From 616dab4b3ac4dfd1864c938df86353d65cdfc749 Mon Sep 17 00:00:00 2001 From: Jeremy Stanley Date: Wed, 8 Mar 2023 19:11:01 +0000 Subject: [PATCH] Block another bogus crawler botnet UA We're seeing tons of this, so either we're besieged by an army of 10-year-old Samsung Galaxy phones or this is a nefarious actor. Change-Id: If52be5c4a191e5c70f55d843348ba7ca0b365e30 --- playbooks/roles/apache-ua-filter/files/ua-filter.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/playbooks/roles/apache-ua-filter/files/ua-filter.conf b/playbooks/roles/apache-ua-filter/files/ua-filter.conf index 5725d5e794..7fb40aa205 100644 --- a/playbooks/roles/apache-ua-filter/files/ua-filter.conf +++ b/playbooks/roles/apache-ua-filter/files/ua-filter.conf @@ -46,7 +46,8 @@ RewriteCond %{HTTP_USER_AGENT} "=UCWEB7.0.2.37/28/999" [OR] RewriteCond %{HTTP_USER_AGENT} "=NOKIA5700/ UCWEB7.0.2.37/28/999" [OR] RewriteCond %{HTTP_USER_AGENT} "=Openwave/ UCWEB7.0.2.37/28/999" [OR] - RewriteCond %{HTTP_USER_AGENT} "=Mozilla/4.0 (compatible; MSIE 6.0; ) Opera/UCWEB7.0.2.37/28/999" + RewriteCond %{HTTP_USER_AGENT} "=Mozilla/4.0 (compatible; MSIE 6.0; ) Opera/UCWEB7.0.2.37/28/999" [OR] + RewriteCond %{HTTP_USER_AGENT} "=Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Mobile Safari/537.36" RewriteRule . - [R=403,L]