gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
This repository has been archived on 2025-09-14. You can view files and clone it, but cannot push or open issues or pull requests.
Files
9979fc00f5970c866c4cb32f4e5bb1cee1c47317
tango-maat/test/benchmark/regex_rules/REGEX_3K

3001 lines
256 KiB
Plaintext
Raw Normal View History

[PATCH]add regex benchmark
2023-08-03 08:48:12 +00:00
3000
1 1 User-Agent:\s.*.abc.net 2 0 0 1
2 2 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5 2 0 0 1
3 3 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980 2 0 0 1
4 4 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E 2 0 0 1
5 5 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333 2 0 0 1
6 6 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C 2 0 0 1
7 7 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E 2 0 0 1
8 8 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E 2 0 0 1
9 9 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E 2 0 0 1
10 10 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E 2 0 0 1
11 11 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08 2 0 0 1
12 12 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42 2 0 0 1
13 13 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4 2 0 0 1
14 14 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980 2 0 0 1
15 15 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3 2 0 0 1
16 16 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980 2 0 0 1
17 17 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB 2 0 0 1
18 18 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E 2 0 0 1
19 19 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E 2 0 0 1
20 20 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664 2 0 0 1
21 21 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C 2 0 0 1
22 22 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980 2 0 0 1
23 23 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E 2 0 0 1
24 24 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E 2 0 0 1
25 25 (EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters) 2 0 0 1
26 26 (SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter) 2 0 0 1
27 27 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3 2 0 0 1
28 28 (ReadMolFile|SaveasMolFile) 2 0 0 1
29 29 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
30 30 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
31 31 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C 2 0 0 1
32 32 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
33 33 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
34 34 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000 2 0 0 1
35 35 file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt) 2 0 0 1
36 36 [0-9]{3,} 2 0 0 1
37 37 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194 2 0 0 1
38 38 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2 2 0 0 1
39 39 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510 2 0 0 1
40 40 (setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch) 2 0 0 1
41 41 param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20} 2 0 0 1
42 42 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C 2 0 0 1
43 43 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1
44 44 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79 2 0 0 1
45 45 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD 2 0 0 1
46 46 (Text|EditSelText|EditText|CellFontName|Archive) 2 0 0 1
47 47 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C 2 0 0 1
48 48 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c 2 0 0 1
49 49 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B 2 0 0 1
50 50 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA 2 0 0 1
51 51 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted) 2 0 0 1
52 52 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam) 2 0 0 1
53 53 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E 2 0 0 1
54 54 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8 2 0 0 1
55 55 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E 2 0 0 1
56 56 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726 2 0 0 1
57 57 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598 2 0 0 1
58 58 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E 2 0 0 1
59 59 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E 2 0 0 1
60 60 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E 2 0 0 1
61 61 (exe|bat|com|dll|ini) 2 0 0 1
62 62 (exe|bat|com|dll|ini) 2 0 0 1
63 63 (exe|bat|com|dll|ini) 2 0 0 1
64 64 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E 2 0 0 1
65 65 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7 2 0 0 1
66 66 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91 2 0 0 1
67 67 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980 2 0 0 1
68 68 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02 2 0 0 1
69 69 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3 2 0 0 1
70 70 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90 2 0 0 1
71 71 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E 2 0 0 1
72 72 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E 2 0 0 1
73 73 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112 2 0 0 1
74 74 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1 2 0 0 1
75 75 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6 2 0 0 1
76 76 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F 2 0 0 1
77 77 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C 2 0 0 1
78 78 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA 2 0 0 1
79 79 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258 2 0 0 1
80 80 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B 2 0 0 1
81 81 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1 2 0 0 1
82 82 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7 2 0 0 1
83 83 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D 2 0 0 1
84 84 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61 2 0 0 1
85 85 (Src|Background|PackageXml) 2 0 0 1
86 86 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters) 2 0 0 1
87 87 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter) 2 0 0 1
88 88 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1
89 89 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1
90 90 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1
91 91 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755 2 0 0 1
92 92 (Save|SaveLayoutChanges|SaveMenuUsageData) 2 0 0 1
93 93 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61 2 0 0 1
94 94 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3 2 0 0 1
95 95 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D 2 0 0 1
96 96 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D 2 0 0 1
97 97 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9 2 0 0 1
98 98 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0 2 0 0 1
99 99 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3 2 0 0 1
100 100 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679 2 0 0 1
101 101 (SaveFile|ExportToXML) 2 0 0 1
102 102 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE 2 0 0 1
103 103 (SnapShotToFile|SnapShotX) 2 0 0 1
104 104 (SnapShotToFile|SnapShotX) 2 0 0 1
105 105 (SnapShotToFile|SnapShotX) 2 0 0 1
106 106 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E 2 0 0 1
107 107 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28 2 0 0 1
108 108 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003 2 0 0 1
109 109 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
110 110 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
111 111 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
112 112 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
113 113 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE 2 0 0 1
114 114 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB 2 0 0 1
115 115 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile) 2 0 0 1
116 116 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD 2 0 0 1
117 117 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA 2 0 0 1
118 118 (Run|SetRegistryValueAsString|PerformUpdateAsync) 2 0 0 1
119 119 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C 2 0 0 1
120 120 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C 2 0 0 1
