hostblock.conf

## Hostblock config

[Global]

## Log level (ERROR/WARNING/INFO/DEBUG)
## ERROR - write only error messages to syslog
## WARNING - write error and warning messages to syslog
## INFO - write error, warning and info messages to syslog (default)
## DEBUG - write all messages to syslog
log.level = INFO

## Interval for log file check (seconds, default 30)
#log.check.interval = 30

## Needed score to create iptables rule for IP address connection drop (default 10)
#address.block.score = 10

## Score multiplier to calculate time how long iptables rule should be kept (seconds, default 3600, 0 will not remove automatically)
##
## If score == 1:
## 1*3600 - hour
## 1*86400 - day
## 1*432000 - 5 days
## 1*2592000 - 30 days
##
## If score == 4:
## 4*3600 - 4 hours
## 4*86400 - 4 days
## 4*432000 - 20 days
## 4*2592000 - 120 days
#address.block.multiplier = 3600

## Rule to use in IP tables rule (use %i as placeholder to specify IP address)
## Simple rule to drop packets from IP address
iptables.rules.block = -s %i -j DROP
## Or set up new iptables chain separate for hostblock
#iptables.rules.block = -s %i -j HB_LOG_AND_DROP

## Whether to add iptables rule to the head or tail of the chain (default head)
#iptables.rules.pos = head

## iptables commands to execute during daemon startup
## If check does not return 0, then execute all add rules
## As example to automatically add HB_LOG_AND_DROP rules if host is restarted and rules are not restored with iptables-restore
#iptables.startup.check = -S HB_LOG_AND_DROP
#iptables.startup.add = -N HB_LOG_AND_DROP
#iptables.startup.add = -A HB_LOG_AND_DROP -j LOG --log-prefix "IPTABLES-DROPPED: " --log-level 4
#iptables.startup.add = -A HB_LOG_AND_DROP -j DROP

## Datetime format (default %Y-%m-%d %H:%M:%S)
#datetime.format = %Y-%m-%d %H:%M:%S

## Datafile location
datafile.path = /usr/local/share/hostblock/hostblock.data

## AbuseIPDB URL
#abuseipdb.api.url = https://api.abuseipdb.com

## AbuseIPDB API Key
#abuseipdb.api.key = AbuseIPDBAPIKeyAbuseIPDBAPIKeyAbuseIPDBA

## AbuseIPDB API date time format
#abuseipdb.datetime.format = %Y-%m-%dT%H:%M:%S

## Interval to sync AbuseIPDB blacklist, use 0 to disable (seconds, default 0)
## Note, it is recommended to sync no more often than once per 24h, i.e. 86400 seconds
#abuseipdb.blacklist.interval = 0

## AbuseIPDB min score to block IP address (25 to 100, default 90)
## If AbuseIPDB confidence score is >= than this setting, then iptables rule to block is created (also used for blacklist sync)
## It is recommended to use value between 75 and 100
## Note, 25 is minimum allowed by AbuseIPDB blacklist API
#abuseipdb.block.score = 90

## Whether to report all matches to AbuseIPDB (true|false, default false)
#abuseipdb.report.all = false

## Mask hostname and/or IP address before sending report to AbuseIPDB (true|false, default true)
#abuseipdb.report.mask = true

## TODO Additional custom phrases to mask before sending report to AbuseIPDB
#abuseipdb.report.maskphrase = Jane Doe
#abuseipdb.report.maskphrase = fqdn.example.com

## Default categories for reporting to AbuseIPDB (default 15, separated with comma, must have at least one category)
#abuseipdb.report.categories = 15

## Default comment for AbuseIPDB reports
## Use %m to include matched line
## Use %i to include address
#abuseipdb.report.comment = Hostblock (https://github.com/tower9/hostblock)
#abuseipdb.report.comment = %m

## Pattern and log file configuration for OpenSSH
[Log.OpenSSH]

## AbuseIPDB log group level configuration (overrides global setting)
#abuseipdb.report.all = true
#abuseipdb.report.categories = 18,22
#abuseipdb.report.comment = %m

