alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Fake Googlebot UA 1 Inbound"; flow:established,to_server; http.user_agent; content:!"Mozilla|2f|5|2e|0|20 28|compatible|3b 20|Googlebot|2f|2|2e|1|3b 20 2b|http|3a 2f 2f|www|2e|google|2e|com|2f|bot|2e|html|29|"; depth:72; content:!"Googlebot|2f|2|2e|1|20 28 2b|http|3a 2f 2f|www|2e|google|2e|com|2f|bot|2e|html|29|"; depth:50; content:"Googlebot"; fast_pattern; nocase; reference:url,www.incapsula.com/the-incapsula-blog/item/369-was-that-really-a-google-bot-crawling-my-site; reference:url,support.google.com/webmasters/bin/answer.py?hl=en&answer=1061943; classtype:bad-unknown; sid:2015526; rev:5; metadata:created_at 2012_07_25, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_20;)