121 121 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084 2 0 0 1
122 122 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6 2 0 0 1
123 123 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF 2 0 0 1
124 124 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5 2 0 0 1
125 125 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C 2 0 0 1
126 126 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA 2 0 0 1
127 127 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020 2 0 0 1
128 128 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020 2 0 0 1
129 129 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B 2 0 0 1
130 130 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356 2 0 0 1
131 131 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520 2 0 0 1
132 132 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C 2 0 0 1
133 133 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26 2 0 0 1
134 134 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0 2 0 0 1
135 135 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF 2 0 0 1
136 136 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142 2 0 0 1
137 137 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB 2 0 0 1
138 138 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7 2 0 0 1
139 139 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747 2 0 0 1
140 140 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456 2 0 0 1
141 141 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0 2 0 0 1
142 142 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999 2 0 0 1
143 143 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899 2 0 0 1
144 144 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5 2 0 0 1
145 145 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E 2 0 0 1
146 146 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F 2 0 0 1
147 147 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9 2 0 0 1
148 148 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F 2 0 0 1
149 149 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448 2 0 0 1
150 150 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92 2 0 0 1
151 151 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F 2 0 0 1
152 152 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED 2 0 0 1
153 153 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB 2 0 0 1
154 154 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305 2 0 0 1
155 155 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7 2 0 0 1
156 156 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B 2 0 0 1
157 157 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C 2 0 0 1
158 158 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627 2 0 0 1
159 159 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E 2 0 0 1
160 160 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE 2 0 0 1
161 161 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496 2 0 0 1
162 162 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0 2 0 0 1
163 163 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E 2 0 0 1
164 164 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C 2 0 0 1
165 165 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53 2 0 0 1
166 166 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014 2 0 0 1
167 167 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A 2 0 0 1
168 168 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A 2 0 0 1
169 169 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741 2 0 0 1
170 170 (SaveToBMP|SaveToFile) 2 0 0 1
171 171 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2 2 0 0 1
172 172 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667 2 0 0 1
173 173 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1
174 174 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1
175 175 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E 2 0 0 1
176 176 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D 2 0 0 1
177 177 (SaveBarCode|SaveEnhWMF) 2 0 0 1
178 178 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B 2 0 0 1
179 179 <object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>) 2 0 0 1
180 180 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000 2 0 0 1
181 181 (exe|bat|com|dll|ini) 2 0 0 1
182 182 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E 2 0 0 1
183 183 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E 2 0 0 1
184 184 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87 2 0 0 1
185 185 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
186 186 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
187 187 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
188 188 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
189 189 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
190 190 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E 2 0 0 1
191 191 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344 2 0 0 1
192 192 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C 2 0 0 1
193 193 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30 2 0 0 1
194 194 (Packagefiles|SaveDna|SetIdentity|AddFile) 2 0 0 1
195 195 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9 2 0 0 1
196 196 (_DOWText)|(_MonthText) 2 0 0 1
197 197 (SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour) 2 0 0 1
198 198 classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE 2 0 0 1
199 199 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004 2 0 0 1
200 200 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004 2 0 0 1
201 201 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F 2 0 0 1
202 202 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5 2 0 0 1
203 203 [\w\W]{2500,} 2 0 0 1
204 204 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3 2 0 0 1
205 205 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8 2 0 0 1
206 206 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04 2 0 0 1
207 207 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue) 2 0 0 1
208 208 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356 2 0 0 1
209 209 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E 2 0 0 1
210 210 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574 2 0 0 1
211 211 (WriteIniFileString|ShellExecute) 2 0 0 1
212 212 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906 2 0 0 1
213 213 (txt|ini|com|exe|bat|dll|dat) 2 0 0 1
214 214 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8 2 0 0 1
215 215 42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733 2 0 0 1
216 216 (Save|ExportImage) 2 0 0 1
217 217 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790 2 0 0 1
218 218 (DeleteFile|write) 2 0 0 1
219 219 (SaveAsBMP|SaveAsWMF) 2 0 0 1
220 220 (SaveAsBMP|SaveAsWMF) 2 0 0 1
221 221 (SaveAsBMP|SaveAsWMF) 2 0 0 1
222 222 (SaveAsBMP|SaveAsWMF) 2 0 0 1
223 223 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967 2 0 0 1
224 224 WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext) 2 0 0 1
225 225 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9 2 0 0 1
226 226 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5 2 0 0 1
227 227 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6 2 0 0 1
228 228 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1
229 229 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9 2 0 0 1
230 230 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24 2 0 0 1
231 231 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9 2 0 0 1
232 232 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA 2 0 0 1
233 233 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec) 2 0 0 1
234 234 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5 2 0 0 1
235 235 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1
236 236 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1
237 237 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1
238 238 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83 2 0 0 1
239 239 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA 2 0 0 1
240 240 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566 2 0 0 1
241 241 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000 2 0 0 1
242 242 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000 2 0 0 1