## Full path to log file(s)
## Gentoo/SuSE
#log.path = /var/log/messages
## RedHat/Fedora
#log.path = /var/log/secure
## Mandrake/FreeBSD/OpenBSD
log.path = /var/log/auth.log

## Patterns to match with scores to use for calculation
## Use %i to specify where in pattern IP address should be looked for
## Score must follow after pattern, if not specified by default will be set 1
## If AbuseIPDB reporting is configured (API key is specified), then it is possible to specify individual rules for reporting (overrides global and log group settings)
## - log.abuseipdb.report - whether to report
## - log.abuseipdb.categories - comma separated categories to specify, if not specified then default are used (abuseipdb.report.categories)
## - log.abuseipdb.comment - comment to specify in report, if not specified then comment from log group or global settings is used, to report without comment, specify setting with empty value
log.pattern = ^.+? sshd\[\d+\]: Invalid user .+? from %i
log.score = 2
log.pattern = ^.+? sshd\[\d+\]: Invalid user .+? from %i port %p
log.score = 2
log.pattern = ^.+? sshd\[\d+\]: error: PAM: Authentication failure for .+? from %i
log.pattern = ^.+? sshd\[\d+\]: ROOT LOGIN REFUSED FROM %i
log.score = 20
log.pattern = ^.+? sshd\[\d+\]: SSH: Server;Ltype: Authname;Remote: %i-\d+;Name: root \[preauth\]
log.score = 20
log.pattern = ^.+? sshd\[\d+\]: Did not receive identification string from %i
log.abuseipdb.categories = 14
log.pattern = ^.+? sshd\[\d+\]: Did not receive identification string from %i port %p
log.abuseipdb.categories = 14
log.pattern = ^.+? sshd\[\d+\]: User .+? from %i not allowed because not listed in AllowUsers
log.score = 2
log.pattern = ^.+? sshd\[\d+\]: pam_unix\(sshd:auth\): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=%i
log.pattern = ^.+? sshd\[\d+\]: Postponed keyboard-interactive for invalid user .+? from %i port %p ssh2 \[preauth\]
log.score = 2
log.pattern = ^.+? sshd\[\d+\]: PAM: Authentication failure for illegal user .+? from %i
log.score = 2
log.pattern = ^.+? sshd\[\d+\]: Failed keyboard-interactive/pam for invalid user .+? from %i port %p ssh2
log.score = 2
log.pattern = ^.+? sshd\[\d+\]: Disconnecting: Too many authentication failures for invalid user .+? from %i port %p ssh2 \[preauth\]
log.score = 2
log.pattern = ^.+? sshd\[\d+\]: Disconnecting invalid user .+? %i port %p: Too many authentication failures \[preauth\]
log.score = 2
log.pattern = ^.+? sshd\[\d+\]: Failed password for invalid user .+? from %i port %p ssh2
log.score = 2
log.pattern = ^.+? sshd\[\d+\]: error: maximum authentication attempts exceeded for invalid user .+? from %i port %p ssh2 \[preauth\]
log.score = 2
log.pattern = ^.+? sshd\[\d+\]: Connection closed by %i port %p \[preauth\]
log.score = 0
log.abuseipdb.report = false
log.pattern = ^.+? sshd\[\d+\]: Disconnected from %i port %p \[preauth\]
log.score = 0
log.abuseipdb.report = false

## Patterns in log file to count refused connection count
## Use %i to specify where in pattern IP address should be looked for
## Score must follow after pattern, if not specified by default will be set to 1
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=22 .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 14,22
#log.abuseipdb.comment = %d SSH access blocked by firewall
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=25 .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,14,15
#log.abuseipdb.comment = %d SMTP access blocked by firewall
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=80 .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 14,21
#log.abuseipdb.comment = %d HTTP access blocked by firewall
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=110 .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,14,15
#log.abuseipdb.comment = %d POP3 access blocked by firewall
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=143 .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,14,15
#log.abuseipdb.comment = %d IMAP access blocked by firewall
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=443 .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 14,21
#log.abuseipdb.comment = %d HTTPs access blocked by firewall
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=465 .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,14,15
#log.abuseipdb.comment = %d SMTPs access blocked by firewall
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=587 .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,14,15
#log.abuseipdb.comment = %d SMTPs access blocked by firewall
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=993 .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,14,15
#log.abuseipdb.comment = %d IMAPs access blocked by firewall
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=995 .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,14,15
#log.abuseipdb.comment = %d POP3s access blocked by firewall
log.refused.pattern = ^.+? kernel: \[\s?\d+\.\d+\] IPTABLES-DROPPED: .+? SRC=%i .+? DPT=%p .+?
log.refused.score = 5
#log.abuseipdb.report = true
#log.abuseipdb.categories = 14
#log.abuseipdb.comment = %d Connection to port %p blocked by firewall

