/\+\/web\/snippet" 1;
-    "~*discobot" 1;
-    "~*domaincrawler" 1;
-    "~*dotbot" 1;
+    "~*curb" 1;
+    "~*curl" 1;
+    "~*cuwhois\/" 1;
+    "~*cybo\.com" 1;
+    "~*dBpoweramp" 1;
+    "~*dataforseobot" 1;
+    "~*dataprovider" 1;
+    "~*ddline" 1;
+    "~*deeris" 1;
+    "~*delve\.ai" 1;
+    "~*demandbase-bot" 1;
+    "~*developers\.google\.com\/\+\/web\/snippet\/" 1;
+    "~*dlvr" 1;
+    "~*docoloc" 1;
+    "~*dotMailer content retrieval" 1;
+    "~*dotSemantic" 1;
+    "~*downforeveryoneorjustme" 1;
+    "~*downnotifier" 1;
     "~*drupact" 1;
-    "~*e\.ventures Investment Crawler" 1;
+    "~*dubaiindex" 1;
+    "~*eCairn-Grabber" 1;
+    "~*eCatch" 1;
+    "~*eContext\/" 1;
     "~*ec2linkfinder" 1;
-    "~*edisterbot" 1;
-    "~*electricmonk" 1;
-    "~*elisabot" 1;
-    "~*epicbot" 1;
-    "~*eright" 1;
+    "~*elefent" 1;
+    "~*endo\/" 1;
     "~*europarchive\.org" 1;
-    "~*ev-crawler\/" 1;
     "~*evc-batch" 1;
-    "~*exabot" 1;
+    "~*everyfeed-spider" 1;
+    "~*exif" 1;
     "~*ezooms" 1;
-    "~*facebookcatalog\/" 1;
+    "~*facebookcatalog" 1;
     "~*facebookexternalhit" 1;
-    "~*fedoraplanet" 1;
-    "~*feedbot" 1;
-    "~*filterdb\.iss\.net\/crawler" 1;
+    "~*facebookexternalua" 1;
+    "~*facebookplatform" 1;
+    "~*facebookscraper" 1;
+    "~*fairshare" 1;
+    "~*fasthttp" 1;
+    "~*faviconarchive" 1;
+    "~*faviconkit" 1;
+    "~*feeder" 1;
+    "~*feeltiptop" 1;
     "~*findlink" 1;
     "~*findthatfile" 1;
-    "~*findxbot" 1;
     "~*fluffy" 1;
-    "~*fr-crawler" 1;
-    "~*fuelbot" 1;
+    "~*flynxapp" 1;
+    "~*forensiq" 1;
+    "~*fragFINN\.de" 1;
+    "~*free thumbnails" 1;
+    "~*frontman" 1;
     "~*g00g1e\.net" 1;
-    "~*g2reader-bot" 1;
-    "~*gnam gnam spider" 1;
+    "~*gSOAP\/" 1;
+    "~*ganarvisitas" 1;
+    "~*gdnplus\.com" 1;
+    "~*geek-tools" 1;
+    "~*getprismatic" 1;
+    "~*getroot" 1;
+    "~*github-camo" 1;
+    "~*github\.com" 1;
+    "~*go-mtasts\/" 1;
+    "~*gobuster" 1;
+    "~*gobyus" 1;
+    "~*gofetch" 1;
+    "~*gooblog" 1;
     "~*google-xrawler" 1;
-    "~*grub\.org" 1;
-    "~*gslfbot" 1;
+    "~*gopher" 1;
+    "~*gosquared-thumbnailer" 1;
+    "~*grabify" 1;
+    "~*grokkit" 1;
+    "~*grouphigh" 1;
+    "~*grub-client" 1;
+    "~*gvfs\/" 1;
+    "~*hackney\/" 1;
+    "~*help@dataminr\.com" 1;
     "~*heritrix" 1;
+    "~*historious" 1;
+    "~*hkedcity" 1;
+    "~*hledejLevne\.cz" 1;
+    "~*hosterstats" 1;
+    "~*ht:\/\/check" 1;
+    "~*htdig" 1;
+    "~*htmlyse" 1;
+    "~*http-get" 1;
+    "~*http-kit" 1;
+    "~*http-request\/" 1;
+    "~*httpRequest" 1;
+    "~*http\.rb\/" 1;
     "~*http_get" 1;
-    "~*https:\/\/developers\.cloudflare\.com\/security-center\/" 1;
+    "~*http_request2" 1;
+    "~*http_requester" 1;
+    "~*httphr" 1;
+    "~*httpscheck" 1;
+    "~*httpssites_power" 1;
     "~*httpunit" 1;
-    "~*httpx" 1;
-    "~*hypestat" 1;
-    "~*hyscore\.io" 1;
-    "~*ia_archiver" 1;
+    "~*httrack" 1;
+    "~*huaweisymantec" 1;
+    "~*i2kconnect\/" 1;
+    "~*iGooglePortal" 1;
+    "~*iThemes Sync\/" 1;
+    "~*iZSearch" 1;
     "~*ichiro" 1;
-    "~*imrbot" 1;
-    "~*infoobot" 1;
-    "~*inoreader" 1;
+    "~*igdeSpyder" 1;
+    "~*imagineeasy" 1;
+    "~*imgsizer" 1;
+    "~*inbound\.li parser" 1;
+    "~*infegy" 1;
+    "~*infohelfer" 1;
+    "~*inpwrd\.com" 1;
+    "~*instabid" 1;
     "~*integromedb" 1;
-    "~*intelium_bot" 1;
-    "~*ip-web-crawler\.com" 1;
+    "~*internetVista monitor" 1;
+    "~*internetVista\ monitor" 1;
+    "~*internet_archive" 1;
+    "~*internetwache" 1;
+    "~*intraVnews" 1;
+    "~*iplabel" 1;
     "~*ips-agent" 1;
+    "~*iqdb\/" 1;
+    "~*isUp\.li" 1;
+    "~*isitup\.org" 1;
     "~*iskanie" 1;
-    "~*it2media-domain-crawler" 1;
-    "~*jpg-newsbot" 1;
-    "~*jyxobot" 1;
-    "~*lb-spider" 1;
-    "~*libwww-perl" 1;
-    "~*linkapediabot" 1;
+    "~*iubenda-radar" 1;
+    "~*janforman" 1;
+    "~*javelin\.io" 1;
+    "~*jobo" 1;
+    "~*khttp\/" 1;
+    "~*knows\.is" 1;
+    "~*kouio" 1;
+    "~*kube-probe" 1;
+    "~*kubectl" 1;
+    "~*kulturarw3" 1;
+    "~*leakix\.net" 1;
+    "~*letsencrypt" 1;
+    "~*libwww" 1;
+    "~*limber\.io" 1;
+    "~*link-check" 1;
+    "~*linkCheck" 1;
+    "~*link_thumbnailer" 1;
     "~*linkdex" 1;
-    "~*lipperhey" 1;
-    "~*lkxscan" 1;
-    "~*lssbot" 1;
-    "~*lssrocketcrawler" 1;
+    "~*linkdexbot" 1;
+    "~*linkfluence" 1;
+    "~*linkpeek" 1;
+    "~*livedoor ScreenShot" 1;
+    "~*localsearch-web" 1;
+    "~*longurl-r-package" 1;
+    "~*looid\.com" 1;
+    "~*looksystems\.net" 1;
+    "~*lscache_runner" 1;
     "~*ltx71" 1;
+    "~*lua-resty-http" 1;
+    "~*lwp-request" 1;
+    "~*lwp-trivial" 1;
+    "~*lycos" 1;
+    "~*mShots" 1;
+    "~*mabontland" 1;
     "~*magpie-crawler" 1;
-    "~*mappydata" 1;
-    "~*memorybot" 1;
-    "~*meta-externalagent\/" 1;
-    "~*meta-externalfetcher\/" 1;
-    "~*mindUpBot" 1;
-    "~*minicrawler" 1;
-    "~*mlbot" 1;
-    "~*moatbot" 1;
-    "~*msnbot" 1;
-    "~*msrbot" 1;
-    "~*nerdybot" 1;
-    "~*netEstate NE Crawler" 1;
-    "~*netresearchserver" 1;
-    "~*newsharecounts" 1;
+    "~*makecontact\/" 1;
+    "~*marketinggrader" 1;
+    "~*masscan\/" 1;
+    "~*mattermost" 1;
+    "~*meanpathbot" 1;
+    "~*mediawords" 1;
+    "~*mio_httpc" 1;
+    "~*mixdata dot com" 1;
+    "~*mixed-content-scan" 1;
+    "~*mixnode" 1;
+    "~*mogimogi" 1;
+    "~*monitis" 1;
+    "~*montastic" 1;
+    "~*mowser" 1;
+    "~*muhstik-scan" 1;
+    "~*myseosnapshot" 1;
+    "~*nWormFeedFinder" 1;
+    "~*nagios" 1;
+    "~*nationalarchives" 1;
+    "~*nbertaupete95" 1;
+    "~*netEstate\ NE\ Crawler" 1;
+    "~*netresearch" 1;
+    "~*nettle" 1;
+    "~*newsme" 1;
     "~*newspaper\/" 1;
-    "~*niki-bot" 1;
+    "~*nghttp2" 1;
+    "~*nineconnections" 1;
     "~*node-fetch" 1;
-    "~*officestorebot" 1;
+    "~*node-superagent" 1;
+    "~*node-urllib" 1;
+    "~*node\.io" 1;
+    "~*nominet\.org\.uk" 1;
+    "~*nominet\.uk" 1;
+    "~*notifyninja" 1;
+    "~*nuhk" 1;
+    "~*nutch" 1;
+    "~*nyawc\/" 1;
+    "~*oBot" 1;
+    "~*oegp" 1;
     "~*okhttp" 1;
     "~*omgili" 1;
-    "~*online-webceo-bot" 1;
-    "~*openindexspider" 1;
-    "~*outbrain" 1;
+    "~*openai" 1;
+    "~*orion-semantics" 1;
+    "~*ow\.ly" 1;
+    "~*ownCloud News" 1;
+    "~*page scorer" 1;
     "~*page2rss" 1;
+    "~*page\ scorer" 1;
+    "~*page_verifier" 1;
     "~*panscient" 1;
-    "~*phpcrawl" 1;
-    "~*pinterest\.com\/bot" 1;
+    "~*parsijoo" 1;
+    "~*pcBrowser" 1;
+    "~*peerindex" 1;
+    "~*php-requests" 1;
+    "~*phpservermon" 1;
+    "~*ping\.blo\.gs" 1;
+    "~*pinterest\.com" 1;
+    "~*plumanalytics" 1;
+    "~*polaris\ version" 1;
+    "~*postano" 1;
+    "~*postfix-mta-sts-resolver" 1;
+    "~*postplanner\.com" 1;
     "~*postrank" 1;
+    "~*probe-image-size" 1;
+    "~*probely\.com" 1;
+    "~*probethenet" 1;
+    "~*prospectb2b" 1;
     "~*proximic" 1;
-    "~*psbot" 1;
-    "~*purebot" 1;
-    "~*python-opengraph" 1;
+    "~*pshtt, https scanning" 1;
+    "~*pulsetic\.com" 1;
+    "~*python-httpx" 1;
     "~*python-requests" 1;
-    "~*redditbot" 1;
-    "~*rogerbot" 1;
-    "~*rssbot\/" 1;
-    "~*scribdbot" 1;
-    "~*search\.marginalia\.nu" 1;
-    "~*seekbot" 1;
-    "~*seewithkids" 1;
-    "~*semanticbot" 1;
-    "~*sempi\.tech" 1;
+    "~*queuedriver" 1;
+    "~*quic-go-HTTP\/" 1;
+    "~*redback\/" 1;
+    "~*request\.js" 1;
+    "~*reqwest\/" 1;
+    "~*ripz" 1;
+    "~*safe-agent-scanner" 1;
+    "~*sc-downloader" 1;
+    "~*scalaj-http" 1;
+    "~*scan\.lol" 1;
+    "~*scooter" 1;
+    "~*search\.thunderstone" 1;
+    "~*searchenginepromotionhelp" 1;
+    "~*semanticdiscovery" 1;
+    "~*semanticjuice" 1;
+    "~*sentry\/" 1;
+    "~*seo-nastroj\.cz" 1;
+    "~*seo4ajax" 1;
+    "~*seobility" 1;
+    "~*seocompany" 1;
     "~*seoscanners" 1;
-    "~*seostar\.co" 1;
-    "~*serpstatbot\/" 1;
-    "~*sitebot" 1;
-    "~*siteexplorer\.info" 1;
-    "~*smtbot" 1;
-    "~*spbot" 1;
+    "~*seositecheckup" 1;
+    "~*seostar" 1;
+    "~*serpstatbot" 1;
+    "~*servernfo" 1;
+    "~*sexsearcher" 1;
+    "~*shortURL lengthener" 1;
+    "~*shrinktheweb" 1;
+    "~*siteripz" 1;
+    "~*sitexy\.com" 1;
+    "~*sli-systems\.com" 1;
+    "~*slider\.com" 1;
+    "~*slurp" 1;
+    "~*sniptracker" 1;
+    "~*sogou web" 1;
+    "~*sogouspider" 1;
+    "~*sovereign\.ai" 1;
+    "~*sp_auditbot" 1;
+    "~*spaziodati" 1;
     "~*speedy" 1;
-    "~*startmebot\/" 1;
+    "~*spray-can" 1;
+    "~*spyfu" 1;
+    "~*spyonweb" 1;
+    "~*sqlmap" 1;
+    "~*ssl-tools" 1;
+    "~*suchen" 1;
     "~*summify" 1;
-    "~*t3versionsBot" 1;
-    "~*tagoobot" 1;
-    "~*theoldreader\.com" 1;
-    "~*tigerbot" 1;
-    "~*toplistbot" 1;
+    "~*swcd " 1;
+    "~*sysscan" 1;
+    "~*tAkeOut" 1;
+    "~*tchelebi\.io" 1;
+    "~*techiaith\.cymru" 1;
+    "~*teoma" 1;
+    "~*terrainformatica" 1;
+    "~*testuri" 1;
+    "~*theinternetrules" 1;
+    "~*timewe\.net" 1;
+    "~*topster" 1;
+    "~*touche\.com" 1;
     "~*tracemyfile" 1;
-    "~*trendictionbot" 1;
-    "~*trovitBot" 1;
+    "~*trendspottr" 1;
+    "~*truwoGPS" 1;
     "~*tweetedtimes" 1;
-    "~*twengabot" 1;
-    "~*um-LN" 1;
-    "~*urlappendbot" 1;
-    "~*vebidoobot" 1;
-    "~*vercel-screenshot" 1;
-    "~*virustotal" 1;
+    "~*twibble" 1;
+    "~*ubermetrics-technologies" 1;
+    "~*uclassify" 1;
+    "~*ultimate_sitemap_parser" 1;
+    "~*unchaos" 1;
+    "~*unirest-java" 1;
+    "~*unshortenit" 1;
+    "~*updated" 1;
+    "~*updown\.io daemon" 1;
+    "~*urlresolver" 1;
+    "~*vBSEO" 1;
+    "~*via ggpht\.com GoogleImageProxy" 1;
+    "~*visionutils" 1;
     "~*vkShare" 1;
-    "~*voilabot" 1;
-    "~*vuhuvBot" 1;
-    "~*wbsearchbot" 1;
-    "~*web-archive-net\.com\.bot" 1;
-    "~*webcompanycrawler" 1;
+    "~*voltron" 1;
+    "~*voyager\/" 1;
+    "~*w3af\.org" 1;
+    "~*wangling" 1;
+    "~*web-capture\.net" 1;
+    "~*webcollage" 1;
+    "~*webgains-bot" 1;
+    "~*webkit2png" 1;
+    "~*webmastercoffee" 1;
+    "~*webmeup-crawler" 1;
     "~*webmon " 1;
-    "~*wocbot" 1;
-    "~*woobot" 1;
-    "~*woorankreview\/" 1;
-    "~*woriobot" 1;
+    "~*webprosbot" 1;
+    "~*webscreenie" 1;
+    "~*websitepulse agent" 1;
+    "~*webtech\/" 1;
+    "~*wf84" 1;
+    "~*wget" 1;
+    "~*wkhtmlto" 1;
+    "~*wmtips" 1;
+    "~*woorankreview" 1;
+    "~*worldping-api" 1;
     "~*wotbox" 1;
-    "~*www\.uptime\.com" 1;
+    "~*wpif" 1;
+    "~*wprecon\.com survey" 1;
+    "~*wscheck" 1;
+    "~*www\.monitor\.us" 1;
     "~*x09Mozilla" 1;
     "~*x22Mozilla" 1;
-    "~*xovibot" 1;
-    "~*yacybot" 1;
-    "~*yandex\.com\/bots" 1;
+    "~*xpymep([0-9]?)\.exe" 1;
+    "~*yacy" 1;
     "~*yanga" 1;
-    "~*yoozBot" 1;
-    "~*zenback bot" 1;
+    "~*yeti" 1;
+    "~*yomins\.com" 1;
+    "~*yoogliFetchAgent" 1;
+    "~*yourls\.org" 1;
     "~*zgrab" 1;
     default 0;
 }
diff --git a/waf_patterns/traefik/bots.toml b/waf_patterns/traefik/bots.toml
index 7d6be6f..82d6a23 100644
--- a/waf_patterns/traefik/bots.toml
+++ b/waf_patterns/traefik/bots.toml
@@ -2,594 +2,1780 @@
 [http.middlewares.bad_bot_block]
   [http.middlewares.bad_bot_block.plugin.badbot]
     userAgent = [
-      "(^| )PTST\/",
-      "(^| )sentry\/",
-      "(sistrix|SISTRIX) [cC]rawler",
-      "007ac9 Crawler",
-      "2ip bot",
+      " YLT",
+      "008\/",
+      "13TABS",
+      "192\.comAgent",
+      "2GDPR\/",
       "2ip\.ru",
       "360Spider",
-      "<li>Mozilla/5.0 (compatible; Ask Jeeves/Teoma; +http://about.ask.com/en/docs/about/webmasters.shtml)</li>",
-      "A Patent Crawler",
+      "404checker",
+      "404enemy",
+      "7Siters",
+      "80legs",
       "A6-Indexer",
       "ADmantX",
-      "AHC\/",
-      "AISearchBot",
+      "AIBOT",
+      "ALittle\ Client",
       "APIs-Google",
+      "ASPSeek",
+      "AWS Security Scanner",
+      "Abonti",
       "Aboundex",
-      "AcademicBotRTU",
-      "AddSearchBot",
+      "Aboundexbot",
+      "Accoona-AI-Agent",
+      "Acunetix",
+      "AdAuth\/",
       "AddThis",
-      "Adidxbot",
-      "AdsBot-Google([^-]|$)",
-      "AdsBot-Google-Mobile",
-      "AdsTxtCrawler",
-      "AdvBot",
-      "Ahrefs(Bot|SiteAudit)",
-      "AlexandriaOrgBot",
+      "AdminLabs",
+      "AdsTxtCrawlerTP",
+      "Adstxtaggregator",
+      "Adyen HttpClient",
+      "AfD-Verbotsverfahren",
+      "AffiliateLabz\/",
+      "AhrefsBot",
+      "AiHitBot",
+      "Aipbot",
+      "Airmail",
+      "Alexibot",
+      "Alibaba\.Security\.Heimdall",
+      "AllSubmitter",
+      "Alligator",
       "AlphaBot",
-      "Amazon CloudFront",
-      "Amazonbot",
-      "AndersPinkBot",
-      "AnyEvent",
-      "Apercite",
+      "Anarchie",
+      "Anarchy",
+      "Anarchy99",
+      "AndroidDownloadManager",
+      "Anemone",
+      "AngleSharp",
+      "Ankit",
+      "Ant\.com",
+      "Anthill",
+      "Anturis Agent",
+      "AnyEvent-HTTP\/",
+      "Apache Ant\/",
+      "Apache Droid",
+      "Apache OpenOffice",
+      "Apache-HttpAsyncClient",
+      "Apache-HttpClient",
+      "ApacheBench",
+      "Apexoo",
+      "AportWorm\/",
+      "AppBeat\/",
       "AppEngine-Google",
-      "AppInsights",
-      "Applebot",
-      "ArchiveBot",
-      "AspiegelBot",
-      "Atom Feed Robot",
-      "Audisto Crawler",
+      "AppleSyndication",
+      "Aprc\/[0-9]",
+      "Arachmo",
+      "Arachnophilia",
+      "Arukereso",
+      "Asana\/",
+      "Ask Jeeves",
+      "AskQuickly",
+      "Aspiegel",
+      "Asterias",
+      "Astute",
+      "Atomseobot",
+      "Attach",
+      "AutomaticWPTester",
+      "Autonomy",
       "AwarioBot",
       "AwarioRssBot",
       "AwarioSmartBot",
-      "B2B Bot",
+      "B-l-i-t-z-B-O-T",
+      "BBBike",
+      "BCKLINKS",
       "BDCbot",
-      "BIGLOTRON",
-      "BLEXBot\/",
-      "BLP_bbot",
-      "BTWebClient",
+      "BDFetch",
+      "BKCTwitterUnshortener\/",
+      "BLEXBot",
+      "BPImageWalker",
       "BUbiNG",
-      "Baidu-YunGuanCe",
-      "Baiduspider",
-      "Bark[rR]owler",
+      "BackDoorBot",
+      "BackStreet",
+      "BackWeb",
+      "Backlink-Ceck",
+      "BacklinkCrawler",
+      "BacklinkHttpStatus",
+      "BacklinksExtendedBot",
+      "BackupLand",
+      "Bad-Neighborhood",
+      "Badass",
+      "Bandit",
+      "Barkrowler",
+      "BatchFTP",
+      "Battleztar Bazinga",
+      "Battleztar\ Bazinga",
       "BazQux",
-      "BehloolBot",
-      "Better Uptime Bot",
-      "BingPreview\/",
-      "BitBot",
-      "BitSightBot\/",
+      "BegunAdvertising",
+      "BetaBot",
+      "Bewica-security-scan",
+      "Bidtellect",
+      "BigBozz",
+      "Bigfoot",
+      "BingLocalSearch",
+      "BingPreview",
+      "Bitacle",
+      "Bitrix link preview",
+      "Black Hole",
+      "BlackWidow",
+      "Black\ Hole",
       "Blackboard",
-      "BlogTraffic\/\d\.\d+ Feed-Fetcher",
-      "BomboraBot",
-      "Bot\.AraTurka\.com",
-      "BoxcarBot",
-      "BrandONbot",
-      "BrandVerity",
-      "BrightEdge Crawler",
-      "BublupBot",
+      "Blackboard Safeassign",
+      "BlockNote\.Net",
+      "BlogBridge",
+      "BlogPulseLive",
+      "BlogSearch",
+      "Bloglines",
+      "Bloglovin",
+      "Blogtrottr",
+      "Blow",
+      "BlowFish",
+      "Boardreader",
+      "Bolt",
+      "Boost\.Beast",
+      "BotALot",
+      "Braintree-Webhooks",
+      "Branch Metrics API",
+      "Branch-Passthrough",
+      "Brandprotect",
+      "Brandwatch",
+      "Brodie\/",
+      "Browsershots",
+      "Buck",
       "Buck\/",
+      "Buddy",
+      "BuiltBotTough",
+      "BuiltWith",
+      "Bullseye",
+      "BunnySlippers",
+      "Burf Search",
+      "Butterfly\/",
+      "BuzzSumo",
       "Bytespider",
+      "CAAM\/[0-9]",
+      "CATExplorador",
       "CC Metadata Scaper",
       "CCBot",
-      "CISPA Webcrawler",
-      "Caliperbot",
-      "CapsuleChecker",
+      "CERT\.at-Statistics-Survey",
+      "CISPA Vulnerability Notification",
+      "CISPA Web Analyser",
+      "CJNetworkQuality",
+      "CODE87",
+      "CSHttp",
+      "CSSCheck",
+      "CakePHP",
+      "Calculon",
+      "Canary%20Mail",
+      "CaretNail",
+      "CazoodleBot",
+      "Cegbfeieh",
+      "CensysInspect",
+      "Cerberian Drtrs",
+      "ChangesMeter",
+      "Charlotte",
       "ChatGPT-User",
-      "CheckMarkNetwork\/",
-      "Chrome-Lighthouse",
-      "Cincraw",
-      "Clickagy",
-      "Cliqzbot\/",
+      "CheTeam",
+      "CheckHost",
+      "CheeseBot",
+      "CherryPicker",
+      "ChinaClaw",
+      "Chirp\/",
+      "Chlooe",
+      "Chromaxa",
+      "CirrusExplorer",
+      "Citoid",
+      "Claritybot",
+      "Clarsentia",
+      "ClaudeBot",
+      "Cliqzbot",
+      "Cloud mapping",
+      "CloudEndure",
       "CloudFlare-AlwaysOnline",
-      "CloudFlare-Prefetch",
+      "Cloud\ mapping",
       "Cloudflare-Healthchecks",
-      "Cloudflare-SSLDetector",
-      "Cloudflare-Traffic-Manager",
+      "Cloudinary",
       "Cocolyzebot",
-      "Companybook-Crawler",
-      "ContextAd Bot",
-      "CookieHubScan",
-      "Cookiebot",
-      "CrawlyProjectCrawler",
-      "CriteoBot",
+      "Cogentbot",
+      "ColdFusion",
+      "Collector",
+      "CommaFeed",
+      "Commons-HttpClient",
+      "Contextual Code Sites Explorer",
+      "CookieReports",
+      "Copier",
+      "CopyRightCheck",
+      "Copyscape",
+      "Cosmos",
+      "Cosmos4j\.feedback",
+      "Covario-IDS",
+      "Craftbot",
+      "Craw\/",
+      "Crawling\ at\ Home\ Project",
+      "CrazyWebCrawler",
+      "Crescent",
+      "Criteo",
+      "Crowsnest",
       "CrunchBot",
-      "CrystalSemanticsBot",
-      "Cutbot",
-      "CyberPatrol",
+      "Cula\/",
+      "Curious",
+      "Curious George",
+      "Custo",
+      "CyotekWebCopy",
+      "DAP\/NetHTTP",
+      "DBLBot",
+      "DIIbot",
+      "DMBrowser",
+      "DNSPod-reporting",
+      "DSearch",
+      "DTS Agent",
+      "DTS\ Agent",
       "DareBoost",
-      "DataForSeoBot",
+      "DataCha0s",
+      "DataXu",
+      "DatabaseDriverMysqli",
+      "DatadogSynthetics",
       "Datafeedwatch",
       "Datanyze",
-      "Dataprovider\.com",
-      "Daum\/",
-      "DeuSu\/",
-      "Diffbot\/",
-      "Digg Deeper",
-      "Digincore bot",
-      "Discordbot",
-      "Disqus",
+      "DataparkSearch",
+      "Daum(oa)?[ \/][0-9]",
+      "Demon",
+      "DeuSu",
+      "Deusu",
+      "Devil",
+      "Digg",
+      "Digincore",
+      "DigitalPebble",
+      "Dirbuster",
+      "Disco",
+      "Discobot",
+      "Discourse Forum Onebox",
+      "Discoverybot",
+      "Dispatch",
+      "Dispatch\/",
+      "Disqus\/",
+      "DittoSpyder",
+      "DnBCrawler-Analytics",
       "DnyzBot",
-      "Domain Re-Animator Bot",
+      "Dolphin http client",
+      "DomCopBot",
+      "DomainAppender",
+      "DomainCrawler",
+      "DomainLabz",
+      "DomainSigmaCrawler",
       "DomainStatsBot",
       "Domains Project\/",
-      "Dragonbot",
-      "Dubbotbot",
-      "DuckDuckBot",
-      "DuckDuckGo-Favicons-Bot",
-      "EZID",
+      "Domains\ Project",
+      "Donuts Content Explorer",
+      "Dotbot",
+      "Download Wonder",
+      "Download\ Wonder",
+      "DowntimeDetector",
+      "Dragonfly",
+      "Drip",
+      "Drupal \(\+http:\/\/drupal\.org\/\)",
+      "DuplexWeb-Google",
+      "DynatraceSynthetic",
+      "EARTHCOM",
+      "ECCP",
+      "ECCP/1.0",
+      "EMail Exractor",
+      "EMail Wolf",
+      "EMail\ Siphon",
+      "EMail\ Wolf",
+      "Easy-Thumb",
+      "EasyDL",
+      "Ebingbong",
+      "Ecxi",
+      "EirGrabber",
+      "ElectricMonk",
+      "EmailWolf",
+      "Embarcadero",
+      "Embed PHP Library",
       "Embedly",
-      "EveryoneSocialBot",
-      "Expanse",
-      "Experibot",
+      "EroCrawler",
+      "EventMachine HttpClient",
+      "Everwall Link Expander",
+      "Evidon",
+      "Evil",
+      "Evrinid",
+      "Exabot",
+      "ExactSearch",
+      "ExaleadCloudview",
+      "Excel\/",
+      "ExoRank",
+      "Exploratodo",
+      "Express WebPictures",
+      "Express\ WebPictures",
       "ExtLinksBot",
-      "Eyeotabot",
-      "FAST Enterprise Crawler",
-      "FAST-WebCrawler",
-      "Facebot",
-      "FeedValidator",
+      "Extractor",
+      "ExtractorPro",
+      "Extreme Picture Finder",
+      "Extreme\ Picture\ Finder",
+      "EyeNetIE",
+      "Ezooms",
+      "FHscan",
+      "FacebookBot",
+      "Faraday v",
+      "FavOrg",
+      "Faveeo",
+      "Favicon downloader",
+      "Feed Wrangler",
+      "FeedBooster",
+      "FeedBucket",
+      "FeedBunch\/",
+      "FeedBurner",
+      "FeedViewer\/",
+      "FeedZcollector",
+      "Feedable\/",
       "Feedbin",
-      "Feedfetcher-Google",
       "Feedly",
+      "FeedshowOnline",
+      "Feedshow\/",
       "Feedspot",
+      "Feedwind\/",
       "FemtosearchBot",
-      "Fetch\/",
-      "Fever",
-      "FindITAnswersbot",
-      "Flamingo_SearchEngine",
+      "Fetch API",
+      "Fetch\/[0-9]",
+      "Fever\/[0-9]",
+      "Fiery%20Feeds",
+      "Filestack",
+      "Fimap",
+      "Firefox/7.0",
+      "FlashGet",
+      "FlipboardBrowserProxy",
       "FlipboardProxy",
-      "FreeWebMonitoring SiteChecker",
+      "FlipboardRSS",
+      "Flock\/",
+      "Florienzh\/",
+      "Flunky",
+      "Foobot",
+      "ForusP",
+      "FoundSeoTool",
+      "Freeuploader",
       "FreshRSS",
-      "FreshpingBot",
-      "Friendica",
+      "FrontPage",
+      "Funnelback",
+      "Fuzz",
+      "Fuzz Faster U Fool",
+      "FyberSpider",
       "Fyrebot",
-      "G2 Web Services",
+      "G-i-g-a-b-o-t",
+      "GIS-LABS",
       "GPTBot",
-      "GarlikCrawler",
-      "GeedoBot",
+      "GRequests",
+      "GT::WWW",
+      "GTmetrix",
+      "GalaxyBot",
+      "GeedoProductSearch",
       "Genieo",
-      "Gigablast",
+      "GentleSource",
+      "GermCrawler",
+      "GetCode",
+      "GetLinkInfo",
+      "GetRight",
+      "GetURLInfo\/",
+      "GetWeb",
+      "Getintent",
+      "Geziyor",
+      "Ghost Inspector",
+      "GigablastOpenSource",
       "Gigabot",
-      "GingerCrawler",
-      "Gluten Free Crawler\/",
-      "GnowitNewsbot",
+      "GitHub-Hookshot",
+      "Go [\d\.]* package http",
+      "Go http package",
+      "Go!Zilla",
+      "Go-Ahead-Got-It",
       "Go-http-client",
-      "Google Favicon",
+      "GoSpotCheck",
+      "GoZilla",
+      "Gofeed",
+      "Goldfire Server",
+      "GomezAgent",
+      "Goodzer\/",
+      "Google AppsViewer",
+      "Google Desktop",
+      "Google Keyword Suggestion",
+      "Google Keyword Tool",
+      "Google PP Default",
+      "Google Page Speed Insights",
+      "Google Search Console",
       "Google Web Preview",
-      "Google-Adwords-Instant",
-      "Google-Certificates-Bridge",
+      "Google favicon",
+      "Google-Ads",
+      "Google-Adwords",
+      "Google-Apps-Script",
+      "Google-Calendar-Importer",
+      "Google-HTTP-Java-Client",
+      "Google-HotelAdsVerifier",
       "Google-InspectionTool",
-      "Google-PhysicalWeb",
+      "Google-Podcast",
+      "Google-Publisher-Plugin",
       "Google-Read-Aloud",
-      "Google-Safety",
+      "Google-SMTP-STS",
+      "Google-SearchByImage",
       "Google-Site-Verification",
       "Google-Structured-Data-Testing-Tool",
+      "Google-Transparency-Report",
+      "Google-Youtube-Links",
+      "Google-speakr",
+      "GoogleDocs",
+      "GoogleHC\/",
       "GoogleOther",
-      "Googlebot-Image",
-      "Googlebot-Mobile",
-      "Googlebot-News",
-      "Googlebot-Video",
-      "Googlebot\/",
-      "Gowikibot",
+      "GoogleProber",
+      "GoogleProducer",
+      "GoogleSites",
+      "Gookey",
+      "Gotit",
+      "GrabNet",
+      "Grabber",
+      "Grafula",
+      "Grammarly",
+      "GrapeFX",
       "GrapeshotCrawler",
-      "Grobbot",
-      "GroupHigh\/",
-      "GroupMeBot",
-      "Gwene",
+      "GreatNews",
+      "Gregarius",
+      "GridBot",
+      "GuzzleHttp",
+      "HAA(A)?RTLAND http client",
+      "HEADMasterSEO",
+      "HMView",
+      "HTMLparser",
+      "HTTP Banner Detection",
+      "HTTP-Header-Abfrage",
+      "HTTP-Tiny",
+      "HTTP::Lite",
+      "HTTPMon",
+      "HTTP_Compression_Test",
+      "HTTPie",
       "HTTrack",
+      "Haansoft",
+      "Hadi Agent",
+      "HaosouSpider",
+      "HappyApps-WebCheck",
+      "Hardenize",
+      "Harvest",
       "Hatena",
+      "Havij",
+      "HaxerMen",
       "HeadlessChrome",
+      "HeartRails_Capture",
+      "Heritrix",
+      "Hexometer",
+      "Hloader",
+      "Holmes",
+      "HonesoSearchEngine",
+      "HonoluluBot",
+      "HootSuite Image proxy",
+      "Hootsuite-WebFeed",
+      "HostTracker",
+      "HttpComponents",
       "HttpUrlConnection",
-      "HubSpot",
-      "IAS crawler",
-      "ICBot\/",
-      "ICC-Crawler",
-      "INETDEX-BOT",
+      "HubSpot ",
+      "HubSpot-Link-Resolver",
+      "Humanlinks",
+      "HybridBot",
+      "IDBTE4M",
+      "IDBot",
+      "IDG Twitter Links Resolver",
+      "IDwhois\/",
+      "IODC",
+      "IPS\/[0-9]",
+      "IPWorks HTTP\/S Component",
+      "IRLbot",
+      "IZaBEE",
+      "Iblog",
+      "Id-search",
+      "IdeelaborPlagiaat",
       "Iframely",
+      "IlTrovatore",
+      "IlseBot",
+      "Image Fetch",
+      "Image Sucker",
+      "ImageEngine\/",
+      "ImageVisu\/",
+      "Image\ Fetch",
+      "Image\ Sucker",
       "ImagesiftBot",
+      "Imagga",
+      "InAGist",
+      "InDesign%20CC",
+      "Inboxb0t",
       "IndeedBot",
-      "InterfaxScanBot",
+      "Indy Library",
+      "Indy\ Library",
+      "InetURL",
+      "InfoNaviRobot",
+      "InfoTekies",
+      "InfoWizards Reciprocal Link",
+      "Information\ Security\ Team\ InfraSec\ Scanner",
+      "InfraSec\ Scanner",
+      "Instapaper",
+      "Integrity",
+      "Intelliseek",
+      "InterGET",
+      "Internet Ninja",
       "InternetMeasurement",
-      "IonCrawl",
+      "InternetSeer",
+      "Internet\ Ninja",
+      "Iria",
+      "Irokez",
+      "Iskanie",
       "IstellaBot",
-      "James BOT",
-      "Jamie's Spider",
-      "Jetslide",
+      "JAHHO",
+      "JOC\ Web\ Spider",
+      "JS-Kit",
+      "JamesBOT",
+      "Jaunt\/",
+      "Java.*outbrain",
+      "Jbrofuzz",
+      "JennyBot",
+      "Jersey\/",
+      "JetCar",
       "Jetty",
-      "JobboerseBot",
-      "Jooblebot",
-      "Jugendschutzprogramm-Crawler",
-      "K7MLWCBot",
-      "KStandBot",
-      "Kemvibot",
-      "KeybaseBot",
-      "KomodiaBot",
-      "KosmioBot",
-      "Landau-Media-Spider",
-      "Laserlikebot",
-      "Leikibot",
-      "LightspeedSystemsCrawler",
-      "Linespider",
-      "Linguee Bot",
-      "LinkArchiver",
-      "LinkedInBot",
-      "LinkisBot",
-      "Livelap[bB]ot",
-      "Luminator-robots",
-      "MBCrawler",
+      "Jigsaw",
+      "JikeSpider",
+      "JobFeed discovery",
+      "Jobboerse",
+      "Jobg8 URL Monitor",
+      "Jobrapido",
+      "Jobsearch1\.5",
+      "JoinVision Generic",
+      "JolokiaPwn",
+      "Joomla",
+      "Jorgee",
+      "JungleKeyThumbnail",
+      "JustView",
+      "Jyxobot",
+      "KOCMOHABT",
+      "Kaspersky Lab CFR link resolver",
+      "Kelny\/",
+      "Kenjin\ Spider",
+      "Kerrigan\/",
+      "KeyCDN",
+      "Keybot\ Translation-Search-Machine",
+      "Keyword Density",
+      "Keyword\ Density",
+      "Keywords Research",
+      "KickFire",
+      "KimonoLabs\/",
+      "Kinza",
+      "Kml-Google",
+      "Kozmosbot",
+      "KumKie",
+      "LNSpiderguy",
+      "LWP::Simple",
+      "LYT\.SR",
+      "L\.webis",
+      "Lanshanbot",
+      "Larbin",
+      "Lavf\/",
+      "Leap",
+      "LeechFTP",
+      "LeechGet",
+      "LexiBot",
+      "Lftp",
+      "LibVLC",
+      "LibWeb",
+      "Libwhisker",
+      "Licorne",
+      "LieBaoFast",
+      "Liferea\/",
+      "Lighthouse",
+      "Lightspeedsystems",
+      "Likse",
+      "Link Valet",
+      "LinkAlarm\/",