243 243 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B 2 0 0 1
244 244 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F 2 0 0 1
245 245 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289 2 0 0 1
246 246 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289 2 0 0 1
247 247 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED 2 0 0 1
248 248 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619 2 0 0 1
249 249 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E 2 0 0 1
250 250 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258 2 0 0 1
251 251 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196 2 0 0 1
252 252 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E 2 0 0 1
253 253 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD 2 0 0 1
254 254 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4 2 0 0 1
255 255 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118 2 0 0 1
256 256 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616 2 0 0 1
257 257 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1
258 258 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1
259 259 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1
260 260 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11 2 0 0 1
261 261 (ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1 2 0 0 1
262 262 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020 2 0 0 1
263 263 (PostURL|AddSeperator|AddString|Post) 2 0 0 1
264 264 (SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF) 2 0 0 1
265 265 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>) 2 0 0 1
266 266 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\> 2 0 0 1
267 267 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\> 2 0 0 1
268 268 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\> 2 0 0 1
269 269 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\> 2 0 0 1
270 270 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
271 271 (Buildpath|GetDriveName|DriveExists|DeleteFile) 2 0 0 1
272 272 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
273 273 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
274 274 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
275 275 <object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>) 2 0 0 1
276 276 \x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission] 2 0 0 1
277 277 <object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\> 2 0 0 1
278 278 000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F 2 0 0 1
279 279 (javascript|http|ftp|vbscript) 2 0 0 1
280 280 (SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen) 2 0 0 1
281 281 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000 2 0 0 1
282 282 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407 2 0 0 1
283 283 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414 2 0 0 1
284 284 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1
285 285 (AddAttachment|SubmitToExpress) 2 0 0 1
286 286 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6 2 0 0 1
287 287 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0 2 0 0 1
288 288 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D 2 0 0 1
289 289 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile) 2 0 0 1
290 290 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\> 2 0 0 1
291 291 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\> 2 0 0 1
292 292 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC 2 0 0 1
293 293 src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape 2 0 0 1
294 294 (LogFile|ClearLogFile|SaveToFile) 2 0 0 1
295 295 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext) 2 0 0 1
296 296 ^User-Agent\x3a Downloader \d\.\d\r?$/Hm 2 0 0 1
297 297 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P 2 0 0 1
298 298 ^((\r?\n\r?\n).)*?\r?\n\r?\nMZ 2 0 0 1
299 299 instructions\/\d{2}\.xml 2 0 0 1
300 300 (GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp 2 0 0 1
301 301 \/updatestats\/update\d+?\.xml$ 2 0 0 1
302 302 (GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab 2 0 0 1
303 303 ctxad-\d+\.sig 2 0 0 1
304 304 /user\d+/counter\.htm 2 0 0 1
305 305 (cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr 2 0 0 1
306 306 (discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe 2 0 0 1
307 307 loaderadv\d+\.jar 2 0 0 1
308 308 \/adv\/\d+\/win32\.exe 2 0 0 1
309 309 \/Message\/\S+\/\S+\.xml 2 0 0 1
310 310 \/abt\?data=\S{150} 2 0 0 1
311 311 ^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi 2 0 0 1
312 312 User-Agent\:[^\n]+wbi_v\d/iH 2 0 0 1
313 313 User-Agent\x3a[^\n]+AskBar/iH 2 0 0 1
314 314 \/tbrequest\d+\.php 2 0 0 1
315 315 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
316 316 sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
317 317 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
318 318 cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
319 319 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
320 320 UID=\d 2 0 0 1
321 321 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
322 322 REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P 2 0 0 1
323 323 victim\.php\?\d\d\d\d\d 2 0 0 1
324 324 \/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d 2 0 0 1
325 325 \/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+ 2 0 0 1
326 326 &ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d 2 0 0 1
327 327 \/sd\?s=\d+&f=\d&C=\d 2 0 0 1
328 328 \.txt$ 2 0 0 1
329 329 \.cfg$ 2 0 0 1
330 330 User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H 2 0 0 1
331 331 ^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi 2 0 0 1
332 332 \x00[\x02-\x1E][0-9]{2,30}\x02cn\x00 2 0 0 1
333 333 \x00[\x02-\x1E][0-9]{2,30}\x02ru\x00 2 0 0 1
334 334 ^[A-F0-9]+$ 2 0 0 1
335 335 \/sd\?s=\d+&f=\d 2 0 0 1
336 336 loadadv\d+\.exe 2 0 0 1
337 337 \/ms\d\d\dcfg\.jsp 2 0 0 1
338 338 ^0x[0-9a-f]+$ 2 0 0 1
339 339 ^[^a-z]*?[0-9]{2,30}\.ru$ 2 0 0 1
340 340 filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe 2 0 0 1
341 341 ^MM \d\.\d+$ 2 0 0 1
342 342 ^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4} 2 0 0 1
343 343 ^\w+pcsetup_\w+ 2 0 0 1
344 344 \x2Fv[0-9]{3,4}[\x2F\x3F] 2 0 0 1
345 345 [a-f0-9]{32}\?v= 2 0 0 1
346 346 ^\/[a-z]{2}\x3Fv\x3D[0-9]$ 2 0 0 1
347 347 ^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$ 2 0 0 1
348 348 ^\/entrance\?s1=[a-f0-9]{100,}$ 2 0 0 1
349 349 ^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report= 2 0 0 1
350 350 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
351 351 ^[0-9][a-z]+ 2 0 0 1
352 352 \.php$ 2 0 0 1
353 353 ^\/([^\x2f]+\/)*log\/\?[bc]= 2 0 0 1
354 354 ^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/)) 2 0 0 1
355 355 ^\/\?pcrc=\d+&v=[\d.]+$ 2 0 0 1
356 356 ^\/\?v=[\d.]+&pcrc=\d+$ 2 0 0 1
357 357 \/v\d\/[^.]+\.asp$ 2 0 0 1
358 358 \/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$ 2 0 0 1
359 359 \/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$ 2 0 0 1
360 360 ^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$ 2 0 0 1
361 361 ^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$ 2 0 0 1
362 362 \?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4}) 2 0 0 1
363 363 ^Downloader\s\d+\.\d+$ 2 0 0 1
364 364 ^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100} 2 0 0 1
365 365 \/get_xml\?(file_id|stb)= 2 0 0 1
366 366 (_[a-z]{2}){1,3}_[a-z]{3}_install\.exe 2 0 0 1
367 367 \d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows 2 0 0 1
368 368 ^[a-zA-Z0-9_-]+$ 2 0 0 1
369 369 ^\/([a-zA-Z0-9]|%2[fb]){400,}$ 2 0 0 1
370 370 User-Agent\:[^\n]+searchengine 2 0 0 1
371 371 User-Agent\:[^\n]+SurferPlugin 2 0 0 1
372 372 User-Agent\:[^\n]+THNALL[^\n]+\.EXE 2 0 0 1
373 373 User-Agent\:[^\n]+XupiterToolbar 2 0 0 1
374 374 User-Agent\:[^\n]+spywareaxe 2 0 0 1
375 375 User-Agent\:[^\n]+iMeshBar 2 0 0 1
376 376 User-Agent\:[^\n]+Oemji 2 0 0 1
377 377 ^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$ 2 0 0 1
378 378 ^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$ 2 0 0 1
379 379 ^\/(get|install)\/\?q= 2 0 0 1
380 380 ^\/[a-f0-9]{50,}$ 2 0 0 1
381 381 ^\/[\w-]{50,}$ 2 0 0 1
382 382 ^\/\?pcrc=[0-9]{7,10}$ 2 0 0 1
383 383 ^Downloader \d\.\d$ 2 0 0 1
384 384 \/Socks[45]\.txt$ 2 0 0 1
385 385 ^Feat[^\r\n]+(Install|Updat)er 2 0 0 1
386 386 User-Agent\:[^\n]+host(ie|oe|oi|ol) 2 0 0 1