## Pattern and log file configuration for Apache
#[Log.ApacheAccess]

## AbuseIPDB log group level configuration
#abuseipdb.report = false

## Full path to log file(s)
#log.path = /var/log/apache2/access.log

## Patterns to match
## Use %i to specify where in pattern IP address should be looked for
## Score must follow after pattern, if not specified by default will be set 1
## If AbuseIPDB reporting is configured (API key specified), then here can also specify individual rules for reporting (overrides global and log group settings)
## - log.abuseipdb.report - whether to report
## - log.abuseipdb.categories - comma separated categories to specify, if not specified then default are used (abuseipdb.report.categories)
## - log.abuseipdb.comment - comment to specify in report, if not specified then default is used (abuseipdb.report.comment)
#log.pattern = ^%i .+?\/user\/soapCaller\.bs.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Morfeus Scanner
#log.pattern = ^%i .+?\/muieblackcat.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Muieblackcat Web scanner/Robot (muieblackcat)
#log.pattern = ^%i .+?(?:phpmy|php\-my|my|mysql|web|php|db|database|phppg|sqlite)(?:admin|\-admin|manager|\-manager|dumper|-\dumper).+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Admin application scan (phpmyadmin|webadmin|dbadmin|dbmanager|sqlitemanager|mysqldumper)
#log.pattern = ^%i .+?\/wp\-admin.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Wordpress admin application scan (wp-admin)
#log.pattern = ^%i .+?\/_vti_bin\/_vti_aut\/author\.dll.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d FrontPage anonymous login scan (author.dll)
#log.pattern = ^%i .+?\/freepbx\/config\.php.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d FreePBX availability scan (/freepbx/config.php)
#log.pattern = ^%i .+?\/manager\/html.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Tomcat admin application scan (/manager/html)
#log.pattern = ^%i .+?GET \/axis2.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Axis2 application scan (/axis2)
#log.pattern = ^%i .+?\/jmx\-console.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d JBoss JMX console scan (/jmx-console)
#log.pattern = ^%i .+?\/(?:bea_wls_deployment_internal|bea_wls_cluster_internal|bea_wls_internal|inspection.wsil|uddiexplorer).+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d WebLogic default deployed application availability scan (bea_wls_deployment_internal|bea_wls_cluster_internal|bea_wls_internal|inspection.wsil|uddiexplorer)
#log.pattern = ^%i .+?\/drupal.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Drupal availability scan (/drupal)
#log.pattern = ^%i .+?\/joomla\/administrator.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Joomla admin application scan (/joomla/administrator)
#log.pattern = ^%i .+?\/jenkins\/script.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Jenkins script console availability scan (/jenkins/script)
#log.pattern = ^%i .+?\/connectors\/system\/phpthumb\.php.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Modx Revolution availability / remote code execution vulnerability scan (/connectors/system/phpthumb.php)
#log.pattern = ^%i .+?\/plugins\/weathermap\/editor\.php.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Weathermap Editor (cacti plugin) remote code execution vulnerability attempt/scan (/plugins/weathermap/editor.php)
#log.pattern = ^%i .+?\/flex2gateway\/(?:amf|amfpolling|http|httpsecure|cfamfpolling).+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Adobe ColdFusion remote code execution vulnerability attempt/scan (/flex2gateway/amf|amfpolling|http|httpsecure|cfamfpolling)
#log.pattern = ^%i .+?GET \/webdav.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Web Distributed Authoring and Versioning server availability scan (webdav)
#log.pattern = ^%i .+?\/(?:xx|w|xw|s)\.php.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Web shell application scan (xx.php|w.php|xw.php|s.php)
#log.pattern = ^%i .+?\/cmd\.jsp.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Web shell application scan (cmd.jsp)
#log.pattern = ^%i .+?\/FxCodeShell\.jsp.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Web shell application scan (FxCodeShell.jsp)
#log.pattern = ^%i .+?\/\.git\/.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Git repository scan (/.git)
#log.pattern = ^%i .+?\/etc\/passwd.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Local file (passwd) inclusion test
#log.pattern = ^%i .+?\/GponForm\/diag_Form\?images.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d CVE-2018-10561 scan
#log.pattern = ^%i .+?\/wls\-wsat\/CoordinatorPortType HTTP.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d CVE-2017-10271 scan
#log.pattern = ^%i .+?compatible; Nmap Scripting Engine;.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Nmap scan
#log.pattern = ^%i .+?\/Diagnostics\.asp.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d CVE-2016-7188 scan
