From: "Steven Levine" <ecs-isp@2rosenthals.com>
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=dk12062016; d=earthlink.net;
  b=rRQLVueE9qrXg5mIdTMB4AZlF8esNt0yT9KFEP5gaMTz9XjfG6T0z3ThSsr+D+bYQKfo6w/Bvd7BqjKlE2oh8TstQGCcP6Bxo/cz5mql/HmStPvgYCgnoBw7rOkyap7+L5M3NiuWeZzrXKyb0W09vQoTi33h//QGcGkPdwXj8wBlQR+YHrIz+LmZhi42GFPsZ+Tv1fCvZVHJPF1jT7urrjMxea6Lu4BYzlx+lgyrvDtfCLA4C1jXtNGDWDl7NAG9/w7icJ6AGX/3lNgY2g3I8ZcEsX1oVjrzyU5UVhPMhIbydhFKisP0XY9VEfn0zaOizAtNojFMdFTAd9Wbpyhpxw==;
  h=Received:From:Date:To:In-Reply-To:Subject:X-Mailer:Message-ID:X-ELNK-Trace:X-Originating-IP;
Date: Mon, 19 Apr 2021 07:58:08 -0700
To: "eCS ISP Mailing List" <ecs-isp@2rosenthals.com>
In-Reply-To: <list-1821020@2rosenthals.com>
Subject: Re: [eCS-ISP] unwanted bots
Message-ID: <E1lYWCx-000DO7-Gy@elasmtp-galgo.atl.sa.earthlink.net>

In <list-1821020@2rosenthals.com>, on 04/19/21
   at 11:18 AM, "Massimo S." <ecs-isp@2rosenthals.com> said:

Hi Massimo,

>thanks, but it seems is not working

Why would you expect it to?

Ian, FWIW, Massimo is trying to do URL matching, whic does allow
wildcards.

Massimo, that said, you are trying to match a URL to a User-Agent name
which is almost never going to work.

What you need to do is match on the bot name in the User-Agent header.

I recommend you start with a logging rule so you can see what the packet
actually contains.  Baring typos, you want:

Log-mj12_2-URLs
   Comment = "Log HTTP requests for MJ bot",
   Destination-Port = "80 443",
   Log-Control = Enabled,
   Log-Mask = "date time severity message rule source resolved_source prot
packet_data",
   Log-Severity = Major,
   Hex-String = "<nocase>12bot",
   Depth = 200
   Rule-Action = Log,
   Direction = Incoming

Once you understand the packet you want to match on, you can convert this
into a Deny Rule-Action, tuning the Depth and Log-Mask to optimized the
filter performance.

FWIW, if this were my problem, I would use an observe rule to blacklist
the source.

Massimo, is the really the logged URL:

  /referenze.html/.../referenze.html/

It does not look valid to me.  If you edited it, don't do that in the
future.  I am only willing to try so hard to help you.

Steven

-- 
----------------------------------------------------------------------
"Steven Levine" <steve53@earthlink.net>  Warp/DIY/BlueLion etc.
www.scoug.com www.arcanoae.com www.warpcave.com
----------------------------------------------------------------------