+      "LinkAnalyser",
+      "LinkExaminer",
+      "LinkPreview",
+      "LinkScan",
+      "LinkTiger",
+      "LinkWalker",
+      "Linkbot",
+      "LinkextractorPro",
+      "LinkpadBot",
+      "LinksManager",
+      "LinqiaMetadataDownloaderBot",
+      "LinqiaRSSBot",
+      "LinqiaScrapeBot",
+      "Lipperhey",
+      "Lipperhey\ Spider",
+      "Litemage_walker",
+      "Lmspider",
+      "LoadImpactRload",
+      "LongURL API",
+      "Ltx71",
+      "Lucee \(CFML Engine\)",
+      "Lush Http Client",
+      "MFC_Tear_Sample",
+      "MIDown tool",
+      "MIDown\ tool",
+      "MIIxpc",
       "MJ12bot",
+      "MQQBrowser",
+      "MS Web Services Client Protocol",
+      "MSFrontPage",
+      "MSIECrawler",
       "MTRobot",
-      "MaCoCu",
-      "Mail\.RU_Bot",
-      "Mastodon",
+      "MVAClient",
+      "MacOutlook\/",
+      "Mag-Net",
+      "Magnet",
+      "MagpieRSS",
+      "Mail.RU_Bot",
+      "Mail::STS",
+      "MailChimp",
+      "Mail\.Ru",
+      "Majestic-SEO",
+      "Majestic12",
+      "Majestic\ SEO",
+      "Mandrill",
+      "MapperCmd",
+      "MarkMonitor",
+      "MarkWatch",
+      "Mass Downloader",
+      "Mass\ Downloader",
+      "Masscan",
+      "Mata Hari",
+      "Mata\ Hari",
       "MauiBot",
-      "Mediapartners \(Googlebot\)",
+      "Mb2345Browser",
+      "MeanPath\ Bot",
+      "Meanpathbot",
+      "Mediametric",
       "Mediapartners-Google",
       "Mediatoolkitbot",
-      "MegaIndex",
+      "MegaIndex\.ru",
       "MeltwaterNews",
-      "MetaInspector",
-      "MetaJobBot",
+      "Melvil Rawi",
+      "MemGator",
       "MetaURI",
-      "Miniflux\/",
-      "MixnodeCache\/",
-      "MojeekBot\/",
-      "Monsidobot",
-      "MoodleBot",
+      "Metaspinner",
+      "Metauri",
+      "MicroMessenger",
+      "Microsearch",
+      "Microsoft Data Access",
+      "Microsoft Office",
+      "Microsoft Outlook",
+      "Microsoft Windows Network Diagnostics",
+      "Microsoft-WebDAV-MiniRedir",
+      "MicrosoftPreview",
+      "Microsoft\ Data\ Access",
+      "Microsoft\ URL\ Control",
+      "Microsoft\.Data\.Mashup",
+      "Mindjet",
+      "Minefield",
+      "Miniature\.io",
+      "Miniflux",
+      "Miro-HttpClient",
+      "Mister PiX",
+      "Mister\ PiX",
+      "Mnogosearch",
+      "Moblie\ Safari",
+      "Mojeek",
+      "Mojolicious",
+      "Mojolicious \(Perl\)",
+      "Mollie",
+      "MolokaiBot",
+      "MonTools",
+      "Monit\/",
+      "Monitority\/",
       "Moreover",
-      "MuckRack",
-      "Multiviewbot",
-      "NAVER Blog Rssbot",
-      "NING\/",
-      "NINJA bot",
-      "NIXStatsbot",
-      "NTENTbot",
-      "Neevabot",
-      "NerdByNature\.Bot",
+      "Morfeus Fucking Scanner",
+      "Morfeus\ Fucking\ Scanner",
+      "Morning Paper",
+      "MovableType",
+      "Mozlila",
+      "Mr.4x3",
+      "Mr\.4x3 Powered",
+      "Mrcgiguy",
+      "Msrabot",
+      "MuckRack\/",
+      "Musobot",
+      "MxToolbox\/",
+      "NETCRAFT",
+      "NG-Search",
+      "NICErsPRO",
+      "NLNZ_IAHarvester",
+      "NPbot",
+      "Najdi\.si",
+      "Name Intelligence",
+      "NameFo\.com",
+      "Name\ Intelligence",
+      "Nameprotect",
+      "Navroad",
+      "NearSite",
+      "Needle",
+      "Nessus",
+      "Net Vampire",
+      "NetAnts",
+      "NetLyzer",
+      "NetMechanic",
+      "NetNewsWire",
+      "NetShelter ContentScan",
+      "NetSpider",
       "NetSystemsResearch",
-      "NetcraftSurveyAgent",
-      "Neticle Crawler",
+      "NetTrack",
+      "NetZIP",
+      "Net\ Vampire",
+      "Netcraft",
+      "Netpursual",
+      "Netsparker",
+      "Nettrack",
       "Netvibes",
-      "NewsBlur",
-      "NextCloud",
-      "Nicecrawler",
-      "Nimbostratus-Bot",
+      "Neustar WPM",
+      "NeutrinoAPI",
+      "NewRelicPinger",
+      "NewsBlur .*Finder",
+      "NewsGator",
+      "Nexgate Ruby Client",
+      "NextGenSearchBot",
+      "Nibbler",
+      "NihilScio",
+      "Niki-bot",
+      "Nikto",
+      "NimbleCrawler",
+      "Nimbostratus",
+      "Ninja",
+      "Nmap",
       "Nmap Scripting Engine",
+      "NodePing",
+      "Nodemeter",
+      "Norton-Safeweb",
+      "Notifixious",
+      "NotionEmbedder",
+      "Nuclei",
       "Nutch",
       "Nuzzel",
-      "OAI-SearchBot",
-      "Ocarinabot",
-      "OdklBot\/",
-      "OpenGraphCheck",
-      "OpenHoseBot",
-      "OrangeBot\/",
+      "Nymesis",
+      "OMSC",
+      "OPPO A33",
+      "Observatory\/",
+      "Ocelli\/",
+      "Octopus",
+      "Offline Explorer",
+      "Offline Navigator",
+      "Offline\ Explorer",
+      "Offline\ Navigator",
+      "OgScrper",
+      "OnCrawl",
+      "Online Domain Tools",
+      "Open Source RSS",
+      "OpenCalaisSemanticProxy",
+      "OpenLinkProfiler",
+      "OpenVAS",
+      "Openfind",
+      "Openstat\/",
+      "Openvas",
+      "Optimizer",
+      "OrangeBot",
+      "OrangeSpider",
+      "Orbiter",
+      "OrgProbe\/",
       "OutclicksBot",
-      "PR-CY\.RU",
-      "PagePeeker\/",
+      "OutfoxBot",
+      "Outlook-Express",
+      "Outlook-iOS",
+      "Owler",
+      "Owlin",
+      "OxfordCloudService",
+      "PDF24 URL To PDF",
+      "PECL::HTTP",
+      "PHPCrawl",
+      "POE-Component-Client-HTTP",
+      "PRTG Network Monitor",
+      "PTST ",
+      "PTST\/[0-9]+",
+      "Page Valet",
+      "PageAnalyzer",
+      "PageFreezer",
+      "PageGrabber",
+      "PagePeeker",
+      "PageScorer",
       "PageThing",
+      "Page\ Analyzer",
+      "Pagespeed\/",
       "Pandalytics",
-      "PaperLiBot",
+      "Panopta",
+      "Panscient",
+      "Papa Foto",
+      "Papa\ Foto",
+      "Pavuk",
+      "PayPal IPN",
       "Pcore-HTTP",
-      "PerplexityBot\/",
-      "PetalBot",
-      "PhantomJS",
-      "PhxBot",
-      "PiplBot",
+      "Pearltrees",
+      "Peew",
+      "PeoplePal",
+      "Perlu -",
+      "Petalbot",
+      "PhantomJS Screenshoter",
+      "PhantomJS\/",
+      "Photon\/",
+      "Pi-Monster",
+      "Picscout",
+      "Picsearch",
+      "PictureFinder",
+      "Piepmatz",
+      "Pimonster",
+      "PingAdmin\.Ru",
+      "PingSpot",
+      "Pingability",
+      "Pingdom",
+      "Pingoscope",
+      "Pixray",
+      "Pizilla",
+      "Plagger\/",
+      "PleaseCrawl",
+      "Pleroma ",
+      "Ploetz \+ Zeller",
+      "Plukkie",
+      "PocketImageCache",
       "PocketParser",
-      "Primalbot",
-      "PrivacyAwareBot",
-      "Pulsepoint",
+      "Pockey",
+      "PodcastAddict\/",
+      "Polymail\/",
+      "Pompos",
+      "Porkbun",
+      "Port Monitor",
+      "PostPost",
+      "PostmanRuntime",
+      "PowerPoint\/",
+      "Prebid",
+      "Prerender",
+      "Priceonomics Analysis Engine",
+      "PrintFriendly",
+      "PritTorrent",
+      "Prlog",
+      "ProPowerBot",
+      "ProWebWalker",
+      "Probethenet",
+      "Project ?25499",
+      "Project-Resonance",
+      "Protopage",
+      "Proximic",
+      "Psbot",
+      "Pu_iN",
+      "Pump",
+      "PxBroker",
+      "PyCurl",
+      "Python-httplib2",
       "Python-urllib",
+      "QQDownload",
+      "Qirina Hurdler",
+      "QrafterPro",
+      "Qseero",
+      "Qualidator",
+      "QueryN Metasearch",
+      "QueryN\ Metasearch",
+      "Quick-Crawler",
+      "QuiteRSS",
+      "Quora Link Preview",
       "Qwantify",
+      "ROI Hunter",
+      "RPT-HTTPClient",
+      "RSSMix\/",
+      "RSSOwl",
       "RSSingBot",
+      "Radian6",
+      "RadioPublicImageResizer",
+      "Railgun\/",
+      "Rainbot",
+      "RankActive",
       "RankActiveLinkBot",
-      "Refindbot",
-      "RegionStuttgartBot",
-      "RetrevoPageAnalyzer",
-      "ReverseEngineeringBot",
-      "RewriteCond %{HTTP_USER_AGENT} ^$|\&lt;|\&gt;|\&#039;|\%|\_iRc|\_Works|\@\$x|\&lt;\?|\$x0e|\+select\+|\+union\+|1\,\1\,1\,|2icommerce|3GSE|4all|59\.64\.153\.|88\.0\.106\.|98|85\.17\.|A\_Browser|ABAC|Abont|abot|Accept|Access|Accoo|AceFTP|Acme|ActiveTouristBot|Address|Adopt|adress|adressendeutschland|ADSARobot|agent|ah\-ha|Ahead|AESOP\_com\_SpiderMan|aipbot|Alarm|Albert|Alek|Alexibot|Alligator|AllSubmitter|alma|almaden|ALot|Alpha|aktuelles|Akregat|Amfi|amzn\_assoc|Anal|Anarchie|andit|Anon|AnotherBot|Ansearch|AnswerBus|antivirx|Apexoo|appie|Aqua_Products|Arachmo|archive|arian|ASPSe|ASSORT|aster|Atari|ATHENS|AtHome|Atlocal|Atomic_Email_Hunter|Atomz|Atrop|^attach|attrib|autoemailspider|autohttp|axod|batch|b2w|Back|BackDoorBot|BackStreet|BackWeb|Badass|Baid|Bali|Bandit|Baidu|Barry|BasicHTTP|BatchFTP|bdfetch|beat|Become|Beij|BenchMark|berts|bew|big.brother|Bigfoot|Bilgi|Bison|Bitacle|Biz360|Black|Black.Hole|BlackWidow|bladder.fusion|Blaiz|Blog.Checker|Blogl|BlogPeople|Blogshares.Spiders|Bloodhound|Blow|bmclient|Board|BOI|boitho|Bond|Bookmark.search.tool|boris|Bost|Boston.Project|BotRightHere|Bot.mailto:craftbot@yahoo.com|BotALot|botpaidtoclick|botw|brandwatch|BravoBrian|Brok|Bropwers|Broth|browseabit|BrowseX|Browsezilla|Bruin|bsalsa|Buddy|Build|Built|Bulls|bumblebee|Bunny|Busca|Busi|Buy|bwh3|c\-spider|CafeK|Cafi|camel|Cand|captu|Catch|cd34|Ceg|CFNetwork|cgichk|Cha0s|Chang|chaos|Char|char\(32\,35\)|charlotte|CheeseBot|Chek|CherryPicker|chill|ChinaClaw|CICC|Cisco|Cita|Clam|Claw|Click.Bot|clipping|clshttp|Clush|COAST|ColdFusion|Coll|Comb|commentreader|Compan|contact|Control|contype|Conc|Conv|Copernic|Copi|Copy|Coral|Corn|core-project|cosmos|costa|cr4nk|crank|craft|Crap|Crawler0|Crazy|Cres|cs\-CZ|cuill|Curl|Custo|Cute|CSHttp|Cyber|cyberalert|^DA$|daoBot|DARK|Data|Daten|Daum|dcbot|dcs|Deep|DepS|Detect|Deweb|Diam|Digger|Digimarc|digout4uagent|DIIbot|Dillo|Ding|DISC|discobot|Disp|Ditto|DLC|DnloadMage|DotBot|Doubanbot|Download|Download.Demon|Download.Devil|Download.Wonder|Downloader|drag|DreamPassport|Drec|Drip|dsdl|dsok|DSurf|DTAAgent|DTS|Dual|dumb|DynaWeb|e\-collector|eag|earn|EARTHCOM|EasyDL|ebin|EBM-APPLE|EBrowse|eCatch|echo|ecollector|Edco|edgeio|efp\@gmx\.net|EirGrabber|email|Email.Extractor|EmailCollector|EmailSearch|EmailSiphon|EmailWolf|Emer|empas|Enfi|Enhan|Enterprise\_Search|envolk|erck|EroCr|ESurf|Eval|Evil|Evere|EWH|Exabot|Exact|EXPLOITER|Expre|Extra|ExtractorPro|EyeN|FairAd|Fake|FANG|FAST|fastlwspider|FavOrg|Favorites.Sweeper|Faxo|FDM\_1|FDSE|fetch|FEZhead|Filan|FileHound|find|Firebat|Firefox.2\.0|Firs|Flam|Flash|FlickBot|Flip|fluffy|flunky|focus|Foob|Fooky|Forex|Forum|ForV|Fost|Foto|Foun|Franklin.Locator|freefind|FreshDownload|FrontPage|FSurf|Fuck|Fuer|futile|Fyber|Gais|GalaxyBot|Galbot|Gamespy\_Arcade|GbPl|Gener|geni|Geona|Get|gigabaz|Gira|Ginxbot|gluc|glx.?v|gnome|Go.Zilla|Goldfire|Google.Wireless.Transcoder|Googlebot\-Image|Got\-It|GOFORIT|gonzo|GornKer|GoSearch|^gotit$|gozilla|grab|Grabber|GrabNet|Grub|Grup|Graf|Green.Research|grub|grub\-client|gsa\-cra|GSearch|GT\:\:WWW|GuideBot|guruji|gvfs|Gyps|hack|haha|hailo|Harv|Hatena|Hax|Head|Helm|herit|hgre|hhjhj\@yahoo|Hippo|hloader|HMView|holm|holy|HomePageSearch|HooWWWer|HouxouCrawler|HMSE|HPPrint|htdig|HTTPConnect|httpdown|http.generic|HTTPGet|httplib|HTTPRetriever|HTTrack|human|Huron|hverify|Hybrid|Hyper|ia\_archiver|iaskspi|IBM\_Planetwide|iCCra|ichiro|ID\-Search|IDA|IDBot|IEAuto|IEMPT|iexplore\.exe|iGetter|Ilse|Iltrov|Image|Image.Stripper|Image.Sucker|imagefetch|iimds\_monitor|Incutio|IncyWincy|Indexer|Industry.Program|Indy|InetURL|informant|InfoNav|InfoTekies|Ingelin|Innerpr|Inspect|InstallShield.DigitalWizard|Insuran\.|Intellig|Intelliseek|InterGET|Internet.Ninja|Internet.x|Internet\_Explorer|InternetLinkagent|InternetSeer.com|Intraf|IP2|Ipsel|Iria|IRLbot|Iron33|Irvine|ISC\_Sys|iSilo|ISRCCrawler|ISSpi|IUPUI.Research.Bot|Jady|Jaka|Jam|^Java|java\/|Java\(tm\)|JBH.agent|Jenny|JetB|JetC|jeteye|jiro|JoBo|JOC|jupit|Just|Jyx|Kapere|kash|Kazo|KBee|Kenjin|Kernel|Keywo|KFSW|KKma|Know|kosmix|KRAE|KRetrieve|Krug|ksibot|ksoap|Kum|KWebGet|Lachesis|lanshan|Lapo|larbin|leacher|leech|LeechFTP|LeechGet|leipzig\.de|Lets|Lexi|lftp|Libby|libcrawl|libcurl|libfetch|libghttp|libWeb|libwhisker|libwww|libwww\-FM|libwww\-perl|LightningDownload|likse|Linc|Link|Link.Sleuth|LinkextractorPro|Linkie|LINKS.ARoMATIZED|LinkScan|linktiger|LinkWalker|Lint|List|lmcrawler|LMQ|LNSpiderguy|loader|LocalcomBot|Locu|London|lone|looksmart|loop|Lork|LTH\_|lwp\-request|LWP|lwp-request|lwp-trivial|Mac.Finder|Macintosh\;.I\;.PPC|Mac\_F|magi|Mag\-Net|Magnet|Magp|Mail.Sweeper|main|majest|Mam|Mana|MarcoPolo|mark.blonin|MarkWatch|MaSagool|Mass|Mass.Downloader|Mata|mavi|McBot|Mecha|MCspider|mediapartners|^Memo|MEGAUPLOAD|MetaProducts.Download.Express|Metaspin|Mete|Microsoft.Data.Access|Microsoft.URL|Microsoft\_Internet\_Explorer|MIDo|MIIx|miner|Mira|MIRE|Mirror|Miss|Missauga|Missigua.Locator|Missouri.College.Browse|Mist|Mizz|MJ12|mkdb|mlbot|MLM|MMMoCrawl|MnoG|moge|Moje|Monster|Monza.Browser|Mooz|Moreoverbot|MOT\-MPx220|mothra\/netscan|mouse|MovableType|Mozdex|Mozi\!|^Mozilla$|Mozilla\/1\.22|Mozilla\/22|^Mozilla\/3\.0.\(compatible|Mozilla\/3\.Mozilla\/2\.01|Mozilla\/4\.0\(compatible|Mozilla\/4\.08|Mozilla\/4\.61.\(Macintosh|Mozilla\/5\.0|Mozilla\/7\.0|Mozilla\/8|Mozilla\/9|Mozilla\:|Mozilla\/Firefox|^Mozilla.*Indy|^Mozilla.*NEWT|^Mozilla*MSIECrawler|Mp3Bot|MPF|MRA|MS.FrontPage|MS.?Search|MSFrontPage|MSIE\_6\.0|MSIE6|MSIECrawler|msnbot\-media|msnbot\-Products|MSNPTC|MSProxy|MSRBOT|multithreaddb|musc|MVAC|MWM|My\_age|MyApp|MyDog|MyEng|MyFamilyBot|MyGetRight|MyIE2|mysearch|myurl|NAG|NAMEPROTECT|NASA.Search|nationaldirectory|Naver|Navr|Near|NetAnts|netattache|Netcach|NetCarta|Netcraft|NetCrawl|NetMech|netprospector|NetResearchServer|NetSp|Net.Vampire|netX|NetZ|Neut|newLISP|NewsGatorInbox|NEWT|NEWT.ActiveX|Next|^NG|NICE|nikto|Nimb|Ninja|Ninte|NIPGCrawler|Noga|nogo|Noko|Nomad|Norb|noxtrumbot|NPbot|NuSe|Nutch|Nutex|NWSp|Obje|Ocel|Octo|ODI3|oegp|Offline|Offline.Explorer|Offline.Navigator|OK.Mozilla|omg|Omni|Onfo|onyx|OpaL|OpenBot|Openf|OpenTextSiteCrawler|OpenU|Orac|OrangeBot|Orbit|Oreg|osis|Outf|Owl|P3P|PackRat|PageGrabber|PagmIEDownload|pansci|Papa|Pars|Patw|pavu|Pb2Pb|pcBrow|PEAR|PEER|PECL|pepe|Perl|PerMan|PersonaPilot|Persuader|petit|PHP|PHP.vers|PHPot|Phras|PicaLo|Piff|Pige|pigs|^Ping|Pingd|PingALink|Pipe|Plag|Plant|playstarmusic|Pluck|Pockey|POE\-Com|Poirot|Pomp|Port.Huron|Post|powerset|Preload|press|Privoxy|Probe|Program.Shareware|Progressive.Download|ProPowerBot|prospector|Provider.Protocol.Discover|ProWebWalker|Prowl|Proxy|Prozilla|psbot|PSurf|psycheclone|^puf$|Pulse|Pump|PushSite|PussyCat|PuxaRapido|PycURL|Pyth|PyQ|QuepasaCreep|Query|Quest|QRVA|Qweer|radian|Radiation|Rambler|RAMP|RealDownload|Reap|Recorder|RedCarpet|RedKernel|ReGet|relevantnoise|replacer|Repo|requ|Rese|Retrieve|Rip|Rix|RMA|Roboz|Rogue|Rover|RPT\-HTTP|Rsync|RTG30|.ru\)|ruby|Rufus|Salt|Sample|SAPO|Sauger|savvy|SBIder|SBP|SCAgent|scan|SCEJ\_|Sched|Schizo|Schlong|Schmo|Scout|Scooter|Scorp|ScoutOut|SCrawl|screen|script|SearchExpress|searchhippo|Searchme|searchpreview|searchterms|Second.Street.Research|Security.Kol|Seekbot|Seeker|Sega|Sensis|Sept|Serious|Sezn|Shai|Share|Sharp|Shaz|shell|shelo|Sherl|Shim|Shiretoko|ShopWiki|SickleBot|Simple|Siph|sitecheck|SiteCrawler|SiteSnagger|Site.Sniper|SiteSucker|sitevigil|SiteX|Sleip|Slide|Slurpy.Verifier|Sly|Smag|SmartDownload|Smurf|sna\-|snag|Snake|Snapbot|Snip|Snoop|So\-net|SocSci|sogou|Sohu|solr|sootle|Soso|SpaceBison|Spad|Span|spanner|Speed|Spegla|Sphere|Sphider|spider|SpiderBot|SpiderEngine|SpiderView|Spin|sproose|Spurl|Spyder|Squi|SQ.Webscanner|sqwid|Sqworm|SSM\_Ag|Stack|Stamina|stamp|Stanford|Statbot|State|Steel|Strateg|Stress|Strip|studybot|Style|subot|Suck|Sume|sun4m|Sunrise|SuperBot|SuperBro|Supervi|Surf4Me|SuperHTTP|Surfbot|SurfWalker|Susi|suza|suzu|Sweep|sygol|syncrisis|Systems|Szukacz|Tagger|Tagyu|tAke|Talkro|TALWinHttpClient|tamu|Tandem|Tarantula|tarspider|tBot|TCF|Tcs\/1|TeamSoft|Tecomi|Teleport|Telesoft|Templeton|Tencent|Terrawiz|Test|TexNut|trivial|Turnitin|The.Intraformant|TheNomad|Thomas|TightTwatBot|Timely|Titan|TMCrawler|TMhtload|toCrawl|Todobr|Tongco|topic|Torrent|Track|translate|Traveler|TREEVIEW|True|Tunnel|turing|Turnitin|TutorGig|TV33\_Mercator|Twat|Tweak|Twice|Twisted.PageGetter|Tygo|ubee|UCmore|UdmSearch|UIowaCrawler|Ultraseek|UMBC|unf|UniversalFeedParser|unknown|UPG1|UtilMind|URLBase|URL.Control|URL\_Spider\_Pro|urldispatcher|URLGetFile|urllib|URLSpiderPro|URLy|User\-Agent|UserAgent|USyd|Vacuum|vagabo|Valet|Valid|Vamp|vayala|VB\_|VCI|VERI\~LI|verif|versus|via|Viewer|virtual|visibilitygap|Visual|vobsub|Void|VoilaBot|voyager|vspider|VSyn|w\:PACBHO60|w0000t|W3C|w3m|w3search|walhello|Walker|Wand|WAOL|WAPT|Watch|Wavefire|wbdbot|Weather|web.by.mail|Web.Data.Extractor|Web.Downloader|Web.Ima|Web.Mole|Web.Sucker|Web2Mal|Web2WAP|WebaltBot|WebAuto|WebBandit|Webbot|WebCapture|WebCat|webcraft\@bea|Webclip|webcollage|WebCollector|WebCopier|WebCopy|WebCor|webcrawl|WebDat|WebDav|webdevil|webdownloader|Webdup|WebEMail|WebEMailExtrac|WebEnhancer|WebFetch|WebGo|WebHook|Webinator|WebInd|webitpr|WebFilter|WebFountain|WebLea|Webmaster|WebmasterWorldForumBot|WebMin|WebMirror|webmole|webpic|WebPin|WebPix|WebReaper|WebRipper|WebRobot|WebSauger|WebSite|Website.eXtractor|Website.Quester|WebSnake|webspider|Webster|WebStripper|websucker|WebTre|WebVac|webwalk|WebWasher|WebWeasel|WebWhacker|WebZIP|Wells|WEP\_S|WEP.Search.00|WeRelateBot|wget|Whack|Whacker|whiz|WhosTalking|Widow|Win67|window.location|Windows.95\;|Windows.95\)|Windows.98\;|Windows.98\)|Winodws|Wildsoft.Surfer|WinHT|winhttp|WinHttpRequest|WinHTTrack|Winnie.Poh|wire|WISEbot|wisenutbot|wish|Wizz|WordP|Works|world|WUMPUS|Wweb|WWWC|WWWOFFLE|WWW\-Collector|WWW.Mechanize|www.ranks.nl|wwwster|^x$|X12R1|x\-Tractor|Xaldon|Xenu|XGET|xirq|Y\!OASIS|Y\!Tunnel|yacy|YaDirectBot|Yahoo\-MMAudVid|YahooSeeker|YahooYSMcm|Yamm|Yand|yang|Yeti|Yoono|yori|Yotta|YTunnel|Zade|zagre|ZBot|Zeal|ZeBot|zerx|Zeus|ZIPCode|Zixy|zmao|Zyborg [NC]",
-      "RidderBot",
-      "Rivva",
+      "RankFlex",
+      "RankSonicSiteAuditor",
+      "RankingBot",
+      "RankingBot2",
+      "Rankivabot",
+      "RankurBot",
+      "RapidLoad\/",
+      "Re-re",
+      "Re-re Studio",
+      "ReGet",
+      "ReactorNetty",
+      "Readability",
+      "RealDownload",
+      "RealPlayer%20Downloader",
+      "Reaper",
+      "RebelMouse",
+      "Recorder",
+      "RecurPost\/",
+      "RedesScrapy",
+      "ReederForMac",
+      "Reeder\/",
+      "RepoMonkey",
+      "ResponseCodeTest",
+      "RestSharp",
+      "Riddler",
+      "Ripper",
+      "Rival IQ",
+      "Robosourcer",
+      "Robozilla",
+      "RocketCrawler",
+      "Rogerbot",
       "RuxitSynthetic",
-      "RyteBot",
-      "SBL-BOT",
+      "RyowlEngine",
+      "SAP NetWeaver Application Server",
+      "SBIder",
+      "SEO Browser",
+      "SEOCentro",
       "SEOkicks",
+      "SEOkicks-Robot",
       "SEOlizer",
-      "SWIMGBot",
-      "S[eE][mM]rushBot",
-      "SafeDNSBot",
-      "SafeSearch microdata crawler",
+      "SEOlyt",
+      "SEOlyticsCrawler",
+      "SEOprofiler",
+      "SEOsearch",
+      "SEOstats",
+      "SISTRIX",
+      "SMRF URL Expander",
+      "SMTBot",
+      "SMUrlExpander",
+      "SPDYCheck",
+      "SPEng",
+      "SSL Labs",
+      "SalesIntelligent",
+      "Saleslift",
+      "SauceNAO",
+      "Scamadviser-Frontend",
+      "ScanAlert",
+      "Scanbot",
+      "Scoop",
+      "ScopeContentAG-HTTP-Client",
       "ScoutJet",
+      "ScoutURLMonitor",
+      "ScrapeBox Page Scanner",
       "Scrapy",
-      "Screaming Frog SEO Spider",
-      "SearchAtlas",
+      "Screaming",
+      "ScreenShotService",
+      "ScreenerBot",
+      "ScrepyBot",
+      "Scrubby",
+      "Scrutiny\/",
+      "Search37",
+      "SearchExpress",
+      "SearchSight",
+      "SearchWP",
+      "Searchestate",
+      "SearchmetricsBot",
+      "Seeker",
       "Seekport",
-      "SemanticScholarBot",
+      "SeekportBot",
+      "SemanticJuice",
+      "Semiocast HTTP client",
+      "Semrush",
+      "SemrushBot",
+      "Sendsay\.Ru",
       "SentiBot",
       "SenutoBot",
+      "Seo Servis",
+      "SeoCheck",
+      "SeoCherryBot",
+      "SeoSiteCheckup",
+      "Seobility",
       "SeobilityBot",
-      "SerendeputyBot",
-      "SeznamBot",
-      "SimpleCrawler",
+      "Seomoz",
+      "Seznam",
+      "Shelob",
+      "Shodan",
+      "ShopWiki",
+      "Shoppimon",
+      "ShortLinkTranslate",
+      "Sideqik",
+      "Siege",
       "SimplePie",
-      "SimpleScraper",
+      "SimplyFast",
+      "Siphon",
+      "Site Sucker",
+      "Site-Shot\/",
+      "Site24x7",
+      "SiteBar",
       "SiteCheckerBotCrawler",
-      "Siteimprove\.com",
+      "SiteCondor",
+      "SiteExplorer",
+      "SiteGuardian",
+      "SiteIndexed",
+      "SiteLockSpider",
+      "SiteMonitor",
+      "SiteSnagger",
+      "SiteSucker",
+      "SiteTruth",
+      "Site\ Sucker",
+      "Sitebeam",
+      "Sitebulb\/",
+      "Siteimprove",
+      "Sitemap(s)? Generator",
+      "SitemapGenerator",
+      "Siteshooter B0t",
+      "Sitevigil",
       "SkypeUriPreview",
-      "Slack-ImgProxy",
-      "Slackbot",
-      "Slurp",
-      "Snacktory",
-      "Snap URL Preview Service",
+      "Slack\/",
+      "SlySearch",
+      "SmartDownload",
+      "Snake",
+      "SnapSearch",
+      "Snapbot",
+      "Snappy",
+      "Snarfer\/",
+      "SniffRSS",
+      "Snoopy",
+      "SnowHaze Search",
       "SocialRankIOBot",
-      "Sogou",
-      "Sonic",
-      "Storebot-Google",
-      "StorygizeBot",
-      "StractBot",
-      "Streamline3Bot\/",
-      "Superfeedr",
-      "SurdotlyBot",
+      "Sociscraper",
+      "Sogou\ web\ spider",
+      "SortSite",
+      "Sosospider",
+      "Sottopop",
+      "SpaceBison",
+      "SpamExperts",
+      "Spammen",
+      "SpankBot",
+      "Spanner",
+      "Spawning-AI",
+      "Spbot",
+      "Specificfeeds",
+      "SpeedKit",
+      "Spider_Bot",
+      "Spider_Bot/3.0",
+      "Spinn3r",
+      "Sprinklr ",
+      "SputnikBot",
+      "Sqlmap",
+      "Sqlworm",
+      "Sqworm",
+      "StackRambler",
+      "Statastico\/",
+      "Statically-",
+      "StatusCake",
+      "Steeler",
+      "Stratagems Kumo",
+      "Stripe\/",
+      "Stripper",
+      "Stroke\.cz",
+      "StudioFACA",
+      "StumbleUpon",
+      "Sucker",
+      "Sucuri",
+      "SuperBot",
+      "SuperHTTP",
+      "Surfbot",
+      "Surphace Scout",
       "SurveyBot",
-      "Synapse",
+      "Suzuran",
+      "Swiftbot",
+      "Symfony BrowserKit",
+      "Symfony2 BrowserKit",
+      "SynHttpClient-Built",
+      "Synapse\/",
+      "Syndirella\/",
       "Sysomos",
-      "Taboolabot",
-      "TangibleeBot",
-      "TelegramBot",
-      "Teoma",
+      "Szukacz",
+      "T0PHackTeam",
+      "T8Abot",
+      "TLSProbe\/",
+      "Tarantula\/",
+      "Taringa UGC",
+      "TarmotGezgin",
+      "Teleport",
+      "TeleportPro",
+      "Telesoft",
+      "Telesphoreo",
+      "Telesphorep",
+      "Tenon\.io",
+      "Test Certificate Info",
+      "Tetrahedron",
+      "TextRazor Downloader",
+      "The Drop Reaper",
+      "The Expert HTML Source Viewer",
+      "The Intraformant",
+      "The Knowledge AI",
+      "TheNomad",
+      "The\ Intraformant",
       "Thinklab",
+      "ThumbSniper",
+      "Thumbor",
+      "Thumbshots",
+      "TightTwatBot",
       "TinEye",
       "Tiny Tiny RSS",
-      "TombaPublicWebCrawler",
-      "ToutiaoSpider",
+      "TinyTestBot",
+      "Titan",
+      "Toata",
+      "Toweyabot",
       "Traackr\.com",
-      "TrendsmapResolver",
-      "Trove",
+      "Tracemyfile",
+      "Trackuity",
+      "TrapitAgent",
+      "Trendiction",
+      "Trendictionbot",
+      "Trendsmap",
+      "True_Robot",
+      "TryJsoup",
+      "TulipChain",
+      "Turingos",
       "Turnitin",
-      "TweetmemeBot",
+      "TurnitinBot",
+      "Tweetminster",
+      "Tweezler\/",
+      "TwengaBot",
+      "Twice",
+      "Twikle",
       "Twingly",
-      "Twitterbot",
-      "Twurly",
-      "UT-Dorkbot",
+      "Twisted PageGetter",
+      "Typhoeus",
+      "URL Verifier",
+      "URLTester",
+      "URL\/Emacs",
+      "URLitor",
+      "URLy Warning",
+      "URLy\ Warning",
+      "URLy\.Warning",
+      "UdmSearch",
+      "UnisterBot",
+      "UniversalFeedParser",
+      "Unshorten\.It",
+      "Untiny",
+      "UnwindFetchor",
       "Upflow",
-      "Uptime-Kuma",
-      "UptimeRobot",
-      "Uptimebot\.org",
-      "UsineNouvelleCrawler",
-      "VKRobot",
-      "Validator\.nu",
-      "Valve\/Steam",
+      "Uptimia",
+      "UrlTrends Ranking Updater",
+      "Urlcheckr",
+      "Urlstat",
+      "V-BOT",
+      "VB Project",
+      "VB\ Project",
+      "VSAgent\/",
+      "VSB-TUO\/",
+      "VYU2",
+      "Vacuum",
+      "Vagabondo",
       "VelenPublicWebCrawler",
-      "Veoozbot",
-      "Vercelbot",
-      "Viber",
-      "Vigil\/",
-      "VoluumDSP-content-bot",
+      "VeriCiteCrawler",
+      "Verity",
+      "VidibleScraper",
+      "Virusdie",
+      "Visual Rights Group",
+      "VoidEYE",
+      "Voil",
+      "Voltron",
+      "Vulnbusters Meter",
       "W3C-checklink",
       "W3C-mobileOK",
-      "W3C_CSS_Validator",
-      "W3C_I18n-Checker",
       "W3C_Unicorn",
-      "W3C_Validator",
-      "WeSEE:Search",
+      "WAC-OFU",
+      "WASALive-Bot",
+      "WBSearchBot",
+      "WDT\.io",
+      "WEBDAV",
+      "WEPA",
+      "WISENutbot",
+      "WP Engine Install Performance API",
+      "WP Rocket",
+      "WPScan",
+      "WWW-Collector-E",
+      "WWW-Mechanize",
+      "WWW::Document",
+      "WWW::Mechanize",
+      "WWWOFFLE",
+      "WakeletLinkExpander",
+      "Wallpapers",
+      "Wallpapers/3.0",
+      "WallpapersHD",
+      "Wallpapers\/[0-9]+",
+      "Wappalyzer",
+      "WatchMouse",
+      "WbSrch\/",
+      "WeLikeLinks",
+      "WeSEE",
+      "Web Auto",
+      "Web Collage",
+      "Web Enhancer",
+      "Web Fetch",
+      "Web Fuck",
+      "Web Pix",
+      "Web Sauger",
+      "Web Sucker",
+      "Web spyder",
+      "Web-sniffer",
+      "WebAuto",
+      "WebBandit",
+      "WebCapture",
+      "WebClient\/",
+      "WebCollage",
+      "WebCookies",
+      "WebCopier",
+      "WebCorp",
       "WebDataStats",
-      "WellKnownBot",
+      "WebDoc",
+      "WebEnhancer",
+      "WebFetch",
+      "WebFuck",
+      "WebGazer",
+      "WebGo IS",
+      "WebGo\ IS",
+      "WebImageCollector",
+      "WebImages",
+      "WebIndex",
+      "WebLeacher",
+      "WebPix",
+      "WebReaper",
+      "WebSauger",
+      "WebSniffer",
+      "WebStripper",
+      "WebSucker",
+      "WebThumbnail",
+      "WebWhacker",
+      "WebZIP",
+      "Web\ Auto",
+      "Web\ Collage",
+      "Web\ Enhancer",
+      "Web\ Fetch",
+      "Web\ Fuck",
+      "Web\ Pix",
+      "Web\ Sauger",
+      "Web\ Sucker",
+      "Webalta",
+      "Webauskunft",
+      "WebmasterWorldForumBot",
+      "Webshag",
+      "Webshot",
+      "Website Quester",
+      "WebsiteExtractor",
+      "WebsiteQuester",
+      "Website\ Quester",
+      "Websnapr",
+      "Webster",
+      "Webthumb\/",
+      "Wfuzz\/",
+      "Whack",
+      "Whacker",
+      "WhatCMS",
+      "WhatWeb",
       "WhatsApp",
+      "WhatsMyIP",
+      "Whatweb",
+      "WhereGoes\?",
+      "Whibse",
+      "WhoAPI\/",
+      "WhoRunsCoinHive",
+      "Whynder Magnet",
+      "Widow",
+      "WinHTTP\/",
+      "WinHTTrack",
+      "WinHttp-Autoproxy-Service",
+      "WinPodder",
+      "Windows-RSS-Platform",
+      "WiseGuys\ Robot",
+      "Woko",
+      "Wolfram HTTPClient",
+      "Wonderbot",
+      "Woobot",
       "WordPress\/",
-      "WordupInfoSearch",
+      "Word\/",
+      "WordupinfoSearch",
+      "Wotbox",
+      "Wprecon",
+      "Wtrace",
+      "XING-contenttabreceiver",
+      "Xaldon\ WebSpider",
+      "Xaldon_WebSpider",
+      "XaxisSemanticsClassifier",
+      "XenForo\/",
+      "Xenu",
       "Xenu Link Sleuth",
-      "Y!J",
-      "YaK\/",
+      "Y!J-[A-Z][A-Z][A-Z]",
+      "YP\.PL",
+      "Yaanb",
       "Yahoo Link Preview",
-      "YandexRenderResourcesBot\/",
-      "Yellowbrandprotectionbot",
-      "Yeti",
-      "YisouSpider",
-      "YouBot",