387 387 User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2} 2 0 0 1
388 388 ^BWL(\sToplist|\d_UPDATE) 2 0 0 1
389 389 ^\x2F[A-F0-9]{25,40}$ 2 0 0 1
390 390 ^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$ 2 0 0 1
391 391 ^\d+\sHTTP/1.1$ 2 0 0 1
392 392 ^[a-zA-Z0-9_-]+ 2 0 0 1
393 393 [a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12} 2 0 0 1
394 394 \/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id= 2 0 0 1
395 395 \{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\} 2 0 0 1
396 396 CN=([^\r\n]+?\.)?showmypc\.com(\.) 2 0 0 1
397 397 ^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$ 2 0 0 1
398 398 (SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk) 2 0 0 1
399 399 (DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog) 2 0 0 1
400 400 \d{13}$ 2 0 0 1
401 401 ^[a-f0-9]{32} 2 0 0 1
402 402 ^[a-f0-9]{32}\" 2 0 0 1
403 403 ^([A-F0-9]{2}\:){5}[A-F0-9]{2} 2 0 0 1
404 404 ^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12} 2 0 0 1
405 405 ^([A-F0-9]{2}\:){5}[A-F0-9]{2} 2 0 0 1
406 406 ^[A-F0-9]{12} 2 0 0 1
407 407 ^[A-Z0-9]{9} 2 0 0 1
408 408 ^\d+[^\r\n\s]+ 2 0 0 1
409 409 ^ SQL[-_ ]Server 2 0 0 1
410 410 ^ \d+ Driver 2 0 0 1
411 411 ORA-\d{4} 2 0 0 1
412 412 Warning.*\Woci_ 2 0 0 1
413 413 Warning.*\Wora_ 2 0 0 1
414 414 CLI Driver.*DB2 2 0 0 1
415 415 bdb2_\w+\( 2 0 0 1
416 416 Exception.*Informix 2 0 0 1
417 417 Warning.*SQLite3:: 2 0 0 1
418 418 SQL error.*POS\([0-9]+\) 2 0 0 1
419 419 Warning.*maxdb 2 0 0 1
420 420 i?Warning.*sybase 2 0 0 1
421 421 Warning.*ingres_ 2 0 0 1
422 422 Warning.*sqlite_ 2 0 0 1
423 423 Ingres\W.*Driver 2 0 0 1
424 424 Exception (condition )\d+\. Transaction rollback\. 2 0 0 1
425 425 SQL Server.*?error \x27[0-9a-f]{8} 2 0 0 1
426 426 ^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$ 2 0 0 1
427 427 ^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll 2 0 0 1
428 428 ^...\x30\x82..\x02\x82...{256,257} 2 0 0 1
429 429 \/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php 2 0 0 1
430 430 \/notify\/(single|mass)$ 2 0 0 1
431 431 a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php) 2 0 0 1
432 432 Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a 2 0 0 1
433 433 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
434 434 [-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10} 2 0 0 1
435 435 ^\d+(\+|\-|\\|\*)\d+ 2 0 0 1
436 436 ^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9 2 0 0 1
437 437 ^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u 2 0 0 1
438 438 ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b 2 0 0 1
439 439 ^\d{4}[01] 2 0 0 1
440 440 ^\d{4}[01] 2 0 0 1
441 441 ^\d{4}[01] 2 0 0 1
442 442 ^\d{4}[01] 2 0 0 1
443 443 ^\d{4}[01] 2 0 0 1
444 444 ^\d{4}[01] 2 0 0 1
445 445 ^\d{4}[01] 2 0 0 1
446 446 ^\d{4}[01] 2 0 0 1
447 447 ^\d{4}[01] 2 0 0 1
448 448 ^\d{4}[01] 2 0 0 1
449 449 ^\d{4}[01] 2 0 0 1
450 450 ^\d{4}[01] 2 0 0 1
451 451 ^\d{4}[01] 2 0 0 1
452 452 ^\d{4}[01] 2 0 0 1
453 453 ^\d{4}[01] 2 0 0 1
454 454 ^\d{4}[01] 2 0 0 1
455 455 ^\d{4}[01] 2 0 0 1
456 456 ^\d{4}[01] 2 0 0 1
457 457 ^\d{4}[01] 2 0 0 1
458 458 ^\d{4}[01] 2 0 0 1
459 459 ^\d{4}[01] 2 0 0 1
460 460 ^\d{4}[01] 2 0 0 1
461 461 ^\d{4}[01] 2 0 0 1
462 462 ^\d{4}[01] 2 0 0 1
463 463 ^\d{4}[01] 2 0 0 1
464 464 ^\d{4}[01] 2 0 0 1
465 465 ^\d{4}[01] 2 0 0 1
466 466 ^\d{4}[01] 2 0 0 1
467 467 ^\d{4}[01] 2 0 0 1
468 468 ^\d{4}[01] 2 0 0 1
469 469 ^\d{4}[01] 2 0 0 1
470 470 ^\d{4}[01] 2 0 0 1
471 471 ^\d{4}[01] 2 0 0 1
472 472 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
473 473 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
474 474 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
475 475 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
476 476 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
477 477 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
478 478 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
479 479 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
480 480 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
481 481 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
482 482 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
483 483 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
484 484 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
485 485 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
486 486 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
487 487 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
488 488 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
489 489 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
490 490 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
491 491 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
492 492 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
493 493 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
494 494 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
495 495 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
496 496 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
497 497 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
498 498 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
499 499 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
500 500 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
501 501 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
502 502 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
503 503 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
504 504 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
505 505 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
506 506 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
507 507 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
508 508 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
509 509 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
510 510 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
511 511 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
512 512 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
513 513 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
514 514 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
515 515 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
516 516 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
517 517 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
518 518 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
519 519 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
520 520 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
521 521 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
522 522 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
523 523 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
524 524 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
525 525 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
526 526 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
527 527 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
528 528 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
529 529 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
530 530 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
531 531 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
532 532 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
533 533 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
534 534 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
535 535 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
536 536 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
537 537 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
538 538 ^\d{4}[01] 2 0 0 1
539 539 ^\d{4}[01] 2 0 0 1
540 540 ^\d{4}[01] 2 0 0 1
541 541 ^\d{4}[01] 2 0 0 1
542 542 ^\d{4}[01] 2 0 0 1
543 543 ^\d{4}[01] 2 0 0 1
544 544 ^\d{4}[01] 2 0 0 1
545 545 ^\d{4}[01] 2 0 0 1
546 546 ^\d{4}[01] 2 0 0 1
547 547 ^\d{4}[01] 2 0 0 1
548 548 ^\d{4}[01] 2 0 0 1
549 549 ^\d{4}[01] 2 0 0 1
550 550 ^\d{4}[01] 2 0 0 1
551 551 ^\d{4}[01] 2 0 0 1
552 552 ^\d{4}[01] 2 0 0 1
553 553 ^\d{4}[01] 2 0 0 1
554 554 ^\d{4}[01] 2 0 0 1
555 555 ^\d{4}[01] 2 0 0 1
556 556 ^\d{4}[01] 2 0 0 1
557 557 ^\d{4}[01] 2 0 0 1
558 558 ^\d{4}[01] 2 0 0 1
559 559 ^\d{4}[01] 2 0 0 1
560 560 ^\d{4}[01] 2 0 0 1
561 561 ^\d{4}[01] 2 0 0 1
562 562 ^\d{4}[01] 2 0 0 1
563 563 ^\d{4}[01] 2 0 0 1