#log.pattern = ^%i .+?\/CFIDE\/(?:product\.cfm|administrator\/).+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d CVE-2010-2861 scan
#log.pattern = ^%i .+?\/wp-content\/plugins\/ezpz\-one\-click\-backup\/functions\/ezpz\-archive\-cmd\.php.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d CVE-2014-3114 scan
#log.pattern = ^%i .+?\/invoker\/readonly.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d CVE-2017-12149 scan
#log.pattern = ^%i .+?\?debug\=browser&object\=\(%23_memberAccess\=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS\).+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d CVE-2017-5638 scan
#log.pattern = ^%i .+?\/index\.php\?s\=\/index\/\\\\think\\\\app\/invokefunction\&function\=call_user_func_array.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d ThinkPHP remote code execution vulnerability availability scan (invokefunction&function=call_user_func_array)
#log.pattern = ^%i .+?\/(?:apps\/|jax_|CGI)?(?:Guestbook|guestbook|gastenboek|gaestebuch|g_book|gb)(?:\.(?:php|html|cgi))?.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Guestbook availability/vulnerability scan (jax_guestbook.php|guestbook.php|gastenboek.php|gaestebuch.php|g_book.cgi|gb.php)
#log.pattern = ^%i .+?http:\/\/check\.proxyradar\.com\/azenv\.php\?auth.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 9
#log.abuseipdb.comment = %d Open proxy scan
#log.pattern = ^%i .+?HEAD.+?\/check_proxy.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 9
#log.abuseipdb.comment = %d Open proxy scan
#log.pattern = ^%i .+?CONNECT.+?antei\.xyz.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 9
#log.abuseipdb.comment = %d Open proxy scan
#log.pattern = ^%i .+?\/onvif\-http\/snapshot\?auth\=YWRtaW46MTEK.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Hikvision IP camera backdoor availability scan (/onvif-http/snapshot?auth=YWRtaW46MTEK)
#log.pattern = ^%i .+?\/currentsetting\.htm.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Netgear router version scan (currentsetting.htm)
#log.pattern = ^%i .+?\/webfig\/roteros\.info.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d MikroTik router version scan (roteros.info)
#log.pattern = ^%i .+?GET \/winbox\.png.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d MikroTik availability scan (winbox.png)
#log.pattern = ^%i .+?\/(?:hndUnblock|tmUnblock)\.cgi.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Cisco/Linksys router scan / vulnerability availability scan (hndUnblock.cgi|tmUnblock.cgi)
#log.pattern = ^%i .+?\/HNAP1\/.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Dlink router scan (HNAP1)
#log.pattern = ^%i .+?servlet\?p\=login\&q\=loginForm\&jumpto\=status.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Yealink web management availability scan
#log.pattern = ^%i .+?\/cgi\-bin\/luci\/;stok\=redacted\/expert\/maintenance\/diagnostic\/nslookup.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d CVE-2017-6884 scan
#log.pattern = ^%i .+?\/stssys\.htm.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d TRENDnet print server scan (stssys.htm)
#log.pattern = ^%i .+?\/stalker_portal\/server\/adm.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Infomir Stalker middleware scan (/stalker_portal/server/adm)
#log.pattern = ^%i .+?\/000000000000\.cfg.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Polycom SIP/UC software availability scan (000000000000.cfg)
#log.pattern = ^%i .+?\/aastra\.cfg.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Asterisk/FreePBX software availability scan (aastra.cfg)
#log.pattern = ^%i .+?\/current_config\/passwd.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Dahua backdoor availability scan (/current_config/passwd)
#log.pattern = ^%i .+?\/cgi\-bin\/kerbynet\?.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Zeroshell Net Services scan (/cgi-bin/kerbynet)
#log.pattern = ^%i .+?\/command\.php.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Command injection vulnerability attempt/scan (command.php)
#log.pattern = ^%i .+?\/common\.cgi.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Command injection vulnerability attempt/scan (common.cgi)
#log.pattern = ^%i .+?\/login\.cgi\?.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Command injection vulnerability attempt/scan (login.cgi)
#log.pattern = ^%i .+?\/search\.cgi\?.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Command injection vulnerability attempt/scan (search.cgi)
#log.pattern = ^%i .+?\/wuwu11\.php.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Command injection vulnerability attempt/scan (wuwu11.php)
#log.pattern = ^%i .+?\/shell\?.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d Command injection vulnerability attempt/scan (/shell?)
#log.pattern = ^%i .+?\?XDEBUG_SESSION_START\=phpstorm.+?
#log.score = 2
#log.abuseipdb.report = true
#log.abuseipdb.categories = 15,21
#log.abuseipdb.comment = %d PHPStorm Xdebug availability scan (?XDEBUG_SESSION_START=phpstorm)