+      "YahooCacheSystem",
+      "YahooMailProxy",
+      "YahooYSMcm",
+      "YandeG",
+      "Yandex(?!Search)",
+      "Yo-yo",
+      "YoYs\.net",
+      "Yoleo Consumer",
+      "YottaaMonitor",
+      "YoudaoBot",
+      "Your-Website-Sucks",
       "Zabbix",
+      "Zade",
+      "Zapier",
+      "Zauba",
+      "Zemanta Aggregator",
+      "Zend\\Http\\Client",
+      "Zend_Http_Client",
+      "Zermelo",
+      "Zeus",
+      "Zeus ",
+      "Zitebot",
+      "ZmEu",
+      "ZnHTTP",
+      "ZnajdzFoto",
+      "Zombie\.js",
       "ZoomBot",
+      "Zoom\.Mac",
       "ZoominfoBot",
+      "ZoteroTranslationServer",
       "ZumBot",
-      "ZuperlistBot\/",
-      "[Cc]urebot",
-      "[cC]laude[bB]ot",
-      "[pP]ingdom",
-      "[wW]get",
-      "^Apache-HttpClient",
-      "^BW\/",
-      "^LCC ",
-      "^PHP-Curl-Class",
-      "^curl",
-      "acapbot",
-      "acoonbot",
-      "adbeat_bot",
+      "ZyBorg",
+      "[a-z0-9\-_]*(bot|crawl|archiver|transcoder|spider|uptime|validator|fetcher|cron|checker|reader|extractor|monitoring|analyzer|scraper)",
+      "^Aether",
+      "^Amazon CloudFront",
+      "^Amazon Simple Notification Service Agent$",
+      "^Amazon-Route53-Health-Check-Service",
+      "^COMODO DCV",
+      "^Calypso v\/",
+      "^Corax",
+      "^DHSH",
+      "^DangDang",
+      "^DavClnt",
+      "^Expanse",
+      "^FDM ",
+      "^Goose\/",
+      "^Grabber",
+      "^Gradle\/",
+      "^HTTPClient\/",
+      "^HTTPing",
+      "^Java\/",
+      "^Jeode\/",
+      "^Jetty\/",
+      "^Mail\/",
+      "^Mget",
+      "^Microsoft URL Control",
+      "^Mikrotik\/",
+      "^NG\/[0-9\.]",
+      "^NING\/",
+      "^Netlab360",
+      "^Nuclei",
+      "^PHP-AYMAPI\/",
+      "^PHP\/",
+      "^RMA\/",
+      "^Ruby|Ruby\/[0-9]",
+      "^Swurl ",
+      "^TLS tester ",
+      "^VSE\/[0-9]",
+      "^WordPress\.com",
+      "^XRL\/[0-9]",
+      "^ZmEu",
+      "^b0t$",
+      "^bluefish ",
+      "^docker\/[0-9]",
+      "^git\/",
+      "^npm\/",
+      "^pip\/",
+      "^pnpm\/",
+      "^twine\/",
+      "^ureq",
+      "a3logics\.in",
+      "a\.pr-cy\.ru",
+      "aboutthedomain",
+      "acebookexternalhit\/",
+      "acoon",
+      "acrylicapps\.com\/pulp",
+      "adbeat",
+      "adressendeutschland",
+      "adreview\/",
       "adscanner",
-      "aiHitBot",
-      "aiohttp",
-      "antibot",
-      "arabot",
-      "archive\.org_bot",
-      "awesomecrawler",
-      "axios",
-      "backlinkcrawler",
-      "betaBot",
-      "bidswitchbot",
-      "bingbot",
+      "adstxt-worker",
+      "adstxt\.com",
+      "affilimate-puppeteer",
+      "agentslug",
+      "aihit",
+      "aiohttp\/",
+      "akka-http\/",
+      "akula\/",
+      "alertra",
+      "alexa site audit",
+      "allloadin",
+      "alyze\.info",
+      "amagit",
+      "annotate_google",
+      "anthropic-ai",
+      "apimon\.de",
+      "arachnode",
+      "archive.org_bot",
+      "aria2",
+      "arquivo-web-crawler",
+      "asafaweb",
+      "asynchttp",
+      "attohttpc",
+      "autocite",
+      "autoemailspider",
+      "awin\.com",
+      "axios\/",
+      "backlink-check",
+      "baidu\.com",
+      "basicstate",
+      "baypup\/",
+      "biNu image cacher",
+      "biglotron",
       "binlar",
-      "bitlybot",
-      "blogmuraBot",
-      "bnf\.fr_bot",
-      "bot-pge\.chlooe\.com",
-      "botify",
-      "brainobot",
-      "buzzbot",
-      "cXensebot",
-      "careerbot",
-      "centurybot",
+      "biz_Directory",
+      "boitho\.com-dc",
+      "caam dot crwlr at gmail dot com",
+      "catexplorador",
+      "censys",
+      "cf-facebook",
+      "cg-eye",
       "changedetection",
-      "check_http",
-      "citeseerxbot",
+      "chatterino-api-cache",
+      "checkprivacy",
+      "chkme\.com",
+      "clark-crawler",
+      "clips\.ua\.ac\.be",
+      "cmcm\.com",
       "coccoc",
-      "collection@infegy\.com",
-      "content crawler spider",
-      "contxbot",
+      "coccocbot",
+      "cognitiveseo",
+      "cohere-ai",
+      "colly -",
+      "commonscan",
+      "contactbigdatafr",
+      "contentkingapp",
       "convera",
+      "copyright sheriff",
+      "cortex\/",
       "crawler4j",
-      "datagnionbot",
-      "dcrawl",
-      "deadlinkchecker",
-      "deepnoc",
-      "developers\.google\.com\/\+\/web\/snippet",
-      "discobot",
-      "domaincrawler",
-      "dotbot",
+      "curb",
+      "curl",
+      "cuwhois\/",
+      "cybo\.com",
+      "dBpoweramp",
+      "dataforseobot",
+      "dataprovider",
+      "ddline",
+      "deeris",
+      "delve\.ai",
+      "demandbase-bot",
+      "developers\.google\.com\/\+\/web\/snippet\/",
+      "dlvr",
+      "docoloc",
+      "dotMailer content retrieval",
+      "dotSemantic",
+      "downforeveryoneorjustme",
+      "downnotifier",
       "drupact",
-      "e\.ventures Investment Crawler",
+      "dubaiindex",
+      "eCairn-Grabber",
+      "eCatch",
+      "eContext\/",
       "ec2linkfinder",
-      "edisterbot",
-      "electricmonk",
-      "elisabot",
-      "epicbot",
-      "eright",
+      "elefent",
+      "endo\/",
       "europarchive\.org",
-      "ev-crawler\/",
       "evc-batch",
-      "exabot",
+      "everyfeed-spider",
+      "exif",
       "ezooms",
-      "facebookcatalog\/",
+      "facebookcatalog",
       "facebookexternalhit",
-      "fedoraplanet",
-      "feedbot",
-      "filterdb\.iss\.net\/crawler",
+      "facebookexternalua",
+      "facebookplatform",
+      "facebookscraper",
+      "fairshare",
+      "fasthttp",
+      "faviconarchive",
+      "faviconkit",
+      "feeder",
+      "feeltiptop",
       "findlink",
       "findthatfile",
-      "findxbot",
       "fluffy",
-      "fr-crawler",
-      "fuelbot",
+      "flynxapp",
+      "forensiq",
+      "fragFINN\.de",
+      "free thumbnails",
+      "frontman",
       "g00g1e\.net",
-      "g2reader-bot",
-      "gnam gnam spider",
+      "gSOAP\/",
+      "ganarvisitas",
+      "gdnplus\.com",
+      "geek-tools",
+      "getprismatic",
+      "getroot",
+      "github-camo",
+      "github\.com",
+      "go-mtasts\/",
+      "gobuster",
+      "gobyus",
+      "gofetch",
+      "gooblog",
       "google-xrawler",
-      "grub\.org",
-      "gslfbot",
+      "gopher",
+      "gosquared-thumbnailer",
+      "grabify",
+      "grokkit",
+      "grouphigh",
+      "grub-client",
+      "gvfs\/",
+      "hackney\/",
+      "help@dataminr\.com",
       "heritrix",
+      "historious",
+      "hkedcity",
+      "hledejLevne\.cz",
+      "hosterstats",
+      "ht:\/\/check",
+      "htdig",
+      "htmlyse",
+      "http-get",
+      "http-kit",
+      "http-request\/",
+      "httpRequest",
+      "http\.rb\/",
       "http_get",
-      "https:\/\/developers\.cloudflare\.com\/security-center\/",
+      "http_request2",
+      "http_requester",
+      "httphr",
+      "httpscheck",
+      "httpssites_power",
       "httpunit",
-      "httpx",
-      "hypestat",
-      "hyscore\.io",
-      "ia_archiver",
+      "httrack",
+      "huaweisymantec",
+      "i2kconnect\/",
+      "iGooglePortal",
+      "iThemes Sync\/",
+      "iZSearch",
       "ichiro",
-      "imrbot",
-      "infoobot",
-      "inoreader",
+      "igdeSpyder",
+      "imagineeasy",
+      "imgsizer",
+      "inbound\.li parser",
+      "infegy",
+      "infohelfer",
+      "inpwrd\.com",
+      "instabid",
       "integromedb",
-      "intelium_bot",
-      "ip-web-crawler\.com",
+      "internetVista monitor",
+      "internetVista\ monitor",
+      "internet_archive",
+      "internetwache",
+      "intraVnews",
+      "iplabel",
       "ips-agent",
+      "iqdb\/",
+      "isUp\.li",
+      "isitup\.org",
       "iskanie",
-      "it2media-domain-crawler",
-      "jpg-newsbot",
-      "jyxobot",
-      "lb-spider",
-      "libwww-perl",
-      "linkapediabot",
+      "iubenda-radar",
+      "janforman",
+      "javelin\.io",
+      "jobo",
+      "khttp\/",
+      "knows\.is",
+      "kouio",
+      "kube-probe",
+      "kubectl",
+      "kulturarw3",
+      "leakix\.net",
+      "letsencrypt",
+      "libwww",
+      "limber\.io",
+      "link-check",
+      "linkCheck",
+      "link_thumbnailer",
       "linkdex",
-      "lipperhey",
-      "lkxscan",
-      "lssbot",
-      "lssrocketcrawler",
+      "linkdexbot",
+      "linkfluence",
+      "linkpeek",
+      "livedoor ScreenShot",
+      "localsearch-web",
+      "longurl-r-package",
+      "looid\.com",
+      "looksystems\.net",
+      "lscache_runner",
       "ltx71",
+      "lua-resty-http",
+      "lwp-request",
+      "lwp-trivial",
+      "lycos",
+      "mShots",
+      "mabontland",
       "magpie-crawler",
-      "mappydata",
-      "memorybot",
-      "meta-externalagent\/",
-      "meta-externalfetcher\/",
-      "mindUpBot",
-      "minicrawler",
-      "mlbot",
-      "moatbot",
-      "msnbot",
-      "msrbot",
-      "nerdybot",
-      "netEstate NE Crawler",
-      "netresearchserver",
-      "newsharecounts",
+      "makecontact\/",
+      "marketinggrader",
+      "masscan\/",
+      "mattermost",
+      "meanpathbot",
+      "mediawords",
+      "mio_httpc",
+      "mixdata dot com",
+      "mixed-content-scan",
+      "mixnode",
+      "mogimogi",
+      "monitis",
+      "montastic",
+      "mowser",
+      "muhstik-scan",
+      "myseosnapshot",
+      "nWormFeedFinder",
+      "nagios",
+      "nationalarchives",
+      "nbertaupete95",
+      "netEstate\ NE\ Crawler",
+      "netresearch",
+      "nettle",
+      "newsme",
       "newspaper\/",
-      "niki-bot",
+      "nghttp2",
+      "nineconnections",
       "node-fetch",
-      "officestorebot",
+      "node-superagent",
+      "node-urllib",
+      "node\.io",
+      "nominet\.org\.uk",
+      "nominet\.uk",
+      "notifyninja",
+      "nuhk",
+      "nutch",
+      "nyawc\/",
+      "oBot",
+      "oegp",
       "okhttp",
       "omgili",
-      "online-webceo-bot",
-      "openindexspider",
-      "outbrain",
+      "openai",
+      "orion-semantics",
+      "ow\.ly",
+      "ownCloud News",
+      "page scorer",
       "page2rss",
+      "page\ scorer",
+      "page_verifier",
       "panscient",
-      "phpcrawl",
-      "pinterest\.com\/bot",
+      "parsijoo",
+      "pcBrowser",
+      "peerindex",
+      "php-requests",
+      "phpservermon",
+      "ping\.blo\.gs",
+      "pinterest\.com",
+      "plumanalytics",
+      "polaris\ version",
+      "postano",
+      "postfix-mta-sts-resolver",
+      "postplanner\.com",
       "postrank",
+      "probe-image-size",
+      "probely\.com",
+      "probethenet",
+      "prospectb2b",
       "proximic",
-      "psbot",
-      "purebot",
-      "python-opengraph",
+      "pshtt, https scanning",
+      "pulsetic\.com",
+      "python-httpx",
       "python-requests",
-      "redditbot",
-      "rogerbot",
-      "rssbot\/",
-      "scribdbot",
-      "search\.marginalia\.nu",
-      "seekbot",
-      "seewithkids",
-      "semanticbot",
-      "sempi\.tech",
+      "queuedriver",
+      "quic-go-HTTP\/",
+      "redback\/",
+      "request\.js",
+      "reqwest\/",
+      "ripz",
+      "safe-agent-scanner",
+      "sc-downloader",
+      "scalaj-http",
+      "scan\.lol",
+      "scooter",
+      "search\.thunderstone",
+      "searchenginepromotionhelp",
+      "semanticdiscovery",
+      "semanticjuice",
+      "sentry\/",
+      "seo-nastroj\.cz",
+      "seo4ajax",
+      "seobility",
+      "seocompany",
       "seoscanners",
-      "seostar\.co",
-      "serpstatbot\/",
-      "sitebot",
-      "siteexplorer\.info",
-      "smtbot",
-      "spbot",
+      "seositecheckup",
+      "seostar",
+      "serpstatbot",
+      "servernfo",
+      "sexsearcher",
+      "shortURL lengthener",
+      "shrinktheweb",
+      "siteripz",
+      "sitexy\.com",
+      "sli-systems\.com",
+      "slider\.com",
+      "slurp",
+      "sniptracker",
+      "sogou web",
+      "sogouspider",
+      "sovereign\.ai",
+      "sp_auditbot",
+      "spaziodati",
       "speedy",
-      "startmebot\/",
+      "spray-can",
+      "spyfu",
+      "spyonweb",
+      "sqlmap",
+      "ssl-tools",
+      "suchen",
       "summify",
-      "t3versionsBot",
-      "tagoobot",
-      "theoldreader\.com",
-      "tigerbot",
-      "toplistbot",
+      "swcd ",
+      "sysscan",
+      "tAkeOut",
+      "tchelebi\.io",
+      "techiaith\.cymru",
+      "teoma",
+      "terrainformatica",
+      "testuri",
+      "theinternetrules",
+      "timewe\.net",
+      "topster",
+      "touche\.com",
       "tracemyfile",
-      "trendictionbot",
-      "trovitBot",
+      "trendspottr",
+      "truwoGPS",
       "tweetedtimes",
-      "twengabot",
-      "um-LN",
-      "urlappendbot",
-      "vebidoobot",
-      "vercel-screenshot",
-      "virustotal",
+      "twibble",
+      "ubermetrics-technologies",
+      "uclassify",
+      "ultimate_sitemap_parser",
+      "unchaos",
+      "unirest-java",
+      "unshortenit",
+      "updated",
+      "updown\.io daemon",
+      "urlresolver",
+      "vBSEO",
+      "via ggpht\.com GoogleImageProxy",
+      "visionutils",
       "vkShare",
-      "voilabot",
-      "vuhuvBot",
-      "wbsearchbot",
-      "web-archive-net\.com\.bot",
-      "webcompanycrawler",
+      "voltron",
+      "voyager\/",
+      "w3af\.org",
+      "wangling",
+      "web-capture\.net",
+      "webcollage",
+      "webgains-bot",
+      "webkit2png",
+      "webmastercoffee",
+      "webmeup-crawler",
       "webmon ",
-      "wocbot",
-      "woobot",
-      "woorankreview\/",
-      "woriobot",
+      "webprosbot",
+      "webscreenie",
+      "websitepulse agent",
+      "webtech\/",
+      "wf84",
+      "wget",
+      "wkhtmlto",
+      "wmtips",
+      "woorankreview",
+      "worldping-api",
       "wotbox",
-      "www\.uptime\.com",
+      "wpif",
+      "wprecon\.com survey",
+      "wscheck",
+      "www\.monitor\.us",
       "x09Mozilla",
       "x22Mozilla",
-      "xovibot",
-      "yacybot",
-      "yandex\.com\/bots",
+      "xpymep([0-9]?)\.exe",
+      "yacy",
       "yanga",
-      "yoozBot",
-      "zenback bot",
+      "yeti",
+      "yomins\.com",
+      "yoogliFetchAgent",
+      "yourls\.org",
       "zgrab",
     ]
diff --git a/waf_patterns/traefik/middleware.toml b/waf_patterns/traefik/middleware.toml
index d20ded4..e9bd136 100644
--- a/waf_patterns/traefik/middleware.toml
+++ b/waf_patterns/traefik/middleware.toml
@@ -3,536 +3,536 @@
 [http.middlewares.bad_bot_block_INITIALIZATION]
   [http.middlewares.bad_bot_block_INITIALIZATION.plugin.badbot]
     userAgent = [
-      "@rx ^[a-f]*([0-9])[a-f]*([0-9])",
-      "!@lt %{tx.sampling_percentage}",
-      "@rx ^.*$",
-      "!@rx (?:URLENCODED|MULTIPART|XML|JSON)",
       "@eq 1",
-      "@lt %{tx.blocking_paranoia_level}",
       "@eq 100",
-      "@eq 0"
-    ]
-
-[http.middlewares.bad_bot_block_EXCEPTIONS]
-  [http.middlewares.bad_bot_block_EXCEPTIONS.plugin.badbot]
-    userAgent = [
-      "@ipMatch 127.0.0.1,::1",
-      "@rx ^(?:GET /|OPTIONS *) HTTP/[12].[01]$",
-      "@streq GET /",
-      "@endsWith (internal dummy connection)"
+      "!@rx (?:URLENCODED|MULTIPART|XML|JSON)",
+      "@rx ^[a-f]*([0-9])[a-f]*([0-9])",
+      "@lt %{tx.blocking_paranoia_level}",
+      "!@lt %{tx.sampling_percentage}",
+      "@eq 0",
+      "@rx ^.*$"
     ]
 
-[http.middlewares.bad_bot_block_ENFORCEMENT]
-  [http.middlewares.bad_bot_block_ENFORCEMENT.plugin.badbot]
+[http.middlewares.bad_bot_block_LFI]
+  [http.middlewares.bad_bot_block_LFI.plugin.badbot]
     userAgent = [
-      "@rx ^(?i)multipart/form-data",
-      "@lt %{tx.1}",
-      "!@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0",
-      "@rx %u[fF]{2}[0-9a-fA-F]{2}",
-      "@rx charsets*=s*[\\"']?([^;\\"'s]+)",
-      "!@rx ^[w/.+*-]+(?:s?;s?(?:action|boundary|charset|component|start(?:-info)?|type|version)s?=s?['\\"w.()+,/:=?<>@#*-]+)*$",
-      "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){63}",
-      "@rx ['\\";=]",
-      "@rx ^(?i)up",
-      "!@pm AppleWebKit Android Business Enterprise Entreprise",
-      "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}",
-      "@eq 1",
-      "@streq POST",
-      "!@within %{tx.allowed_methods}",
-      "@gt %{tx.max_num_args}",
-      "!@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:s*,s*|$)){1,7}$",
-      "!@rx ^OPTIONS$",
-      "@rx .([^.]+)$",
-      "!@rx ^(?:OPTIONS|CONNECT)$",
-      "@validateByteRange 9,10,13,32-126,128-255",
-      "@rx (d+)-(d+)",
-      "!@within %{tx.allowed_request_content_type_charset}",
-      "@lt 4",
-      "!@pm AppleWebKit Android",
-      "@rx ^.*$",
-      "@rx b(?:keep-alive|close),s?(?:keep-alive|close)b",
-      "@gt 1",
-      "@rx charset.*?charset",
-      "!@rx ^d+$",
-      "@within %{tx.restricted_extensions}",
-      "@gt %{tx.arg_length}",
-      "!@within %{tx.allowed_request_content_type}",
-      "@within %{tx.restricted_headers_basic}",
-      "@rx .[^.~]+~(?:/.*|)$",
-      "@rx %[0-9a-fA-F]{2}",
-      "@rx ^(?i)application/x-www-form-urlencoded",
-      "!@within %{tx.allowed_http_versions}",
-      "@validateUtf8Encoding",
-      "@gt %{tx.max_file_size}",
-      "!@endsWith .pdf",
-      "!@eq 0",
-      "@rx (?:^|[^x5c])x5c[cdeghijklmpqwxyz123456789]",
-      "@rx ^[^;s]+",
-      "@rx (?i)x5cu[0-9a-f]{4}",
-      "@lt 3",
       "@lt 1",
-      "!@rx ^0$",
-      "@gt %{tx.total_arg_length}",
-      "!@rx (?i)^(?:&(?:(?:[acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|(?:[cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^\\"';=])*$",
-      "@ge 1",
-      "@gt %{tx.combined_file_sizes}",
-      "!@rx (?i)^(?:get /[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?|(?:connect (?:(?:[0-9]{1,3}.){3}[0-9]{1,3}.?(?::[0-9]+)?|[--9A-Z_a-z]+:[0-9]+)|options *|[a-z]{3,10}[sv]+(?:[0-9A-Z_a-z]{3,7}?://[--9A-Z_a-z]*(?::[0-9]+)?)?/[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?)[sv]+[.-9A-Z_a-z]+)$",
-      "@validateUrlEncoding",
-      "@validateByteRange 32,34,38,42-59,61,65-90,95,97-122",
-      "!@rx ^(?:?[01])?$",
-      "@eq 0",
+      "@rx (?:(?:^|[x5c/;]).{2,3}[x5c/;]|[x5c/;].{2,3}(?:[x5c/;]|$))",
+      "@pmFromFile restricted-files.data",
+      "@lt 3",
+      "@lt 4",
+      "@pmFromFile lfi-os-files.data",
       "@lt 2",
-      "@rx x25",
-      "!@streq JSON",
-      "@endsWith .pdf",
-      "@gt 0",
-      "@rx (?:^([d.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$)",
-      "@contains #",
-      "!@rx br|compress|deflate|(?:pack200-)?gzip|identity|*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)",
-      "!@rx ^(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$",
-      "@validateByteRange 38,44-46,48-58,61,65-90,95,97-122",
-      "@validateByteRange 32-36,38-126",
-      "@validateByteRange 1-255",
-      "@gt %{tx.arg_name_length}",
-      "!@rx ^0?$",
-      "@within %{tx.restricted_headers_extended}",
-      "@gt 50",
-      "@rx ^$",
-      "@rx ^(?:GET|HEAD)$"
+      "@rx (?i)(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:.(?:%0[0-1]|?)?|?.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:.|%[25-6ae-f]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))"
     ]
 
 [http.middlewares.bad_bot_block_DETECTION]
   [http.middlewares.bad_bot_block_DETECTION.plugin.badbot]
     userAgent = [
-      "@lt 4",
-      "@lt 3",
-      "@lt 1",
       "@pmFromFile scanners-user-agents.data",
-      "@lt 2"
-    ]
-
-[http.middlewares.bad_bot_block_ATTACK]
-  [http.middlewares.bad_bot_block_ATTACK.plugin.badbot]
-    userAgent = [
-      "@rx unix:[^|]*|",
-      "@rx ^content-types*:s*(.*)$",
-      "@rx [rn]W*?(?:content-(?:type|length)|set-cookie|location):s*w",
-      "@rx ^[^sv,;]+[sv,;].*?(?:application/(?:.++)?json|(?:application/(?:soap+)?|text/)xml)",
-      "@rx [nr]+(?:s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*:",
-      "@rx content-transfer-encoding:(.*)",
-      "@lt 4",
-      "@gt 0",
-      "@gt 1",
-      "!@within |%{tx.allowed_request_content_type_charset}|",
-      "@rx (?:bhttp/d|<(?:html|meta)b)",
-      "@rx ^[^:()&|!<>~]*)s*(?:((?:[^,()=&|!<>~]+[><~]?=|s*[&!|]s*(?:)|()?s*)|)s*(s*[&|!]s*|[&!|]s*([^()=&|!<>~]+[><~]?=[^:()&|!<>~]*)",
-      "!@eq 0",
-      "@rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d",
-      "@lt 3",
       "@lt 1",
-      "@rx ^[^sv,;]+[sv,;].*?b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([+/]))b",
-      "@rx [nr]",
-      "@lt 2",
-      "@rx .",
-      "@rx (][^]]+$|][^]]+[)",
-      "@rx [",
-      "!@rx ^(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$",
-      "@rx TX:paramcounter_(.*)"
-    ]
-
-[http.middlewares.bad_bot_block_LFI]
-  [http.middlewares.bad_bot_block_LFI.plugin.badbot]
-    userAgent = [
-      "@lt 4",
       "@lt 3",
-      "@rx (?i)(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:.(?:%0[0-1]|?)?|?.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:.|%[25-6ae-f]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))",
-      "@pmFromFile lfi-os-files.data",
-      "@lt 1",
-      "@rx (?:(?:^|[x5c/;]).{2,3}[x5c/;]|[x5c/;].{2,3}(?:[x5c/;]|$))",
-      "@pmFromFile restricted-files.data",
-      "@lt 2"
+      "@lt 2",
+      "@lt 4"
     ]
 
-[http.middlewares.bad_bot_block_RFI]
-  [http.middlewares.bad_bot_block_RFI.plugin.badbot]
+[http.middlewares.bad_bot_block_EVALUATION]
+  [http.middlewares.bad_bot_block_EVALUATION.plugin.badbot]
     userAgent = [
-      "@lt 4",
-      "@lt 3",
-      "@rx (?i)(?:bincludes*([^)]*|mosConfig_absolute_path|_CONF[path]|_SERVER[DOCUMENT_ROOT]|GALLERY_BASEDIR|path[docroot]|appserv_root|config[root_dir])=(?:file|ftps?|https?)://",
-      "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)",
+      "@eq 1",
       "@lt 1",
-      "@rx ^(?i:file|ftps?|https?).*??+$",
-      "@rx ^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})",
-      "!@endsWith .%{request_headers.host}",
-      "@lt 2"
-    ]
-
-[http.middlewares.bad_bot_block_RCE]
-  [http.middlewares.bad_bot_block_RCE.plugin.badbot]
-    userAgent = [
-      "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:A(?:PPEND (?:[\\"-#%-&*--9A-Zx5c_a-z]+)?(?: ([ x5ca-z]+))?(?: \\"?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [+-][0-9]{4}\\"?)? {[0-9]{1,20}+?}|UTHENTICATE [-0-9_a-z]{1,20}rn)|L(?:SUB (?:[\\"-#*.-9A-Z_a-z~]+)? (?:[\\"%-&*.-9A-Zx5c_a-z]+)?|ISTRIGHTS (?:[\\"%-&*--9A-Zx5c_a-z]+)?)|S(?:TATUS (?:[\\"%-&*--9A-Zx5c_a-z]+)? ((?:U(?:NSEEN|IDNEXT)|MESSAGES|UIDVALIDITY|RECENT| )+)|ETACL (?:[\\"%-&*--9A-Zx5c_a-z]+)? [+-][ac-eik-lpr-tw-x]+?)|UID (?:COPY|FETCH|STORE) (?:[*,0-:]+)?|(?:(?:DELETE|GET)ACL|MYRIGHTS) (?:[\\"%-&*--9A-Zx5c_a-z]+)?)",
-      "@rx (?i)(?:^|=)[sv]*(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:7[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:b[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|[ckz][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|(?:h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)[sv&)<>|]",
-      "@rx /",
-      "@pmFromFile restricted-upload.data",
-      "@rx ba[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?sb[sv]+[!-\\"%',0-9@-Z_a-z]+=[^sv]",
-      "@rx !-d",
-      "@rx (?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*.[sv].*b",
-      "@rx (?i)(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:7[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:(?:b[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|[ckz][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[&,<>|]|(?:[--.0-9A-Z_a-z][\\"'[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#*-0-9?-@_a-{]*)?x5c?)+[sv&,<>|]).*|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:4|[sv&),<>|].*))|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*)?|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|(?:e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)b",
-      "@rx ^[^.]+.[^;?]+[;?](.*(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]))",
-      "!@rx [0-9]s*'s*[0-9]",
-      "@rx rn(?s:.)*?b(?:(?i:E)(?:HLO [--.A-Za-zx17fx212a]{1,255}|XPN .{1,64})|HELO [--.A-Za-zx17fx212a]{1,255}|MAIL FROM:<.{1,64}(?i:@).{1,255}(?i:>)|(?i:R)(?:CPT TO:(?:(?i:<).{1,64}(?i:@).{1,255}(?i:>)|(?i: ))?(?i:<).{1,64}(?i:>)|SETb)|VRFY .{1,64}(?: <.{1,64}(?i:@).{1,255}(?i:>)|(?i:@).{1,255})|AUTH [-0-9A-Z_a-zx17fx212a]{1,20}(?i: )(?:(?:[+/-9A-Z_a-zx17fx212a]{4})*(?:[+/-9A-Z_a-zx17fx212a]{2}(?i:=)|[+/-9A-Z_a-zx17fx212a]{3}))?(?i:=)|STARTTLSb|NOOPb(?:(?i: ).{1,255})?)",
-      "@rx (?i)(?:(?:^|=)[sv]*(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*|(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*)[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:(?:(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))",
-      "@rx (?i)(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[sv&)<>|]|a(?:dd(?:group|user)|getty|l(?:ias|pine)[sv&)<>|]|nsible-playbook|pt(?:-get|itude[sv&)<>|])|r(?:ch[sv&)<>|]|ia2c)|s(?:cii(?:-xfr|85)|pell)|tobm|xel)|b(?:a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu)|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:a(?:ncel|psh)[sv&)<>|]|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|p(?:an|io|ulimit)|r(?:ash[sv&)<>|]|on(?:tab)?)|s(?:plit|vtool)|u(?:psfilter|rl[sv&)<>|]))|d(?:(?:a(?:sh|te)|i(?:alog|ff))[sv&)<>|]|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:2fsck|(?:asy_instal|va)l|cho[sv&)<>|]|fax|grep|macs|n(?:d(?:if|sw)|v-update)|sac|x(?:ec[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r)))|f(?:acter|(?:etch|lock|unction)[sv&)<>|]|grep|i(?:le(?:[sv&)<>|]|test)|(?:n(?:d|ger)|sh)[sv&)<>|])|o(?:ld[sv&)<>|]|reach)|ping|tp(?:stats|who))|g(?:awk[sv&)<>|]|core|e(?:ni(?:e[sv&)<>|]|soimage)|tfacl[sv&)<>|])|hci|i(?:mp[sv&)<>|]|nsh)|r(?:ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:conv|f(?:config|top)|nstall[sv&)<>|]|onice|p(?:6?tables|config)|spell)|j(?:ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:ill(?:[sv&)<>|]|all)|nife[sv&)<>|]|sshell)|l(?:a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|dconfig|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|(?:inks|ynx)[sv&)<>|]|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:il(?:[sv&)<>q|]|x[sv&)<>|])|ke[sv&)<>|]|ster.passwd|wk)|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|utt[sv&)<>|]|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:a(?:no[sv&)<>|]|sm|wk)|c(?:.(?:openbsd|traditional)|at)|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan))|(?:ice|ull)[sv&)<>|]|map|o(?:de[sv&)<>|]|hup)|ping|roff|s(?:enter|lookup|tat))|o(?:ctave[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:f(?:la)?tex|ksh)|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|(?:ft|gre)p|hp(?:-cgi|[57])|i(?:(?:co|ng)[sv&)<>|]|dstat|gz)|k(?:exec|g_?info|ill)|opd|rint(?:env|f[sv&)<>|])|s(?:ed|ftp|ql)|tar(?:diff|grep)?|u(?:ppet[sv&)<>|]|shd)|wd.db|ython[^sv])|r(?:ak(?:e[sv&)<>|]|u)|bash|e(?:a(?:delf|lpath)|(?:dcarpet|name|p(?:eat|lace))[sv&)<>|]|stic)|l(?:ogin|wrap)|m(?:dir[sv&)<>|]|user)|nano|oute[sv&)<>|]|pm(?:db|(?:quer|verif)y)|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:(?:ash|nap)[sv&)<>|]|c(?:hed|r(?:een|ipt)[sv&)<>|])|diff|e(?:(?:lf|rvice)[sv&)<>|]|ndmail|t(?:arch|env|facl[sv&)<>|]|sid))|ftp|h(?:.distrib|(?:adow|ells)[sv&)<>|]|u(?:f|tdown[sv&)<>|]))|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|sh(?:-key(?:ge|sca)n|pass)|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|udo|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|c(?:l?sh|p(?:dump|ing|traceroute))|elnet|ftp|ime(?:(?:out)?[sv&)<>|]|datectl)|mux|ouch[sv&)<>|]|r(?:aceroute6?|off)|shark)|u(?:limit[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:ew[sv&)<>|]|gr|mdiff|pw|rsh)|olatility[sv&)<>|])|w(?:a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:args|e(?:la)?tex|mo(?:dmap|re)|pad|term|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|s(?:oelim|td(?:(?:ca|m)t|grep|less)?)|ypper))",
-      "@rx ['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]",