564 564 ^\d{4}[01] 2 0 0 1
565 565 ^\d{4}[01] 2 0 0 1
566 566 ^\d{4}[01] 2 0 0 1
567 567 ^\d{4}[01] 2 0 0 1
568 568 ^\d{4}[01] 2 0 0 1
569 569 ^\d{4}[01] 2 0 0 1
570 570 ^\d{4}[01] 2 0 0 1
571 571 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
572 572 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
573 573 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
574 574 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
575 575 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
576 576 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
577 577 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
578 578 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
579 579 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
580 580 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
581 581 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
582 582 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
583 583 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
584 584 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
585 585 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
586 586 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
587 587 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
588 588 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
589 589 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
590 590 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
591 591 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
592 592 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
593 593 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
594 594 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
595 595 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
596 596 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
597 597 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
598 598 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
599 599 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
600 600 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
601 601 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
602 602 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
603 603 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
604 604 ^\d{4}[01] 2 0 0 1
605 605 ^\d{4}[01] 2 0 0 1
606 606 ^\d{4}[01] 2 0 0 1
607 607 ^\d{4}[01] 2 0 0 1
608 608 ^\d{4}[01] 2 0 0 1
609 609 ^\d{4}[01] 2 0 0 1
610 610 ^\d{4}[01] 2 0 0 1
611 611 ^\d{4}[01] 2 0 0 1
612 612 ^\d{4}[01] 2 0 0 1
613 613 ^\d{4}[01] 2 0 0 1
614 614 ^\d{4}[01] 2 0 0 1
615 615 ^\d{4}[01] 2 0 0 1
616 616 ^\d{4}[01] 2 0 0 1
617 617 ^\d{4}[01] 2 0 0 1
618 618 ^\d{4}[01] 2 0 0 1
619 619 ^\d{4}[01] 2 0 0 1
620 620 ^\d{4}[01] 2 0 0 1
621 621 ^\d{4}[01] 2 0 0 1
622 622 ^\d{4}[01] 2 0 0 1
623 623 ^\d{4}[01] 2 0 0 1
624 624 ^\d{4}[01] 2 0 0 1
625 625 ^\d{4}[01] 2 0 0 1
626 626 ^\d{4}[01] 2 0 0 1
627 627 ^\d{4}[01] 2 0 0 1
628 628 ^\d{4}[01] 2 0 0 1
629 629 ^\d{4}[01] 2 0 0 1
630 630 ^\d{4}[01] 2 0 0 1
631 631 ^\d{4}[01] 2 0 0 1
632 632 ^\d{4}[01] 2 0 0 1
633 633 ^\d{4}[01] 2 0 0 1
634 634 ^\d{4}[01] 2 0 0 1
635 635 ^\d{4}[01] 2 0 0 1
636 636 ^\d{4}[01] 2 0 0 1
637 637 ^\d{4}[01] 2 0 0 1
638 638 ^\d{4}[01] 2 0 0 1
639 639 ^\d{4}[01] 2 0 0 1
640 640 ^\d{4}[01] 2 0 0 1
641 641 ^\d{4}[01] 2 0 0 1
642 642 ^\d{4}[01] 2 0 0 1
643 643 ^\d{4}[01] 2 0 0 1
644 644 ^\d{4}[01] 2 0 0 1
645 645 ^\d{4}[01] 2 0 0 1
646 646 ^\d{4}[01] 2 0 0 1
647 647 ^\d{4}[01] 2 0 0 1
648 648 ^\d{4}[01] 2 0 0 1
649 649 ^\d{4}[01] 2 0 0 1
650 650 ^\d{4}[01] 2 0 0 1
651 651 ^\d{4}[01] 2 0 0 1
652 652 ^\d{4}[01] 2 0 0 1
653 653 ^\d{4}[01] 2 0 0 1
654 654 ^\d{4}[01] 2 0 0 1
655 655 ^\d{4}[01] 2 0 0 1
656 656 ^\d{4}[01] 2 0 0 1
657 657 ^\d{4}[01] 2 0 0 1
658 658 ^\d{4}[01] 2 0 0 1
659 659 ^\d{4}[01] 2 0 0 1
660 660 ^\d{4}[01] 2 0 0 1
661 661 ^\d{4}[01] 2 0 0 1
662 662 ^\d{4}[01] 2 0 0 1
663 663 ^\d{4}[01] 2 0 0 1
664 664 ^\d{4}[01] 2 0 0 1
665 665 ^\d{4}[01] 2 0 0 1
666 666 ^\d{4}[01] 2 0 0 1
667 667 ^\d{4}[01] 2 0 0 1
668 668 ^\d{4}[01] 2 0 0 1
669 669 ^\d{4}[01] 2 0 0 1
670 670 ^\d{4}[01] 2 0 0 1
671 671 ^\d{4}[01] 2 0 0 1
672 672 ^\d{4}[01] 2 0 0 1
673 673 ^\d{4}[01] 2 0 0 1
674 674 ^\d{4}[01] 2 0 0 1
675 675 ^\d{4}[01] 2 0 0 1
676 676 ^\d{4}[01] 2 0 0 1
677 677 ^\d{4}[01] 2 0 0 1
678 678 ^\d{4}[01] 2 0 0 1
679 679 ^\d{4}[01] 2 0 0 1
680 680 ^\d{4}[01] 2 0 0 1
681 681 ^\d{4}[01] 2 0 0 1
682 682 ^\d{4}[01] 2 0 0 1
683 683 ^\d{4}[01] 2 0 0 1
684 684 ^\d{4}[01] 2 0 0 1
685 685 ^\d{4}[01] 2 0 0 1
686 686 ^\d{4}[01] 2 0 0 1
687 687 ^\d{4}[01] 2 0 0 1
688 688 ^\d{4}[01] 2 0 0 1
689 689 ^\d{4}[01] 2 0 0 1
690 690 ^\d{4}[01] 2 0 0 1
691 691 ^\d{4}[01] 2 0 0 1
692 692 ^\d{4}[01] 2 0 0 1
693 693 ^\d{4}[01] 2 0 0 1
694 694 ^\d{4}[01] 2 0 0 1
695 695 ^\d{4}[01] 2 0 0 1
696 696 ^\d{4}[01] 2 0 0 1
697 697 ^\d{4}[01] 2 0 0 1
698 698 ^\d{4}[01] 2 0 0 1
699 699 ^\d{4}[01] 2 0 0 1
700 700 ^\d{4}[01] 2 0 0 1
701 701 ^\d{4}[01] 2 0 0 1
702 702 ^\d{4}[01] 2 0 0 1
703 703 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
704 704 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
705 705 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
706 706 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
707 707 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
708 708 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
709 709 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
710 710 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
711 711 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
712 712 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
713 713 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
714 714 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
715 715 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
716 716 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
717 717 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
718 718 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
719 719 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
720 720 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
721 721 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
722 722 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
723 723 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
724 724 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
725 725 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
726 726 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
727 727 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
728 728 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
729 729 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
730 730 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
731 731 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
732 732 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
733 733 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
734 734 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
735 735 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
736 736 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
737 737 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
738 738 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
739 739 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
740 740 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
741 741 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
742 742 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
743 743 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
744 744 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
745 745 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
746 746 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
747 747 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
748 748 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
749 749 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
750 750 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
751 751 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
752 752 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
753 753 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
754 754 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
755 755 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
756 756 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
