ModSec rules to block RapidLeech

From James Dooley's Wiki
Revision as of 17:38, 17 February 2012 by Smsldoo (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search
#### Block .com sharing sites ####
SecRule ARGS_POST ^http://[A-Za-z0-9\.?]+\.(10upload|1fichier|2shared|4shared|adrive|azsharing|badongo|bitshare|depositfiles|easy\.share|egoshare|enterupload|esnips|evilshare|extabit|fileadded|filedino|filedude|filefactory|filefat|fileflyer|filehook|filekeen|fileserve|filesmonster|filesonic|freakshare|gigasize|hotfile|jumbofiles|kewlshare|mediafire|megaporn|megashare|megashares|megaupload|megavideo|midupload|novamov|oron|plunder|rapidshare|rapidvideo|savefile|saveqube|sendspace|sharebomb|sharedzilla|speedyshare|stagevu|torrific|turboupload|ugotfile|uploadbaz|uploadbox|uploading|uploads\.bizhat|uploadstation|videobb|video\.google|videoweed|videozer|vip-file|wupload|youtube|ziddu|zippyshare)\.com.+
"log,deny,msg:'Rapidleech !!'"

SecRule ARGS_POST ^http://(10upload|1fichier|2shared|4shared|adrive|azsharing|badongo|bitshare|depositfiles|easy\.share|egoshare|enterupload|esnips|evilshare|extabit|fileadded|filedino|filedude|filefactory|filefat|fileflyer|filehook|filekeen|fileserve|filesmonster|filesonic|freakshare|gigasize|hotfile|jumbofiles|kewlshare|mediafire|megaporn|megashare|megashares|megaupload|megavideo|midupload|novamov|oron|plunder|rapidshare|rapidvideo|savefile|saveqube|sendspace|sharebomb|sharedzilla|speedyshare|stagevu|torrific|turboupload|ugotfile|uploadbaz|uploadbox|uploading|uploads\.bizhat|uploadstation|videobb|video\.google|videoweed|videozer|vip-file|wupload|youtube|ziddu|zippyshare)\.com.+ "log,deny,msg:'Rapidleech !!'"


#### Block .net sharing sites ####
SecRule ARGS_POST ^http://[A-Za-z0-9\.?]+\.(bitroad|cash\.file|fileover|filesend|filego|furk|letitbit|movshare|share-now|simpleupload|turbobit|zshare)\.net.+ "log,deny,msg:'Rapidleech !!'"

SecRule ARGS_POST ^http://(bitroad|cash\.file|fileover|filesend|filego|furk|letitbit|movshare|share-now|simpleupload|turbobit|zshare)\.net.+ "log,deny,msg:'Rapidleech !!'"

#### Block random sharing sites ####
SecRule ARGS_POST ^http://[A-Za-z0-9\.?]+\.(cramit\.in|divxstage\.eu|dl\.free\.fr|downtown\.vc|files\.to|fshare\.vn|ifile\.it|ifolder\.ru|
imageshack\.us|netload\.in|rapidshare\.de|sharebase\.to|share\.online\.biz|supershare\.pl|ul\.to|uploaded\.to|videoweed\.es|x7\.to|youload\.to).+
"log,deny,msg:'Rapidleech !!'"

SecRule ARGS_POST ^http://(cramit\.in|divxstage\.eu|dl\.free\.fr|downtown\.vc|files\.to|fshare\.vn|ifile\.it|ifolder\.ru|
imageshack\.us|netload\.in|rapidshare\.de|sharebase\.to|share\.online\.biz|supershare\.pl|ul\.to|uploaded\.to|videoweed\.es|x7\.to|youload\.to)\.com.+ "log,deny,msg:'Rapidleech !!'"