-      "@lt 4",
-      "@rx ;[sv]*.[sv]*[\\"']?(?:a(?:rchive|uth)|b(?:a(?:ckup|il)|inary)|c(?:d|h(?:anges|eck)|lone|onnection)|d(?:atabases|b(?:config|info)|ump)|e(?:cho|qp|x(?:cel|it|p(?:ert|lain)))|f(?:ilectrl|ullschema)|he(?:aders|lp)|i(?:mpo(?:rt|ster)|ndexes|otrace)|l(?:i(?:mi|n)t|o(?:ad|g))|(?:mod|n(?:onc|ullvalu)|unmodul)e|o(?:nce|pen|utput)|p(?:arameter|r(?:int|o(?:gress|mpt)))|quit|re(?:ad|cover|store)|s(?:ave|c(?:anstats|hema)|e(?:lftest|parator|ssion)|h(?:a3sum|ell|ow)?|tats|ystem)|t(?:ables|estc(?:ase|trl)|ime(?:out|r)|race)|vfs(?:info|list|name)|width)",
-      "@rx (?i)(?:t[\\"^]*i[\\"^]*m[\\"^]*e|[nr;`{]|||?|&&?)[sv]*[sv\\"'-(,@]*(?:[\\"'.-9A-Z_a-z]+/|(?:[\\"'x5c^]*[0-9A-Z_a-z][\\"'x5c^]*:.*|[ \\"'.-9A-Zx5c^-_a-z]*)x5c)?[\\"^]*(?:a[\\"^]*(?:c[\\"^]*c[\\"^]*c[\\"^]*h[\\"^]*e[\\"^]*c[\\"^]*k[\\"^]*c[\\"^]*o[\\"^]*n[\\"^]*s[\\"^]*o[\\"^]*l[\\"^]*e|d[\\"^]*(?:p[\\"^]*l[\\"^]*u[\\"^]*s|v[\\"^]*p[\\"^]*a[\\"^]*c[\\"^]*k)|(?:g[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*e[\\"^]*x[\\"^]*e[\\"^]*c[\\"^]*u[\\"^]*t[\\"^]*o|s[\\"^]*p[\\"^]*n[\\"^]*e[\\"^]*t[\\"^]*_[\\"^]*c[\\"^]*o[\\"^]*m[\\"^]*p[\\"^]*i[\\"^]*l[\\"^]*e)[\\"^]*r|p[\\"^]*p[\\"^]*(?:i[\\"^]*n[\\"^]*s[\\"^]*t[\\"^]*a[\\"^]*l[\\"^]*l[\\"^]*e[\\"^]*r|v[\\"^]*l[\\"^]*p)|t[\\"^]*(?:[sv,.-/;-<>].*|b[\\"^]*r[\\"^]*o[\\"^]*k[\\"^]*e[\\"^]*r))|b[\\"^]*(?:a[\\"^]*s[\\"^]*h|g[\\"^]*i[\\"^]*n[\\"^]*f[\\"^]*o|i[\\"^]*t[\\"^]*s[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n)|c[\\"^]*(?:d[\\"^]*b|e[\\"^]*r[\\"^]*t[\\"^]*(?:o[\\"^]*c|r[\\"^]*e[\\"^]*q|u[\\"^]*t[\\"^]*i[\\"^]*l)|l[\\"^]*_[\\"^]*(?:i[\\"^]*n[\\"^]*v[\\"^]*o[\\"^]*c[\\"^]*a[\\"^]*t[\\"^]*i[\\"^]*o[\\"^]*n|l[\\"^]*o[\\"^]*a[\\"^]*d[\\"^]*a[\\"^]*s[\\"^]*s[\\"^]*e[\\"^]*m[\\"^]*b[\\"^]*l[\\"^]*y|m[\\"^]*u[\\"^]*t[\\"^]*e[\\"^]*x[\\"^]*v[\\"^]*e[\\"^]*r[\\"^]*i[\\"^]*f[\\"^]*i[\\"^]*e[\\"^]*r[\\"^]*s)|m[\\"^]*(?:d(?:[\\"^]*(?:k[\\"^]*e[\\"^]*y|l[\\"^]*3[\\"^]*2))?|s[\\"^]*t[\\"^]*p)|o[\\"^]*(?:m[\\"^]*s[\\"^]*v[\\"^]*c[\\"^]*s|n[\\"^]*(?:f[\\"^]*i[\\"^]*g[\\"^]*s[\\"^]*e[\\"^]*c[\\"^]*u[\\"^]*r[\\"^]*i[\\"^]*t[\\"^]*y[\\"^]*p[\\"^]*o[\\"^]*l[\\"^]*i[\\"^]*c[\\"^]*y|h[\\"^]*o[\\"^]*s[\\"^]*t|t[\\"^]*r[\\"^]*o[\\"^]*l)|r[\\"^]*e[\\"^]*g[\\"^]*e[\\"^]*n)|r[\\"^]*e[\\"^]*a[\\"^]*t[\\"^]*e[\\"^]*d[\\"^]*u[\\"^]*m[\\"^]*p|s[\\"^]*(?:c(?:[\\"^]*r[\\"^]*i[\\"^]*p[\\"^]*t)?|i)|u[\\"^]*s[\\"^]*t[\\"^]*o[\\"^]*m[\\"^]*s[\\"^]*h[\\"^]*e[\\"^]*l[\\"^]*l[\\"^]*h[\\"^]*o[\\"^]*s[\\"^]*t)|d[\\"^]*(?:a[\\"^]*t[\\"^]*a[\\"^]*s[\\"^]*v[\\"^]*c[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|e[\\"^]*(?:f[\\"^]*a[\\"^]*u[\\"^]*l[\\"^]*t[\\"^]*p[\\"^]*a[\\"^]*c[\\"^]*k|s[\\"^]*k(?:[\\"^]*t[\\"^]*o[\\"^]*p[\\"^]*i[\\"^]*m[\\"^]*g[\\"^]*d[\\"^]*o[\\"^]*w[\\"^]*n[\\"^]*l[\\"^]*d[\\"^]*r)?|v[\\"^]*(?:i[\\"^]*c[\\"^]*e[\\"^]*c[\\"^]*r[\\"^]*e[\\"^]*d[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*i[\\"^]*a[\\"^]*l[\\"^]*d[\\"^]*e[\\"^]*p[\\"^]*l[\\"^]*o[\\"^]*y[\\"^]*m[\\"^]*e[\\"^]*n[\\"^]*t|t[\\"^]*o[\\"^]*o[\\"^]*l[\\"^]*s[\\"^]*l[\\"^]*a[\\"^]*u[\\"^]*n[\\"^]*c[\\"^]*h[\\"^]*e[\\"^]*r))|f[\\"^]*s[\\"^]*(?:h[\\"^]*i[\\"^]*m|v[\\"^]*c)|i[\\"^]*(?:a[\\"^]*n[\\"^]*t[\\"^]*z|s[\\"^]*k[\\"^]*s[\\"^]*h[\\"^]*a[\\"^]*d[\\"^]*o[\\"^]*w)|n[\\"^]*(?:s[\\"^]*c[\\"^]*m[\\"^]*d|x)|o[\\"^]*t[\\"^]*n[\\"^]*e[\\"^]*t|u[\\"^]*m[\\"^]*p[\\"^]*6[\\"^]*4|x[\\"^]*c[\\"^]*a[\\"^]*p)|e[\\"^]*(?:s[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*u[\\"^]*t[\\"^]*l|v[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*v[\\"^]*w[\\"^]*r|x[\\"^]*(?:c[\\"^]*e[\\"^]*l|p[\\"^]*(?:a[\\"^]*n[\\"^]*d|l[\\"^]*o[\\"^]*r[\\"^]*e[\\"^]*r)|t[\\"^]*(?:e[\\"^]*x[\\"^]*p[\\"^]*o[\\"^]*r[\\"^]*t|r[\\"^]*a[\\"^]*c[\\"^]*3[\\"^]*2)))|f[\\"^]*(?:i[\\"^]*n[\\"^]*(?:d[\\"^]*s[\\"^]*t|g[\\"^]*e)[\\"^]*r|l[\\"^]*t[\\"^]*m[\\"^]*c|o[\\"^]*r[\\"^]*f[\\"^]*i[\\"^]*l[\\"^]*e[\\"^]*s|s[\\"^]*(?:i(?:[\\"^]*a[\\"^]*n[\\"^]*y[\\"^]*c[\\"^]*p[\\"^]*u)?|u[\\"^]*t[\\"^]*i[\\"^]*l)|t[\\"^]*p)|g[\\"^]*(?:f[\\"^]*x[\\"^]*d[\\"^]*o[\\"^]*w[\\"^]*n[\\"^]*l[\\"^]*o[\\"^]*a[\\"^]*d[\\"^]*w[\\"^]*r[\\"^]*a[\\"^]*p[\\"^]*p[\\"^]*e[\\"^]*r|p[\\"^]*s[\\"^]*c[\\"^]*r[\\"^]*i[\\"^]*p[\\"^]*t)|h[\\"^]*h|i[\\"^]*(?:e[\\"^]*(?:4[\\"^]*u[\\"^]*i[\\"^]*n[\\"^]*i[\\"^]*t|a[\\"^]*d[\\"^]*v[\\"^]*p[\\"^]*a[\\"^]*c[\\"^]*k|e[\\"^]*x[\\"^]*e[\\"^]*c|f[\\"^]*r[\\"^]*a[\\"^]*m[\\"^]*e)|l[\\"^]*a[\\"^]*s[\\"^]*m|m[\\"^]*e[\\"^]*w[\\"^]*d[\\"^]*b[\\"^]*l[\\"^]*d|n[\\"^]*(?:f[\\"^]*d[\\"^]*e[\\"^]*f[\\"^]*a[\\"^]*u[\\"^]*l[\\"^]*t[\\"^]*i[\\"^]*n[\\"^]*s[\\"^]*t[\\"^]*a[\\"^]*l|s[\\"^]*t[\\"^]*a[\\"^]*l[\\"^]*l[\\"^]*u[\\"^]*t[\\"^]*i)[\\"^]*l)|j[\\"^]*s[\\"^]*c|l[\\"^]*(?:a[\\"^]*u[\\"^]*n[\\"^]*c[\\"^]*h[\\"^]*-[\\"^]*v[\\"^]*s[\\"^]*d[\\"^]*e[\\"^]*v[\\"^]*s[\\"^]*h[\\"^]*e[\\"^]*l[\\"^]*l|d[\\"^]*i[\\"^]*f[\\"^]*d[\\"^]*e)|m[\\"^]*(?:a[\\"^]*(?:k[\\"^]*e[\\"^]*c[\\"^]*a[\\"^]*b|n[\\"^]*a[\\"^]*g[\\"^]*e[\\"^]*-[\\"^]*b[\\"^]*d[\\"^]*e|v[\\"^]*i[\\"^]*n[\\"^]*j[\\"^]*e[\\"^]*c[\\"^]*t)|f[\\"^]*t[\\"^]*r[\\"^]*a[\\"^]*c[\\"^]*e|i[\\"^]*c[\\"^]*r[\\"^]*o[\\"^]*s[\\"^]*o[\\"^]*f[\\"^]*t|m[\\"^]*c|p[\\"^]*c[\\"^]*m[\\"^]*d[\\"^]*r[\\"^]*u[\\"^]*n|s[\\"^]*(?:(?:b[\\"^]*u[\\"^]*i[\\"^]*l|o[\\"^]*h[\\"^]*t[\\"^]*m[\\"^]*e)[\\"^]*d|c[\\"^]*o[\\"^]*n[\\"^]*f[\\"^]*i[\\"^]*g|d[\\"^]*(?:e[\\"^]*p[\\"^]*l[\\"^]*o[\\"^]*y|t)|h[\\"^]*t[\\"^]*(?:a|m[\\"^]*l)|i[\\"^]*e[\\"^]*x[\\"^]*e[\\"^]*c|p[\\"^]*u[\\"^]*b|x[\\"^]*s[\\"^]*l))|n[\\"^]*(?:e[\\"^]*t[\\"^]*s[\\"^]*h|t[\\"^]*d[\\"^]*s[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l)|o[\\"^]*(?:d[\\"^]*b[\\"^]*c[\\"^]*c[\\"^]*o[\\"^]*n[\\"^]*f|f[\\"^]*f[\\"^]*l[\\"^]*i[\\"^]*n[\\"^]*e[\\"^]*s[\\"^]*c[\\"^]*a[\\"^]*n[\\"^]*n[\\"^]*e[\\"^]*r[\\"^]*s[\\"^]*h[\\"^]*e[\\"^]*l[\\"^]*l|n[\\"^]*e[\\"^]*d[\\"^]*r[\\"^]*i[\\"^]*v[\\"^]*e[\\"^]*s[\\"^]*t[\\"^]*a[\\"^]*n[\\"^]*d[\\"^]*a[\\"^]*l[\\"^]*o[\\"^]*n[\\"^]*e[\\"^]*u[\\"^]*p[\\"^]*d[\\"^]*a[\\"^]*t[\\"^]*e[\\"^]*r|p[\\"^]*e[\\"^]*n[\\"^]*c[\\"^]*o[\\"^]*n[\\"^]*s[\\"^]*o[\\"^]*l[\\"^]*e)|p[\\"^]*(?:c[\\"^]*(?:a[\\"^]*l[\\"^]*u[\\"^]*a|w[\\"^]*(?:r[\\"^]*u[\\"^]*n|u[\\"^]*t[\\"^]*l))|(?:e[\\"^]*s[\\"^]*t[\\"^]*e|s)[\\"^]*r|(?:k[\\"^]*t[\\"^]*m[\\"^]*o|u[\\"^]*b[\\"^]*p[\\"^]*r)[\\"^]*n|n[\\"^]*p[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|o[\\"^]*w[\\"^]*e[\\"^]*r[\\"^]*p[\\"^]*n[\\"^]*t|r[\\"^]*(?:e[\\"^]*s[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*a[\\"^]*t[\\"^]*i[\\"^]*o[\\"^]*n[\\"^]*h[\\"^]*o[\\"^]*s[\\"^]*t|i[\\"^]*n[\\"^]*t(?:[\\"^]*b[\\"^]*r[\\"^]*m)?|o[\\"^]*(?:c[\\"^]*d[\\"^]*u[\\"^]*m[\\"^]*p|t[\\"^]*o[\\"^]*c[\\"^]*o[\\"^]*l[\\"^]*h[\\"^]*a[\\"^]*n[\\"^]*d[\\"^]*l[\\"^]*e[\\"^]*r)))|r[\\"^]*(?:a[\\"^]*s[\\"^]*a[\\"^]*u[\\"^]*t[\\"^]*o[\\"^]*u|c[\\"^]*s[\\"^]*i|(?:d[\\"^]*r[\\"^]*l[\\"^]*e[\\"^]*a[\\"^]*k[\\"^]*d[\\"^]*i[\\"^]*a|p[\\"^]*c[\\"^]*p[\\"^]*i[\\"^]*n)[\\"^]*g|e[\\"^]*(?:g(?:[\\"^]*(?:a[\\"^]*s[\\"^]*m|e[\\"^]*d[\\"^]*i[\\"^]*t|i[\\"^]*(?:n[\\"^]*i|s[\\"^]*t[\\"^]*e[\\"^]*r[\\"^]*-[\\"^]*c[\\"^]*i[\\"^]*m[\\"^]*p[\\"^]*r[\\"^]*o[\\"^]*v[\\"^]*i[\\"^]*d[\\"^]*e[\\"^]*r)|s[\\"^]*v[\\"^]*(?:c[\\"^]*s|r[\\"^]*3[\\"^]*2)))?|(?:m[\\"^]*o[\\"^]*t|p[\\"^]*l[\\"^]*a[\\"^]*c)[\\"^]*e)|u[\\"^]*n[\\"^]*(?:d[\\"^]*l[\\"^]*l[\\"^]*3[\\"^]*2|(?:e[\\"^]*x[\\"^]*e|s[\\"^]*c[\\"^]*r[\\"^]*i[\\"^]*p[\\"^]*t)[\\"^]*h[\\"^]*e[\\"^]*l[\\"^]*p[\\"^]*e[\\"^]*r|o[\\"^]*n[\\"^]*c[\\"^]*e))|s[\\"^]*(?:c[\\"^]*(?:[sv,.-/;-<>].*|h[\\"^]*t[\\"^]*a[\\"^]*s[\\"^]*k[\\"^]*s|r[\\"^]*i[\\"^]*p[\\"^]*t[\\"^]*r[\\"^]*u[\\"^]*n[\\"^]*n[\\"^]*e[\\"^]*r)|e[\\"^]*t[\\"^]*(?:r[\\"^]*e[\\"^]*s|t[\\"^]*i[\\"^]*n[\\"^]*g[\\"^]*s[\\"^]*y[\\"^]*n[\\"^]*c[\\"^]*h[\\"^]*o[\\"^]*s[\\"^]*t|u[\\"^]*p[\\"^]*a[\\"^]*p[\\"^]*i)|h[\\"^]*(?:d[\\"^]*o[\\"^]*c[\\"^]*v[\\"^]*w|e[\\"^]*l[\\"^]*l[\\"^]*3[\\"^]*2)|q[\\"^]*(?:l[\\"^]*(?:d[\\"^]*u[\\"^]*m[\\"^]*p[\\"^]*e[\\"^]*r|(?:t[\\"^]*o[\\"^]*o[\\"^]*l[\\"^]*s[\\"^]*)?p[\\"^]*s)|u[\\"^]*i[\\"^]*r[\\"^]*r[\\"^]*e[\\"^]*l)|s[\\"^]*h|t[\\"^]*o[\\"^]*r[\\"^]*d[\\"^]*i[\\"^]*a[\\"^]*g|y[\\"^]*(?:n[\\"^]*c[\\"^]*a[\\"^]*p[\\"^]*p[\\"^]*v[\\"^]*p[\\"^]*u[\\"^]*b[\\"^]*l[\\"^]*i[\\"^]*s[\\"^]*h[\\"^]*i[\\"^]*n[\\"^]*g[\\"^]*s[\\"^]*e[\\"^]*r[\\"^]*v[\\"^]*e[\\"^]*r|s[\\"^]*s[\\"^]*e[\\"^]*t[\\"^]*u[\\"^]*p))|t[\\"^]*(?:e[\\"^]*[sv,.-/;-<>].*|r[\\"^]*a[\\"^]*c[\\"^]*k[\\"^]*e[\\"^]*r|t[\\"^]*(?:d[\\"^]*i[\\"^]*n[\\"^]*j[\\"^]*e[\\"^]*c[\\"^]*t|t[\\"^]*r[\\"^]*a[\\"^]*c[\\"^]*e[\\"^]*r))|u[\\"^]*(?:n[\\"^]*r[\\"^]*e[\\"^]*g[\\"^]*m[\\"^]*p[\\"^]*2|p[\\"^]*d[\\"^]*a[\\"^]*t[\\"^]*e|r[\\"^]*l|t[\\"^]*i[\\"^]*l[\\"^]*i[\\"^]*t[\\"^]*y[\\"^]*f[\\"^]*u[\\"^]*n[\\"^]*c[\\"^]*t[\\"^]*i[\\"^]*o[\\"^]*n[\\"^]*s)|v[\\"^]*(?:b[\\"^]*c|e[\\"^]*r[\\"^]*c[\\"^]*l[\\"^]*s[\\"^]*i[\\"^]*d|i[\\"^]*s[\\"^]*u[\\"^]*a[\\"^]*l[\\"^]*u[\\"^]*i[\\"^]*a[\\"^]*v[\\"^]*e[\\"^]*r[\\"^]*i[\\"^]*f[\\"^]*y[\\"^]*n[\\"^]*a[\\"^]*t[\\"^]*i[\\"^]*v[\\"^]*e|s[\\"^]*(?:i[\\"^]*i[\\"^]*s[\\"^]*e[\\"^]*x[\\"^]*e[\\"^]*l[\\"^]*a[\\"^]*u[\\"^]*n[\\"^]*c[\\"^]*h|j[\\"^]*i[\\"^]*t[\\"^]*d[\\"^]*e[\\"^]*b[\\"^]*u[\\"^]*g[\\"^]*g)[\\"^]*e[\\"^]*r)|w[\\"^]*(?:a[\\"^]*b|(?:f|m[\\"^]*i)[\\"^]*c|i[\\"^]*n[\\"^]*(?:g[\\"^]*e[\\"^]*t|r[\\"^]*m|w[\\"^]*o[\\"^]*r[\\"^]*d)|l[\\"^]*r[\\"^]*m[\\"^]*d[\\"^]*r|o[\\"^]*r[\\"^]*k[\\"^]*f[\\"^]*o[\\"^]*l[\\"^]*d[\\"^]*e[\\"^]*r[\\"^]*s|s[\\"^]*(?:(?:c[\\"^]*r[\\"^]*i[\\"^]*p|r[\\"^]*e[\\"^]*s[\\"^]*e)[\\"^]*t|l)|t[\\"^]*[sv,.-/;-<>].*|u[\\"^]*a[\\"^]*u[\\"^]*c[\\"^]*l[\\"^]*t)|x[\\"^]*w[\\"^]*i[\\"^]*z[\\"^]*a[\\"^]*r[\\"^]*d|z[\\"^]*i[\\"^]*p[\\"^]*f[\\"^]*l[\\"^]*d[\\"^]*r)(?:.[\\"^]*[0-9A-Z_a-z]+)?b",
-      "@rx rn(?s:.)*?b(?:(?:QUI|STA|RSE)(?i:T)|NOOP|CAPA)",
-      "@rx ^(s*)s+{",
-      "@rx $(?:((?:.*|(.*)))|{.*})|[<>](.*)|/[0-9A-Z_a-z]*[!?.+]",
-      "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:C(?:(?:REATE|OPY [*,0-:]+) [\\"-#%-&*--9A-Zx5c_a-z]+|APABILITY|HECK|LOSE)|DELETE [\\"-#%-&*--.0-9A-Zx5c_a-z]+|EX(?:AMINE [\\"-#%-&*--.0-9A-Zx5c_a-z]+|PUNGE)|FETCH [*,0-:]+|L(?:IST [\\"-#*--9A-Zx5c_a-z~]+? [\\"-#%-&*--9A-Zx5c_a-z]+|OG(?:IN [--.0-9@_a-z]{1,40} .*?|OUT))|RENAME [\\"-#%-&*--9A-Zx5c_a-z]+? [\\"-#%-&*--9A-Zx5c_a-z]+|S(?:E(?:LECT [\\"-#%-&*--9A-Zx5c_a-z]+|ARCH(?: CHARSET [--.0-9A-Z_a-z]{1,40})? (?:(KEYWORD x5c)?(?:A(?:LL|NSWERED)|BCC|D(?:ELETED|RAFT)|(?:FLAGGE|OL)D|RECENT|SEEN|UN(?:(?:ANSWER|FLAGG)ED|D(?:ELETED|RAFT)|SEEN)|NEW)|(?:BODY|CC|FROM|HEADER .{1,100}|NOT|OR .{1,255}|T(?:EXT|O)) .{1,255}|LARGER [0-9]{1,20}|[*,0-:]+|(?:BEFORE|ON|S(?:ENT(?:(?:BEFOR|SINC)E|ON)|INCE)) \\"?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4}\\"?|S(?:MALLER [0-9]{1,20}|UBJECT .{1,255})|U(?:ID [*,0-:]+?|NKEYWORD x5c(Seen|(?:Answer|Flagg)ed|D(?:eleted|raft)|Recent))))|T(?:ORE [*,0-:]+? [+-]?FLAGS(?:.SILENT)? (?:(x5c[a-z]{1,20}))?|ARTTLS)|UBSCRIBE [\\"-#%-&*--9A-Zx5c_a-z]+)|UN(?:SUBSCRIBE [\\"-#%-&*--9A-Zx5c_a-z]+|AUTHENTICATE)|NOOP)",
-      "@rx s",
+      "@ge 2",
+      "@ge 4",
+      "@ge %{tx.outbound_anomaly_score_threshold}",
       "@lt 3",
-      "@rx (?i)(?:[nr;`{]|||?|&&?)[sv]*[sv\\"'-(,@]*(?:[\\"'.-9A-Z_a-z]+/|(?:[\\"'x5c^]*[0-9A-Z_a-z][\\"'x5c^]*:.*|[ \\"'.-9A-Zx5c^-_a-z]*)x5c)?[\\"^]*(?:(?:a[\\"^]*(?:c|s[\\"^]*n[\\"^]*p)|e[\\"^]*(?:b[\\"^]*p|p[\\"^]*(?:a[\\"^]*l|c[\\"^]*s[\\"^]*v|s[\\"^]*n)|[tx][\\"^]*s[\\"^]*n)|f[\\"^]*(?:[cltw]|o[\\"^]*r[\\"^]*e[\\"^]*a[\\"^]*c[\\"^]*h)|i[\\"^]*(?:[cr][\\"^]*m|e[\\"^]*x|h[\\"^]*y|i|p[\\"^]*(?:a[\\"^]*l|c[\\"^]*s[\\"^]*v|m[\\"^]*o|s[\\"^]*n)|s[\\"^]*e|w[\\"^]*(?:m[\\"^]*i|r))|m[\\"^]*(?:a[\\"^]*n|[dipv]|o[\\"^]*u[\\"^]*n[\\"^]*t)|o[\\"^]*g[\\"^]*v|p[\\"^]*(?:o[\\"^]*p|u[\\"^]*s[\\"^]*h)[\\"^]*d|t[\\"^]*r[\\"^]*c[\\"^]*m|w[\\"^]*j[\\"^]*b)[\\"^]*[sv,.-/;-<>].*|c[\\"^]*(?:(?:(?:d|h[\\"^]*d[\\"^]*i[\\"^]*r|v[\\"^]*p[\\"^]*a)[\\"^]*|p[\\"^]*(?:[ip][\\"^]*)?)[sv,.-/;-<>].*|l[\\"^]*(?:(?:[cipv]|h[\\"^]*y)[\\"^]*[sv,.-/;-<>].*|s)|n[\\"^]*s[\\"^]*n)|d[\\"^]*(?:(?:b[\\"^]*p|e[\\"^]*l|i[\\"^]*(?:f[\\"^]*f|r))[\\"^]*[sv,.-/;-<>].*|n[\\"^]*s[\\"^]*n)|g[\\"^]*(?:(?:(?:(?:a[\\"^]*)?l|b[\\"^]*p|d[\\"^]*r|h[\\"^]*y|(?:w[\\"^]*m[\\"^]*)?i|j[\\"^]*b|[u-v])[\\"^]*|c[\\"^]*(?:[ims][\\"^]*)?|m[\\"^]*(?:o[\\"^]*)?|s[\\"^]*(?:n[\\"^]*(?:p[\\"^]*)?|v[\\"^]*))[sv,.-/;-<>].*|e[\\"^]*r[\\"^]*r|p[\\"^]*(?:(?:s[\\"^]*)?[sv,.-/;-<>].*|v))|l[\\"^]*s|n[\\"^]*(?:(?:a[\\"^]*l|d[\\"^]*r|[iv]|m[\\"^]*o|s[\\"^]*n)[\\"^]*[sv,.-/;-<>].*|p[\\"^]*s[\\"^]*s[\\"^]*c)|r[\\"^]*(?:(?:(?:(?:b[\\"^]*)?p|e[\\"^]*n|(?:w[\\"^]*m[\\"^]*)?i|j[\\"^]*b|n[\\"^]*[ip])[\\"^]*|d[\\"^]*(?:r[\\"^]*)?|m[\\"^]*(?:(?:d[\\"^]*i[\\"^]*r|o)[\\"^]*)?|s[\\"^]*n[\\"^]*(?:p[\\"^]*)?|v[\\"^]*(?:p[\\"^]*a[\\"^]*)?)[sv,.-/;-<>].*|c[\\"^]*(?:j[\\"^]*b[\\"^]*[sv,.-/;-<>].*|s[\\"^]*n)|u[\\"^]*j[\\"^]*b)|s[\\"^]*(?:(?:(?:a[\\"^]*(?:j[\\"^]*b|l|p[\\"^]*s|s[\\"^]*v)|b[\\"^]*p|[civ]|w[\\"^]*m[\\"^]*i)[\\"^]*|l[\\"^]*(?:s[\\"^]*)?|p[\\"^]*(?:(?:j[\\"^]*b|p[\\"^]*s|s[\\"^]*v)[\\"^]*)?)[sv,.-/;-<>].*|h[\\"^]*c[\\"^]*m|u[\\"^]*j[\\"^]*b))(?:.[\\"^]*[0-9A-Z_a-z]+)?b",
-      "@lt 1",
-      "@rx (?:$(?:((?:(.*)|.*))|{.*})|[<>](.*)|[!?.+])",
-      "@rx (?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:(?:(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))b",
+      "@ge %{tx.inbound_anomaly_score_threshold}",
+      "@ge 3",
       "@lt 2",
-      "@rx rn(?s:.)*?b(?:DATA|QUIT|HELP(?: .{1,255})?)",
-      "@rx (?i)[-0-9_a-z]+(?:[\\"'[-]]+|$+[!#*-0-9?-@x5c_a-{]+|``|[$<>]())[sv]*[-0-9_a-z]+",
-      "@rx (?i)(?:(?:^|=)[sv]*(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*|(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*)[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:c|a(?:ll|tch)[sv&)<>|]|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))",
-      "@pmFromFile unix-shell.data",
-      "@pmFromFile windows-powershell-commands.data",
-      "@rx (?is)rn.*?b(?:(?:LIST|TOP [0-9]+)(?: [0-9]+)?|U(?:SER .+?|IDL(?: [0-9]+)?)|PASS .+?|(?:RETR|DELE) [0-9]+?|A(?:POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [-0-9A-Z_]{1,20} (?:(?:[+/-9A-Z_a-z]{4})*(?:[+/-9A-Z_a-z]{2}=|[+/-9A-Z_a-z]{3}))?=))",
-      "@rx (?i)b(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:(?:itude)?[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|n?f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|s(?:[sv&)<>|]|ed|ftp|ql)?|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:ew)?[sv&)<>|]|m(?:[sv&)<>|]|diff)|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:[sv&)<>c|]|h(?:o(?:[sv&)<>|]|ami|is)?|iptail[sv&)<>|])|a(?:ll|tch)[sv&)<>|]|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))b",
-      "@rx !(?:d|!)",
-      "@rx (?i)(?:^|=)[sv]*(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:a(?:ddgroup|xel)|b(?:ase(?:32|64|nc)|lkid|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|yobu|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:h(?:g(?:passwd|rp)|pass|sh)|lang++|oproc|ron)|d(?:iff[sv&)<>|]|mesg|oas)|e(?:2fsck|grep)|f(?:grep|iletest|tp(?:stats|who))|g(?:r(?:ep[sv&)<>|]|oupmod)|unzip|z(?:cat|exe|ip))|htop|l(?:ast(?:comm|log(?:in)?)|ess(?:echo|(?:fil|pip)e)|ftp(?:get)?|osetup|s(?:-F|b_release|cpu|mod|of|pci|usb)|wp-download|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:ilq|ster.passwd)|k(?:fifo|nod|temp)|locate|ysql(?:admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:.(?:openbsd|traditional)|at)|et(?:(?:c|st)at|kit-ftp|plan)|ohup|ping|stat)|onintr|p(?:dksh|erl5?|(?:ft|gre)p|hp(?:-cgi|[57])|igz|k(?:exec|ill)|(?:op|se)d|rint(?:env|f[sv&)<>|])|tar(?:diff|grep)?|wd.db|ython[2-3])|r(?:(?:bas|ealpat)h|m(?:dir[sv&)<>|]|user)|nano|sync)|s(?:diff|e(?:ndmail|t(?:env|sid))|ftp|(?:h.distri|pwd.d)b|ocat|td(?:err|in|out)|udo|ysctl)|t(?:ailf|c(?:p(?:ing|traceroute)|sh)|elnet|imeout[sv&)<>|]|raceroute6?)|u(?:n(?:ame|lz(?:4|ma)|(?:pig|x)z|rar|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:gr|pw)|w(?:get|hoami)|x(?:args|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:c(?:at|mp)|diff|[e-f]?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|std(?:(?:ca|m)t|grep|less)?))",
-      "@rx (?i)(?:(?:^|=)[sv]*(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*|(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*)[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|an|io|ulimit)|s(?:h|plit|vtool)|u(?:(?:t|rl)[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|inks|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[^sv])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash|nap)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:3m|c|a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))",
-      "@rx ^[^.]*?(?:['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{])",
-      "@rx b(?:for(?:/[dflr].*)? %+[^ ]+ in(.*)[sv]?do|if(?:/i)?(?: not)?(?: (?:e(?:xist|rrorlevel)|defined|cmdextversion)b|[ (].*(?:b(?:g(?:eq|tr)|equ|neq|l(?:eq|ss))b|==)))",
-      "@rx (?i).|(?:[sv]*|t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:7[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|G[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?E[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?T|a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:b|(?:p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?t|r(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[jp])?|s(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ks])|b[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[8-9][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?9|[au][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|c|(?:m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?p|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dfu]|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[gr])|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[bdx]|n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|q[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|s(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?)|f[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[c-dgi]|m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|g[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[chr][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|o|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dp]|r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b)|j[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:j[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|q)|k[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|l[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)?|[nps]|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a|z(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|v)|n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[cl]|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|(?:p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|o[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[at][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?x|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|f|(?:k[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?g|h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cp]|r(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?y)?|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|c(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dv]|(?:p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dt]|[g-hu]|s(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cr]|b[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l|[co][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ex]|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c)|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|l)|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:3[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|c)|x[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:x[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|z)|y[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)|z[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h))",
-      "@rx /(?:[?*]+[a-z/]+|[a-z/]+[?*]+)",
-      "@rx (?i)(?:t[\\"^]*i[\\"^]*m[\\"^]*e|[nr;`{]|||?|&&?)[sv]*[sv\\"'-(,@]*(?:[\\"'.-9A-Z_a-z]+/|(?:[\\"'x5c^]*[0-9A-Z_a-z][\\"'x5c^]*:.*|[ \\"'.-9A-Zx5c^-_a-z]*)x5c)?[\\"^]*(?:a[\\"^]*(?:s[\\"^]*s[\\"^]*o[\\"^]*c|t[\\"^]*(?:m[\\"^]*a[\\"^]*d[\\"^]*m|t[\\"^]*r[\\"^]*i[\\"^]*b)|u[\\"^]*(?:d[\\"^]*i[\\"^]*t[\\"^]*p[\\"^]*o[\\"^]*l|t[\\"^]*o[\\"^]*(?:c[\\"^]*(?:h[\\"^]*k|o[\\"^]*n[\\"^]*v)|(?:f[\\"^]*m|m[\\"^]*o[\\"^]*u[\\"^]*n)[\\"^]*t)))|b[\\"^]*(?:c[\\"^]*d[\\"^]*(?:b[\\"^]*o[\\"^]*o|e[\\"^]*d[\\"^]*i)[\\"^]*t|(?:d[\\"^]*e[\\"^]*h[\\"^]*d|o[\\"^]*o[\\"^]*t)[\\"^]*c[\\"^]*f[\\"^]*g|i[\\"^]*t[\\"^]*s[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n)|c[\\"^]*(?:a[\\"^]*c[\\"^]*l[\\"^]*s|e[\\"^]*r[\\"^]*t[\\"^]*(?:r[\\"^]*e[\\"^]*q|u[\\"^]*t[\\"^]*i[\\"^]*l)|h[\\"^]*(?:c[\\"^]*p|d[\\"^]*i[\\"^]*r|g[\\"^]*(?:l[\\"^]*o[\\"^]*g[\\"^]*o[\\"^]*n|p[\\"^]*o[\\"^]*r[\\"^]*t|u[\\"^]*s[\\"^]*r)|k[\\"^]*(?:d[\\"^]*s[\\"^]*k|n[\\"^]*t[\\"^]*f[\\"^]*s))|l[\\"^]*e[\\"^]*a[\\"^]*n[\\"^]*m[\\"^]*g[\\"^]*r|m[\\"^]*(?:d(?:[\\"^]*k[\\"^]*e[\\"^]*y)?|s[\\"^]*t[\\"^]*p)|s[\\"^]*c[\\"^]*r[\\"^]*i[\\"^]*p[\\"^]*t)|d[\\"^]*(?:c[\\"^]*(?:d[\\"^]*i[\\"^]*a[\\"^]*g|g[\\"^]*p[\\"^]*o[\\"^]*f[\\"^]*i[\\"^]*x)|e[\\"^]*(?:f[\\"^]*r[\\"^]*a[\\"^]*g|l)|f[\\"^]*s[\\"^]*(?:d[\\"^]*i[\\"^]*a|r[\\"^]*m[\\"^]*i)[\\"^]*g|i[\\"^]*(?:a[\\"^]*n[\\"^]*t[\\"^]*z|r|s[\\"^]*(?:k[\\"^]*(?:c[\\"^]*o[\\"^]*(?:m[\\"^]*p|p[\\"^]*y)|p[\\"^]*(?:a[\\"^]*r[\\"^]*t|e[\\"^]*r[\\"^]*f)|r[\\"^]*a[\\"^]*i[\\"^]*d|s[\\"^]*h[\\"^]*a[\\"^]*d[\\"^]*o[\\"^]*w)|p[\\"^]*d[\\"^]*i[\\"^]*a[\\"^]*g))|n[\\"^]*s[\\"^]*c[\\"^]*m[\\"^]*d|(?:o[\\"^]*s[\\"^]*k[\\"^]*e|r[\\"^]*i[\\"^]*v[\\"^]*e[\\"^]*r[\\"^]*q[\\"^]*u[\\"^]*e[\\"^]*r)[\\"^]*y)|e[\\"^]*(?:n[\\"^]*d[\\"^]*l[\\"^]*o[\\"^]*c[\\"^]*a[\\"^]*l|v[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*c[\\"^]*r[\\"^]*e[\\"^]*a[\\"^]*t[\\"^]*e)|E[\\"^]*v[\\"^]*n[\\"^]*t[\\"^]*c[\\"^]*m[\\"^]*d|f[\\"^]*(?:c|i[\\"^]*(?:l[\\"^]*e[\\"^]*s[\\"^]*y[\\"^]*s[\\"^]*t[\\"^]*e[\\"^]*m[\\"^]*s|n[\\"^]*d[\\"^]*s[\\"^]*t[\\"^]*r)|l[\\"^]*a[\\"^]*t[\\"^]*t[\\"^]*e[\\"^]*m[\\"^]*p|o[\\"^]*r(?:[\\"^]*f[\\"^]*i[\\"^]*l[\\"^]*e[\\"^]*s)?|r[\\"^]*e[\\"^]*e[\\"^]*d[\\"^]*i[\\"^]*s[\\"^]*k|s[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|(?:t[\\"^]*y[\\"^]*p|v[\\"^]*e[\\"^]*u[\\"^]*p[\\"^]*d[\\"^]*a[\\"^]*t)[\\"^]*e)|g[\\"^]*(?:e[\\"^]*t[\\"^]*(?:m[\\"^]*a[\\"^]*c|t[\\"^]*y[\\"^]*p[\\"^]*e)|o[\\"^]*t[\\"^]*o|p[\\"^]*(?:f[\\"^]*i[\\"^]*x[\\"^]*u[\\"^]*p|(?:r[\\"^]*e[\\"^]*s[\\"^]*u[\\"^]*l[\\"^]*)?t|u[\\"^]*p[\\"^]*d[\\"^]*a[\\"^]*t[\\"^]*e)|r[\\"^]*a[\\"^]*f[\\"^]*t[\\"^]*a[\\"^]*b[\\"^]*l)|h[\\"^]*(?:e[\\"^]*l[\\"^]*p[\\"^]*c[\\"^]*t[\\"^]*r|o[\\"^]*s[\\"^]*t[\\"^]*n[\\"^]*a[\\"^]*m[\\"^]*e)|i[\\"^]*(?:c[\\"^]*a[\\"^]*c[\\"^]*l[\\"^]*s|f|p[\\"^]*(?:c[\\"^]*o[\\"^]*n[\\"^]*f[\\"^]*i[\\"^]*g|x[\\"^]*r[\\"^]*o[\\"^]*u[\\"^]*t[\\"^]*e)|r[\\"^]*f[\\"^]*t[\\"^]*p)|j[\\"^]*e[\\"^]*t[\\"^]*p[\\"^]*a[\\"^]*c[\\"^]*k|k[\\"^]*(?:l[\\"^]*i[\\"^]*s[\\"^]*t|s[\\"^]*e[\\"^]*t[\\"^]*u[\\"^]*p|t[\\"^]*(?:m[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|p[\\"^]*a[\\"^]*s[\\"^]*s))|l[\\"^]*(?:o[\\"^]*(?:d[\\"^]*c[\\"^]*t[\\"^]*r|g[\\"^]*(?:m[\\"^]*a[\\"^]*n|o[\\"^]*f[\\"^]*f))|p[\\"^]*[q-r])|m[\\"^]*(?:a[\\"^]*(?:c[\\"^]*f[\\"^]*i[\\"^]*l[\\"^]*e|k[\\"^]*e[\\"^]*c[\\"^]*a[\\"^]*b|p[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n)|k[\\"^]*(?:d[\\"^]*i[\\"^]*r|l[\\"^]*i[\\"^]*n[\\"^]*k)|m[\\"^]*c|o[\\"^]*u[\\"^]*n[\\"^]*t[\\"^]*v[\\"^]*o[\\"^]*l|q[\\"^]*(?:b[\\"^]*k[\\"^]*u[\\"^]*p|(?:t[\\"^]*g[\\"^]*)?s[\\"^]*v[\\"^]*c)|s[\\"^]*(?:d[\\"^]*t|i[\\"^]*(?:e[\\"^]*x[\\"^]*e[\\"^]*c|n[\\"^]*f[\\"^]*o[\\"^]*3[\\"^]*2)|t[\\"^]*s[\\"^]*c))|n[\\"^]*(?:b[\\"^]*t[\\"^]*s[\\"^]*t[\\"^]*a[\\"^]*t|e[\\"^]*t[\\"^]*(?:c[\\"^]*f[\\"^]*g|d[\\"^]*o[\\"^]*m|s[\\"^]*(?:h|t[\\"^]*a[\\"^]*t))|f[\\"^]*s[\\"^]*(?:a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n|s[\\"^]*(?:h[\\"^]*a[\\"^]*r[\\"^]*e|t[\\"^]*a[\\"^]*t))|l[\\"^]*(?:b[\\"^]*m[\\"^]*g[\\"^]*r|t[\\"^]*e[\\"^]*s[\\"^]*t)|s[\\"^]*l[\\"^]*o[\\"^]*o[\\"^]*k[\\"^]*u[\\"^]*p|t[\\"^]*(?:b[\\"^]*a[\\"^]*c[\\"^]*k[\\"^]*u[\\"^]*p|c[\\"^]*m[\\"^]*d[\\"^]*p[\\"^]*r[\\"^]*o[\\"^]*m[\\"^]*p[\\"^]*t|f[\\"^]*r[\\"^]*s[\\"^]*u[\\"^]*t[\\"^]*l))|o[\\"^]*(?:f[\\"^]*f[\\"^]*l[\\"^]*i[\\"^]*n[\\"^]*e|p[\\"^]*e[\\"^]*n[\\"^]*f[\\"^]*i[\\"^]*l[\\"^]*e[\\"^]*s)|p[\\"^]*(?:a[\\"^]*(?:g[\\"^]*e[\\"^]*f[\\"^]*i[\\"^]*l[\\"^]*e[\\"^]*c[\\"^]*o[\\"^]*n[\\"^]*f[\\"^]*i|t[\\"^]*h[\\"^]*p[\\"^]*i[\\"^]*n)[\\"^]*g|(?:b[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i|k[\\"^]*t[\\"^]*m[\\"^]*o)[\\"^]*n|e[\\"^]*(?:n[\\"^]*t[\\"^]*n[\\"^]*t|r[\\"^]*f[\\"^]*m[\\"^]*o[\\"^]*n)|n[\\"^]*p[\\"^]*u[\\"^]*(?:n[\\"^]*a[\\"^]*t[\\"^]*t[\\"^]*e[\\"^]*n[\\"^]*d|t[\\"^]*i[\\"^]*l)|o[\\"^]*(?:p[\\"^]*d|w[\\"^]*e[\\"^]*r[\\"^]*s[\\"^]*h[\\"^]*e[\\"^]*l[\\"^]*l)|r[\\"^]*n[\\"^]*(?:c[\\"^]*n[\\"^]*f[\\"^]*g|(?:d[\\"^]*r[\\"^]*v|m[\\"^]*n[\\"^]*g)[\\"^]*r|j[\\"^]*o[\\"^]*b[\\"^]*s|p[\\"^]*o[\\"^]*r[\\"^]*t|q[\\"^]*c[\\"^]*t[\\"^]*l)|u[\\"^]*(?:b[\\"^]*p[\\"^]*r[\\"^]*n|s[\\"^]*h[\\"^]*(?:d|p[\\"^]*r[\\"^]*i[\\"^]*n[\\"^]*t[\\"^]*e[\\"^]*r[\\"^]*c[\\"^]*o[\\"^]*n[\\"^]*n[\\"^]*e[\\"^]*c[\\"^]*t[\\"^]*i[\\"^]*o[\\"^]*n[\\"^]*s))|w[\\"^]*(?:l[\\"^]*a[\\"^]*u[\\"^]*n[\\"^]*c[\\"^]*h[\\"^]*e[\\"^]*r|s[\\"^]*h))|q[\\"^]*(?:a[\\"^]*p[\\"^]*p[\\"^]*s[\\"^]*r[\\"^]*v|p[\\"^]*r[\\"^]*o[\\"^]*c[\\"^]*e[\\"^]*s[\\"^]*s|u[\\"^]*s[\\"^]*e[\\"^]*r|w[\\"^]*i[\\"^]*n[\\"^]*s[\\"^]*t[\\"^]*a)|r[\\"^]*(?:d(?:[\\"^]*p[\\"^]*s[\\"^]*i[\\"^]*g[\\"^]*n)?|e[\\"^]*(?:f[\\"^]*s[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|g(?:[\\"^]*(?:i[\\"^]*n[\\"^]*i|s[\\"^]*v[\\"^]*r[\\"^]*3[\\"^]*2))?|l[\\"^]*o[\\"^]*g|(?:(?:p[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i|s[\\"^]*c[\\"^]*a)[\\"^]*)?n|x[\\"^]*e[\\"^]*c)|i[\\"^]*s[\\"^]*e[\\"^]*t[\\"^]*u[\\"^]*p|m[\\"^]*d[\\"^]*i[\\"^]*r|o[\\"^]*b[\\"^]*o[\\"^]*c[\\"^]*o[\\"^]*p[\\"^]*y|p[\\"^]*c[\\"^]*(?:i[\\"^]*n[\\"^]*f[\\"^]*o|p[\\"^]*i[\\"^]*n[\\"^]*g)|s[\\"^]*h|u[\\"^]*n[\\"^]*d[\\"^]*l[\\"^]*l[\\"^]*3[\\"^]*2|w[\\"^]*i[\\"^]*n[\\"^]*s[\\"^]*t[\\"^]*a)|s[\\"^]*(?:a[\\"^]*n|c[\\"^]*(?:h[\\"^]*t[\\"^]*a[\\"^]*s[\\"^]*k[\\"^]*s|w[\\"^]*c[\\"^]*m[\\"^]*d)|e[\\"^]*(?:c[\\"^]*e[\\"^]*d[\\"^]*i[\\"^]*t|r[\\"^]*v[\\"^]*e[\\"^]*r[\\"^]*(?:(?:c[\\"^]*e[\\"^]*i[\\"^]*p|w[\\"^]*e[\\"^]*r)[\\"^]*o[\\"^]*p[\\"^]*t[\\"^]*i[\\"^]*n|m[\\"^]*a[\\"^]*n[\\"^]*a[\\"^]*g[\\"^]*e[\\"^]*r[\\"^]*c[\\"^]*m[\\"^]*d)|t[\\"^]*x)|f[\\"^]*c|(?:h[\\"^]*o[\\"^]*w[\\"^]*m[\\"^]*o[\\"^]*u[\\"^]*n|u[\\"^]*b[\\"^]*s)[\\"^]*t|x[\\"^]*s[\\"^]*t[\\"^]*r[\\"^]*a[\\"^]*c[\\"^]*e|y[\\"^]*s[\\"^]*(?:o[\\"^]*c[\\"^]*m[\\"^]*g[\\"^]*r|t[\\"^]*e[\\"^]*m[\\"^]*i[\\"^]*n[\\"^]*f[\\"^]*o))|t[\\"^]*(?:a[\\"^]*(?:k[\\"^]*e[\\"^]*o[\\"^]*w[\\"^]*n|p[\\"^]*i[\\"^]*c[\\"^]*f[\\"^]*g|s[\\"^]*k[\\"^]*(?:k[\\"^]*i[\\"^]*l[\\"^]*l|l[\\"^]*i[\\"^]*s[\\"^]*t))|(?:c[\\"^]*m[\\"^]*s[\\"^]*e[\\"^]*t[\\"^]*u|f[\\"^]*t)[\\"^]*p|(?:(?:e[\\"^]*l[\\"^]*n[\\"^]*e|i[\\"^]*m[\\"^]*e[\\"^]*o[\\"^]*u)[\\"^]*|r[\\"^]*a[\\"^]*c[\\"^]*e[\\"^]*r[\\"^]*(?:p[\\"^]*)?)t|l[\\"^]*n[\\"^]*t[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*n|p[\\"^]*m[\\"^]*(?:t[\\"^]*o[\\"^]*o[\\"^]*l|v[\\"^]*s[\\"^]*c[\\"^]*m[\\"^]*g[\\"^]*r)|s[\\"^]*(?:(?:d[\\"^]*i[\\"^]*s[\\"^]*)?c[\\"^]*o[\\"^]*n|e[\\"^]*c[\\"^]*i[\\"^]*m[\\"^]*p|k[\\"^]*i[\\"^]*l[\\"^]*l|p[\\"^]*r[\\"^]*o[\\"^]*f)|y[\\"^]*p[\\"^]*e[\\"^]*p[\\"^]*e[\\"^]*r[\\"^]*f|z[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l)|u[\\"^]*n[\\"^]*(?:e[\\"^]*x[\\"^]*p[\\"^]*o[\\"^]*s[\\"^]*e|i[\\"^]*q[\\"^]*u[\\"^]*e[\\"^]*i[\\"^]*d|l[\\"^]*o[\\"^]*d[\\"^]*c[\\"^]*t[\\"^]*r)|v[\\"^]*(?:o[\\"^]*l|s[\\"^]*s[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n)|w[\\"^]*(?:a[\\"^]*i[\\"^]*t[\\"^]*f[\\"^]*o[\\"^]*r|b[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n|(?:d[\\"^]*s|e[\\"^]*(?:c|v[\\"^]*t))[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|h[\\"^]*(?:e[\\"^]*r[\\"^]*e|o[\\"^]*a[\\"^]*m[\\"^]*i)|i[\\"^]*n[\\"^]*(?:n[\\"^]*t(?:[\\"^]*3[\\"^]*2)?|r[\\"^]*s)|m[\\"^]*i[\\"^]*c|s[\\"^]*c[\\"^]*r[\\"^]*i[\\"^]*p[\\"^]*t)|x[\\"^]*c[\\"^]*o[\\"^]*p[\\"^]*y)(?:.[\\"^]*[0-9A-Z_a-z]+)?b"
+      "@ge 1",
+      "@lt 4"
     ]
 
 [http.middlewares.bad_bot_block_PHP]
   [http.middlewares.bad_bot_block_PHP.plugin.badbot]
