rules.json 2.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105
  1. [
  2. { "name": "suspiciously frequent IP",
  3. "filters": [],
  4. "interval": 600,
  5. "limit": 30,
  6. "aggregations": [
  7. "Header:X-Forwarded-For"
  8. ],
  9. "actions":[
  10. {"name":"log"}
  11. ]
  12. },
  13. { "name": "search request",
  14. "filters": [
  15. "Param:q",
  16. "Path=^(/|/search)$"
  17. ],
  18. "interval": 61,
  19. "limit": 999,
  20. "subrules": [
  21. {
  22. "name": "roboagent limit",
  23. "interval": 61,
  24. "limit": 1,
  25. "filters": [
  26. "Header:User-Agent=(curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client)"
  27. ],
  28. "actions": [
  29. { "name": "log"},
  30. { "name": "block",
  31. "params": {
  32. "message": "Rate limit exceeded"
  33. }
  34. }
  35. ]
  36. },
  37. {
  38. "name": "botlimit",
  39. "limit": 0,
  40. "stop": true,
  41. "filters": [
  42. "Header:User-Agent=(Googlebot|bingbot|Baiduspider|yacybot|YandexMobileBot|YandexBot|Yahoo! Slurp|MJ12bot|AhrefsBot|archive.org_bot|msnbot|MJ12bot|SeznamBot|linkdexbot|Netvibes|SMTBot|zgrab|James BOT)"
  43. ],
  44. "actions": [
  45. { "name": "log"},
  46. { "name": "block",
  47. "params": {
  48. "message": "Rate limit exceeded"
  49. }
  50. }
  51. ]
  52. },
  53. {
  54. "name": "IP limit",
  55. "interval": 61,
  56. "limit": 9,
  57. "stop": true,
  58. "aggregations": [
  59. "Header:X-Forwarded-For"
  60. ],
  61. "actions": [
  62. { "name": "log"},
  63. { "name": "block",
  64. "params": {
  65. "message": "Rate limit exceeded"
  66. }
  67. }
  68. ]
  69. },
  70. {
  71. "name": "rss/json limit",
  72. "interval": 121,
  73. "limit": 2,
  74. "stop": true,
  75. "filters": [
  76. "Param:format=(csv|json|rss)"
  77. ],
  78. "actions": [
  79. { "name": "log"},
  80. { "name": "block",
  81. "params": {
  82. "message": "Rate limit exceeded"
  83. }
  84. }
  85. ]
  86. },
  87. {
  88. "name": "useragent limit",
  89. "interval": 61,
  90. "limit": 199,
  91. "aggregations": [
  92. "Header:User-Agent"
  93. ],
  94. "actions": [
  95. { "name": "log"},
  96. { "name": "block",
  97. "params": {
  98. "message": "Rate limit exceeded"
  99. }
  100. }
  101. ]
  102. }
  103. ]
  104. }
  105. ]