## Pattern and log file configuration for mailserver
#[Log.Mail]

## Full path to log file(s)
#log.path = /var/log/maillog

## Patterns to match
## Use %i to specify where in pattern IP address should be looked for
## Score must follow after pattern, if not specified by default will be set 1
## If AbuseIPDB reporting is configured (API key specified), then here can also specify individual rules for reporting (overrides global and log group settings)
## - log.abuseipdb.report - whether to report
## - log.abuseipdb.categories - comma separated categories to specify, if not specified then default are used (abuseipdb.report.categories)
## - log.abuseipdb.comment - comment to specify in report, if not specified then default is used (abuseipdb.report.comment)
#log.pattern = ^.+? dovecot: pop3-login: Aborted login \(tried to use disallowed plaintext auth\): .+? rip=%i,.+?
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,18
#log.abuseipdb.comment = %d POP3 login with disallowed plaintext auth
#log.pattern = ^.+? postfix\/smtps\/smtpd\[\s?\d+\]: SSL_accept error from .+?\[%i\]: -1$
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,18
#log.abuseipdb.comment = %m
#log.pattern = ^.+? postfix\/smtps\/smtpd\[\s?\d+\]: improper command pipelining after QUIT from .+?\[%i\].+?
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,18
#log.abuseipdb.comment = %m
#log.pattern = ^.+? postfix\/smtps\/smtpd\[\s?\d+\]: NOQUEUE: reject: RCPT from unknown\[%i\]: .+? Relay access denied; from=.+? to=.+? proto=.+? helo=.+?
#log.abuseipdb.report = true
#log.abuseipdb.categories = 11,18
#log.abuseipdb.comment = %d SMTPs relay access denied

## Pattern and log file configuration for Bind
#[Log.Named]

## Full path to log file(s)
#log.path = /var/log/daemon.log

## Patterns to match
## Use %i to specify where in pattern IP address should be looked for
## Score must follow after pattern, if not specified by default will be set 1
## If AbuseIPDB reporting is configured (API key specified), then here can also specify individual rules for reporting (overrides global and log group settings)
## - log.abuseipdb.report - whether to report
## - log.abuseipdb.categories - comma separated categories to specify, if not specified then default are used (abuseipdb.report.categories)
## - log.abuseipdb.comment - comment to specify in report, if not specified then default is used (abuseipdb.report.comment)
#log.pattern = ^.+? named\[\s?\d+\]: client %i.+?: query \(cache\) .+? denied
#log.abuseipdb.report = true
#log.abuseipdb.categories = 14,15
#log.abuseipdb.comment = %d Recursive DNS scan