     userAgent = [
-      "@pmFromFile php-config-directives.data",
-      "@rx (?:((?:.+)(?:[\\"'][-0-9A-Z_a-z]+[\\"'])?(.+|[^)]*string[^)]*)[sv\\"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|[\\"'][-0-9A-Zx5c_a-z]+[\\"'])(.+))(?:;|$)?",
-      "@pm =",
-      "@pmFromFile php-variables.data",
-      "@rx .*.ph(?:pd*|tml|ar|ps|t|pt).*$",
-      "@lt 4",
-      "@rx (?:((?:.+)(?:[\\"'][-0-9A-Z_a-z]+[\\"'])?(.+|[^)]*string[^)]*)[sv\\"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|[\\"'][-0-9A-Zx5c_a-z]+[\\"'])(.+));",
-      "@rx .*.(?:phpd*|phtml)..*$",
+      "@lt 1",
+      "@rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)",
+      "@pmFromFile php-function-names-933150.data",
       "@pmFromFile php-errors.data",
-      "@rx $+(?:[a-zA-Z_x7f-xff][a-zA-Z0-9_x7f-xff]*|s*{.+})(?:s|[.+]|{.+}|/*.**/|//.*|#.*)*(.*)",
-      "@rx (?i)b(?[\\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:*.**/|/.*)|#.*[sv]|\\")*[\\"']*)?[sv]*(.*)",
       "@pm ?>",
+      "@pmFromFile php-function-names-933151.data",
+      "@lt 2",
       "@rx (?:<?(?:[^x]|x[^m]|xm[^l]|xml[^s]|xml$|$)|<?php|[(?:/|x5c)?php])",
-      "@lt 3",
-      "@pmFromFile php-function-names-933150.data",
-      "@lt 1",
-      "@rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI",
-      "@rx (?:b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|$_(?:(?:pos|ge)t|session))b",
-      "@pmFromFile php-errors-pl2.data",
-      "@rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)",
+      "@rx (?:((?:.+)(?:[\\"'][-0-9A-Z_a-z]+[\\"'])?(.+|[^)]*string[^)]*)[sv\\"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|[\\"'][-0-9A-Zx5c_a-z]+[\\"'])(.+));",
+      "@rx [oOcC]:d+:\\".+?\\":d+:{.*}",
+      "@rx (?i)b(?[\\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:*.**/|/.*)|#.*[sv]|\\")*[\\"']*)?[sv]*(.*)",
+      "@rx .*.ph(?:pd*|tml|ar|ps|t|pt).*$",
+      "@rx (?:((?:.+)(?:[\\"'][-0-9A-Z_a-z]+[\\"'])?(.+|[^)]*string[^)]*)[sv\\"'--.0-9A-[]_a-{}]+([^)]*)|(?:[[0-9]+]|{[0-9]+}|$[^(-),.-/;x5c]+|[\\"'][-0-9A-Zx5c_a-z]+[\\"'])(.+))(?:;|$)?",
       "@rx (?i)b(?:a(?:bs|s(?:in|sert(?:_options)?))|basename|c(?:h(?:eckdate|r(?:oot)?)|o(?:(?:mpac|(?:nsta|u)n)t|py|sh?)|r(?:eate_function|ypt)|urrent)|d(?:ate|e(?:coct|fined?)|ir)|e(?:nd|val|x(?:ec|p(?:lode)?|tract))|f(?:ile(?:(?:[acm]tim|inod|siz|typ)e|group|owner|perms)?|l(?:o(?:ck|or)|ush))|glob|h(?:ash|eader)|i(?:date|m(?:age(?:gif|(?:jpe|pn)g|wbmp|xbm)|plode)|s_a)|key|l(?:ink|og)|m(?:a(?:il|x)|d5|in)|n(?:ame|ext)|o(?:pendir|rd)|p(?:a(?:ck|ss(?:thru)?)|i|o(?:pen|w)|rev)|r(?:an(?:d|ge)|e(?:(?:adfil|nam)e|set)|ound)|s(?:(?:erializ|huffl)e|in|leep|(?:or|ta)t|ubstr|y(?:mlink|s(?:log|tem)))|t(?:an|(?:im|mpfil)e|ouch|rim)|u(?:cfirst|n(?:lin|pac)k)|virtual)(?:[sv]|/*.**/|(?:#|//).*)*(.*)",
-      "@lt 2",
+      "@pmFromFile php-variables.data",
       "@pm (",
-      "@rx (?i)<?(?:=|php)?s+",
       "@rx (?:bzip2|expect|glob|ogg|(?:ph|r)ar|ssh2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?|z(?:ip|lib))://",
-      "@pmFromFile php-function-names-933151.data",
-      "@rx [oOcC]:d+:\\".+?\\":d+:{.*}"
+      "@rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI",
+      "@rx (?:b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|$_(?:(?:pos|ge)t|session))b",
+      "@rx (?i)<?(?:=|php)?s+",
+      "@pmFromFile php-errors-pl2.data",
+      "@rx $+(?:[a-zA-Z_x7f-xff][a-zA-Z0-9_x7f-xff]*|s*{.+})(?:s|[.+]|{.+}|/*.**/|//.*|#.*)*(.*)",
+      "@pmFromFile php-config-directives.data",
+      "@lt 3",
+      "@pm =",
+      "@rx .*.(?:phpd*|phtml)..*$",
+      "@lt 4"
     ]
 
-[http.middlewares.bad_bot_block_GENERIC]
-  [http.middlewares.bad_bot_block_GENERIC.plugin.badbot]
+[http.middlewares.bad_bot_block_ENFORCEMENT]
+  [http.middlewares.bad_bot_block_ENFORCEMENT.plugin.badbot]
     userAgent = [
-      "@rx @{.*}",
-      "@pmFromFile ssrf.data",
-      "@rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}.(?:[0-9]{1,3}.[0-9]{5}|[0-9]{8})|(?:x5cx5c[-0-9a-z].?_?)+|[[0-:a-f]+(?:[.0-9]+|%[0-9A-Z_a-z]+)?]|[a-z][--.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[sv]*&?@(?:(?:[0-9]{1,3}.){3}[0-9]{1,3}|[a-z][--.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[.0-9]{0,11}(?:xe2(?:x91[xa0-xbf]|x92[x80-xbf]|x93[x80-xa9xab-xbf])|xe3x80x82)+))",
-      "@lt 4",
-      "@rx [s*constructors*]",
-      "@rx _(?:$$ND_FUNC$$_|_js_function)|(?:beval|new[sv]+Function[sv]*)(|String.fromCharCode|function(){|this.constructor|module.exports=|([sv]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][sv]*)|process(?:.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:.call)?(|binding|constructor|env|global|main(?:Module)?|process|require)|[[\\"'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)[\\"'`]])|(?:binding|constructor|env|global|main(?:Module)?|process|require)[|console(?:.(?:debug|error|info|trace|warn)(?:.call)?(|[[\\"'`](?:debug|error|info|trace|warn)[\\"'`]])|require(?:.(?:resolve(?:.call)?(|main|extensions|cache)|[[\\"'`](?:(?:resolv|cach)e|main|extensions)[\\"'`]])",
-      "@lt 3",
-      "@rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[sv]*(",
       "@lt 1",
-      "@rx (?:__proto__|constructors*(?:.|[)s*prototype)",
-      "@rx ^data:(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*",
-      "@rx Process[sv]*.[sv]*spawn[sv]*(",
-      "@rx while[sv]*([sv(]*(?:!+(?:false|null|undefined|NaN|[+-]?0|\\"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[+-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)b|{.*}|[.*]|\\"[^\\"]+\\"|'[^']+'|`[^`]+`)).*)",
-      "@lt 2"
-    ]
+      "!@streq JSON",
+      "@validateByteRange 32,34,38,42-59,61,65-90,95,97-122",
+      "!@rx ^(?:?[01])?$",
+      "@rx ^(?:GET|HEAD)$",
+      "@rx .[^.~]+~(?:/.*|)$",
+      "!@rx ^(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$",
+      "@rx ^[^;s]+",
+      "@lt 2",
+      "@rx x25",
+      "!@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0",
+      "@validateByteRange 1-255",
+      "@gt 1",
+      "@within %{tx.restricted_headers_extended}",
+      "@ge 1",
+      "@gt %{tx.arg_name_length}",
+      "@validateByteRange 38,44-46,48-58,61,65-90,95,97-122",
+      "@lt %{tx.1}",
+      "!@within %{tx.allowed_request_content_type}",
+      "!@rx ^OPTIONS$",
+      "!@rx (?i)^(?:&(?:(?:[acegiln-or-suz]acut|[aeiou]grav|[ain-o]tild)e|[c-elnr-tz]caron|(?:[cgk-lnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^\\"';=])*$",
+      "!@within %{tx.allowed_http_versions}",
+      "!@pm AppleWebKit Android",
+      "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){6}",
+      "@rx ^(?i)application/x-www-form-urlencoded",
+      "!@endsWith .pdf",
+      "@endsWith .pdf",
+      "@rx ^(?i)up",
+      "@gt 50",
+      "@rx ^bytes=(?:(?:d+)?-(?:d+)?s*,?s*){63}",
+      "@gt %{tx.max_num_args}",
+      "@rx b(?:keep-alive|close),s?(?:keep-alive|close)b",
+      "@rx %[0-9a-fA-F]{2}",
+      "@eq 0",
+      "@validateUrlEncoding",
+      "@rx ^.*$",
+      "@eq 1",
+      "@rx (d+)-(d+)",
+      "@rx charset.*?charset",
+      "@contains #",
+      "@gt %{tx.total_arg_length}",
+      "@rx (?i)x5cu[0-9a-f]{4}",
+      "!@rx ^0$",
+      "!@rx (?i)^(?:get /[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?|(?:connect (?:(?:[0-9]{1,3}.){3}[0-9]{1,3}.?(?::[0-9]+)?|[--9A-Z_a-z]+:[0-9]+)|options *|[a-z]{3,10}[sv]+(?:[0-9A-Z_a-z]{3,7}?://[--9A-Z_a-z]*(?::[0-9]+)?)?/[^#?]*(?:?[^sv#]*)?(?:#[^sv]*)?)[sv]+[.-9A-Z_a-z]+)$",
+      "@validateByteRange 32-36,38-126",
+      "!@pm AppleWebKit Android Business Enterprise Entreprise",
+      "!@rx ^(?:OPTIONS|CONNECT)$",
+      "@gt %{tx.combined_file_sizes}",
+      "!@within %{tx.allowed_request_content_type_charset}",
+      "@rx .([^.]+)$",
+      "!@within %{tx.allowed_methods}",
+      "@rx ['\\";=]",
+      "!@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:s*,s*|$)){1,7}$",
+      "@rx ^(?i)multipart/form-data",
+      "!@rx ^0?$",
+      "@within %{tx.restricted_extensions}",
+      "@rx charsets*=s*[\\"']?([^;\\"'s]+)",
+      "@lt 3",
+      "!@eq 0",
+      "@gt %{tx.arg_length}",
+      "@rx (?:^|[^x5c])x5c[cdeghijklmpqwxyz123456789]",
+      "@gt %{tx.max_file_size}",
+      "@within %{tx.restricted_headers_basic}",
+      "@streq POST",
+      "@rx (?:^([d.]+|[[da-f:]+]|[da-f:]+)(:[d]+)?$)",
+      "!@rx ^[w/.+*-]+(?:s?;s?(?:action|boundary|charset|component|start(?:-info)?|type|version)s?=s?['\\"w.()+,/:=?<>@#*-]+)*$",
+      "@validateByteRange 9,10,13,32-126,128-255",
+      "!@rx br|compress|deflate|(?:pack200-)?gzip|identity|*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)",
+      "!@rx ^d+$",
+      "@rx ^$",
+      "@rx %u[fF]{2}[0-9a-fA-F]{2}",
+      "@gt 0",
+      "@validateUtf8Encoding",
+      "@lt 4"
+    ]
 
-[http.middlewares.bad_bot_block_XSS]
-  [http.middlewares.bad_bot_block_XSS.plugin.badbot]
+[http.middlewares.bad_bot_block_ATTACK]
+  [http.middlewares.bad_bot_block_ATTACK.plugin.badbot]
     userAgent = [
-      "@pm document.cookie document.domain document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[",
-      "@rx (?i)b(?:s(?:tyle|rc)|href)b[sS]*?=",
-      "@rx (?i)[\\"'][ ]*(?:[^a-z0-9~_:' ]|in).+?[.].+?=",
-      "@rx (?i)<APPLET[s/+>]",
-      "@rx (?i)<script[^>]*>[sS]*?",
-      "@rx (?i:<.*[:]?vmlframe.*?[s/+]*?src[s/+]*=)",
-      "@rx (?i:<META[s/+].*?charset[s/+]*=)",
-      "@rx ((?:[[^]]*][^.]*.)|Reflect[^.]*.).*(?:map|sort|apply)[^.]*..*call[^`]*`.*`",
-      "@rx (?i)<OBJECT[s/+].*?(?:type|codetype|classid|code|data)[s/+]*=",
-      "@rx (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:v|&#(?:0*(?:86|118)|x0*[57]6);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;)).",
-      "@rx (?i).(?:b(?:x(?:link:href|html|mlns)|data:text/html|formaction|patternb.*?=)|!ENTITY[sv]+(?:%[sv]+)?[^sv]+[sv]+(?:SYSTEM|PUBLIC)|@import|;base64)b",
-      "@rx {{.*?}}",
-      "@lt 4",
-      "@detectXSS",
-      "@rx (?i:<style.*?>.*?(?:@[ix5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(x5c]|&#x?0*(?:40|28|92|5C);?)))",
-      "@rx (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url(javascript",
-      "@rx (?i)<BASE[s/+].*?href[s/+]*=",
-      "@rx <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|hr|html|i|iframe|ilayer|img|input|ins|isindex|kdb|keygen|label|layer|legend|li|limittext|link|listing|map|marquee|menu|meta|multicol|nobr|noembed|noframes|noscript|nosmartquotes|object|ol|optgroup|option|p|param|plaintext|pre|q|rt|ruby|s|samp|script|select|server|shadow|sidebar|small|spacer|span|strike|strong|style|sub|sup|table|tbody|td|textarea|tfoot|th|thead|title|tr|tt|u|ul|var|wbr|xml|xmp)W",
-      "@rx (?i:[\\"'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|x5cu006C)(?:o|x5cu006F)(?:c|x5cu0063)(?:a|x5cu0061)(?:t|x5cu0074)(?:i|x5cu0069)(?:o|x5cu006F)(?:n|x5cu006E)|(?:n|x5cu006E)(?:a|x5cu0061)(?:m|x5cu006D)(?:e|x5cu0065)|(?:o|x5cu006F)(?:n|x5cu006E)(?:e|x5cu0065)(?:r|x5cu0072)(?:r|x5cu0072)(?:o|x5cu006F)(?:r|x5cu0072)|(?:v|x5cu0076)(?:a|x5cu0061)(?:l|x5cu006C)(?:u|x5cu0075)(?:e|x5cu0065)(?:O|x5cu004F)(?:f|x5cu0066)).*?=)",
+      "@lt 1",
+      "@rx [",
+      "@rx [nr]",
+      "@rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)s+[^s]+s+http/d",
+      "@rx (][^]]+$|][^]]+[)",
+      "!@rx ^(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*$",
+      "@gt 1",
+      "@lt 2",
+      "@rx content-transfer-encoding:(.*)",
+      "@rx (?:bhttp/d|<(?:html|meta)b)",
+      "@rx unix:[^|]*|",
+      "!@within |%{tx.allowed_request_content_type_charset}|",
+      "@rx ^[^sv,;]+[sv,;].*?b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([+/]))b",
+      "@rx ^[^sv,;]+[sv,;].*?(?:application/(?:.++)?json|(?:application/(?:soap+)?|text/)xml)",
+      "@rx [rn]W*?(?:content-(?:type|length)|set-cookie|location):s*w",
+      "@rx [nr]+(?:s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))s*:",
+      "@rx ^content-types*:s*(.*)$",
+      "@rx TX:paramcounter_(.*)",
       "@lt 3",
-      "!@validateByteRange 20, 45-47, 48-57, 65-90, 95, 97-122",
-      "@rx (?i)<EMBED[s/+].*?(?:src|type).*?=",
+      "!@eq 0",
+      "@rx ^[^:()&|!<>~]*)s*(?:((?:[^,()=&|!<>~]+[><~]?=|s*[&!|]s*(?:)|()?s*)|)s*(s*[&|!]s*|[&!|]s*([^()=&|!<>~]+[><~]?=[^:()&|!<>~]*)",
+      "@gt 0",
+      "@rx .",
+      "@lt 4"
+    ]
+
+[http.middlewares.bad_bot_block_SQL]
+  [http.middlewares.bad_bot_block_SQL.plugin.badbot]
+    userAgent = [
       "@lt 1",
-      "@rx <[?]?import[s/+S]*?implementation[s/+]*?=",
-      "@rx (?i)[s\\"'`;/0-9=x0Bx09x0Cx3Bx2Cx28x3B]on[a-zA-Z]{3,25}[sx0Bx09x0Cx3Bx2Cx28x3B]*?=[^=]",
-      "@contains -->",
-      "@rx (?:xbcs*/s*[^xbe>]*[xbe>])|(?:<s*/s*[^xbe]*xbe)",
-      "@rx (?:self|document|this|top|window)s*(?:/*|[[)]).+?(?:]|*/)",
+      "@rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|pg_(?:query|exec)() [:|Warning.{1,20}bpg_.*|valid PostgreSQL result|Npgsql.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er",
+      "@rx (?i)Exception (?:condition )?d+. Transaction rollback.",
+      "@rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*Server message.*)",
+      "@rx (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])",
       "@lt 2",
-      "@rx (?i)(?:v|&#(?:0*8|x0*5)[36];)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*6[26]|x0*(?:98|42));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;)).",
-      "@rx (?i)(?:W|^)(?:javascript:(?:[sS]+[=x5c([.<]|[sS]*?(?:bnameb|x5c[ux]d))|data:(?:(?:[a-z]w+/w[w+-]+w)?[;,]|[sS]*?;[sS]*?b(?:base64|charset=)|[sS]*?,[sS]*?<[sS]*?w[sS]*?>))|@W*?iW*?mW*?pW*?oW*?rW*?tW*?(?:/*[sS]*?)?(?:[\\"']|W*?uW*?rW*?l[sS]*?()|[^-]*?-W*?mW*?oW*?zW*?-W*?bW*?iW*?nW*?dW*?iW*?nW*?g[^:]*?:W*?uW*?rW*?l[sS]*?(",
-      "@rx (?i:<META[s/+].*?http-equiv[s/+]*=[s/+]*[\\"'`]?(?:(?:c|&#x?0*(?:67|43|99|63);?)|(?:r|&#x?0*(?:82|52|114|72);?)|(?:s|&#x?0*(?:83|53|115|73);?)))",
-      "@rx (?i)<LINK[s/+].*?href[s/+]*=",
-      "@rx xbc[^xbe>]*[xbe>]|<[^xbe]*xbe",
-      "@rx +ADw-.*(?:+AD4-|>)|<.*+AD4-",
-      "@rx ![!+ ][]",
-      "@rx (?i)b(?:eval|set(?:timeout|interval)|new[sv]+Function|a(?:lert|tob)|btoa)[sv]*(",
-      "@rx (?i)<[^0-9<>A-Z_a-z]*(?:[^sv\\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e|v[^0-9A-Z_a-z]*?g|e[^0-9A-Z_a-z]*?t[^0-9>A-Z_a-z])|f[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?m|m[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?q[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?e|e[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?a[^0-9>A-Z_a-z])|(?:l[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?k|o[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?j[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?c[^0-9A-Z_a-z]*?t|e[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?d|a[^0-9A-Z_a-z]*?(?:p[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?t|u[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?o|n[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?e)|p[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m|i?[^0-9A-Z_a-z]*?f[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?e|b[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?s[^0-9A-Z_a-z]*?e|o[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?y|i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?s)|i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a?[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?e?|v[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?o)[^0-9>A-Z_a-z])|(?:<[0-9A-Z_a-z].*[sv/]|[\\"'](?:.*[sv/])?)(?:background|formaction|lowsrc|on(?:a(?:bort|ctivate|d(?:apteradded|dtrack)|fter(?:print|(?:scriptexecu|upda)te)|lerting|n(?:imation(?:cancel|end|iteration|start)|tennastatechange)|ppcommand|u(?:dio(?:end|process|start)|xclick))|b(?:e(?:fore(?:(?:(?:(?:de)?activa|scriptexecu)t|toggl)e|c(?:opy|ut)|editfocus|input|p(?:aste|rint)|u(?:nload|pdate))|gin(?:Event)?)|l(?:ocked|ur)|oun(?:ce|dary)|roadcast|usy)|c(?:a(?:(?:ch|llschang)ed|nplay(?:through)?|rdstatechange)|(?:ell|fstate)change|h(?:a(?:rging(?:time)?cha)?nge|ecking)|l(?:ick|ose)|o(?:m(?:mand(?:update)?|p(?:lete|osition(?:end|start|update)))|n(?:nect(?:ed|ing)|t(?:extmenu|rolselect))|py)|u(?:echange|t))|d(?:ata(?:(?:availabl|chang)e|error|setc(?:hanged|omplete))|blclick|e(?:activate|livery(?:error|success)|vice(?:found|light|(?:mo|orienta)tion|proximity))|i(?:aling|s(?:abled|c(?:hargingtimechange|onnect(?:ed|ing))))|o(?:m(?:a(?:ctivate|ttrmodified)|(?:characterdata|subtree)modified|focus(?:in|out)|mousescroll|node(?:inserted(?:intodocument)?|removed(?:fromdocument)?))|wnloading)|r(?:ag(?:drop|e(?:n(?:d|ter)|xit)|(?:gestur|leav)e|over|start)|op)|urationchange)|e(?:mptied|n(?:abled|d(?:ed|Event)?|ter)|rror(?:update)?|xit)|f(?:ailed|i(?:lterchange|nish)|o(?:cus(?:in|out)?|rm(?:change|input))|ullscreenchange)|g(?:amepad(?:axismove|button(?:down|up)|(?:dis)?connected)|et)|h(?:ashchange|e(?:adphoneschange|l[dp])|olding)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|put|valid))|key(?:down|press|up)|l(?:evelchange|o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|y)|m(?:ark|essage|o(?:use(?:down|enter|(?:lea|mo)ve|o(?:ut|ver)|up|wheel)|ve(?:end|start)?|z(?:a(?:fterpaint|udioavailable)|(?:beforeresiz|orientationchang|t(?:apgestur|imechang))e|(?:edgeui(?:c(?:ancel|omplet)|start)e|network(?:down|up)loa)d|fullscreen(?:change|error)|m(?:agnifygesture(?:start|update)?|ouse(?:hittest|pixelscroll))|p(?:ointerlock(?:change|error)|resstapgesture)|rotategesture(?:start|update)?|s(?:crolledareachanged|wipegesture(?:end|start|update)?))))|no(?:match|update)|o(?:(?:bsolet|(?:ff|n)lin)e|pen|verflow(?:changed)?)|p(?:a(?:ge(?:hide|show)|int|(?:st|us)e)|lay(?:ing)?|o(?:inter(?:down|enter|(?:(?:lea|mo)v|rawupdat)e|o(?:ut|ver)|up)|p(?:state|up(?:hid(?:den|ing)|show(?:ing|n))))|ro(?:gress|pertychange))|r(?:atechange|e(?:adystatechange|ceived|movetrack|peat(?:Event)?|quest|s(?:et|ize|u(?:lt|m(?:e|ing)))|trieving)|ow(?:e(?:nter|xit)|s(?:delete|inserted)))|s(?:croll(?:end)?|e(?:arch|ek(?:complete|ed|ing)|lect(?:ionchange|start)?|n(?:ding|t)|t)|how|(?:ound|peech)(?:end|start)|t(?:a(?:lled|rt|t(?:echange|uschanged))|k(?:comma|sessione)nd|op)|u(?:bmit|ccess|spend)|vg(?:abort|error|(?:un)?load|resize|scroll|zoom))|t(?:ext|ime(?:out|update)|o(?:ggle|uch(?:cancel|en(?:d|ter)|(?:lea|mo)ve|start))|ransition(?:cancel|end|run|start))|u(?:n(?:derflow|handledrejection|load)|p(?:dateready|gradeneeded)|s(?:erproximity|sdreceived))|v(?:ersion|o(?:ic|lum)e)change|w(?:a(?:it|rn)ing|ebkit(?:animation(?:end|iteration|start)|transitionend)|heel)|zoom)|ping|s(?:rc|tyle))[x08-nf-r ]*?="
+      "@rx (?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array()|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient.)|[MySQL][ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[(-)_a-z]{1,26})?|(?:ERROR [0-9]{4} ([0-9a-z]{5})|XPATH syntax error):",
+      "@rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)",
+      "!@pmFromFile sql-errors.data",
+      "@rx (?i)Dynamic SQL Error",
+      "@rx (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)",
+      "@rx (?i)org.hsqldb.jdbc",
+      "@rx (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)",
+      "@rx (?i:Warning.*ingres_|Ingres SQLSTATE|IngresW.*Driver)",
+      "@rx (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)",
+      "@rx (?i:DB2 SQL error:|[IBM][CLI Driver][DB2/6000]|CLI Driver.*DB2|DB2 SQL error|db2_w+()",
+      "@rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)",
+      "@lt 3",
+      "@rx (?i)(?:System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*WSystem.Data.SqlClient.|Conversion failed when converting the varchar value .*? to data type int.)",
+      "@rx (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception.*Informix)",
+      "@lt 4"
     ]
 
-[http.middlewares.bad_bot_block_SQLI]
-  [http.middlewares.bad_bot_block_SQLI.plugin.badbot]
+[http.middlewares.bad_bot_block_GENERIC]
+  [http.middlewares.bad_bot_block_GENERIC.plugin.badbot]
     userAgent = [
-      "@rx (?i)[?$(?:n(?:e|in?|o[rt])|e(?:q|xists|lemMatch)|l(?:te?|ike)|mod|a(?:ll|nd)|(?:s(?:iz|lic)|wher)e|t(?:ype|ext)|x?or|div|between|regex|jsonSchema)]?",
-      "@rx W{4}",
-      "@rx (?i)(?:([sv]*?select[sv]*?[0-9A-Z_a-z]+|coalesce|order[sv]+by[sv]+if[0-9A-Z_a-z]*?)[sv]*?(|*/from|+[sv]*?[0-9]+[sv]*?+[sv]*?@|[0-9A-Z_a-z][\\"'`][sv]*?(?:(?:[+-=@|]+[sv]+?)+|[+-=@|]+)[(0-9]|@@[0-9A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]|[^0-9A-Z_a-z]!+[\\"'`][0-9A-Z_a-z]|[\\"'`](?:;[sv]*?(?:if|while|begin)|[sv0-9]+=[sv]*?[0-9])|[sv(]+case[0-9]*?[^0-9A-Z_a-z].+[tw]hen[sv(]",
-      "@rx ((?:[~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>]*?){3})",
-      "@rx ((?:[~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>]*?){12})",
-      "@rx ((?:[~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>]*?){8})",
-      "@rx (?i:merge.*?usings*?(|executes*?immediates*?[\\"'`]|matchs*?[w(),+-]+s*?againsts*?()",
-      "@rx (?i)!=|&&||||>[=->]|<(?:<|=>?|>(?:[sv]+binary)?)|b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)b|[0-9A-Z_a-z]*?_))|(?:likel(?:ihood|y)|unlikely)[sv]*()|r(?:egexp|like)[sv]+binary|not[sv]+between[sv]+(?:0[sv]+and|(?:'[^']*'|\\"[^\\"]*\\")[sv]+and[sv]+(?:'[^']*'|\\"[^\\"]*\\"))|is[sv]+null|like[sv]+(?:null|[0-9A-Z_a-z]+[sv]+escapeb)|(?:^|[^0-9A-Z_a-z])in[sv+]*([sv\\"0-9]+[^(-)]*)|[!<->]{1,2}[sv]*allb",
-      "@rx (?i)[sv\\"'-)`]*?b([0-9A-Z_a-z]+)b[sv\\"'-)`]*?(?:=|<=>|(?:sounds[sv]+)?like|glob|r(?:like|egexp))[sv\\"'-)`]*?b([0-9A-Z_a-z]+)b",
-      "@rx (?i:sleep(s*?d*?s*?)|benchmark(.*?,.*?))",
-      "@detectSQLi",
-      "@rx (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)[sv]?(?|end[sv]*?);|[sv(]load_file[sv]*?(|[\\"'`][sv]+regexp[^0-9A-Z_a-z]|[^A-Z_a-z][sv]+asb[sv]*[\\"'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:create[sv]+[0-9A-Z_a-z]+|(?:d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load|(?:renam|truncat)e|u(?:pdate|nion[sv]*(?:all|(?:sele|distin)ct))|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject)))b)",
-      "@rx (?i))[sv]*?when[sv]*?[0-9]+[sv]*?then|[\\"'`][sv]*?(?:[#{]|--)|/*![sv]?[0-9]+|b(?:(?:binary|cha?r)[sv]*?([sv]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:egexp|like))[sv]+[0-9A-Z_a-z]+()|(?:|||&&)[sv]*?[0-9A-Z_a-z]+(",
-      "@rx (?i)b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|g(?:lob|roup_concat)|h(?:ex|our)|i(?:f(?:null)?|if|n(?:str)?)|l(?:ast(?:_insert_rowid)?|ength|ike(?:l(?:ihood|y))?|n|o(?:ad_extension|g(?:10|2)?|wer(?:pi)?|cal)|trim)|m(?:ax|in(?:ute)?|o(?:d|nth))|n(?:ullif|ow)|p(?:i|ow(?:er)?|rintf|assword)|quote|r(?:a(?:dians|ndom(?:blob)?)|e(?:p(?:lace|eat)|verse)|ound|trim|ight)|s(?:i(?:gn|nh?)|oundex|q(?:lite_(?:compileoption_(?:get|used)|offset|source_id|version)|rt)|u(?:bstr(?:ing)?|m)|econd|leep)|t(?:anh?|otal(?:_changes)?|r(?:im|unc)|ypeof|ime)|u(?:n(?:icode|likely)|(?:pp|s)er)|zeroblob|bin|v(?:alues|ersion)|week|year)[^0-9A-Z_a-z]*(",
-      "@rx (?i)in[sv]*?(+[sv]*?select|(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)[sv+0-9A-Z_a-z]+(?:regexp[sv]*?(|sounds[sv]+like[sv]*?[\\"'`]|[0-9=]+x)|[\\"'`](?:[sv]*?(?:[0-9][sv]*?(?:--|#)|is[sv]*?(?:[0-9].+[\\"'`]?[0-9A-Z_a-z]|[.0-9]+[sv]*?[^0-9A-Z_a-z].*?[\\"'`]))|[%-&<->^]+[0-9][sv]*?(?:=|x?or|div|like|between|and)|(?:[^0-9A-Z_a-z]+[+-0-9A-Z_a-z]+[sv]*?=[sv]*?[0-9][^0-9A-Z_a-z]+||?[-0-9A-Z_a-z]{3,}[^sv,.0-9A-Z_a-z]+)[\\"'`]|[sv]*(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)(?:array[sv]*[|[0-9A-Z_a-z]+(?:[sv]*!?~|[sv]+(?:not[sv]+)?similar[sv]+to[sv]+)|(?:tru|fals)eb))|bexcept[sv]+(?:selectb|values[sv]*?()",
-      "@rx ((?:[~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>]*?){2})",
-      "@rx (?i:^[Wd]+s*?(?:alter|union)b)",
-      "@rx (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^\\"]*?(?:\\"[^\\"]*?\\"[^\\"]*?)*?\\"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b",
-      "!@rx ^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+.[-0-9A-Z_a-z]+$",
-      "@rx /*!?|*/|[';]--|--(?:[sv]|[^-]*?-)|[^&-]#.*?[sv]|;?x00",
-      "@rx (?i)[\\"'`](?:[sv]*![sv]*[\\"'0-9A-Z_-z]|;?[sv]*(?:having|select|unionb[sv]*(?:all|(?:distin|sele)ct))b[sv]*[^sv])|b(?:(?:(?:c(?:onnection_id|urrent_user)|database|schema|user)[sv]*?|select.*?[0-9A-Z_a-z]?user)(|exec(?:ute)?[sv]+master.|from[^0-9A-Z_a-z]+information_schema[^0-9A-Z_a-z]|into[sv+]+(?:dump|out)file[sv]*?[\\"'`]|union(?:[sv]select[sv]@|[sv(0-9A-Z_a-z]*?select))|[sv]*?exec(?:ute)?.*?[^0-9A-Z_a-z]xp_cmdshell|[^0-9A-Z_a-z]iif[sv]*?(",
-      "@rx (?i)(?:/*)+[\\"'`]+[sv]?(?:--|[#{]|/*)?|[\\"'`](?:[sv]*(?:(?:x?or|and|div|like|between)[sv-0-9A-Z_a-z]+[(-)+--<->][sv]*[\\"'0-9`]|[!=|](?:[sv -!+-0-9=]+.*?[\\"'-(`].*?|[sv -!0-9=]+.*?[0-9]+)$|(?:like|print)[^0-9A-Z_a-z]+[\\"'-(0-9A-Z_-z]|;)|(?:[<>~]+|[sv]*[^sv0-9A-Z_a-z]?=[sv]*|[^0-9A-Z_a-z]*?[+=]+[^0-9A-Z_a-z]*?)[\\"'`])|[0-9][\\"'`][sv]+[\\"'`][sv]+[0-9]|^admin[sv]*?[\\"'`]|[sv\\"'-(`][sv]*?glob[^0-9A-Z_a-z]+[\\"'-(0-9A-Z_-z]|[sv]is[sv]*?0[^0-9A-Z_a-z]|where[sv][sv,-.0-9A-Z_a-z]+[sv]=",
-      "@rx (?i)b(?:d(?:atabas|b_nam)e[^0-9A-Z_a-z]*(|(?:information_schema|m(?:aster..sysdatabases|s(?:db|ys(?:ac(?:cess(?:objects|storage|xml)|es)|modules2?|(?:object|querie|relationship)s))|ysql.db)|northwind|pg_(?:catalog|toast)|tempdb)b|s(?:chema(?:_nameb|[^0-9A-Z_a-z]*()|(?:qlite_(?:temp_)?master|ys(?:aux|.database_name))b))",
-      "@rx (?i:b0x[a-fd]{3,})",
-      "@lt 4",
-      "@rx (?i)[sv(-)]case[sv]+when.*?then|)[sv]*?like[sv]*?(|select.*?having[sv]*?[^sv]+[sv]*?[^sv0-9A-Z_a-z]|if[sv]?([0-9A-Z_a-z]+[sv]*?[<->~]",
-      "@rx ';",
-      "@rx (?i)[\\"'`][sv]*?b(?:x?or|div|like|between|and)b[sv]*?[\\"'`]?[0-9]|x5cx(?:2[37]|3d)|^(?:.?[\\"'`]$|[\\"'x5c`]*?(?:[\\"'0-9`]+|[^\\"'`]+[\\"'`])[sv]*?b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)b[sv]*?[\\"'0-9A-Z_-z][!&(-)+-.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?[\\"'`][sv]*?[0-9A-Z_a-z]|@(?:[0-9A-Z_a-z]+[sv]+(?:and|x?or|div|like|between)b[sv]*?[\\"'0-9`]+|[-0-9A-Z_a-z]+[sv](?:and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?[\\"'`].|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]",
-      "@rx (?:'(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)')",
-      "@rx (?i)union.*?select.*?from",
-      "@rx (?i)W+d*?s*?bhavingbs*?[^s-]",
-      "@streq %{TX.2}",
-      "@rx ^.*?x5c['\\"`](?:.*?['\\"`])?s*(?:and|or)b",
-      "@rx [\\"'`][sd]*?[^ws]W*?dW*?.*?[\\"'`d]",
-      "@rx (?i:/*[!+](?:[ws=_-()]+)?*/)",
-      "@rx (?i)[\\"'`](?:[sv]*?(?:(?:*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?[\\"'`]|(?:x?or|div|like|between|and)[sv][^0-9]+[-0-9A-Z_a-z]+.*?)[0-9]|[^sv0-9?A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]+[sv]*?[\\"'`]|[^sv0-9A-Z_a-z]+[sv]*?[^A-Z_a-z].*?(?:#|--))|.*?*[sv]*?[0-9])|^[\\"'`]|[%(-+-<>][-0-9A-Z_a-z]+[^sv0-9A-Z_a-z]+[\\"'`][^,]",
-      "@rx ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$",
-      "@rx ^(?:[^']*'|[^\\"]*\\"|[^`]*`)[sv]*;",
-      "@rx (?i)1.e[(-),]",
-      "@rx (?i)(?:&&||||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[sv(]+[0-9A-Z_a-z]+[sv)]*?[!+=]+[sv0-9]*?[\\"'-)=`]|[0-9](?:[sv]*?(?:and|between|div|like|x?or)[sv]*?[0-9]+[sv]*?[+-]|[sv]+group[sv]+by.+()|/[0-9A-Z_a-z]+;?[sv]+(?:and|between|div|having|like|x?or|select)[^0-9A-Z_a-z]|(?:[#;]|--)[sv]*?(?:alter|drop|(?:insert|update)[sv]*?[0-9A-Z_a-z]{2,})|@.+=[sv]*?([sv]*?select|[^0-9A-Z_a-z]SET[sv]*?@[0-9A-Z_a-z]+",
-      "@rx ^(?:and|or)$",
+      "@lt 1",
+      "@rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}.(?:[0-9]{1,3}.[0-9]{5}|[0-9]{8})|(?:x5cx5c[-0-9a-z].?_?)+|[[0-:a-f]+(?:[.0-9]+|%[0-9A-Z_a-z]+)?]|[a-z][--.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[sv]*&?@(?:(?:[0-9]{1,3}.){3}[0-9]{1,3}|[a-z][--.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[.0-9]{0,11}(?:xe2(?:x91[xa0-xbf]|x92[x80-xbf]|x93[x80-xa9xab-xbf])|xe3x80x82)+))",
+      "@rx (?:__proto__|constructors*(?:.|[)s*prototype)",
+      "@rx [s*constructors*]",
       "@lt 3",
-      "@rx (?:`(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)`)",
+      "@rx Process[sv]*.[sv]*spawn[sv]*(",