757 757 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
758 758 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
759 759 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
760 760 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
761 761 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
762 762 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
763 763 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
764 764 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
765 765 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
766 766 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
767 767 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
768 768 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
769 769 ^\d{4}[01] 2 0 0 1
770 770 ^\d{4}[01] 2 0 0 1
771 771 ^\d{4}[01] 2 0 0 1
772 772 ^\d{4}[01] 2 0 0 1
773 773 ^\d{4}[01] 2 0 0 1
774 774 ^\d{4}[01] 2 0 0 1
775 775 ^\d{4}[01] 2 0 0 1
776 776 ^\d{4}[01] 2 0 0 1
777 777 ^\d{4}[01] 2 0 0 1
778 778 ^\d{4}[01] 2 0 0 1
779 779 ^\d{4}[01] 2 0 0 1
780 780 ^\d{4}[01] 2 0 0 1
781 781 ^\d{4}[01] 2 0 0 1
782 782 ^\d{4}[01] 2 0 0 1
783 783 ^\d{4}[01] 2 0 0 1
784 784 ^\d{4}[01] 2 0 0 1
785 785 ^\d{4}[01] 2 0 0 1
786 786 ^\d{4}[01] 2 0 0 1
787 787 ^\d{4}[01] 2 0 0 1
788 788 ^\d{4}[01] 2 0 0 1
789 789 ^\d{4}[01] 2 0 0 1
790 790 ^\d{4}[01] 2 0 0 1
791 791 ^\d{4}[01] 2 0 0 1
792 792 ^\d{4}[01] 2 0 0 1
793 793 ^\d{4}[01] 2 0 0 1
794 794 ^\d{4}[01] 2 0 0 1
795 795 ^\d{4}[01] 2 0 0 1
796 796 ^\d{4}[01] 2 0 0 1
797 797 ^\d{4}[01] 2 0 0 1
798 798 ^\d{4}[01] 2 0 0 1
799 799 ^\d{4}[01] 2 0 0 1
800 800 ^\d{4}[01] 2 0 0 1
801 801 ^\d{4}[01] 2 0 0 1
802 802 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
803 803 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
804 804 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
805 805 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
806 806 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
807 807 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
808 808 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
809 809 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
810 810 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
811 811 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
812 812 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
813 813 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
814 814 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
815 815 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
816 816 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
817 817 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
818 818 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
819 819 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
820 820 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
821 821 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
822 822 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
823 823 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
824 824 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
825 825 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
826 826 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
827 827 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
828 828 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
829 829 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
830 830 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
831 831 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
832 832 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
833 833 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
834 834 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
835 835 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
836 836 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
837 837 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
838 838 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
839 839 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
840 840 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
841 841 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
842 842 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
843 843 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
844 844 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
845 845 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
846 846 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
847 847 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
848 848 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
849 849 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
850 850 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
851 851 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
852 852 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
853 853 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
854 854 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
855 855 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
856 856 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
857 857 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
858 858 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
859 859 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
860 860 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
861 861 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
862 862 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
863 863 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
864 864 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
865 865 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
866 866 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
867 867 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
868 868 ^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22 2 0 0 1
869 869 ^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22 2 0 0 1
870 870 \x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,} 2 0 0 1
871 871 ^\x3c(REQIMG|RVWCFG)\x3e 2 0 0 1
872 872 appid\x3a\s+2 2 0 0 1
873 873 ^\x3c(REQIMG|RVWCFG)\x3e 2 0 0 1
874 874 \x22mining\x2E(subscribe|authorize)\x22 2 0 0 1
875 875 ^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start 2 0 0 1
876 876 ^\/api\/(bit|lite)coin\/balance\/ 2 0 0 1
877 877 miner[^a-z] 2 0 0 1
878 878 (\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22) 2 0 0 1
879 879 (\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22) 2 0 0 1
880 880 ([0-9]{1,3}\.){3}[0-9]{1,3} 2 0 0 1
881 881 \/tmp\/[^\/]+\.swf$ 2 0 0 1
882 882 name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22 2 0 0 1
883 883 name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22 2 0 0 1
884 884 =[0-9a-f]{8}\.jar/H 2 0 0 1
885 885 ^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\? 2 0 0 1
886 886 ^\/[a-z0-9]{32}\?s=1$ 2 0 0 1
887 887 ^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s]))) 2 0 0 1
888 888 ^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>] 2 0 0 1
889 889 ^(mous)?\.class 2 0 0 1
890 890 \/chrome\/google_chrome_(update|installer)\.exe$ 2 0 0 1
891 891 ^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f) 2 0 0 1
892 892 ^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P 2 0 0 1
893 893 findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$ 2 0 0 1
894 894 ^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m 2 0 0 1
895 895 \.php\?cashe=\d+$ 2 0 0 1
896 896 \.jar\?m=[1-2]$ 2 0 0 1
897 897 \.pdf\?p=1&s=[1-2]$ 2 0 0 1
898 898 ^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi 2 0 0 1
899 899 ^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$ 2 0 0 1
900 900 \/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$ 2 0 0 1
901 901 \/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$ 2 0 0 1
902 902 \/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$ 2 0 0 1
903 903 \/tds\/[a-f0-9]{32}$ 2 0 0 1
904 904 ^[a-f0-9]{32}[\x22\x27] 2 0 0 1
905 905 Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi 2 0 0 1
906 906 (\.\.\/)+kboxwww\/tmp\/ 2 0 0 1
907 907 ^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22 2 0 0 1
908 908 ^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs 2 0 0 1
909 909 ^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs 2 0 0 1
910 910 \/\?[0-9a-f]{60,66}[\;\d\x2c]*$ 2 0 0 1
911 911 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15} 2 0 0 1
