alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SERVER Fake Googlebot UA 2 Inbound"; flow:established,to_server; http.user_agent; content:"Googlebot-"; fast_pattern; nocase; content:!"Googlebot-News"; startswith; content:!"Googlebot-Image/1.0"; startswith; content:!"Googlebot-Video/1.0"; startswith; content:!"Mobile/2.1|3b| +http|3a|//www.google.com/bot.html)"; endswith; reference:url,www.incapsula.com/the-incapsula-blog/item/369-was-that-really-a-google-bot-crawling-my-site; reference:url,support.google.com/webmasters/bin/answer.py?hl=en&answer=1061943; classtype:network-scan; sid:2015527; rev:4; metadata:created_at 2012_07_26, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_27;)