+      "@rx while[sv]*([sv(]*(?:!+(?:false|null|undefined|NaN|[+-]?0|\\"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[+-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)b|{.*}|[.*]|\\"[^\\"]+\\"|'[^']+'|`[^`]+`)).*)",
+      "@rx _(?:$$ND_FUNC$$_|_js_function)|(?:beval|new[sv]+Function[sv]*)(|String.fromCharCode|function(){|this.constructor|module.exports=|([sv]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][sv]*)|process(?:.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:.call)?(|binding|constructor|env|global|main(?:Module)?|process|require)|[[\\"'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)[\\"'`]])|(?:binding|constructor|env|global|main(?:Module)?|process|require)[|console(?:.(?:debug|error|info|trace|warn)(?:.call)?(|[[\\"'`](?:debug|error|info|trace|warn)[\\"'`]])|require(?:.(?:resolve(?:.call)?(|main|extensions|cache)|[[\\"'`](?:(?:resolv|cach)e|main|extensions)[\\"'`]])",
+      "@rx @{.*}",
+      "@lt 2",
+      "@pmFromFile ssrf.data",
+      "@rx ^data:(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*(?:[sv]*,[sv]*(?:(?:*|[^!-\\"(-),/:-?[-]{}]+)/(?:*|[^!-\\"(-),/:-?[-]{}]+)|*)(?:[sv]*;[sv]*(?:charset[sv]*=[sv]*\\"?(?:iso-8859-15?|utf-8|windows-1252)b\\"?|(?:[^sv -\\"(-),/:-?[-]c{}]|c(?:[^!-\\"(-),/:-?[-]h{}]|h(?:[^!-\\"(-),/:-?[-]a{}]|a(?:[^!-\\"(-),/:-?[-]r{}]|r(?:[^!-\\"(-),/:-?[-]s{}]|s(?:[^!-\\"(-),/:-?[-]e{}]|e[^!-\\"(-),/:-?[-]t{}]))))))[^!-\\"(-),/:-?[-]{}]*[sv]*=[sv]*[^!(-),/:-?[-]{}]+);?)*)*",
+      "@rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[sv]*(",
+      "@lt 4"
+    ]
+
+[http.middlewares.bad_bot_block_RFI]
+  [http.middlewares.bad_bot_block_RFI.plugin.badbot]
+    userAgent = [
+      "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)",
       "@lt 1",
-      "@rx (?i)[\\"'`][sv]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?[\\"'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+[\\"'`]|like[sv]*?[\\"'`]%|select[sv]+?[sv\\"'-),-.0-9A-[]_-z]+from[sv]+",
-      "@rx (?i)[sv\\"'-)`]*?b([0-9A-Z_a-z]+)b[sv\\"'-)`]*?(?:![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(?:like|r(?:like|egexp)))[sv\\"'-)`]*?b([0-9A-Z_a-z]+)b",
-      "@rx (?i)alter[sv]*?[0-9A-Z_a-z]+.*?char(?:acter)?[sv]+set[sv]+[0-9A-Z_a-z]+|[\\"'`](?:;*?[sv]*?waitfor[sv]+(?:time|delay)[sv]+[\\"'`]|;.*?:[sv]*?goto)",
-      "@rx (?i)(?:select|;)[sv]+(?:benchmark|if|sleep)[sv]*?([sv]*?(?[sv]*?[0-9A-Z_a-z]+",
-      "@rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*(",
-      "@rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)",
+      "@rx ^(?i:file|ftps?|https?).*??+$",
+      "@lt 3",
+      "@rx (?i)(?:bincludes*([^)]*|mosConfig_absolute_path|_CONF[path]|_SERVER[DOCUMENT_ROOT]|GALLERY_BASEDIR|path[docroot]|appserv_root|config[root_dir])=(?:file|ftps?|https?)://",
+      "@rx ^(?i:file|ftps?|https?)://(?:d{1,3}.d{1,3}.d{1,3}.d{1,3})",
       "@lt 2",
-      "@rx (?i)b(?:orb(?:[sv]?(?:[0-9]{1,10}|[\\"'][^=]{1,10}[\\"'])[sv]?[<->]+|[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|xorb[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|'[sv]+x?or[sv]+.{1,20}[!+-<->]",
-      "@rx (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|oacreate|p(?:assword|repare)|replwritetovarbin)|ql_(?:longvarchar|variant))|utl_(?:file|http)|xp_(?:availablemedia|(?:cmdshel|servicecontro)l|dirtree|e(?:numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(?:_enumdomains)?|reg(?:addmultistring|delete(?:key|value)|enum(?:key|value)s|re(?:ad|movemultistring)|write)|terminate(?:_process)?)",
-      "@rx (?i)bandb(?:[sv]+(?:[0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|[\\"'][^=]{1,10}[\\"']) ?[<->]+)",
-      "@rx ((?:[~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>]*?){6})",
-      "@rx [\\"'`][[{].*[]}][\\"'`].*(::.*jsonb?)?.*(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)|(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)[\\"'`][[{].*[]}][\\"'`]|json_extract.*(.*)",
-      "@rx (?i)select[sv]*?pg_sleep|waitfor[sv]*?delay[sv]?[\\"'`]+[sv]?[0-9]|;[sv]*?shutdown[sv]*?(?:[#;{]|/*|--)",
-      "@rx (?i)b(?:(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)b[sv]*(?|end[sv]*?);)|[sv(]load_file[sv]*?(|[\\"'`][sv]+regexp[^0-9A-Z_a-z]|[\\"'0-9A-Z_-z][sv]+asb[sv]*[\\"'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:(?:(?:(?:cre|trunc)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]+[0-9A-Z_a-z]+|u(?:pdate[sv]+[0-9A-Z_a-z]+|nion[sv]*(?:all|(?:sele|distin)ct)b)|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject))b)",
-      "@rx (?i)b(?:havingb(?:[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')[sv]*?[<->]| ?(?:[0-9]{1,10} ?[<->]+|[\\"'][^=]{1,10}[ \\"'<-?[]+))|ex(?:ecute(?:(|[sv]{1,5}[$.0-9A-Z_a-z]{1,5}[sv]{0,3})|ists[sv]*?([sv]*?selectb)|(?:create[sv]+?table.{0,20}?|like[^0-9A-Z_a-z]*?char[^0-9A-Z_a-z]*?)()|select.*?case|from.*?limit|order[sv]by|exists[sv](?:[sv]select|s(?:elect[^sv](?:if(?:null)?[sv](|top|concat)|ystem[sv]()|bhavingb[sv]+[0-9]{1,10}|'[^=]{1,10}')",
-      "@rx (?i),.*?[\\"')0-9`-f][\\"'`](?:[\\"'`].*?[\\"'`]|(?:r?n)?z|[^\\"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]*?([sv]*?space[sv]*?(",
-      "@rx (?i)[\\"'`][sv]*?(?:(?:is[sv]+not|not[sv]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|])",
-      "!@streq %{TX.2}",
-      "@rx (?i)create[sv]+function[sv].+[sv]returns|;[sv]*?(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)b[sv]*?[([]?[0-9A-Z_a-z]{2,}",
-      "@rx (?:^s*[\\"'`;]+|[\\"'`]+s*$)",
-      "@rx (?i)b(?:a(?:(?:b|co)s|dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:in|cii(?:str)?)|tan2?|vg)|b(?:enchmark|i(?:n(?:_to_num)?|t_(?:and|count|length|x?or)))|c(?:ast|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|o(?:alesce|ercibility|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|(?:un)?t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|time(?:stamp)?|user)))|d(?:a(?:t(?:abase|e(?:_(?:add|format|sub)|diff)?)|y(?:name|of(?:month|week|year))?)|count|e(?:code|(?:faul|s_(?:de|en)cryp)t|grees)|ump)|e(?:lt|nc(?:ode|rypt)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:eld(?:_in_set)?|nd_in_set)|loor|o(?:rmat|und_rows)|rom_(?:base64|days|unixtime))|g(?:et_(?:format|lock)|r(?:eates|oup_conca)t)|h(?:ex(?:toraw)?|our)|i(?:f(?:null)?|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)?|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull))|null)?)|l(?:ast(?:_(?:day|insert_id))?|case|e(?:(?:as|f)t|ngth)|n|o(?:ad_file|ca(?:l(?:timestamp)?|te)|g(?:10|2)?|wer)|pad|trim)|m(?:a(?:ke(?:date|_set)|ster_pos_wait|x)|d5|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:d|nth(?:name)?))|n(?:ame_const|o(?:t_in|w)|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:assword|eriod_(?:add|diff)|g_sleep|i|o(?:sition|w(?:er)?)|rocedure_analyse)|qu(?:arter|ote)|r(?:a(?:dians|nd|wto(?:hex|nhex(?:toraw)?))|e(?:lease_lock|p(?:eat|lace)|verse)|ight|o(?:und|w_count)|pad|trim)|s(?:chema|e(?:c(?:ond|_to_time)|ssion_user)|ha[1-2]?|ig?n|leep|oundex|pace|qrt|t(?:d(?:dev(?:_(?:po|sam)p)?)?|r(?:cmp|_to_date))|u(?:b(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|m)|ys(?:date|tem_user))|t(?:an|ime(?:diff|_(?:format|to_sec)|stamp(?:add|diff)?)?|o_(?:base64|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|ix_timestamp)|p(?:datexml|per)|ser|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|v(?:a(?:lues|r(?:iance|_(?:po|sam)p))|ersion)|we(?:ek(?:day|ofyear)?|ight_string)|xmltype|year(?:week)?)[^0-9A-Z_a-z]*?(",
-      "@rx (?i)b(?:(?:d(?:bms_[0-9A-Z_a-z]+.|eleteb[^0-9A-Z_a-z]*?bfrom)|(?:groupb.*?bbyb.{1,100}?bhav|overlayb[^0-9A-Z_a-z]*?(.*?b[^0-9A-Z_a-z]*?plac)ing|in(?:nerb[^0-9A-Z_a-z]*?bjoin|sertb[^0-9A-Z_a-z]*?binto|tob[^0-9A-Z_a-z]*?b(?:dump|out)file)|loadb[^0-9A-Z_a-z]*?bdatab.*?binfile|s(?:electb.{1,100}?b(?:(?:.*?bdumpb.*|(?:count|length)b.{1,100}?)bfrom|(?:data_typ|fromb.{1,100}?bwher)e|instr|to(?:_(?:cha|numbe)r|pb.{1,100}?bfrom))|ys_context)|u(?:nionb.{1,100}?bselect|tl_inaddr))b|printb[^0-9A-Z_a-z]*?@@)|(?:collation[^0-9A-Z_a-z]*?(a|@@version|;[^0-9A-Z_a-z]*?b(?:drop|shutdown))b|'(?:dbo|msdasql|s(?:a|qloledb))'"
+      "!@endsWith .%{request_headers.host}",
+      "@lt 4"
     ]
 
-[http.middlewares.bad_bot_block_FIXATION]
-  [http.middlewares.bad_bot_block_FIXATION.plugin.badbot]
+[http.middlewares.bad_bot_block_LEAKAGES]
+  [http.middlewares.bad_bot_block_LEAKAGES.plugin.badbot]
     userAgent = [
-      "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$",
-      "@rx (?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)",
-      "!@endsWith %{request_headers.host}",
-      "@lt 4",
+      "@lt 1",
+      "@rx ^5d{2}$",
       "@lt 3",
+      "@rx ^#!s?/",
+      "@lt 2",
+      "@rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>[To Parent Directory]</[Aa]><br>)",
+      "@lt 4"
+    ]
+
+[http.middlewares.bad_bot_block_XSS]
+  [http.middlewares.bad_bot_block_XSS.plugin.badbot]
+    userAgent = [
+      "@rx (?i)b(?:s(?:tyle|rc)|href)b[sS]*?=",
       "@lt 1",
-      "@rx ^(?:ht|f)tps?://(.*?)/",
-      "@eq 0",
-      "@lt 2"
+      "@rx +ADw-.*(?:+AD4-|>)|<.*+AD4-",
+      "@rx (?i)<OBJECT[s/+].*?(?:type|codetype|classid|code|data)[s/+]*=",
+      "@rx (?i:<style.*?>.*?(?:@[ix5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(x5c]|&#x?0*(?:40|28|92|5C);?)))",
+      "@rx (?i)b(?:eval|set(?:timeout|interval)|new[sv]+Function|a(?:lert|tob)|btoa)[sv]*(",
+      "@rx (?i:[\\"'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|x5cu006C)(?:o|x5cu006F)(?:c|x5cu0063)(?:a|x5cu0061)(?:t|x5cu0074)(?:i|x5cu0069)(?:o|x5cu006F)(?:n|x5cu006E)|(?:n|x5cu006E)(?:a|x5cu0061)(?:m|x5cu006D)(?:e|x5cu0065)|(?:o|x5cu006F)(?:n|x5cu006E)(?:e|x5cu0065)(?:r|x5cu0072)(?:r|x5cu0072)(?:o|x5cu006F)(?:r|x5cu0072)|(?:v|x5cu0076)(?:a|x5cu0061)(?:l|x5cu006C)(?:u|x5cu0075)(?:e|x5cu0065)(?:O|x5cu004F)(?:f|x5cu0066)).*?=)",
+      "@rx (?i)(?:v|&#(?:0*8|x0*5)[36];)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:b|&#(?:0*6[26]|x0*(?:98|42));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;)).",
+      "@lt 2",
+      "@rx (?i)<EMBED[s/+].*?(?:src|type).*?=",
+      "@rx ![!+ ][]",
+      "@rx (?i:<.*[:]?vmlframe.*?[s/+]*?src[s/+]*=)",
+      "@detectXSS",
+      "@rx (?i)<BASE[s/+].*?href[s/+]*=",
+      "@rx ((?:[[^]]*][^.]*.)|Reflect[^.]*.).*(?:map|sort|apply)[^.]*..*call[^`]*`.*`",
+      "@rx (?i)<LINK[s/+].*?href[s/+]*=",
+      "@rx (?i:<META[s/+].*?http-equiv[s/+]*=[s/+]*[\\"'`]?(?:(?:c|&#x?0*(?:67|43|99|63);?)|(?:r|&#x?0*(?:82|52|114|72);?)|(?:s|&#x?0*(?:83|53|115|73);?)))",
+      "@rx (?i)[\\"'][ ]*(?:[^a-z0-9~_:' ]|in).+?[.].+?=",
+      "@rx (?i)<APPLET[s/+>]",
+      "@rx {{.*?}}",
+      "@rx <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|hr|html|i|iframe|ilayer|img|input|ins|isindex|kdb|keygen|label|layer|legend|li|limittext|link|listing|map|marquee|menu|meta|multicol|nobr|noembed|noframes|noscript|nosmartquotes|object|ol|optgroup|option|p|param|plaintext|pre|q|rt|ruby|s|samp|script|select|server|shadow|sidebar|small|spacer|span|strike|strong|style|sub|sup|table|tbody|td|textarea|tfoot|th|thead|title|tr|tt|u|ul|var|wbr|xml|xmp)W",
+      "@contains -->",
+      "@rx xbc[^xbe>]*[xbe>]|<[^xbe]*xbe",
+      "@rx (?i)[s\\"'`;/0-9=x0Bx09x0Cx3Bx2Cx28x3B]on[a-zA-Z]{3,25}[sx0Bx09x0Cx3Bx2Cx28x3B]*?=[^=]",
+      "@rx (?i).(?:b(?:x(?:link:href|html|mlns)|data:text/html|formaction|patternb.*?=)|!ENTITY[sv]+(?:%[sv]+)?[^sv]+[sv]+(?:SYSTEM|PUBLIC)|@import|;base64)b",
+      "!@validateByteRange 20, 45-47, 48-57, 65-90, 95, 97-122",
+      "@rx (?:self|document|this|top|window)s*(?:/*|[[)]).+?(?:]|*/)",
+      "@pm document.cookie document.domain document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[",
+      "@rx (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url(javascript",
+      "@rx (?i)<[^0-9<>A-Z_a-z]*(?:[^sv\\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e|v[^0-9A-Z_a-z]*?g|e[^0-9A-Z_a-z]*?t[^0-9>A-Z_a-z])|f[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?m|m[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?q[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?e|e[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?a[^0-9>A-Z_a-z])|(?:l[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?k|o[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?j[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?c[^0-9A-Z_a-z]*?t|e[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?d|a[^0-9A-Z_a-z]*?(?:p[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?t|u[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?o|n[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?e)|p[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m|i?[^0-9A-Z_a-z]*?f[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?e|b[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?s[^0-9A-Z_a-z]*?e|o[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?y|i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?s)|i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a?[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?e?|v[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?o)[^0-9>A-Z_a-z])|(?:<[0-9A-Z_a-z].*[sv/]|[\\"'](?:.*[sv/])?)(?:background|formaction|lowsrc|on(?:a(?:bort|ctivate|d(?:apteradded|dtrack)|fter(?:print|(?:scriptexecu|upda)te)|lerting|n(?:imation(?:cancel|end|iteration|start)|tennastatechange)|ppcommand|u(?:dio(?:end|process|start)|xclick))|b(?:e(?:fore(?:(?:(?:(?:de)?activa|scriptexecu)t|toggl)e|c(?:opy|ut)|editfocus|input|p(?:aste|rint)|u(?:nload|pdate))|gin(?:Event)?)|l(?:ocked|ur)|oun(?:ce|dary)|roadcast|usy)|c(?:a(?:(?:ch|llschang)ed|nplay(?:through)?|rdstatechange)|(?:ell|fstate)change|h(?:a(?:rging(?:time)?cha)?nge|ecking)|l(?:ick|ose)|o(?:m(?:mand(?:update)?|p(?:lete|osition(?:end|start|update)))|n(?:nect(?:ed|ing)|t(?:extmenu|rolselect))|py)|u(?:echange|t))|d(?:ata(?:(?:availabl|chang)e|error|setc(?:hanged|omplete))|blclick|e(?:activate|livery(?:error|success)|vice(?:found|light|(?:mo|orienta)tion|proximity))|i(?:aling|s(?:abled|c(?:hargingtimechange|onnect(?:ed|ing))))|o(?:m(?:a(?:ctivate|ttrmodified)|(?:characterdata|subtree)modified|focus(?:in|out)|mousescroll|node(?:inserted(?:intodocument)?|removed(?:fromdocument)?))|wnloading)|r(?:ag(?:drop|e(?:n(?:d|ter)|xit)|(?:gestur|leav)e|over|start)|op)|urationchange)|e(?:mptied|n(?:abled|d(?:ed|Event)?|ter)|rror(?:update)?|xit)|f(?:ailed|i(?:lterchange|nish)|o(?:cus(?:in|out)?|rm(?:change|input))|ullscreenchange)|g(?:amepad(?:axismove|button(?:down|up)|(?:dis)?connected)|et)|h(?:ashchange|e(?:adphoneschange|l[dp])|olding)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|put|valid))|key(?:down|press|up)|l(?:evelchange|o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|y)|m(?:ark|essage|o(?:use(?:down|enter|(?:lea|mo)ve|o(?:ut|ver)|up|wheel)|ve(?:end|start)?|z(?:a(?:fterpaint|udioavailable)|(?:beforeresiz|orientationchang|t(?:apgestur|imechang))e|(?:edgeui(?:c(?:ancel|omplet)|start)e|network(?:down|up)loa)d|fullscreen(?:change|error)|m(?:agnifygesture(?:start|update)?|ouse(?:hittest|pixelscroll))|p(?:ointerlock(?:change|error)|resstapgesture)|rotategesture(?:start|update)?|s(?:crolledareachanged|wipegesture(?:end|start|update)?))))|no(?:match|update)|o(?:(?:bsolet|(?:ff|n)lin)e|pen|verflow(?:changed)?)|p(?:a(?:ge(?:hide|show)|int|(?:st|us)e)|lay(?:ing)?|o(?:inter(?:down|enter|(?:(?:lea|mo)v|rawupdat)e|o(?:ut|ver)|up)|p(?:state|up(?:hid(?:den|ing)|show(?:ing|n))))|ro(?:gress|pertychange))|r(?:atechange|e(?:adystatechange|ceived|movetrack|peat(?:Event)?|quest|s(?:et|ize|u(?:lt|m(?:e|ing)))|trieving)|ow(?:e(?:nter|xit)|s(?:delete|inserted)))|s(?:croll(?:end)?|e(?:arch|ek(?:complete|ed|ing)|lect(?:ionchange|start)?|n(?:ding|t)|t)|how|(?:ound|peech)(?:end|start)|t(?:a(?:lled|rt|t(?:echange|uschanged))|k(?:comma|sessione)nd|op)|u(?:bmit|ccess|spend)|vg(?:abort|error|(?:un)?load|resize|scroll|zoom))|t(?:ext|ime(?:out|update)|o(?:ggle|uch(?:cancel|en(?:d|ter)|(?:lea|mo)ve|start))|ransition(?:cancel|end|run|start))|u(?:n(?:derflow|handledrejection|load)|p(?:dateready|gradeneeded)|s(?:erproximity|sdreceived))|v(?:ersion|o(?:ic|lum)e)change|w(?:a(?:it|rn)ing|ebkit(?:animation(?:end|iteration|start)|transitionend)|heel)|zoom)|ping|s(?:rc|tyle))[x08-nf-r ]*?=",
+      "@rx (?i:<META[s/+].*?charset[s/+]*=)",
+      "@rx (?i)(?:j|&#(?:0*(?:74|106)|x0*[46]A);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:v|&#(?:0*(?:86|118)|x0*[57]6);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:a|&#(?:0*(?:65|97)|x0*[46]1);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:s|&#(?:0*(?:115|83)|x0*[57]3);)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:c|&#(?:x0*[46]3|0*(?:99|67));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:r|&#(?:x0*[57]2|0*(?:114|82));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:i|&#(?:x0*[46]9|0*(?:105|73));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:p|&#(?:x0*[57]0|0*(?:112|80));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?:t|&#(?:x0*[57]4|0*(?:116|84));)(?:[t-nr]|&(?:#(?:0*(?:9|1[03])|x0*[AD]);?|(?:tab|newline);))*(?::|&(?:#(?:0*58|x0*3A);?|colon;)).",
+      "@rx (?i)(?:W|^)(?:javascript:(?:[sS]+[=x5c([.<]|[sS]*?(?:bnameb|x5c[ux]d))|data:(?:(?:[a-z]w+/w[w+-]+w)?[;,]|[sS]*?;[sS]*?b(?:base64|charset=)|[sS]*?,[sS]*?<[sS]*?w[sS]*?>))|@W*?iW*?mW*?pW*?oW*?rW*?tW*?(?:/*[sS]*?)?(?:[\\"']|W*?uW*?rW*?l[sS]*?()|[^-]*?-W*?mW*?oW*?zW*?-W*?bW*?iW*?nW*?dW*?iW*?nW*?g[^:]*?:W*?uW*?rW*?l[sS]*?(",
+      "@lt 3",
+      "@rx (?i)<script[^>]*>[sS]*?",
+      "@rx (?:xbcs*/s*[^xbe>]*[xbe>])|(?:<s*/s*[^xbe]*xbe)",
+      "@rx <[?]?import[s/+S]*?implementation[s/+]*?=",
+      "@lt 4"
     ]
 
 [http.middlewares.bad_bot_block_JAVA]
   [http.middlewares.bad_bot_block_JAVA.plugin.badbot]
     userAgent = [
-      "@pmFromFile java-code-leakages.data",
-      "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)",
-      "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)",
+      "@lt 1",
       "@rx .*.(?:jsp|jspx).*$",
-      "@rx xacxedx00x05",
-      "@pmFromFile java-classes.data",
-      "@lt 4",
-      "@pmFromFile java-errors.data",
+      "@rx java.lang.(?:runtime|processbuilder)",
+      "@lt 2",
       "@rx (?:rO0ABQ|KztAAU|Cs7QAF)",
+      "@pmFromFile java-classes.data",
+      "@pmFromFile java-code-leakages.data",
+      "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)",
       "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)|jndi|ctx)",
-      "@lt 3",
-      "@lt 1",
       "@rx (?i)(?:$|&dollar;?)(?:{|&l(?:brace|cub);?)",
-      "@rx java.lang.(?:runtime|processbuilder)",
       "@rx javab.+(?:runtime|processbuilder)",
-      "@rx (?:unmarshaller|base64data|java.)",
-      "@lt 2",
-      "@rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)",
+      "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)",
       "@rx (?:runtime|processbuilder)",
-      "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)"
+      "@rx xacxedx00x05",
+      "@rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)",
+      "@rx (?:unmarshaller|base64data|java.)",
+      "@pmFromFile java-errors.data",
+      "@lt 3",
+      "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)",
+      "@lt 4"
     ]
 
-[http.middlewares.bad_bot_block_EVALUATION]
-  [http.middlewares.bad_bot_block_EVALUATION.plugin.badbot]
+[http.middlewares.bad_bot_block_SQLI]
+  [http.middlewares.bad_bot_block_SQLI.plugin.badbot]
     userAgent = [
-      "@ge 4",
-      "@ge %{tx.inbound_anomaly_score_threshold}",
-      "@lt 4",
-      "@lt 3",
+      "@rx (?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^\\"]*?(?:\\"[^\\"]*?\\"[^\\"]*?)*?\\"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[sv]*([0-9A-Z_a-z]+)b",
       "@lt 1",
-      "@ge %{tx.outbound_anomaly_score_threshold}",
-      "@ge 1",
-      "@eq 1",
-      "@ge 2",
+      "@streq %{TX.2}",
+      "@rx ^(?:[^']*'|[^\\"]*\\"|[^`]*`)[sv]*;",
+      "@rx (?i),.*?[\\"')0-9`-f][\\"'`](?:[\\"'`].*?[\\"'`]|(?:r?n)?z|[^\\"'`]+)|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]*?([sv]*?space[sv]*?(",
+      "@rx /*!?|*/|[';]--|--(?:[sv]|[^-]*?-)|[^&-]#.*?[sv]|;?x00",
+      "@rx (?i)(?:select|;)[sv]+(?:benchmark|if|sleep)[sv]*?([sv]*?(?[sv]*?[0-9A-Z_a-z]+",
+      "@rx ((?:[~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>]*?){6})",
+      "@rx (?i)b(?:havingb(?:[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')[sv]*?[<->]| ?(?:[0-9]{1,10} ?[<->]+|[\\"'][^=]{1,10}[ \\"'<-?[]+))|ex(?:ecute(?:(|[sv]{1,5}[$.0-9A-Z_a-z]{1,5}[sv]{0,3})|ists[sv]*?([sv]*?selectb)|(?:create[sv]+?table.{0,20}?|like[^0-9A-Z_a-z]*?char[^0-9A-Z_a-z]*?)()|select.*?case|from.*?limit|order[sv]by|exists[sv](?:[sv]select|s(?:elect[^sv](?:if(?:null)?[sv](|top|concat)|ystem[sv]()|bhavingb[sv]+[0-9]{1,10}|'[^=]{1,10}')",
+      "@rx (?:^s*[\\"'`;]+|[\\"'`]+s*$)",
+      "@rx (?i)b(?:(?:d(?:bms_[0-9A-Z_a-z]+.|eleteb[^0-9A-Z_a-z]*?bfrom)|(?:groupb.*?bbyb.{1,100}?bhav|overlayb[^0-9A-Z_a-z]*?(.*?b[^0-9A-Z_a-z]*?plac)ing|in(?:nerb[^0-9A-Z_a-z]*?bjoin|sertb[^0-9A-Z_a-z]*?binto|tob[^0-9A-Z_a-z]*?b(?:dump|out)file)|loadb[^0-9A-Z_a-z]*?bdatab.*?binfile|s(?:electb.{1,100}?b(?:(?:.*?bdumpb.*|(?:count|length)b.{1,100}?)bfrom|(?:data_typ|fromb.{1,100}?bwher)e|instr|to(?:_(?:cha|numbe)r|pb.{1,100}?bfrom))|ys_context)|u(?:nionb.{1,100}?bselect|tl_inaddr))b|printb[^0-9A-Z_a-z]*?@@)|(?:collation[^0-9A-Z_a-z]*?(a|@@version|;[^0-9A-Z_a-z]*?b(?:drop|shutdown))b|'(?:dbo|msdasql|s(?:a|qloledb))'",
+      "@rx (?i)[\\"'`][sv]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)[sv]+[sv0-9A-Z_a-z]+=[sv]*?[0-9A-Z_a-z]+[sv]*?having[sv]+|like[^0-9A-Z_a-z]*?[\\"'0-9`])|[0-9A-Z_a-z][sv]+like[sv]+[\\"'`]|like[sv]*?[\\"'`]%|select[sv]+?[sv\\"'-),-.0-9A-[]_-z]+from[sv]+",
       "@lt 2",
-      "@ge 3"
-    ]
-
-[http.middlewares.bad_bot_block_LEAKAGES]
-  [http.middlewares.bad_bot_block_LEAKAGES.plugin.badbot]
-    userAgent = [
-      "@lt 4",
+      "@rx (?i)in[sv]*?(+[sv]*?select|(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)[sv+0-9A-Z_a-z]+(?:regexp[sv]*?(|sounds[sv]+like[sv]*?[\\"'`]|[0-9=]+x)|[\\"'`](?:[sv]*?(?:[0-9][sv]*?(?:--|#)|is[sv]*?(?:[0-9].+[\\"'`]?[0-9A-Z_a-z]|[.0-9]+[sv]*?[^0-9A-Z_a-z].*?[\\"'`]))|[%-&<->^]+[0-9][sv]*?(?:=|x?or|div|like|between|and)|(?:[^0-9A-Z_a-z]+[+-0-9A-Z_a-z]+[sv]*?=[sv]*?[0-9][^0-9A-Z_a-z]+||?[-0-9A-Z_a-z]{3,}[^sv,.0-9A-Z_a-z]+)[\\"'`]|[sv]*(?:(?:(?i:N)?AND|(?i:X)?(?i:X)?OR|DIV|LIKE|BETWEEN|NOT)[sv]+|(?:|||&&)[sv]*)(?:array[sv]*[|[0-9A-Z_a-z]+(?:[sv]*!?~|[sv]+(?:not[sv]+)?similar[sv]+to[sv]+)|(?:tru|fals)eb))|bexcept[sv]+(?:selectb|values[sv]*?()",
+      "@rx ((?:[~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>]*?){8})",
+      "@rx ((?:[~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>]*?){3})",
+      "!@streq %{TX.2}",
+      "@rx (?i)autonomous_transaction|(?:current_use|n?varcha|tbcreato)r|db(?:a_users|ms_java)|open(?:owa_util|query|rowset)|s(?:p_(?:(?:addextendedpro|sqlexe)c|execute(?:sql)?|help|is_srvrolemember|makewebtask|oacreate|p(?:assword|repare)|replwritetovarbin)|ql_(?:longvarchar|variant))|utl_(?:file|http)|xp_(?:availablemedia|(?:cmdshel|servicecontro)l|dirtree|e(?:numdsn|xecresultset)|filelist|loginconfig|makecab|ntsec(?:_enumdomains)?|reg(?:addmultistring|delete(?:key|value)|enum(?:key|value)s|re(?:ad|movemultistring)|write)|terminate(?:_process)?)",
+      "@rx [\\"'`][sd]*?[^ws]W*?dW*?.*?[\\"'`d]",
+      "@rx ((?:[~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>]*?){12})",
+      "@rx (?i)[\\"'`](?:[sv]*?(?:(?:*.+(?:x?or|div|like|between|(?:an|i)d)[^0-9A-Z_a-z]*?[\\"'`]|(?:x?or|div|like|between|and)[sv][^0-9]+[-0-9A-Z_a-z]+.*?)[0-9]|[^sv0-9?A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]+[sv]*?[\\"'`]|[^sv0-9A-Z_a-z]+[sv]*?[^A-Z_a-z].*?(?:#|--))|.*?*[sv]*?[0-9])|^[\\"'`]|[%(-+-<>][-0-9A-Z_a-z]+[^sv0-9A-Z_a-z]+[\\"'`][^,]",
+      "@rx (?i:b0x[a-fd]{3,})",
+      "@rx (?i)b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|iel(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|inser_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[1-2]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*(",
+      "@rx (?i:^[Wd]+s*?(?:alter|union)b)",
+      "@rx (?i)[sv\\"'-)`]*?b([0-9A-Z_a-z]+)b[sv\\"'-)`]*?(?:![<->]|<[=->]?|>=?|^|is[sv]+not|not[sv]+(?:like|r(?:like|egexp)))[sv\\"'-)`]*?b([0-9A-Z_a-z]+)b",
+      "@rx (?i)b(?:d(?:atabas|b_nam)e[^0-9A-Z_a-z]*(|(?:information_schema|m(?:aster..sysdatabases|s(?:db|ys(?:ac(?:cess(?:objects|storage|xml)|es)|modules2?|(?:object|querie|relationship)s))|ysql.db)|northwind|pg_(?:catalog|toast)|tempdb)b|s(?:chema(?:_nameb|[^0-9A-Z_a-z]*()|(?:qlite_(?:temp_)?master|ys(?:aux|.database_name))b))",
+      "@rx (?i)create[sv]+function[sv].+[sv]returns|;[sv]*?(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)b[sv]*?[([]?[0-9A-Z_a-z]{2,}",
+      "@rx (?i)b(?:a(?:(?:b|co)s|dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:in|cii(?:str)?)|tan2?|vg)|b(?:enchmark|i(?:n(?:_to_num)?|t_(?:and|count|length|x?or)))|c(?:ast|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|o(?:alesce|ercibility|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|(?:un)?t)|r32|ur(?:(?:dat|tim)e|rent_(?:date|time(?:stamp)?|user)))|d(?:a(?:t(?:abase|e(?:_(?:add|format|sub)|diff)?)|y(?:name|of(?:month|week|year))?)|count|e(?:code|(?:faul|s_(?:de|en)cryp)t|grees)|ump)|e(?:lt|nc(?:ode|rypt)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:eld(?:_in_set)?|nd_in_set)|loor|o(?:rmat|und_rows)|rom_(?:base64|days|unixtime))|g(?:et_(?:format|lock)|r(?:eates|oup_conca)t)|h(?:ex(?:toraw)?|our)|i(?:f(?:null)?|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)?|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull))|null)?)|l(?:ast(?:_(?:day|insert_id))?|case|e(?:(?:as|f)t|ngth)|n|o(?:ad_file|ca(?:l(?:timestamp)?|te)|g(?:10|2)?|wer)|pad|trim)|m(?:a(?:ke(?:date|_set)|ster_pos_wait|x)|d5|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:d|nth(?:name)?))|n(?:ame_const|o(?:t_in|w)|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:assword|eriod_(?:add|diff)|g_sleep|i|o(?:sition|w(?:er)?)|rocedure_analyse)|qu(?:arter|ote)|r(?:a(?:dians|nd|wto(?:hex|nhex(?:toraw)?))|e(?:lease_lock|p(?:eat|lace)|verse)|ight|o(?:und|w_count)|pad|trim)|s(?:chema|e(?:c(?:ond|_to_time)|ssion_user)|ha[1-2]?|ig?n|leep|oundex|pace|qrt|t(?:d(?:dev(?:_(?:po|sam)p)?)?|r(?:cmp|_to_date))|u(?:b(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|m)|ys(?:date|tem_user))|t(?:an|ime(?:diff|_(?:format|to_sec)|stamp(?:add|diff)?)?|o_(?:base64|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|ix_timestamp)|p(?:datexml|per)|ser|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|v(?:a(?:lues|r(?:iance|_(?:po|sam)p))|ersion)|we(?:ek(?:day|ofyear)?|ight_string)|xmltype|year(?:week)?)[^0-9A-Z_a-z]*?(",
+      "@rx (?i)union.*?select.*?from",
+      "@rx ((?:[~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>][^~!@#$%^&*()-+={}[]|:;\\"'´’‘`<>]*?){2})",
+      "@rx (?i)select[sv]*?pg_sleep|waitfor[sv]*?delay[sv]?[\\"'`]+[sv]?[0-9]|;[sv]*?shutdown[sv]*?(?:[#;{]|/*|--)",
+      "@rx (?i)W+d*?s*?bhavingbs*?[^s-]",
+      "@rx (?i)create[sv]+(?:function|procedure)[sv]*?[0-9A-Z_a-z]+[sv]*?([sv]*?)[sv]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][sv]*?[0-9A-Z_a-z]+|iv[sv]*?([+-]*[sv.0-9]+,[+-]*[sv.0-9]+))|exec[sv]*?([sv]*?@|(?:lo_(?:impor|ge)t|procedure[sv]+analyse)[sv]*?(|;[sv]*?(?:declare|open)[sv]+[-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[sv]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)",
+      "@rx (?i:/*[!+](?:[ws=_-()]+)?*/)",
+      "@rx (?i)(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)[sv]?(?|end[sv]*?);|[sv(]load_file[sv]*?(|[\\"'`][sv]+regexp[^0-9A-Z_a-z]|[^A-Z_a-z][sv]+asb[sv]*[\\"'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:create[sv]+[0-9A-Z_a-z]+|(?:d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load|(?:renam|truncat)e|u(?:pdate|nion[sv]*(?:all|(?:sele|distin)ct))|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject)))b)",
+      "@rx (?:'(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)')",