912 912 \/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php 2 0 0 1
913 913 debugenableplugins=[a-zA-Z0-9]+?\x3b 2 0 0 1
914 914 ^\/[a-z0-9]+\/load\.php$ 2 0 0 1
915 915 ^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H 2 0 0 1
916 916 ^\/xteas\/code$ 2 0 0 1
917 917 \/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash= 2 0 0 1
918 918 =\w{8}\.pdf/Hi 2 0 0 1
919 919 ^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$ 2 0 0 1
920 920 ^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H 2 0 0 1
921 921 ^Host\x3a\s.+\.in\r?$/Hmi 2 0 0 1
922 922 name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22 2 0 0 1
923 923 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$ 2 0 0 1
924 924 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$ 2 0 0 1
925 925 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$ 2 0 0 1
926 926 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$ 2 0 0 1
927 927 ^Location\x3a\x20[a-f0-9]{32}\/e\.html\r$/Hm 2 0 0 1
928 928 ^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket)) 2 0 0 1
929 929 ^(\/updates|\/license\/eula|\/docs\/office|\/software-activation) 2 0 0 1
930 930 ^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google)) 2 0 0 1
931 931 ^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b 2 0 0 1
932 932 ^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2) 2 0 0 1
933 933 \/api\/v1\/user\/(512|124)\/avatar 2 0 0 1
934 934 ^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01] 2 0 0 1
935 935 ^\/v1\/(queue|profile|docs\/wsdl|pull) 2 0 0 1
936 936 ^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/) 2 0 0 1
937 937 ^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check) 2 0 0 1
938 938 ^[^\n]*[\x00-\x08\x0e-\x1f] 2 0 0 1
939 939 (TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
940 940 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
941 941 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
942 942 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
943 943 (TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
944 944 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR)) 2 0 0 1
945 945 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
946 946 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
947 947 (TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
948 948 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
949 949 (TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
950 950 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
951 951 (TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
952 952 (TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
953 953 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
954 954 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
955 955 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
956 956 (TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
957 957 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
958 958 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
959 959 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
960 960 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
961 961 (TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
962 962 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
963 963 (TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
964 964 (TOP|//)\Wsecret[^\w/a] 2 0 0 1
965 965 \[\[\d{1,3}\,\[\\\"\w\\\"\,\\\".+@gmail.com.+\\\"\,\\\" 2 0 0 1
966 966 User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER 2 0 0 1
967 967 \x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20) 2 0 0 1
968 968 PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20) 2 0 0 1
969 969 \x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A 2 0 0 1
970 970 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000 2 0 0 1
971 971 filename\s*=\s*"WU_Details_.....\.zip 2 0 0 1
972 972 filename\s*=\s*MySpace_document_[0-9]{5}\.zip 2 0 0 1
973 973 filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22 2 0 0 1
974 974 filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22 2 0 0 1
975 975 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E 2 0 0 1
976 976 MyValue=[a-f0-9]{32} 2 0 0 1
977 977 \x0d\x0aUser-Agent\: 0\:0\:[^\n]{120} 2 0 0 1
978 978 User-Agent\: 0\:0\:[^\x0a|\x0d]{128} 2 0 0 1
979 979 01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20 2 0 0 1
980 980 (\.\.\/){1,} 2 0 0 1
981 981 \/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172} 2 0 0 1
982 982 03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C 2 0 0 1
983 983 4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B 2 0 0 1
984 984 php\?r=\d+&p= 2 0 0 1
985 985 \/socks\.php\?name=[^&]+&port=\d{1,5}$ 2 0 0 1
986 986 SELECT.+FROM 2 0 0 1
987 987 UNION\s+SELECT 2 0 0 1
988 988 INSERT.+INTO 2 0 0 1
989 989 DELETE.+FROM 2 0 0 1
990 990 ASCII\(.+SELECT 2 0 0 1
991 991 UPDATE.+SET 2 0 0 1
992 992 EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5 2 0 0 1
993 993 BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5 2 0 0 1
994 994 6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41 2 0 0 1
995 995 index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3) 2 0 0 1
996 996 (file=\|.+\|) 2 0 0 1
997 997 SELECT.+FROM 2 0 0 1
998 998 UNION\s+SELECT 2 0 0 1
999 999 INSERT.+INTO 2 0 0 1
1000 1000 DELETE.+FROM 2 0 0 1
1001 1001 ASCII\(.+SELECT 2 0 0 1
1002 1002 UPDATE.+SET 2 0 0 1
1003 1003 SELECT.+FROM 2 0 0 1
1004 1004 UNION\s+SELECT 2 0 0 1
1005 1005 INSERT.+INTO 2 0 0 1
1006 1006 DELETE.+FROM 2 0 0 1
1007 1007 ASCII\(.+SELECT 2 0 0 1
1008 1008 UPDATE.+SET 2 0 0 1
1009 1009 SELECT.+FROM 2 0 0 1
1010 1010 UNION\s+SELECT 2 0 0 1
1011 1011 INSERT.+INTO 2 0 0 1
1012 1012 DELETE.+FROM 2 0 0 1
1013 1013 ASCII\(.+SELECT 2 0 0 1
1014 1014 UPDATE.+SET 2 0 0 1
1015 1015 (TOP|//)\Wsecret[^\w/a] 2 0 0 1
1016 1016 filename=\x22Facebook_(Password|Support|Document)_[A-Z0-9]{4,7}\.zip\x22 2 0 0 1
1017 1017 \x2FU3D\x2FLength\x20172[0-5][0-9]{2} 2 0 0 1
1018 1018 \/000[a-z][0-9]{3}\x2Eso 2 0 0 1
1019 1019 \/000[a-z][0-9]{3}\x2Eexe 2 0 0 1
1020 1020 UPDATE.+SET 2 0 0 1
1021 1021 PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F] 2 0 0 1
1022 1022 ^FOLD\s[^\n]{256} 2 0 0 1
1023 1023 ^FOLD\s+\/ 2 0 0 1
1024 1024 ^Username\:[^\n]{100} 2 0 0 1
1025 1025 ^http\x3a\x2f\x2f[^\n]{400} 2 0 0 1
1026 1026 ^http\x3a\x2f\x2f[^\n]{400} 2 0 0 1
1027 1027 ^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\} 2 0 0 1
1028 1028 ^file\x3a\x2f\x2f[^\n]{400} 2 0 0 1
1029 1029 \x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65) 2 0 0 1
1030 1030 OS 4_[0-3]_[1-4] like/H 2 0 0 1
1031 1031 [a-f0-9]{16}$ 2 0 0 1
1032 1032 mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1
1033 1033 (/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration) 2 0 0 1
1034 1034 \x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02 2 0 0 1
1035 1035 \x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02 2 0 0 1
1036 1036 NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A 2 0 0 1
1037 1037 \x3a.4\x7c.12.\x3a.4 2 0 0 1
1038 1038 (cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta) 2 0 0 1
1039 1039 keepalive([0-9]{4}|\x7c[0-9]{4}) 2 0 0 1
1040 1040 User-Agent\x3a[^\n]+sbu-hb- 2 0 0 1
1041 1041 User-Agent\:[^\n]+Peer Points/iH 2 0 0 1
1042 1042 User-Agent\:[^\n]+zbu-hb-/Hi 2 0 0 1
1043 1043 User-Agent\:[^\n]+HSN/iH 2 0 0 1
1044 1044 User-Agent\:[^\n]+Wildtangent/iH 2 0 0 1
1045 1045 ^RMD\s+\x2f$ 2 0 0 1
1046 1046 User-Agent\x3A[^\n]+TheWorld/H 2 0 0 1
1047 1047 ^Max-dotdot[\s\r\n]*\d{3,} 2 0 0 1
1048 1048 ^Authorization\x3a Basic\s+= 2 0 0 1
1049 1049 ^Authorization\x3a Basic\s+= 2 0 0 1
1050 1050 Host\x3a\s[a-z]{16}\.ru/H 2 0 0 1
1051 1051 CREATE.+ENDPOINT 2 0 0 1
1052 1052 \/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir= 2 0 0 1
1053 1053 MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w 2 0 0 1
1054 1054 MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w 2 0 0 1
1055 1055 \x00[0-9]{4,7}\x02co\x00 2 0 0 1
1056 1056 \x2fsogou(config)?\x2f 2 0 0 1
1057 1057 \/\d{8,}\/\d{4,}\/\d{4,}\.jsp 2 0 0 1
1058 1058 adv\d+\.php 2 0 0 1
1059 1059 a=\%[0-9a-fA-F]{2}\&b 2 0 0 1
1060 1060 \Wcustomer\slist(s)?\W 2 0 0 1
1061 1061 \Wtransaction\shistor(y|ies)\W 2 0 0 1
1062 1062 \Wcredit\shistor(y|ies)\W 2 0 0 1
