Versions (3)
Version DetailsCurrent
Rev: 4 • Jul 26, 2012, 12:00 PMET WEB_SERVER Fake Googlebot UA 2 Inbound
alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SERVER Fake Googlebot UA 2 Inbound"; flow:established,to_server; http.user_agent; content:"Googlebot-"; fast_pattern; nocase; content:!"Googlebot-News"; startswith; content:!"Googlebot-Image/1.0"; startswith; content:!"Googlebot-Video/1.0"; startswith; content:!"Mobile/2.1|3b| +http|3a|//www.google.com/bot.html)"; endswith; reference:url,www.incapsula.com/the-incapsula-blog/item/369-was-that-really-a-google-bot-crawling-my-site; reference:url,support.google.com/webmasters/bin/answer.py?hl=en&answer=1061943; classtype:network-scan; sid:2015527; rev:4; metadata:created_at 2012_07_26, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_27;)
Jul 26, 2012, 12:00 PM
Jan 27, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 6, 2025, 9:38 PM
rules/emerging-web_server.rules