+      "@rx (?i))[sv]*?when[sv]*?[0-9]+[sv]*?then|[\\"'`][sv]*?(?:[#{]|--)|/*![sv]?[0-9]+|b(?:(?:binary|cha?r)[sv]*?([sv]*?[0-9]|(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|r(?:egexp|like))[sv]+[0-9A-Z_a-z]+()|(?:|||&&)[sv]*?[0-9A-Z_a-z]+(",
+      "@rx ';",
+      "@rx (?i)[?$(?:n(?:e|in?|o[rt])|e(?:q|xists|lemMatch)|l(?:te?|ike)|mod|a(?:ll|nd)|(?:s(?:iz|lic)|wher)e|t(?:ype|ext)|x?or|div|between|regex|jsonSchema)]?",
+      "@rx (?i:merge.*?usings*?(|executes*?immediates*?[\\"'`]|matchs*?[w(),+-]+s*?againsts*?()",
+      "@rx (?i)b(?:(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[sv]+(?:char|group_concat|load_file)b[sv]*(?|end[sv]*?);)|[sv(]load_file[sv]*?(|[\\"'`][sv]+regexp[^0-9A-Z_a-z]|[\\"'0-9A-Z_-z][sv]+asb[sv]*[\\"'0-9A-Z_-z]+[sv]*bfrom|^[^A-Z_a-z]+[sv]*?(?:(?:(?:(?:cre|trunc)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser|selec)t|load)[sv]+[0-9A-Z_a-z]+|u(?:pdate[sv]+[0-9A-Z_a-z]+|nion[sv]*(?:all|(?:sele|distin)ct)b)|alter[sv]*(?:a(?:(?:ggregat|pplication[sv]*rol)e|s(?:sembl|ymmetric[sv]*ke)y|u(?:dit|thorization)|vailability[sv]*group)|b(?:roker[sv]*priority|ufferpool)|c(?:ertificate|luster|o(?:l(?:latio|um)|nversio)n|r(?:edential|yptographic[sv]*provider))|d(?:atabase|efault|i(?:mension|skgroup)|omain)|e(?:(?:ndpoi|ve)nt|xte(?:nsion|rnal))|f(?:lashback|oreign|u(?:lltext|nction))|hi(?:erarchy|stogram)|group|in(?:dex(?:type)?|memory|stance)|java|l(?:a(?:ngua|r)ge|ibrary|o(?:ckdown|g(?:file[sv]*group|in)))|m(?:a(?:s(?:k|ter[sv]*key)|terialized)|e(?:ssage[sv]*type|thod)|odule)|(?:nicknam|queu)e|o(?:perator|utline)|p(?:a(?:ckage|rtition)|ermission|ro(?:cedur|fil)e)|r(?:e(?:mot|sourc)e|o(?:l(?:e|lback)|ute))|s(?:chema|e(?:arch|curity|rv(?:er|ice)|quence|ssion)|y(?:mmetric[sv]*key|nonym)|togroup)|t(?:able(?:space)?|ext|hreshold|r(?:igger|usted)|ype)|us(?:age|er)|view|w(?:ork(?:load)?|rapper)|x(?:ml[sv]*schema|srobject))b)",
+      "@rx (?i)b(?:json(?:_[0-9A-Z_a-z]+)?|a(?:bs|(?:cos|sin)h?|tan[2h]?|vg)|c(?:eil(?:ing)?|h(?:a(?:nges|r(?:set)?)|r)|o(?:alesce|sh?|unt)|ast)|d(?:e(?:grees|fault)|a(?:te|y))|exp|f(?:loor(?:avg)?|ormat|ield)|g(?:lob|roup_concat)|h(?:ex|our)|i(?:f(?:null)?|if|n(?:str)?)|l(?:ast(?:_insert_rowid)?|ength|ike(?:l(?:ihood|y))?|n|o(?:ad_extension|g(?:10|2)?|wer(?:pi)?|cal)|trim)|m(?:ax|in(?:ute)?|o(?:d|nth))|n(?:ullif|ow)|p(?:i|ow(?:er)?|rintf|assword)|quote|r(?:a(?:dians|ndom(?:blob)?)|e(?:p(?:lace|eat)|verse)|ound|trim|ight)|s(?:i(?:gn|nh?)|oundex|q(?:lite_(?:compileoption_(?:get|used)|offset|source_id|version)|rt)|u(?:bstr(?:ing)?|m)|econd|leep)|t(?:anh?|otal(?:_changes)?|r(?:im|unc)|ypeof|ime)|u(?:n(?:icode|likely)|(?:pp|s)er)|zeroblob|bin|v(?:alues|ersion)|week|year)[^0-9A-Z_a-z]*(",
+      "@rx ^.*?x5c['\\"`](?:.*?['\\"`])?s*(?:and|or)b",
+      "@rx (?:`(?:(?:[ws=_-+{}()<@]){2,29}|(?:[A-Za-z0-9+/]{4})+(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)`)",
+      "@rx (?i)[\\"'`](?:[sv]*![sv]*[\\"'0-9A-Z_-z]|;?[sv]*(?:having|select|unionb[sv]*(?:all|(?:distin|sele)ct))b[sv]*[^sv])|b(?:(?:(?:c(?:onnection_id|urrent_user)|database|schema|user)[sv]*?|select.*?[0-9A-Z_a-z]?user)(|exec(?:ute)?[sv]+master.|from[^0-9A-Z_a-z]+information_schema[^0-9A-Z_a-z]|into[sv+]+(?:dump|out)file[sv]*?[\\"'`]|union(?:[sv]select[sv]@|[sv(0-9A-Z_a-z]*?select))|[sv]*?exec(?:ute)?.*?[^0-9A-Z_a-z]xp_cmdshell|[^0-9A-Z_a-z]iif[sv]*?(",
+      "@rx [\\"'`][[{].*[]}][\\"'`].*(::.*jsonb?)?.*(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)|(?:(?:@|->?)>|<@|?[&|]?|#>>?|[<>]|<-)[\\"'`][[{].*[]}][\\"'`]|json_extract.*(.*)",
+      "@rx (?i)(?:([sv]*?select[sv]*?[0-9A-Z_a-z]+|coalesce|order[sv]+by[sv]+if[0-9A-Z_a-z]*?)[sv]*?(|*/from|+[sv]*?[0-9]+[sv]*?+[sv]*?@|[0-9A-Z_a-z][\\"'`][sv]*?(?:(?:[+-=@|]+[sv]+?)+|[+-=@|]+)[(0-9]|@@[0-9A-Z_a-z]+[sv]*?[^sv0-9A-Z_a-z]|[^0-9A-Z_a-z]!+[\\"'`][0-9A-Z_a-z]|[\\"'`](?:;[sv]*?(?:if|while|begin)|[sv0-9]+=[sv]*?[0-9])|[sv(]+case[0-9]*?[^0-9A-Z_a-z].+[tw]hen[sv(]",
+      "@rx ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$",
+      "@rx (?i)1.e[(-),]",
+      "@rx (?i)(?:/*)+[\\"'`]+[sv]?(?:--|[#{]|/*)?|[\\"'`](?:[sv]*(?:(?:x?or|and|div|like|between)[sv-0-9A-Z_a-z]+[(-)+--<->][sv]*[\\"'0-9`]|[!=|](?:[sv -!+-0-9=]+.*?[\\"'-(`].*?|[sv -!0-9=]+.*?[0-9]+)$|(?:like|print)[^0-9A-Z_a-z]+[\\"'-(0-9A-Z_-z]|;)|(?:[<>~]+|[sv]*[^sv0-9A-Z_a-z]?=[sv]*|[^0-9A-Z_a-z]*?[+=]+[^0-9A-Z_a-z]*?)[\\"'`])|[0-9][\\"'`][sv]+[\\"'`][sv]+[0-9]|^admin[sv]*?[\\"'`]|[sv\\"'-(`][sv]*?glob[^0-9A-Z_a-z]+[\\"'-(0-9A-Z_-z]|[sv]is[sv]*?0[^0-9A-Z_a-z]|where[sv][sv,-.0-9A-Z_a-z]+[sv]=",
+      "@rx (?i)[\\"'`][sv]*?(?:(?:is[sv]+not|not[sv]+(?:like|glob|(?:betwee|i)n|null|regexp|match)|mod|div|sounds[sv]+like)b|[%-&*-+-/<->^|])",
+      "@rx (?i)bandb(?:[sv]+(?:[0-9]{1,10}[sv]*?[<->]|'[^=]{1,10}')| ?(?:[0-9]{1,10}|[\\"'][^=]{1,10}[\\"']) ?[<->]+)",
+      "@rx (?i)[sv(-)]case[sv]+when.*?then|)[sv]*?like[sv]*?(|select.*?having[sv]*?[^sv]+[sv]*?[^sv0-9A-Z_a-z]|if[sv]?([0-9A-Z_a-z]+[sv]*?[<->~]",
+      "@rx (?i)[sv\\"'-)`]*?b([0-9A-Z_a-z]+)b[sv\\"'-)`]*?(?:=|<=>|(?:sounds[sv]+)?like|glob|r(?:like|egexp))[sv\\"'-)`]*?b([0-9A-Z_a-z]+)b",
+      "@rx (?i)b(?:orb(?:[sv]?(?:[0-9]{1,10}|[\\"'][^=]{1,10}[\\"'])[sv]?[<->]+|[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|xorb[sv]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[sv]*?[<->])?)|'[sv]+x?or[sv]+.{1,20}[!+-<->]",
       "@lt 3",
-      "@rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>[To Parent Directory]</[Aa]><br>)",
-      "@lt 1",
-      "@rx ^#!s?/",
-      "@rx ^5d{2}$",
-      "@lt 2"
+      "@rx (?i)[\\"'`][sv]*?b(?:x?or|div|like|between|and)b[sv]*?[\\"'`]?[0-9]|x5cx(?:2[37]|3d)|^(?:.?[\\"'`]$|[\\"'x5c`]*?(?:[\\"'0-9`]+|[^\\"'`]+[\\"'`])[sv]*?b(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between||||&&)b[sv]*?[\\"'0-9A-Z_-z][!&(-)+-.@])|[^sv0-9A-Z_a-z][0-9A-Z_a-z]+[sv]*?[-|][sv]*?[\\"'`][sv]*?[0-9A-Z_a-z]|@(?:[0-9A-Z_a-z]+[sv]+(?:and|x?or|div|like|between)b[sv]*?[\\"'0-9`]+|[-0-9A-Z_a-z]+[sv](?:and|x?or|div|like|between)b[sv]*?[^sv0-9A-Z_a-z])|[^sv0-:A-Z_a-z][sv]*?[0-9][^0-9A-Z_a-z]+[^sv0-9A-Z_a-z][sv]*?[\\"'`].|[^0-9A-Z_a-z]information_schema|table_name[^0-9A-Z_a-z]",
+      "@detectSQLi",
+      "@rx (?i)!=|&&||||>[=->]|<(?:<|=>?|>(?:[sv]+binary)?)|b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)b|[0-9A-Z_a-z]*?_))|(?:likel(?:ihood|y)|unlikely)[sv]*()|r(?:egexp|like)[sv]+binary|not[sv]+between[sv]+(?:0[sv]+and|(?:'[^']*'|\\"[^\\"]*\\")[sv]+and[sv]+(?:'[^']*'|\\"[^\\"]*\\"))|is[sv]+null|like[sv]+(?:null|[0-9A-Z_a-z]+[sv]+escapeb)|(?:^|[^0-9A-Z_a-z])in[sv+]*([sv\\"0-9]+[^(-)]*)|[!<->]{1,2}[sv]*allb",
+      "@rx ^(?:and|or)$",
+      "@rx (?i)(?:&&||||and|between|div|like|n(?:and|ot)|(?:xx?)?or)[sv(]+[0-9A-Z_a-z]+[sv)]*?[!+=]+[sv0-9]*?[\\"'-)=`]|[0-9](?:[sv]*?(?:and|between|div|like|x?or)[sv]*?[0-9]+[sv]*?[+-]|[sv]+group[sv]+by.+()|/[0-9A-Z_a-z]+;?[sv]+(?:and|between|div|having|like|x?or|select)[^0-9A-Z_a-z]|(?:[#;]|--)[sv]*?(?:alter|drop|(?:insert|update)[sv]*?[0-9A-Z_a-z]{2,})|@.+=[sv]*?([sv]*?select|[^0-9A-Z_a-z]SET[sv]*?@[0-9A-Z_a-z]+",
+      "@rx (?i)alter[sv]*?[0-9A-Z_a-z]+.*?char(?:acter)?[sv]+set[sv]+[0-9A-Z_a-z]+|[\\"'`](?:;*?[sv]*?waitfor[sv]+(?:time|delay)[sv]+[\\"'`]|;.*?:[sv]*?goto)",
+      "@rx (?i:sleep(s*?d*?s*?)|benchmark(.*?,.*?))",
+      "!@rx ^ey[-0-9A-Z_a-z]+.ey[-0-9A-Z_a-z]+.[-0-9A-Z_a-z]+$",
+      "@rx W{4}",
+      "@lt 4"
     ]
 
-[http.middlewares.bad_bot_block_SQL]
-  [http.middlewares.bad_bot_block_SQL.plugin.badbot]
+[http.middlewares.bad_bot_block_RCE]
+  [http.middlewares.bad_bot_block_RCE.plugin.badbot]
     userAgent = [
-      "@rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|pg_(?:query|exec)() [:|Warning.{1,20}bpg_.*|valid PostgreSQL result|Npgsql.|Supplied argument is not a valid PostgreSQL .*? resource|(?:Unable to connect to PostgreSQL serv|invalid input syntax for integ)er",
-      "@rx (?i)(?:System.Data.OleDb.OleDbException|[Microsoft][ODBC SQL Server Driver]|[Macromedia][SQLServer JDBC Driver]|[SqlException|System.Data.SqlClient.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query()|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression.|ADODB.Field (0x800A0BCD)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*WSystem.Data.SqlClient.|Conversion failed when converting the varchar value .*? to data type int.)",
-      "@rx (?i:ORA-[0-9][0-9][0-9][0-9]|java.sql.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)",
-      "@rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite.Exception|System.Data.SQLite.SQLiteException)",
-      "!@pmFromFile sql-errors.data",
-      "@lt 4",
-      "@rx (?i)Exception (?:condition )?d+. Transaction rollback.",
-      "@rx (?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array()|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient.)|[MySQL][ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[(-)_a-z]{1,26})?|(?:ERROR [0-9]{4} ([0-9a-z]{5})|XPATH syntax error):",
-      "@rx (?i)org.hsqldb.jdbc",
-      "@rx (?i:JET Database Engine|Access Database Engine|[Microsoft][ODBC Microsoft Access Driver])",
-      "@rx (?i:[DM_QUERY_E_SYNTAX]|has occurred in the vicinity of:)",
-      "@lt 3",
-      "@rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*Server message.*)",
       "@lt 1",
-      "@rx (?i:An illegal character has been found in the statement|com.informix.jdbc|Exception.*Informix)",
-      "@rx (?i:DB2 SQL error:|[IBM][CLI Driver][DB2/6000]|CLI Driver.*DB2|DB2 SQL error|db2_w+()",
+      "@rx (?i)(?:(?:^|=)[sv]*(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*|(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*)[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|an|io|ulimit)|s(?:h|plit|vtool)|u(?:(?:t|rl)[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|inks|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[^sv])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash|nap)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:3m|c|a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))",
+      "@rx (?i)(?:(?:^|=)[sv]*(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*|(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*)[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|s(?:ed|ftp|ql)|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[sv&)<>|]|diff)|ew[sv&)<>|]|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:c|a(?:ll|tch)[sv&)<>|]|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))",
+      "@rx ba[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?sb[sv]+[!-\\"%',0-9@-Z_a-z]+=[^sv]",
+      "@rx !-d",
+      "@rx (?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*.[sv].*b",
       "@lt 2",
-      "@rx (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)",
-      "@rx (?i)Dynamic SQL Error",
-      "@rx (?i:Warning.*ingres_|Ingres SQLSTATE|IngresW.*Driver)",
-      "@rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)"
+      "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:C(?:(?:REATE|OPY [*,0-:]+) [\\"-#%-&*--9A-Zx5c_a-z]+|APABILITY|HECK|LOSE)|DELETE [\\"-#%-&*--.0-9A-Zx5c_a-z]+|EX(?:AMINE [\\"-#%-&*--.0-9A-Zx5c_a-z]+|PUNGE)|FETCH [*,0-:]+|L(?:IST [\\"-#*--9A-Zx5c_a-z~]+? [\\"-#%-&*--9A-Zx5c_a-z]+|OG(?:IN [--.0-9@_a-z]{1,40} .*?|OUT))|RENAME [\\"-#%-&*--9A-Zx5c_a-z]+? [\\"-#%-&*--9A-Zx5c_a-z]+|S(?:E(?:LECT [\\"-#%-&*--9A-Zx5c_a-z]+|ARCH(?: CHARSET [--.0-9A-Z_a-z]{1,40})? (?:(KEYWORD x5c)?(?:A(?:LL|NSWERED)|BCC|D(?:ELETED|RAFT)|(?:FLAGGE|OL)D|RECENT|SEEN|UN(?:(?:ANSWER|FLAGG)ED|D(?:ELETED|RAFT)|SEEN)|NEW)|(?:BODY|CC|FROM|HEADER .{1,100}|NOT|OR .{1,255}|T(?:EXT|O)) .{1,255}|LARGER [0-9]{1,20}|[*,0-:]+|(?:BEFORE|ON|S(?:ENT(?:(?:BEFOR|SINC)E|ON)|INCE)) \\"?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4}\\"?|S(?:MALLER [0-9]{1,20}|UBJECT .{1,255})|U(?:ID [*,0-:]+?|NKEYWORD x5c(Seen|(?:Answer|Flagg)ed|D(?:eleted|raft)|Recent))))|T(?:ORE [*,0-:]+? [+-]?FLAGS(?:.SILENT)? (?:(x5c[a-z]{1,20}))?|ARTTLS)|UBSCRIBE [\\"-#%-&*--9A-Zx5c_a-z]+)|UN(?:SUBSCRIBE [\\"-#%-&*--9A-Zx5c_a-z]+|AUTHENTICATE)|NOOP)",
+      "@rx rn(?s:.)*?b(?:(?:QUI|STA|RSE)(?i:T)|NOOP|CAPA)",
+      "@rx $(?:((?:.*|(.*)))|{.*})|[<>](.*)|/[0-9A-Z_a-z]*[!?.+]",
+      "@pmFromFile windows-powershell-commands.data",
+      "@pmFromFile restricted-upload.data",
+      "@rx (?is)rn[0-9A-Z_a-z]{1,50}b (?:A(?:PPEND (?:[\\"-#%-&*--9A-Zx5c_a-z]+)?(?: ([ x5ca-z]+))?(?: \\"?[0-9]{1,2}-[0-9A-Z_a-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [+-][0-9]{4}\\"?)? {[0-9]{1,20}+?}|UTHENTICATE [-0-9_a-z]{1,20}rn)|L(?:SUB (?:[\\"-#*.-9A-Z_a-z~]+)? (?:[\\"%-&*.-9A-Zx5c_a-z]+)?|ISTRIGHTS (?:[\\"%-&*--9A-Zx5c_a-z]+)?)|S(?:TATUS (?:[\\"%-&*--9A-Zx5c_a-z]+)? ((?:U(?:NSEEN|IDNEXT)|MESSAGES|UIDVALIDITY|RECENT| )+)|ETACL (?:[\\"%-&*--9A-Zx5c_a-z]+)? [+-][ac-eik-lpr-tw-x]+?)|UID (?:COPY|FETCH|STORE) (?:[*,0-:]+)?|(?:(?:DELETE|GET)ACL|MYRIGHTS) (?:[\\"%-&*--9A-Zx5c_a-z]+)?)",
+      "@rx (?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:(?:(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))b",
+      "@rx ;[sv]*.[sv]*[\\"']?(?:a(?:rchive|uth)|b(?:a(?:ckup|il)|inary)|c(?:d|h(?:anges|eck)|lone|onnection)|d(?:atabases|b(?:config|info)|ump)|e(?:cho|qp|x(?:cel|it|p(?:ert|lain)))|f(?:ilectrl|ullschema)|he(?:aders|lp)|i(?:mpo(?:rt|ster)|ndexes|otrace)|l(?:i(?:mi|n)t|o(?:ad|g))|(?:mod|n(?:onc|ullvalu)|unmodul)e|o(?:nce|pen|utput)|p(?:arameter|r(?:int|o(?:gress|mpt)))|quit|re(?:ad|cover|store)|s(?:ave|c(?:anstats|hema)|e(?:lftest|parator|ssion)|h(?:a3sum|ell|ow)?|tats|ystem)|t(?:ables|estc(?:ase|trl)|ime(?:out|r)|race)|vfs(?:info|list|name)|width)",
+      "@rx b(?:for(?:/[dflr].*)? %+[^ ]+ in(.*)[sv]?do|if(?:/i)?(?: not)?(?: (?:e(?:xist|rrorlevel)|defined|cmdextversion)b|[ (].*(?:b(?:g(?:eq|tr)|equ|neq|l(?:eq|ss))b|==)))",
+      "@rx rn(?s:.)*?b(?:DATA|QUIT|HELP(?: .{1,255})?)",
+      "@rx ^(s*)s+{",
+      "@rx (?i)[-0-9_a-z]+(?:[\\"'[-]]+|$+[!#*-0-9?-@x5c_a-{]+|``|[$<>]())[sv]*[-0-9_a-z]+",
+      "@rx s",
+      "@rx ^[^.]+.[^;?]+[;?](.*(['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]))",
+      "@rx /(?:[?*]+[a-z/]+|[a-z/]+[?*]+)",
+      "@pmFromFile unix-shell.data",
+      "!@rx [0-9]s*'s*[0-9]",
+      "@rx ^[^.]*?(?:['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{])",
+      "@rx !(?:d|!)",
+      "@rx ['*?x5c`][^n/]+/|/[^/]+?['*?x5c`]|$[!#-$(*-0-9?-[_a-{]",
+      "@rx (?i)(?:^|=)[sv]*(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:7[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:b[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|[ckz][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|(?:h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)[sv&)<>|]",
+      "@rx (?i)(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:7[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|(?:(?:b[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|x)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|[ckz][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|f[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dg]|g[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[&,<>|]|(?:[--.0-9A-Z_a-z][\\"'[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#*-0-9?-@_a-{]*)?x5c?)+[sv&,<>|]).*|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|l[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:s|z[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:4|[sv&),<>|].*))|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*)?|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|(?:e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|(?:s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?h)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?3[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)b",
+      "@rx /",
+      "@rx (?i)(?:^|=)[sv]*(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:a(?:ddgroup|xel)|b(?:ase(?:32|64|nc)|lkid|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|yobu|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:h(?:g(?:passwd|rp)|pass|sh)|lang++|oproc|ron)|d(?:iff[sv&)<>|]|mesg|oas)|e(?:2fsck|grep)|f(?:grep|iletest|tp(?:stats|who))|g(?:r(?:ep[sv&)<>|]|oupmod)|unzip|z(?:cat|exe|ip))|htop|l(?:ast(?:comm|log(?:in)?)|ess(?:echo|(?:fil|pip)e)|ftp(?:get)?|osetup|s(?:-F|b_release|cpu|mod|of|pci|usb)|wp-download|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:ilq|ster.passwd)|k(?:fifo|nod|temp)|locate|ysql(?:admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:.(?:openbsd|traditional)|at)|et(?:(?:c|st)at|kit-ftp|plan)|ohup|ping|stat)|onintr|p(?:dksh|erl5?|(?:ft|gre)p|hp(?:-cgi|[57])|igz|k(?:exec|ill)|(?:op|se)d|rint(?:env|f[sv&)<>|])|tar(?:diff|grep)?|wd.db|ython[2-3])|r(?:(?:bas|ealpat)h|m(?:dir[sv&)<>|]|user)|nano|sync)|s(?:diff|e(?:ndmail|t(?:env|sid))|ftp|(?:h.distri|pwd.d)b|ocat|td(?:err|in|out)|udo|ysctl)|t(?:ailf|c(?:p(?:ing|traceroute)|sh)|elnet|imeout[sv&)<>|]|raceroute6?)|u(?:n(?:ame|lz(?:4|ma)|(?:pig|x)z|rar|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:gr|pw)|w(?:get|hoami)|x(?:args|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:c(?:at|mp)|diff|[e-f]?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|std(?:(?:ca|m)t|grep|less)?))",
+      "@rx (?i)(?:t[\\"^]*i[\\"^]*m[\\"^]*e|[nr;`{]|||?|&&?)[sv]*[sv\\"'-(,@]*(?:[\\"'.-9A-Z_a-z]+/|(?:[\\"'x5c^]*[0-9A-Z_a-z][\\"'x5c^]*:.*|[ \\"'.-9A-Zx5c^-_a-z]*)x5c)?[\\"^]*(?:a[\\"^]*(?:s[\\"^]*s[\\"^]*o[\\"^]*c|t[\\"^]*(?:m[\\"^]*a[\\"^]*d[\\"^]*m|t[\\"^]*r[\\"^]*i[\\"^]*b)|u[\\"^]*(?:d[\\"^]*i[\\"^]*t[\\"^]*p[\\"^]*o[\\"^]*l|t[\\"^]*o[\\"^]*(?:c[\\"^]*(?:h[\\"^]*k|o[\\"^]*n[\\"^]*v)|(?:f[\\"^]*m|m[\\"^]*o[\\"^]*u[\\"^]*n)[\\"^]*t)))|b[\\"^]*(?:c[\\"^]*d[\\"^]*(?:b[\\"^]*o[\\"^]*o|e[\\"^]*d[\\"^]*i)[\\"^]*t|(?:d[\\"^]*e[\\"^]*h[\\"^]*d|o[\\"^]*o[\\"^]*t)[\\"^]*c[\\"^]*f[\\"^]*g|i[\\"^]*t[\\"^]*s[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n)|c[\\"^]*(?:a[\\"^]*c[\\"^]*l[\\"^]*s|e[\\"^]*r[\\"^]*t[\\"^]*(?:r[\\"^]*e[\\"^]*q|u[\\"^]*t[\\"^]*i[\\"^]*l)|h[\\"^]*(?:c[\\"^]*p|d[\\"^]*i[\\"^]*r|g[\\"^]*(?:l[\\"^]*o[\\"^]*g[\\"^]*o[\\"^]*n|p[\\"^]*o[\\"^]*r[\\"^]*t|u[\\"^]*s[\\"^]*r)|k[\\"^]*(?:d[\\"^]*s[\\"^]*k|n[\\"^]*t[\\"^]*f[\\"^]*s))|l[\\"^]*e[\\"^]*a[\\"^]*n[\\"^]*m[\\"^]*g[\\"^]*r|m[\\"^]*(?:d(?:[\\"^]*k[\\"^]*e[\\"^]*y)?|s[\\"^]*t[\\"^]*p)|s[\\"^]*c[\\"^]*r[\\"^]*i[\\"^]*p[\\"^]*t)|d[\\"^]*(?:c[\\"^]*(?:d[\\"^]*i[\\"^]*a[\\"^]*g|g[\\"^]*p[\\"^]*o[\\"^]*f[\\"^]*i[\\"^]*x)|e[\\"^]*(?:f[\\"^]*r[\\"^]*a[\\"^]*g|l)|f[\\"^]*s[\\"^]*(?:d[\\"^]*i[\\"^]*a|r[\\"^]*m[\\"^]*i)[\\"^]*g|i[\\"^]*(?:a[\\"^]*n[\\"^]*t[\\"^]*z|r|s[\\"^]*(?:k[\\"^]*(?:c[\\"^]*o[\\"^]*(?:m[\\"^]*p|p[\\"^]*y)|p[\\"^]*(?:a[\\"^]*r[\\"^]*t|e[\\"^]*r[\\"^]*f)|r[\\"^]*a[\\"^]*i[\\"^]*d|s[\\"^]*h[\\"^]*a[\\"^]*d[\\"^]*o[\\"^]*w)|p[\\"^]*d[\\"^]*i[\\"^]*a[\\"^]*g))|n[\\"^]*s[\\"^]*c[\\"^]*m[\\"^]*d|(?:o[\\"^]*s[\\"^]*k[\\"^]*e|r[\\"^]*i[\\"^]*v[\\"^]*e[\\"^]*r[\\"^]*q[\\"^]*u[\\"^]*e[\\"^]*r)[\\"^]*y)|e[\\"^]*(?:n[\\"^]*d[\\"^]*l[\\"^]*o[\\"^]*c[\\"^]*a[\\"^]*l|v[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*c[\\"^]*r[\\"^]*e[\\"^]*a[\\"^]*t[\\"^]*e)|E[\\"^]*v[\\"^]*n[\\"^]*t[\\"^]*c[\\"^]*m[\\"^]*d|f[\\"^]*(?:c|i[\\"^]*(?:l[\\"^]*e[\\"^]*s[\\"^]*y[\\"^]*s[\\"^]*t[\\"^]*e[\\"^]*m[\\"^]*s|n[\\"^]*d[\\"^]*s[\\"^]*t[\\"^]*r)|l[\\"^]*a[\\"^]*t[\\"^]*t[\\"^]*e[\\"^]*m[\\"^]*p|o[\\"^]*r(?:[\\"^]*f[\\"^]*i[\\"^]*l[\\"^]*e[\\"^]*s)?|r[\\"^]*e[\\"^]*e[\\"^]*d[\\"^]*i[\\"^]*s[\\"^]*k|s[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|(?:t[\\"^]*y[\\"^]*p|v[\\"^]*e[\\"^]*u[\\"^]*p[\\"^]*d[\\"^]*a[\\"^]*t)[\\"^]*e)|g[\\"^]*(?:e[\\"^]*t[\\"^]*(?:m[\\"^]*a[\\"^]*c|t[\\"^]*y[\\"^]*p[\\"^]*e)|o[\\"^]*t[\\"^]*o|p[\\"^]*(?:f[\\"^]*i[\\"^]*x[\\"^]*u[\\"^]*p|(?:r[\\"^]*e[\\"^]*s[\\"^]*u[\\"^]*l[\\"^]*)?t|u[\\"^]*p[\\"^]*d[\\"^]*a[\\"^]*t[\\"^]*e)|r[\\"^]*a[\\"^]*f[\\"^]*t[\\"^]*a[\\"^]*b[\\"^]*l)|h[\\"^]*(?:e[\\"^]*l[\\"^]*p[\\"^]*c[\\"^]*t[\\"^]*r|o[\\"^]*s[\\"^]*t[\\"^]*n[\\"^]*a[\\"^]*m[\\"^]*e)|i[\\"^]*(?:c[\\"^]*a[\\"^]*c[\\"^]*l[\\"^]*s|f|p[\\"^]*(?:c[\\"^]*o[\\"^]*n[\\"^]*f[\\"^]*i[\\"^]*g|x[\\"^]*r[\\"^]*o[\\"^]*u[\\"^]*t[\\"^]*e)|r[\\"^]*f[\\"^]*t[\\"^]*p)|j[\\"^]*e[\\"^]*t[\\"^]*p[\\"^]*a[\\"^]*c[\\"^]*k|k[\\"^]*(?:l[\\"^]*i[\\"^]*s[\\"^]*t|s[\\"^]*e[\\"^]*t[\\"^]*u[\\"^]*p|t[\\"^]*(?:m[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|p[\\"^]*a[\\"^]*s[\\"^]*s))|l[\\"^]*(?:o[\\"^]*(?:d[\\"^]*c[\\"^]*t[\\"^]*r|g[\\"^]*(?:m[\\"^]*a[\\"^]*n|o[\\"^]*f[\\"^]*f))|p[\\"^]*[q-r])|m[\\"^]*(?:a[\\"^]*(?:c[\\"^]*f[\\"^]*i[\\"^]*l[\\"^]*e|k[\\"^]*e[\\"^]*c[\\"^]*a[\\"^]*b|p[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n)|k[\\"^]*(?:d[\\"^]*i[\\"^]*r|l[\\"^]*i[\\"^]*n[\\"^]*k)|m[\\"^]*c|o[\\"^]*u[\\"^]*n[\\"^]*t[\\"^]*v[\\"^]*o[\\"^]*l|q[\\"^]*(?:b[\\"^]*k[\\"^]*u[\\"^]*p|(?:t[\\"^]*g[\\"^]*)?s[\\"^]*v[\\"^]*c)|s[\\"^]*(?:d[\\"^]*t|i[\\"^]*(?:e[\\"^]*x[\\"^]*e[\\"^]*c|n[\\"^]*f[\\"^]*o[\\"^]*3[\\"^]*2)|t[\\"^]*s[\\"^]*c))|n[\\"^]*(?:b[\\"^]*t[\\"^]*s[\\"^]*t[\\"^]*a[\\"^]*t|e[\\"^]*t[\\"^]*(?:c[\\"^]*f[\\"^]*g|d[\\"^]*o[\\"^]*m|s[\\"^]*(?:h|t[\\"^]*a[\\"^]*t))|f[\\"^]*s[\\"^]*(?:a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n|s[\\"^]*(?:h[\\"^]*a[\\"^]*r[\\"^]*e|t[\\"^]*a[\\"^]*t))|l[\\"^]*(?:b[\\"^]*m[\\"^]*g[\\"^]*r|t[\\"^]*e[\\"^]*s[\\"^]*t)|s[\\"^]*l[\\"^]*o[\\"^]*o[\\"^]*k[\\"^]*u[\\"^]*p|t[\\"^]*(?:b[\\"^]*a[\\"^]*c[\\"^]*k[\\"^]*u[\\"^]*p|c[\\"^]*m[\\"^]*d[\\"^]*p[\\"^]*r[\\"^]*o[\\"^]*m[\\"^]*p[\\"^]*t|f[\\"^]*r[\\"^]*s[\\"^]*u[\\"^]*t[\\"^]*l))|o[\\"^]*(?:f[\\"^]*f[\\"^]*l[\\"^]*i[\\"^]*n[\\"^]*e|p[\\"^]*e[\\"^]*n[\\"^]*f[\\"^]*i[\\"^]*l[\\"^]*e[\\"^]*s)|p[\\"^]*(?:a[\\"^]*(?:g[\\"^]*e[\\"^]*f[\\"^]*i[\\"^]*l[\\"^]*e[\\"^]*c[\\"^]*o[\\"^]*n[\\"^]*f[\\"^]*i|t[\\"^]*h[\\"^]*p[\\"^]*i[\\"^]*n)[\\"^]*g|(?:b[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i|k[\\"^]*t[\\"^]*m[\\"^]*o)[\\"^]*n|e[\\"^]*(?:n[\\"^]*t[\\"^]*n[\\"^]*t|r[\\"^]*f[\\"^]*m[\\"^]*o[\\"^]*n)|n[\\"^]*p[\\"^]*u[\\"^]*(?:n[\\"^]*a[\\"^]*t[\\"^]*t[\\"^]*e[\\"^]*n[\\"^]*d|t[\\"^]*i[\\"^]*l)|o[\\"^]*(?:p[\\"^]*d|w[\\"^]*e[\\"^]*r[\\"^]*s[\\"^]*h[\\"^]*e[\\"^]*l[\\"^]*l)|r[\\"^]*n[\\"^]*(?:c[\\"^]*n[\\"^]*f[\\"^]*g|(?:d[\\"^]*r[\\"^]*v|m[\\"^]*n[\\"^]*g)[\\"^]*r|j[\\"^]*o[\\"^]*b[\\"^]*s|p[\\"^]*o[\\"^]*r[\\"^]*t|q[\\"^]*c[\\"^]*t[\\"^]*l)|u[\\"^]*(?:b[\\"^]*p[\\"^]*r[\\"^]*n|s[\\"^]*h[\\"^]*(?:d|p[\\"^]*r[\\"^]*i[\\"^]*n[\\"^]*t[\\"^]*e[\\"^]*r[\\"^]*c[\\"^]*o[\\"^]*n[\\"^]*n[\\"^]*e[\\"^]*c[\\"^]*t[\\"^]*i[\\"^]*o[\\"^]*n[\\"^]*s))|w[\\"^]*(?:l[\\"^]*a[\\"^]*u[\\"^]*n[\\"^]*c[\\"^]*h[\\"^]*e[\\"^]*r|s[\\"^]*h))|q[\\"^]*(?:a[\\"^]*p[\\"^]*p[\\"^]*s[\\"^]*r[\\"^]*v|p[\\"^]*r[\\"^]*o[\\"^]*c[\\"^]*e[\\"^]*s[\\"^]*s|u[\\"^]*s[\\"^]*e[\\"^]*r|w[\\"^]*i[\\"^]*n[\\"^]*s[\\"^]*t[\\"^]*a)|r[\\"^]*(?:d(?:[\\"^]*p[\\"^]*s[\\"^]*i[\\"^]*g[\\"^]*n)?|e[\\"^]*(?:f[\\"^]*s[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|g(?:[\\"^]*(?:i[\\"^]*n[\\"^]*i|s[\\"^]*v[\\"^]*r[\\"^]*3[\\"^]*2))?|l[\\"^]*o[\\"^]*g|(?:(?:p[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i|s[\\"^]*c[\\"^]*a)[\\"^]*)?n|x[\\"^]*e[\\"^]*c)|i[\\"^]*s[\\"^]*e[\\"^]*t[\\"^]*u[\\"^]*p|m[\\"^]*d[\\"^]*i[\\"^]*r|o[\\"^]*b[\\"^]*o[\\"^]*c[\\"^]*o[\\"^]*p[\\"^]*y|p[\\"^]*c[\\"^]*(?:i[\\"^]*n[\\"^]*f[\\"^]*o|p[\\"^]*i[\\"^]*n[\\"^]*g)|s[\\"^]*h|u[\\"^]*n[\\"^]*d[\\"^]*l[\\"^]*l[\\"^]*3[\\"^]*2|w[\\"^]*i[\\"^]*n[\\"^]*s[\\"^]*t[\\"^]*a)|s[\\"^]*(?:a[\\"^]*n|c[\\"^]*(?:h[\\"^]*t[\\"^]*a[\\"^]*s[\\"^]*k[\\"^]*s|w[\\"^]*c[\\"^]*m[\\"^]*d)|e[\\"^]*(?:c[\\"^]*e[\\"^]*d[\\"^]*i[\\"^]*t|r[\\"^]*v[\\"^]*e[\\"^]*r[\\"^]*(?:(?:c[\\"^]*e[\\"^]*i[\\"^]*p|w[\\"^]*e[\\"^]*r)[\\"^]*o[\\"^]*p[\\"^]*t[\\"^]*i[\\"^]*n|m[\\"^]*a[\\"^]*n[\\"^]*a[\\"^]*g[\\"^]*e[\\"^]*r[\\"^]*c[\\"^]*m[\\"^]*d)|t[\\"^]*x)|f[\\"^]*c|(?:h[\\"^]*o[\\"^]*w[\\"^]*m[\\"^]*o[\\"^]*u[\\"^]*n|u[\\"^]*b[\\"^]*s)[\\"^]*t|x[\\"^]*s[\\"^]*t[\\"^]*r[\\"^]*a[\\"^]*c[\\"^]*e|y[\\"^]*s[\\"^]*(?:o[\\"^]*c[\\"^]*m[\\"^]*g[\\"^]*r|t[\\"^]*e[\\"^]*m[\\"^]*i[\\"^]*n[\\"^]*f[\\"^]*o))|t[\\"^]*(?:a[\\"^]*(?:k[\\"^]*e[\\"^]*o[\\"^]*w[\\"^]*n|p[\\"^]*i[\\"^]*c[\\"^]*f[\\"^]*g|s[\\"^]*k[\\"^]*(?:k[\\"^]*i[\\"^]*l[\\"^]*l|l[\\"^]*i[\\"^]*s[\\"^]*t))|(?:c[\\"^]*m[\\"^]*s[\\"^]*e[\\"^]*t[\\"^]*u|f[\\"^]*t)[\\"^]*p|(?:(?:e[\\"^]*l[\\"^]*n[\\"^]*e|i[\\"^]*m[\\"^]*e[\\"^]*o[\\"^]*u)[\\"^]*|r[\\"^]*a[\\"^]*c[\\"^]*e[\\"^]*r[\\"^]*(?:p[\\"^]*)?)t|l[\\"^]*n[\\"^]*t[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*n|p[\\"^]*m[\\"^]*(?:t[\\"^]*o[\\"^]*o[\\"^]*l|v[\\"^]*s[\\"^]*c[\\"^]*m[\\"^]*g[\\"^]*r)|s[\\"^]*(?:(?:d[\\"^]*i[\\"^]*s[\\"^]*)?c[\\"^]*o[\\"^]*n|e[\\"^]*c[\\"^]*i[\\"^]*m[\\"^]*p|k[\\"^]*i[\\"^]*l[\\"^]*l|p[\\"^]*r[\\"^]*o[\\"^]*f)|y[\\"^]*p[\\"^]*e[\\"^]*p[\\"^]*e[\\"^]*r[\\"^]*f|z[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l)|u[\\"^]*n[\\"^]*(?:e[\\"^]*x[\\"^]*p[\\"^]*o[\\"^]*s[\\"^]*e|i[\\"^]*q[\\"^]*u[\\"^]*e[\\"^]*i[\\"^]*d|l[\\"^]*o[\\"^]*d[\\"^]*c[\\"^]*t[\\"^]*r)|v[\\"^]*(?:o[\\"^]*l|s[\\"^]*s[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n)|w[\\"^]*(?:a[\\"^]*i[\\"^]*t[\\"^]*f[\\"^]*o[\\"^]*r|b[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n|(?:d[\\"^]*s|e[\\"^]*(?:c|v[\\"^]*t))[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|h[\\"^]*(?:e[\\"^]*r[\\"^]*e|o[\\"^]*a[\\"^]*m[\\"^]*i)|i[\\"^]*n[\\"^]*(?:n[\\"^]*t(?:[\\"^]*3[\\"^]*2)?|r[\\"^]*s)|m[\\"^]*i[\\"^]*c|s[\\"^]*c[\\"^]*r[\\"^]*i[\\"^]*p[\\"^]*t)|x[\\"^]*c[\\"^]*o[\\"^]*p[\\"^]*y)(?:.[\\"^]*[0-9A-Z_a-z]+)?b",
+      "@rx (?i)b(?:7z[arx]?|(?:(?:GE|POS)T|HEAD)[sv&)<>|]|a(?:(?:b|w[ks]|l(?:ias|pine))[sv&)<>|]|pt(?:(?:itude)?[sv&)<>|]|-get)|r(?:[sv&)<>j|]|(?:p|ch)[sv&)<>|]|ia2c)|s(?:h?[sv&)<>|]|cii(?:-xfr|85)|pell)|t(?:[sv&)<>|]|obm)|dd(?:group|user)|getty|nsible-playbook|xel)|b(?:z(?:z[sv&)<>|]|c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more)|a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu))|c(?:[8-9]9|(?:a(?:t|ncel|psh)|c)[sv&)<>|]|mp|p(?:[sv&)<>|]|io|ulimit)|s(?:h|plit|vtool)|u(?:t[sv&)<>|]|psfilter)|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|r(?:ash[sv&)<>|]|on(?:tab)?))|d(?:(?:[du]|i(?:(?:alo)?g|r|ff)|a(?:sh|te))[sv&)<>|]|n?f|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:(?:[bd]|cho)[sv&)<>|]|n(?:v(?:-update)?|d(?:if|sw))|qn|s(?:[sv&)<>h|]|ac)|x(?:(?:ec)?[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r))|2fsck|(?:asy_instal|va)l|fax|grep|macs)|f(?:(?:c|etch|lock|unction)[sv&)<>|]|d|g(?:rep)?|i(?:(?:n(?:d|ger)|sh)?[sv&)<>|]|le(?:[sv&)<>|]|test))|mt|tp(?:[sv&)<>|]|stats|who)|acter|o(?:ld[sv&)<>|]|reach)|ping)|g(?:c(?:c[^sv]|ore)|db|e(?:(?:m|tfacl)[sv&)<>|]|ni(?:e[sv&)<>|]|soimage))|hci?|i(?:(?:t|mp)[sv&)<>|]|nsh)|(?:o|awk)[sv&)<>|]|pg|r(?:c|ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:d|up|ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:d|p(?:6?tables|config)?|rb|conv|f(?:config|top)|nstall[sv&)<>|]|onice|spell)|j(?:js|q|ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:s(?:h|shell)|ill(?:[sv&)<>|]|all)|nife[sv&)<>|])|l(?:d(?:d?[sv&)<>|]|config)|(?:[np]|ynx)[sv&)<>|]|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)?|ua(?:[sv&)<>|]|(?:la)?tex)|z(?:[sv&)4<>|]|4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore))|a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|ke)[sv&)<>|]|il(?:[sv&)<>q|]|x[sv&)<>|])|ster.passwd|wk)|tr|(?:v|utt)[sv&)<>|]|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:c(?:[sv&)<>|]|.(?:openbsd|traditional)|at)|e(?:t(?:[sv&)<>|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:(?:ul)?l|ice)[sv&)<>|]|m(?:[sv&)<>|]|ap)|p(?:m[sv&)<>|]|ing)|a(?:no[sv&)<>|]|sm|wk)|o(?:de[sv&)<>|]|hup)|roff|s(?:enter|lookup|tat))|o(?:(?:d|ctave)[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:x|cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:b|f(?:la)?tex|ksh)|f(?:[sv&)<>|]|tp)|g(?:rep)?|hp(?:[sv&)57<>|]|-cgi)|i(?:(?:co?|ng)[sv&)<>|]|p[^sv]|dstat|gz)|k(?:g(?:_?info)?|exec|ill)|r(?:y?[sv&)<>|]|int(?:env|f[sv&)<>|]))|s(?:[sv&)<>|]|ed|ftp|ql)?|t(?:x|ar(?:diff|grep)?)|wd(?:.db)?|xz|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|opd|u(?:ppet[sv&)<>|]|shd)|ython[2-3])|r(?:a(?:r[sv&)<>|]|k(?:e[sv&)<>|]|u))|c(?:p[sv&)<>|])?|e(?:(?:d(?:carpet)?|v|name|p(?:eat|lace))[sv&)<>|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[sv&)<>|]|user)|pm(?:[sv&)<>|]|db|(?:quer|verif)y)|bash|l(?:ogin|wrap)|nano|oute[sv&)<>|]|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:c(?:p|hed|r(?:een|ipt)[sv&)<>|])|e(?:(?:d|lf|rvice)[sv&)<>|]|t(?:arch|env|facl[sv&)<>|]|sid)?|ndmail)|(?:g|ash)[sv&)<>|]|h(?:(?:adow|ells)?[sv&)<>|]|.distrib|u(?:f|tdown[sv&)<>|]))|s(?:[sv&)<>|]|h(?:[sv&)<>|]|-key(?:ge|sca)n|pass))|u(?:[sv&)<>|]|do)|vn|diff|ftp|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:c|r[sv&)<>|]|il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|bl|c(?:p(?:[sv&)<>|]|dump|ing|traceroute)|l?sh)|e(?:[ex][sv&)<>|]|lnet)|i(?:c[sv&)<>|]|me(?:(?:out)?[sv&)<>|]|datectl))|o(?:p|uch[sv&)<>|])|ftp|mux|r(?:aceroute6?|off)|shark)|u(?:dp|l(?:imit)?[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:ew)?[sv&)<>|]|m(?:[sv&)<>|]|diff)|gr|pw|rsh)|algrind|olatility[sv&)<>|])|w(?:[sv&)<>c|]|h(?:o(?:[sv&)<>|]|ami|is)?|iptail[sv&)<>|])|a(?:ll|tch)[sv&)<>|]|i(?:reshark|sh[sv&)<>|]))|x(?:(?:x|pa)d|z(?:[sv&)<>|]|c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more)|args|e(?:la)?tex|mo(?:dmap|re)|term)|y(?:(?:e(?:s|lp)|arn)[sv&)<>|]|um)|z(?:ip(?:[sv&)<>|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h|oelim|td(?:(?:ca|m)t|grep|less)?)|athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|less|more|run|ypper))b",
+      "@rx (?i)(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[sv&)<>|]|a(?:dd(?:group|user)|getty|l(?:ias|pine)[sv&)<>|]|nsible-playbook|pt(?:-get|itude[sv&)<>|])|r(?:ch[sv&)<>|]|ia2c)|s(?:cii(?:-xfr|85)|pell)|tobm|xel)|b(?:a(?:s(?:e(?:32|64|n(?:ame[sv&)<>|]|c))|h[sv&)<>|])|tch[sv&)<>|])|lkid|pftrace|r(?:eaksw|idge[sv&)<>|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[sv&)<>|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu)|z(?:c(?:at|mp)|diff|e(?:grep|xe)|f?grep|ip2(?:recover)?|less|more))|c(?:a(?:ncel|psh)[sv&)<>|]|ertbot|h(?:attr|(?:dir|root)[sv&)<>|]|eck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|(?:flag|pas)s|g(?:passwd|rp)|mod|o(?:om|wn)|sh)|lang(?:[sv&)<>|]|++)|o(?:(?:b|pro)c|lumn[sv&)<>|]|m(?:m(?:and[sv&)<>|])?|p(?:oser|ress)[sv&)<>|])|w(?:say|think))|p(?:an|io|ulimit)|r(?:ash[sv&)<>|]|on(?:tab)?)|s(?:plit|vtool)|u(?:psfilter|rl[sv&)<>|]))|d(?:(?:a(?:sh|te)|i(?:alog|ff))[sv&)<>|]|hclient|m(?:esg|idecode|setup)|o(?:as|(?:cker|ne)[sv&)<>|]|sbox)|pkg|vips)|e(?:2fsck|(?:asy_instal|va)l|cho[sv&)<>|]|fax|grep|macs|n(?:d(?:if|sw)|v-update)|sac|x(?:ec[sv&)<>|]|iftool|p(?:(?:and|(?:ec|or)t)[sv&)<>|]|r)))|f(?:acter|(?:etch|lock|unction)[sv&)<>|]|grep|i(?:le(?:[sv&)<>|]|test)|(?:n(?:d|ger)|sh)[sv&)<>|])|o(?:ld[sv&)<>|]|reach)|ping|tp(?:stats|who))|g(?:awk[sv&)<>|]|core|e(?:ni(?:e[sv&)<>|]|soimage)|tfacl[sv&)<>|])|hci|i(?:mp[sv&)<>|]|nsh)|r(?:ep[sv&)<>|]|oup(?:[sv&)<>|]|mod))|tester|unzip|z(?:cat|exe|ip))|h(?:(?:ash|i(?:ghlight|story))[sv&)<>|]|e(?:ad[sv&)<>|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op|passwd))|i(?:conv|f(?:config|top)|nstall[sv&)<>|]|onice|p(?:6?tables|config)|spell)|j(?:ava[sv&)<>|]|exec|o(?:(?:bs|in)[sv&)<>|]|urnalctl)|runscript)|k(?:ill(?:[sv&)<>|]|all)|nife[sv&)<>|]|sshell)|l(?:a(?:st(?:[sv&)<>|]|comm|log(?:in)?)|tex[sv&)<>|])|dconfig|ess(?:[sv&)<>|]|echo|(?:fil|pip)e)|ftp(?:get)?|(?:inks|ynx)[sv&)<>|]|o(?:(?:ca(?:l|te)|ok)[sv&)<>|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:-F|b_release|cpu|hw|mod|of|pci|usb)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:at)?|c(?:at|mp)|diff|[e-f]?grep|less|m(?:a(?:dec|info)?|ore)))|m(?:a(?:il(?:[sv&)<>q|]|x[sv&)<>|])|ke[sv&)<>|]|ster.passwd|wk)|k(?:dir[sv&)<>|]|fifo|nod|temp)|locate|o(?:(?:re|unt)[sv&)<>|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|utt[sv&)<>|]|ysql(?:admin|dump(?:slow)?|hotcopy|show)?)|n(?:a(?:no[sv&)<>|]|sm|wk)|c(?:.(?:openbsd|traditional)|at)|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan))|(?:ice|ull)[sv&)<>|]|map|o(?:de[sv&)<>|]|hup)|ping|roff|s(?:enter|lookup|tat))|o(?:ctave[sv&)<>|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg))|p(?:a(?:(?:cman|rted|tch)[sv&)<>|]|s(?:swd|te[sv&)<>|]))|d(?:f(?:la)?tex|ksh)|er(?:f|l(?:5|sh)?|ms[sv&)<>|])|(?:ft|gre)p|hp(?:-cgi|[57])|i(?:(?:co|ng)[sv&)<>|]|dstat|gz)|k(?:exec|g_?info|ill)|opd|rint(?:env|f[sv&)<>|])|s(?:ed|ftp|ql)|tar(?:diff|grep)?|u(?:ppet[sv&)<>|]|shd)|wd.db|ython[^sv])|r(?:ak(?:e[sv&)<>|]|u)|bash|e(?:a(?:delf|lpath)|(?:dcarpet|name|p(?:eat|lace))[sv&)<>|]|stic)|l(?:ogin|wrap)|m(?:dir[sv&)<>|]|user)|nano|oute[sv&)<>|]|pm(?:db|(?:quer|verif)y)|sync|u(?:by[^sv]|n-(?:mailcap|parts))|vi(?:ew|m))|s(?:(?:ash|nap)[sv&)<>|]|c(?:hed|r(?:een|ipt)[sv&)<>|])|diff|e(?:(?:lf|rvice)[sv&)<>|]|ndmail|t(?:arch|env|facl[sv&)<>|]|sid))|ftp|h(?:.distrib|(?:adow|ells)[sv&)<>|]|u(?:f|tdown[sv&)<>|]))|l(?:eep[sv&)<>|]|sh)|mbclient|o(?:cat|elim|(?:rt|urce)[sv&)<>|])|p(?:lit[sv&)<>|]|wd.db)|qlite3|sh(?:-key(?:ge|sca)n|pass)|t(?:art-stop-daemon|d(?:buf|err|in|out)|r(?:ace|ings[sv&)<>|]))|udo|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:il[sv&)<>f|]|sk(?:[sv&)<>|]|set))|c(?:l?sh|p(?:dump|ing|traceroute))|elnet|ftp|ime(?:(?:out)?[sv&)<>|]|datectl)|mux|ouch[sv&)<>|]|r(?:aceroute6?|off)|shark)|u(?:limit[sv&)<>|]|n(?:ame|(?:compress|s(?:et|hare))[sv&)<>|]|expand|iq|l(?:ink[sv&)<>|]|z(?:4|ma))|(?:pig|x)z|rar|z(?:ip[sv&)<>|]|std))|p(?:2date[sv&)<>|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:ew[sv&)<>|]|gr|mdiff|pw|rsh)|olatility[sv&)<>|])|w(?:a(?:ll|tch)[sv&)<>|]|get|h(?:iptail[sv&)<>|]|o(?:ami|is))|i(?:reshark|sh[sv&)<>|]))|x(?:args|e(?:la)?tex|mo(?:dmap|re)|pad|term|z(?:c(?:at|mp)|d(?:ec|iff)|[e-f]?grep|less|more))|z(?:athura|c(?:at|mp)|diff|e(?:grep|ro[sv&)<>|])|f?grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|less|more|run|s(?:oelim|td(?:(?:ca|m)t|grep|less)?)|ypper))",
+      "@lt 3",
+      "@rx (?i).|(?:[sv]*|t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:7[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[arx])?|G[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?E[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?T|a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:b|(?:p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?t|r(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[jp])?|s(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ks])|b[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z|c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[8-9][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?9|[au][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|c|(?:m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?p|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dfu]|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[gr])|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[bdx]|n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?v|q[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|s(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?)|f[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[c-dgi]|m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|g[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[chr][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|o|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?g)|h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[dp]|r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b)|j[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:j[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|q)|k[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h|l[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d)?|[nps]|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a|z(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?4)?)|m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n|t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|v)|n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[cl]|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t|(?:p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|o[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:[at][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?x|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?b|f|(?:k[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?g|h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cp]|r(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?y)?|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|x[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?z)|r[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?r|c(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p)?|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dv]|(?:p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?)?m)|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[dt]|[g-hu]|s(?:[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h)?|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n)|t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[cr]|b[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?l|[co][\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[ex]|i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c)|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|l)|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:3[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m|c)|x[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:x[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|z)|y[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:e[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?s|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m)|z[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p|s[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?h))",
+      "@rx (?i)(?:(?:^|=)[sv]*(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*|(?:t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|[nr;`{]|||?|&&?|$(?:((?|{)|[<>](|([sv]*))[sv]*(?:[${]|(?:[sv]*(|!)[sv]*|[0-9A-Z_a-z]+=(?:[^sv]*|$(?:.*|.*)|[<>].*|'.*'|\\".*\\")[sv]+)*)[sv]*[\\"']*(?:[\\"'-+--9?A-]_a-z|]+/)?[\\"'x5c]*(?:(?:(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d|u[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?2[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?t)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?e|v[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?i)[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|d[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?f|p[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?c[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?m[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?a[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?n[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?[sv&),<>|].*|s)|w[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?(?:h[\\"')[-x5c]*(?:(?:(?:|||&&)[sv]*)?$[!#(*-0-9?-@_a-{]*)?x5c?o|[sv&),<>|].*))",
+      "@rx rn(?s:.)*?b(?:(?i:E)(?:HLO [--.A-Za-zx17fx212a]{1,255}|XPN .{1,64})|HELO [--.A-Za-zx17fx212a]{1,255}|MAIL FROM:<.{1,64}(?i:@).{1,255}(?i:>)|(?i:R)(?:CPT TO:(?:(?i:<).{1,64}(?i:@).{1,255}(?i:>)|(?i: ))?(?i:<).{1,64}(?i:>)|SETb)|VRFY .{1,64}(?: <.{1,64}(?i:@).{1,255}(?i:>)|(?i:@).{1,255})|AUTH [-0-9A-Z_a-zx17fx212a]{1,20}(?i: )(?:(?:[+/-9A-Z_a-zx17fx212a]{4})*(?:[+/-9A-Z_a-zx17fx212a]{2}(?i:=)|[+/-9A-Z_a-zx17fx212a]{3}))?(?i:=)|STARTTLSb|NOOPb(?:(?i: ).{1,255})?)",
+      "@rx (?:$(?:((?:(.*)|.*))|{.*})|[<>](.*)|[!?.+])",
+      "@rx (?is)rn.*?b(?:(?:LIST|TOP [0-9]+)(?: [0-9]+)?|U(?:SER .+?|IDL(?: [0-9]+)?)|PASS .+?|(?:RETR|DELE) [0-9]+?|A(?:POP [0-9A-Z_a-z]+ [0-9a-f]{32}|UTH [-0-9A-Z_]{1,20} (?:(?:[+/-9A-Z_a-z]{4})*(?:[+/-9A-Z_a-z]{2}=|[+/-9A-Z_a-z]{3}))?=))",
+      "@rx (?i)(?:t[\\"^]*i[\\"^]*m[\\"^]*e|[nr;`{]|||?|&&?)[sv]*[sv\\"'-(,@]*(?:[\\"'.-9A-Z_a-z]+/|(?:[\\"'x5c^]*[0-9A-Z_a-z][\\"'x5c^]*:.*|[ \\"'.-9A-Zx5c^-_a-z]*)x5c)?[\\"^]*(?:a[\\"^]*(?:c[\\"^]*c[\\"^]*c[\\"^]*h[\\"^]*e[\\"^]*c[\\"^]*k[\\"^]*c[\\"^]*o[\\"^]*n[\\"^]*s[\\"^]*o[\\"^]*l[\\"^]*e|d[\\"^]*(?:p[\\"^]*l[\\"^]*u[\\"^]*s|v[\\"^]*p[\\"^]*a[\\"^]*c[\\"^]*k)|(?:g[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*e[\\"^]*x[\\"^]*e[\\"^]*c[\\"^]*u[\\"^]*t[\\"^]*o|s[\\"^]*p[\\"^]*n[\\"^]*e[\\"^]*t[\\"^]*_[\\"^]*c[\\"^]*o[\\"^]*m[\\"^]*p[\\"^]*i[\\"^]*l[\\"^]*e)[\\"^]*r|p[\\"^]*p[\\"^]*(?:i[\\"^]*n[\\"^]*s[\\"^]*t[\\"^]*a[\\"^]*l[\\"^]*l[\\"^]*e[\\"^]*r|v[\\"^]*l[\\"^]*p)|t[\\"^]*(?:[sv,.-/;-<>].*|b[\\"^]*r[\\"^]*o[\\"^]*k[\\"^]*e[\\"^]*r))|b[\\"^]*(?:a[\\"^]*s[\\"^]*h|g[\\"^]*i[\\"^]*n[\\"^]*f[\\"^]*o|i[\\"^]*t[\\"^]*s[\\"^]*a[\\"^]*d[\\"^]*m[\\"^]*i[\\"^]*n)|c[\\"^]*(?:d[\\"^]*b|e[\\"^]*r[\\"^]*t[\\"^]*(?:o[\\"^]*c|r[\\"^]*e[\\"^]*q|u[\\"^]*t[\\"^]*i[\\"^]*l)|l[\\"^]*_[\\"^]*(?:i[\\"^]*n[\\"^]*v[\\"^]*o[\\"^]*c[\\"^]*a[\\"^]*t[\\"^]*i[\\"^]*o[\\"^]*n|l[\\"^]*o[\\"^]*a[\\"^]*d[\\"^]*a[\\"^]*s[\\"^]*s[\\"^]*e[\\"^]*m[\\"^]*b[\\"^]*l[\\"^]*y|m[\\"^]*u[\\"^]*t[\\"^]*e[\\"^]*x[\\"^]*v[\\"^]*e[\\"^]*r[\\"^]*i[\\"^]*f[\\"^]*i[\\"^]*e[\\"^]*r[\\"^]*s)|m[\\"^]*(?:d(?:[\\"^]*(?:k[\\"^]*e[\\"^]*y|l[\\"^]*3[\\"^]*2))?|s[\\"^]*t[\\"^]*p)|o[\\"^]*(?:m[\\"^]*s[\\"^]*v[\\"^]*c[\\"^]*s|n[\\"^]*(?:f[\\"^]*i[\\"^]*g[\\"^]*s[\\"^]*e[\\"^]*c[\\"^]*u[\\"^]*r[\\"^]*i[\\"^]*t[\\"^]*y[\\"^]*p[\\"^]*o[\\"^]*l[\\"^]*i[\\"^]*c[\\"^]*y|h[\\"^]*o[\\"^]*s[\\"^]*t|t[\\"^]*r[\\"^]*o[\\"^]*l)|r[\\"^]*e[\\"^]*g[\\"^]*e[\\"^]*n)|r[\\"^]*e[\\"^]*a[\\"^]*t[\\"^]*e[\\"^]*d[\\"^]*u[\\"^]*m[\\"^]*p|s[\\"^]*(?:c(?:[\\"^]*r[\\"^]*i[\\"^]*p[\\"^]*t)?|i)|u[\\"^]*s[\\"^]*t[\\"^]*o[\\"^]*m[\\"^]*s[\\"^]*h[\\"^]*e[\\"^]*l[\\"^]*l[\\"^]*h[\\"^]*o[\\"^]*s[\\"^]*t)|d[\\"^]*(?:a[\\"^]*t[\\"^]*a[\\"^]*s[\\"^]*v[\\"^]*c[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|e[\\"^]*(?:f[\\"^]*a[\\"^]*u[\\"^]*l[\\"^]*t[\\"^]*p[\\"^]*a[\\"^]*c[\\"^]*k|s[\\"^]*k(?:[\\"^]*t[\\"^]*o[\\"^]*p[\\"^]*i[\\"^]*m[\\"^]*g[\\"^]*d[\\"^]*o[\\"^]*w[\\"^]*n[\\"^]*l[\\"^]*d[\\"^]*r)?|v[\\"^]*(?:i[\\"^]*c[\\"^]*e[\\"^]*c[\\"^]*r[\\"^]*e[\\"^]*d[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*i[\\"^]*a[\\"^]*l[\\"^]*d[\\"^]*e[\\"^]*p[\\"^]*l[\\"^]*o[\\"^]*y[\\"^]*m[\\"^]*e[\\"^]*n[\\"^]*t|t[\\"^]*o[\\"^]*o[\\"^]*l[\\"^]*s[\\"^]*l[\\"^]*a[\\"^]*u[\\"^]*n[\\"^]*c[\\"^]*h[\\"^]*e[\\"^]*r))|f[\\"^]*s[\\"^]*(?:h[\\"^]*i[\\"^]*m|v[\\"^]*c)|i[\\"^]*(?:a[\\"^]*n[\\"^]*t[\\"^]*z|s[\\"^]*k[\\"^]*s[\\"^]*h[\\"^]*a[\\"^]*d[\\"^]*o[\\"^]*w)|n[\\"^]*(?:s[\\"^]*c[\\"^]*m[\\"^]*d|x)|o[\\"^]*t[\\"^]*n[\\"^]*e[\\"^]*t|u[\\"^]*m[\\"^]*p[\\"^]*6[\\"^]*4|x[\\"^]*c[\\"^]*a[\\"^]*p)|e[\\"^]*(?:s[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*u[\\"^]*t[\\"^]*l|v[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*v[\\"^]*w[\\"^]*r|x[\\"^]*(?:c[\\"^]*e[\\"^]*l|p[\\"^]*(?:a[\\"^]*n[\\"^]*d|l[\\"^]*o[\\"^]*r[\\"^]*e[\\"^]*r)|t[\\"^]*(?:e[\\"^]*x[\\"^]*p[\\"^]*o[\\"^]*r[\\"^]*t|r[\\"^]*a[\\"^]*c[\\"^]*3[\\"^]*2)))|f[\\"^]*(?:i[\\"^]*n[\\"^]*(?:d[\\"^]*s[\\"^]*t|g[\\"^]*e)[\\"^]*r|l[\\"^]*t[\\"^]*m[\\"^]*c|o[\\"^]*r[\\"^]*f[\\"^]*i[\\"^]*l[\\"^]*e[\\"^]*s|s[\\"^]*(?:i(?:[\\"^]*a[\\"^]*n[\\"^]*y[\\"^]*c[\\"^]*p[\\"^]*u)?|u[\\"^]*t[\\"^]*i[\\"^]*l)|t[\\"^]*p)|g[\\"^]*(?:f[\\"^]*x[\\"^]*d[\\"^]*o[\\"^]*w[\\"^]*n[\\"^]*l[\\"^]*o[\\"^]*a[\\"^]*d[\\"^]*w[\\"^]*r[\\"^]*a[\\"^]*p[\\"^]*p[\\"^]*e[\\"^]*r|p[\\"^]*s[\\"^]*c[\\"^]*r[\\"^]*i[\\"^]*p[\\"^]*t)|h[\\"^]*h|i[\\"^]*(?:e[\\"^]*(?:4[\\"^]*u[\\"^]*i[\\"^]*n[\\"^]*i[\\"^]*t|a[\\"^]*d[\\"^]*v[\\"^]*p[\\"^]*a[\\"^]*c[\\"^]*k|e[\\"^]*x[\\"^]*e[\\"^]*c|f[\\"^]*r[\\"^]*a[\\"^]*m[\\"^]*e)|l[\\"^]*a[\\"^]*s[\\"^]*m|m[\\"^]*e[\\"^]*w[\\"^]*d[\\"^]*b[\\"^]*l[\\"^]*d|n[\\"^]*(?:f[\\"^]*d[\\"^]*e[\\"^]*f[\\"^]*a[\\"^]*u[\\"^]*l[\\"^]*t[\\"^]*i[\\"^]*n[\\"^]*s[\\"^]*t[\\"^]*a[\\"^]*l|s[\\"^]*t[\\"^]*a[\\"^]*l[\\"^]*l[\\"^]*u[\\"^]*t[\\"^]*i)[\\"^]*l)|j[\\"^]*s[\\"^]*c|l[\\"^]*(?:a[\\"^]*u[\\"^]*n[\\"^]*c[\\"^]*h[\\"^]*-[\\"^]*v[\\"^]*s[\\"^]*d[\\"^]*e[\\"^]*v[\\"^]*s[\\"^]*h[\\"^]*e[\\"^]*l[\\"^]*l|d[\\"^]*i[\\"^]*f[\\"^]*d[\\"^]*e)|m[\\"^]*(?:a[\\"^]*(?:k[\\"^]*e[\\"^]*c[\\"^]*a[\\"^]*b|n[\\"^]*a[\\"^]*g[\\"^]*e[\\"^]*-[\\"^]*b[\\"^]*d[\\"^]*e|v[\\"^]*i[\\"^]*n[\\"^]*j[\\"^]*e[\\"^]*c[\\"^]*t)|f[\\"^]*t[\\"^]*r[\\"^]*a[\\"^]*c[\\"^]*e|i[\\"^]*c[\\"^]*r[\\"^]*o[\\"^]*s[\\"^]*o[\\"^]*f[\\"^]*t|m[\\"^]*c|p[\\"^]*c[\\"^]*m[\\"^]*d[\\"^]*r[\\"^]*u[\\"^]*n|s[\\"^]*(?:(?:b[\\"^]*u[\\"^]*i[\\"^]*l|o[\\"^]*h[\\"^]*t[\\"^]*m[\\"^]*e)[\\"^]*d|c[\\"^]*o[\\"^]*n[\\"^]*f[\\"^]*i[\\"^]*g|d[\\"^]*(?:e[\\"^]*p[\\"^]*l[\\"^]*o[\\"^]*y|t)|h[\\"^]*t[\\"^]*(?:a|m[\\"^]*l)|i[\\"^]*e[\\"^]*x[\\"^]*e[\\"^]*c|p[\\"^]*u[\\"^]*b|x[\\"^]*s[\\"^]*l))|n[\\"^]*(?:e[\\"^]*t[\\"^]*s[\\"^]*h|t[\\"^]*d[\\"^]*s[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l)|o[\\"^]*(?:d[\\"^]*b[\\"^]*c[\\"^]*c[\\"^]*o[\\"^]*n[\\"^]*f|f[\\"^]*f[\\"^]*l[\\"^]*i[\\"^]*n[\\"^]*e[\\"^]*s[\\"^]*c[\\"^]*a[\\"^]*n[\\"^]*n[\\"^]*e[\\"^]*r[\\"^]*s[\\"^]*h[\\"^]*e[\\"^]*l[\\"^]*l|n[\\"^]*e[\\"^]*d[\\"^]*r[\\"^]*i[\\"^]*v[\\"^]*e[\\"^]*s[\\"^]*t[\\"^]*a[\\"^]*n[\\"^]*d[\\"^]*a[\\"^]*l[\\"^]*o[\\"^]*n[\\"^]*e[\\"^]*u[\\"^]*p[\\"^]*d[\\"^]*a[\\"^]*t[\\"^]*e[\\"^]*r|p[\\"^]*e[\\"^]*n[\\"^]*c[\\"^]*o[\\"^]*n[\\"^]*s[\\"^]*o[\\"^]*l[\\"^]*e)|p[\\"^]*(?:c[\\"^]*(?:a[\\"^]*l[\\"^]*u[\\"^]*a|w[\\"^]*(?:r[\\"^]*u[\\"^]*n|u[\\"^]*t[\\"^]*l))|(?:e[\\"^]*s[\\"^]*t[\\"^]*e|s)[\\"^]*r|(?:k[\\"^]*t[\\"^]*m[\\"^]*o|u[\\"^]*b[\\"^]*p[\\"^]*r)[\\"^]*n|n[\\"^]*p[\\"^]*u[\\"^]*t[\\"^]*i[\\"^]*l|o[\\"^]*w[\\"^]*e[\\"^]*r[\\"^]*p[\\"^]*n[\\"^]*t|r[\\"^]*(?:e[\\"^]*s[\\"^]*e[\\"^]*n[\\"^]*t[\\"^]*a[\\"^]*t[\\"^]*i[\\"^]*o[\\"^]*n[\\"^]*h[\\"^]*o[\\"^]*s[\\"^]*t|i[\\"^]*n[\\"^]*t(?:[\\"^]*b[\\"^]*r[\\"^]*m)?|o[\\"^]*(?:c[\\"^]*d[\\"^]*u[\\"^]*m[\\"^]*p|t[\\"^]*o[\\"^]*c[\\"^]*o[\\"^]*l[\\"^]*h[\\"^]*a[\\"^]*n[\\"^]*d[\\"^]*l[\\"^]*e[\\"^]*r)))|r[\\"^]*(?:a[\\"^]*s[\\"^]*a[\\"^]*u[\\"^]*t[\\"^]*o[\\"^]*u|c[\\"^]*s[\\"^]*i|(?:d[\\"^]*r[\\"^]*l[\\"^]*e[\\"^]*a[\\"^]*k[\\"^]*d[\\"^]*i[\\"^]*a|p[\\"^]*c[\\"^]*p[\\"^]*i[\\"^]*n)[\\"^]*g|e[\\"^]*(?:g(?:[\\"^]*(?:a[\\"^]*s[\\"^]*m|e[\\"^]*d[\\"^]*i[\\"^]*t|i[\\"^]*(?:n[\\"^]*i|s[\\"^]*t[\\"^]*e[\\"^]*r[\\"^]*-[\\"^]*c[\\"^]*i[\\"^]*m[\\"^]*p[\\"^]*r[\\"^]*o[\\"^]*v[\\"^]*i[\\"^]*d[\\"^]*e[\\"^]*r)|s[\\"^]*v[\\"^]*(?:c[\\"^]*s|r[\\"^]*3[\\"^]*2)))?|(?:m[\\"^]*o[\\"^]*t|p[\\"^]*l[\\"^]*a[\\"^]*c)[\\"^]*e)|u[\\"^]*n[\\"^]*(?:d[\\"^]*l[\\"^]*l[\\"^]*3[\\"^]*2|(?:e[\\"^]*x[\\"^]*e|s[\\"^]*c[\\"^]*r[\\"^]*i[\\"^]*p[\\"^]*t)[\\"^]*h[\\"^]*e[\\"^]*l[\\"^]*p[\\"^]*e[\\"^]*r|o[\\"^]*n[\\"^]*c[\\"^]*e))|s[\\"^]*(?:c[\\"^]*(?:[sv,.-/;-<>].*|h[\\"^]*t[\\"^]*a[\\"^]*s[\\"^]*k[\\"^]*s|r[\\"^]*i[\\"^]*p[\\"^]*t[\\"^]*r[\\"^]*u[\\"^]*n[\\"^]*n[\\"^]*e[\\"^]*r)|e[\\"^]*t[\\"^]*(?:r[\\"^]*e[\\"^]*s|t[\\"^]*i[\\"^]*n[\\"^]*g[\\"^]*s[\\"^]*y[\\"^]*n[\\"^]*c[\\"^]*h[\\"^]*o[\\"^]*s[\\"^]*t|u[\\"^]*p[\\"^]*a[\\"^]*p[\\"^]*i)|h[\\"^]*(?:d[\\"^]*o[\\"^]*c[\\"^]*v[\\"^]*w|e[\\"^]*l[\\"^]*l[\\"^]*3[\\"^]*2)|q[\\"^]*(?:l[\\"^]*(?:d[\\"^]*u[\\"^]*m[\\"^]*p[\\"^]*e[\\"^]*r|(?:t[\\"^]*o[\\"^]*o[\\"^]*l[\\"^]*s[\\"^]*)?p[\\"^]*s)|u[\\"^]*i[\\"^]*r[\\"^]*r[\\"^]*e[\\"^]*l)|s[\\"^]*h|t[\\"^]*o[\\"^]*r[\\"^]*d[\\"^]*i[\\"^]*a[\\"^]*g|y[\\"^]*(?:n[\\"^]*c[\\"^]*a[\\"^]*p[\\"^]*p[\\"^]*v[\\"^]*p[\\"^]*u[\\"^]*b[\\"^]*l[\\"^]*i[\\"^]*s[\\"^]*h[\\"^]*i[\\"^]*n[\\"^]*g[\\"^]*s[\\"^]*e[\\"^]*r[\\"^]*v[\\"^]*e[\\"^]*r|s[\\"^]*s[\\"^]*e[\\"^]*t[\\"^]*u[\\"^]*p))|t[\\"^]*(?:e[\\"^]*[sv,.-/;-<>].*|r[\\"^]*a[\\"^]*c[\\"^]*k[\\"^]*e[\\"^]*r|t[\\"^]*(?:d[\\"^]*i[\\"^]*n[\\"^]*j[\\"^]*e[\\"^]*c[\\"^]*t|t[\\"^]*r[\\"^]*a[\\"^]*c[\\"^]*e[\\"^]*r))|u[\\"^]*(?:n[\\"^]*r[\\"^]*e[\\"^]*g[\\"^]*m[\\"^]*p[\\"^]*2|p[\\"^]*d[\\"^]*a[\\"^]*t[\\"^]*e|r[\\"^]*l|t[\\"^]*i[\\"^]*l[\\"^]*i[\\"^]*t[\\"^]*y[\\"^]*f[\\"^]*u[\\"^]*n[\\"^]*c[\\"^]*t[\\"^]*i[\\"^]*o[\\"^]*n[\\"^]*s)|v[\\"^]*(?:b[\\"^]*c|e[\\"^]*r[\\"^]*c[\\"^]*l[\\"^]*s[\\"^]*i[\\"^]*d|i[\\"^]*s[\\"^]*u[\\"^]*a[\\"^]*l[\\"^]*u[\\"^]*i[\\"^]*a[\\"^]*v[\\"^]*e[\\"^]*r[\\"^]*i[\\"^]*f[\\"^]*y[\\"^]*n[\\"^]*a[\\"^]*t[\\"^]*i[\\"^]*v[\\"^]*e|s[\\"^]*(?:i[\\"^]*i[\\"^]*s[\\"^]*e[\\"^]*x[\\"^]*e[\\"^]*l[\\"^]*a[\\"^]*u[\\"^]*n[\\"^]*c[\\"^]*h|j[\\"^]*i[\\"^]*t[\\"^]*d[\\"^]*e[\\"^]*b[\\"^]*u[\\"^]*g[\\"^]*g)[\\"^]*e[\\"^]*r)|w[\\"^]*(?:a[\\"^]*b|(?:f|m[\\"^]*i)[\\"^]*c|i[\\"^]*n[\\"^]*(?:g[\\"^]*e[\\"^]*t|r[\\"^]*m|w[\\"^]*o[\\"^]*r[\\"^]*d)|l[\\"^]*r[\\"^]*m[\\"^]*d[\\"^]*r|o[\\"^]*r[\\"^]*k[\\"^]*f[\\"^]*o[\\"^]*l[\\"^]*d[\\"^]*e[\\"^]*r[\\"^]*s|s[\\"^]*(?:(?:c[\\"^]*r[\\"^]*i[\\"^]*p|r[\\"^]*e[\\"^]*s[\\"^]*e)[\\"^]*t|l)|t[\\"^]*[sv,.-/;-<>].*|u[\\"^]*a[\\"^]*u[\\"^]*c[\\"^]*l[\\"^]*t)|x[\\"^]*w[\\"^]*i[\\"^]*z[\\"^]*a[\\"^]*r[\\"^]*d|z[\\"^]*i[\\"^]*p[\\"^]*f[\\"^]*l[\\"^]*d[\\"^]*r)(?:.[\\"^]*[0-9A-Z_a-z]+)?b",
+      "@rx (?i)(?:[nr;`{]|||?|&&?)[sv]*[sv\\"'-(,@]*(?:[\\"'.-9A-Z_a-z]+/|(?:[\\"'x5c^]*[0-9A-Z_a-z][\\"'x5c^]*:.*|[ \\"'.-9A-Zx5c^-_a-z]*)x5c)?[\\"^]*(?:(?:a[\\"^]*(?:c|s[\\"^]*n[\\"^]*p)|e[\\"^]*(?:b[\\"^]*p|p[\\"^]*(?:a[\\"^]*l|c[\\"^]*s[\\"^]*v|s[\\"^]*n)|[tx][\\"^]*s[\\"^]*n)|f[\\"^]*(?:[cltw]|o[\\"^]*r[\\"^]*e[\\"^]*a[\\"^]*c[\\"^]*h)|i[\\"^]*(?:[cr][\\"^]*m|e[\\"^]*x|h[\\"^]*y|i|p[\\"^]*(?:a[\\"^]*l|c[\\"^]*s[\\"^]*v|m[\\"^]*o|s[\\"^]*n)|s[\\"^]*e|w[\\"^]*(?:m[\\"^]*i|r))|m[\\"^]*(?:a[\\"^]*n|[dipv]|o[\\"^]*u[\\"^]*n[\\"^]*t)|o[\\"^]*g[\\"^]*v|p[\\"^]*(?:o[\\"^]*p|u[\\"^]*s[\\"^]*h)[\\"^]*d|t[\\"^]*r[\\"^]*c[\\"^]*m|w[\\"^]*j[\\"^]*b)[\\"^]*[sv,.-/;-<>].*|c[\\"^]*(?:(?:(?:d|h[\\"^]*d[\\"^]*i[\\"^]*r|v[\\"^]*p[\\"^]*a)[\\"^]*|p[\\"^]*(?:[ip][\\"^]*)?)[sv,.-/;-<>].*|l[\\"^]*(?:(?:[cipv]|h[\\"^]*y)[\\"^]*[sv,.-/;-<>].*|s)|n[\\"^]*s[\\"^]*n)|d[\\"^]*(?:(?:b[\\"^]*p|e[\\"^]*l|i[\\"^]*(?:f[\\"^]*f|r))[\\"^]*[sv,.-/;-<>].*|n[\\"^]*s[\\"^]*n)|g[\\"^]*(?:(?:(?:(?:a[\\"^]*)?l|b[\\"^]*p|d[\\"^]*r|h[\\"^]*y|(?:w[\\"^]*m[\\"^]*)?i|j[\\"^]*b|[u-v])[\\"^]*|c[\\"^]*(?:[ims][\\"^]*)?|m[\\"^]*(?:o[\\"^]*)?|s[\\"^]*(?:n[\\"^]*(?:p[\\"^]*)?|v[\\"^]*))[sv,.-/;-<>].*|e[\\"^]*r[\\"^]*r|p[\\"^]*(?:(?:s[\\"^]*)?[sv,.-/;-<>].*|v))|l[\\"^]*s|n[\\"^]*(?:(?:a[\\"^]*l|d[\\"^]*r|[iv]|m[\\"^]*o|s[\\"^]*n)[\\"^]*[sv,.-/;-<>].*|p[\\"^]*s[\\"^]*s[\\"^]*c)|r[\\"^]*(?:(?:(?:(?:b[\\"^]*)?p|e[\\"^]*n|(?:w[\\"^]*m[\\"^]*)?i|j[\\"^]*b|n[\\"^]*[ip])[\\"^]*|d[\\"^]*(?:r[\\"^]*)?|m[\\"^]*(?:(?:d[\\"^]*i[\\"^]*r|o)[\\"^]*)?|s[\\"^]*n[\\"^]*(?:p[\\"^]*)?|v[\\"^]*(?:p[\\"^]*a[\\"^]*)?)[sv,.-/;-<>].*|c[\\"^]*(?:j[\\"^]*b[\\"^]*[sv,.-/;-<>].*|s[\\"^]*n)|u[\\"^]*j[\\"^]*b)|s[\\"^]*(?:(?:(?:a[\\"^]*(?:j[\\"^]*b|l|p[\\"^]*s|s[\\"^]*v)|b[\\"^]*p|[civ]|w[\\"^]*m[\\"^]*i)[\\"^]*|l[\\"^]*(?:s[\\"^]*)?|p[\\"^]*(?:(?:j[\\"^]*b|p[\\"^]*s|s[\\"^]*v)[\\"^]*)?)[sv,.-/;-<>].*|h[\\"^]*c[\\"^]*m|u[\\"^]*j[\\"^]*b))(?:.[\\"^]*[0-9A-Z_a-z]+)?b",
+      "@lt 4"
     ]
 
-[http.middlewares.bad_bot_block_IIS]
-  [http.middlewares.bad_bot_block_IIS.plugin.badbot]
+[http.middlewares.bad_bot_block_FIXATION]
+  [http.middlewares.bad_bot_block_FIXATION.plugin.badbot]
     userAgent = [
-      "!@rx ^404$",
-      "@pmFromFile iis-errors.data",
-      "@lt 4",
-      "@lt 3",
-      "@rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error.</h2>|cannot connect to the server: timed out)",
+      "@lt 2",
       "@lt 1",
-      "@rx [a-z]:x5cinetpubb",
-      "@rx bServer Error in.{0,50}?bApplicationb",
-      "@lt 2"
+      "!@endsWith %{request_headers.host}",
+      "@lt 3",
+      "@rx ^(?:jsessionid|aspsessionid|asp.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$",
+      "@rx (?i:.cookieb.*?;W*?(?:expires|domain)W*?=|bhttp-equivW+set-cookieb)",
+      "@rx ^(?:ht|f)tps?://(.*?)/",
+      "@eq 0",
+      "@lt 4"
     ]
 
 [http.middlewares.bad_bot_block_SHELLS]
   [http.middlewares.bad_bot_block_SHELLS.plugin.badbot]
     userAgent = [
-      "@contains <h1 style=\\"margin-bottom: 0\\">webadmin.php</h1>",
+      "@rx ^<html><head><meta http-equiv='Content-Type' content='text/html; charset=Windows-1251'><title>.*? - WSO [0-9.]+</title>",
       "@rx ^ *<html>n[ ]+<head>n[ ]+<title>lostDC -",
-      "@rx <title>Symlink_Sa [0-9.]+</title>",
+      "@lt 1",
+      "@rx ^<html>rn<head>rn<meta http-equiv=\\"Content-Type\\" content=\\"text/html; charset=gb2312\\">rn<title>PhpSpy Ver [0-9]+</title>",
+      "@rx ^ <html><head><title>:: b374k m1n1 [0-9.]+ ::</title>",
       "@rx <title>.:: .* ~ Ashiyane V [0-9.]+ ::.</title>",
-      "@rx ^<html>n<head>n<title>Ru24PostWebShell -",
       "@rx <small>NGHshell [0-9.]+ by Cr4sh</body></html>n$",
+      "@lt 2",
+      "@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King</title>",
+      "@rx <title>Symlink_Sa [0-9.]+</title>",
+      "@rx <title>Mini Shell</title>.*Developed By LameHacker",
+      "@rx <title>lama's'hell v. [0-9.]+</title>",
       "@rx ^<!DOCTYPE html>n<html>n<!-- By Artyum .*<title>Web Shell</title>",
+      "@lt 4",
       "@pmFromFile web-shells-php.data",
-      "@rx ^<html>n<title>.*? ~ Shell I</title>n<head>n<style>",
+      "@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ -",
       "@rx ^ <html>nn<head>nn<title>g00nshell v[0-9.]+",
-      "@contains <title>punkholicshell</title>",
-      "@lt 4",
-      "@rx ^ <html><head><title>:: b374k m1n1 [0-9.]+ ::</title>",
-      "@rx ^<html>rn<head>rn<meta http-equiv=\\"Content-Type\\" content=\\"text/html; charset=gb2312\\">rn<title>PhpSpy Ver [0-9]+</title>",
-      "@rx ^<title>PHP Web Shell</title>rn<html>rn<body>rn    <!-- Replaces command with Base64-encoded Data -->",
+      "@rx ^<html>n<title>.*? ~ Shell I</title>n<head>n<style>",
       "@rx >SmEvK_PaThAn Shell v[0-9]+ coded by <a href=",
+      "@rx (<title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>)",
+      "@rx ^<title>PHP Web Shell</title>rn<html>rn<body>rn    <!-- Replaces command with Base64-encoded Data -->",
+      "@rx ^<html>n<head>n<title>Ru24PostWebShell -",
+      "@rx <title>CasuS [0-9.]+ by MafiABoY</title>",
       "@rx B4TM4N SH3LL</title>.*<meta name='author' content='k4mpr3t'/>",
+      "@contains <title>punkholicshell</title>",
       "@lt 3",
-      "@lt 1",
-      "@rx <title>lama's'hell v. [0-9.]+</title>",
-      "@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King</title>",
-      "@rx <title>CasuS [0-9.]+ by MafiABoY</title>",
-      "@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ -",
-      "@lt 2",
+      "@rx ^<html>n<head>n<div align=\\"left\\"><font size=\\"1\\">Input command :</font></div>n<form name=\\"cmd\\" method=\\"POST\\" enctype=\\"multipart/form-data\\">",
+      "@contains <h1 style=\\"margin-bottom: 0\\">webadmin.php</h1>",
       "@rx ^<html>n      <head>n             <title>azrail [0-9.]+ by C-W-M</title>",
-      "@rx (<title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>)",
-      "@rx ^<html><head><meta http-equiv='Content-Type' content='text/html; charset=Windows-1251'><title>.*? - WSO [0-9.]+</title>",
-      "@rx ^<html>rn<head>rn<title>GRP WebShell [0-9.]+",
-      "@rx <title>Mini Shell</title>.*Developed By LameHacker",
-      "@rx ^<html>n<head>n<div align=\\"left\\"><font size=\\"1\\">Input command :</font></div>n<form name=\\"cmd\\" method=\\"POST\\" enctype=\\"multipart/form-data\\">"
+      "@rx ^<html>rn<head>rn<title>GRP WebShell [0-9.]+"
+    ]
+
+[http.middlewares.bad_bot_block_EXCEPTIONS]
+  [http.middlewares.bad_bot_block_EXCEPTIONS.plugin.badbot]
+    userAgent = [
+      "@endsWith (internal dummy connection)",
+      "@ipMatch 127.0.0.1,::1",
+      "@rx ^(?:GET /|OPTIONS *) HTTP/[12].[01]$",
+      "@streq GET /"
+    ]
+
+[http.middlewares.bad_bot_block_IIS]
+  [http.middlewares.bad_bot_block_IIS.plugin.badbot]
+    userAgent = [
+      "@lt 2",
+      "@lt 1",
+      "@rx bServer Error in.{0,50}?bApplicationb",
+      "@lt 3",
+      "@lt 4",
+      "@rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| (0x80040e31)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error.</h2>|cannot connect to the server: timed out)",
+      "!@rx ^404$",
+      "@rx [a-z]:x5cinetpubb",
+      "@pmFromFile iis-errors.data"
     ]
 
 [http.middlewares.bad_bot_block_CORRELATION]
   [http.middlewares.bad_bot_block_CORRELATION.plugin.badbot]
     userAgent = [
-      "@ge %{tx.inbound_anomaly_score_threshold}",
-      "@lt 4",
-      "@lt 3",
-      "@gt 0",
       "@lt 1",
-      "@ge %{tx.outbound_anomaly_score_threshold}",
       "@ge 5",
+      "@ge %{tx.outbound_anomaly_score_threshold}",
+      "@lt 3",
+      "@ge %{tx.inbound_anomaly_score_threshold}",
+      "@lt 2",
       "@eq 0",
-      "@lt 2"
+      "@gt 0",
+      "@lt 4"
     ]