1063 1063 \Wannual\sincome(s)?\W 2 0 0 1
1064 1064 \Wpayment\shistory\W 2 0 0 1
1065 1065 \Waccount\sbalance(s)?\W 2 0 0 1
1066 1066 \Wappraisal(s)?\W 2 0 0 1
1067 1067 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1
1068 1068 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1
1069 1069 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1
1070 1070 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1
1071 1071 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1
1072 1072 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1
1073 1073 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1
1074 1074 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1
1075 1075 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1
1076 1076 \Winternal\suse\sonly\W 2 0 0 1
1077 1077 \Wlaw\senforcement\ssensitive\W 2 0 0 1
1078 1078 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1
1079 1079 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1
1080 1080 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1
1081 1081 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1
1082 1082 (//)\Wtop\ssecret[^\w/a] 2 0 0 1
1083 1083 (//)\Wconfidential[^\w/] 2 0 0 1
1084 1084 (//)\Wrestricted[^\w/] 2 0 0 1
1085 1085 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1
1086 1086 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1
1087 1087 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1
1088 1088 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1
1089 1089 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1
1090 1090 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1
1091 1091 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1
1092 1092 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1
1093 1093 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1
1094 1094 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1
1095 1095 //((NATO\sSECRET)|NS)//MR 2 0 0 1
1096 1096 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1
1097 1097 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1
1098 1098 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1
1099 1099 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1100 1100 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1101 1101 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1102 1102 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1103 1103 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1104 1104 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
1105 1105 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1106 1106 //FGI[\s\w,/-]*(//X5) 2 0 0 1
1107 1107 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1
1108 1108 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1109 1109 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1110 1110 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1111 1111 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1112 1112 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1113 1113 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1114 1114 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1115 1115 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1116 1116 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1117 1117 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1118 1118 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1119 1119 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1120 1120 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1121 1121 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1
1122 1122 (//)\Wrestricted[^\w/] 2 0 0 1
1123 1123 (//)\Wtop\ssecret[^\w/a] 2 0 0 1
1124 1124 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1
1125 1125 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1
1126 1126 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1
1127 1127 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1
1128 1128 \Wlaw\senforcement\ssensitive\W 2 0 0 1
1129 1129 \Winternal\suse\sonly\W 2 0 0 1
1130 1130 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1
1131 1131 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1
1132 1132 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1
1133 1133 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1
1134 1134 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1
1135 1135 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1
1136 1136 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1
1137 1137 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1
1138 1138 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1
1139 1139 \Wappraisal(s)?\W 2 0 0 1
1140 1140 \Waccount\sbalance(s)?\W 2 0 0 1
1141 1141 \Wannual\sincome(s)?\W 2 0 0 1
1142 1142 \Wcredit\shistor(y|ies)\W 2 0 0 1
1143 1143 \Wtransaction\shistor(y|ies)\W 2 0 0 1
1144 1144 \Wcustomer\slist(s)?\W 2 0 0 1
1145 1145 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1
1146 1146 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1
1147 1147 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1
1148 1148 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1
1149 1149 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1
1150 1150 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1
1151 1151 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1
1152 1152 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1
1153 1153 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1
1154 1154 //((NATO\sSECRET)|NS)//MR 2 0 0 1
1155 1155 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1
1156 1156 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1
1157 1157 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1
1158 1158 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1159 1159 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1160 1160 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1161 1161 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1162 1162 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1163 1163 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
1164 1164 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1165 1165 //FGI[\s\w,/-]*(//X5) 2 0 0 1
1166 1166 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1
1167 1167 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1168 1168 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1169 1169 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1170 1170 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1171 1171 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1172 1172 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1173 1173 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1174 1174 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1175 1175 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1176 1176 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1177 1177 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1178 1178 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1179 1179 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1180 1180 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1
1181 1181 (//)\Wrestricted[^\w/] 2 0 0 1
1182 1182 (//)\Wconfidential[^\w/] 2 0 0 1
1183 1183 (//)\Wtop\ssecret[^\w/a] 2 0 0 1
1184 1184 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1
1185 1185 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1
1186 1186 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1
1187 1187 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1
1188 1188 \Wlaw\senforcement\ssensitive\W 2 0 0 1
1189 1189 \Winternal\suse\sonly\W 2 0 0 1
1190 1190 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1
1191 1191 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1
1192 1192 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1
1193 1193 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1
1194 1194 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1
1195 1195 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1
1196 1196 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1
1197 1197 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1
1198 1198 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1
1199 1199 \Wappraisal(s)?\W 2 0 0 1
1200 1200 \Waccount\sbalance(s)?\W 2 0 0 1
1201 1201 \Wpayment\shistory\W 2 0 0 1
1202 1202 \Wannual\sincome(s)?\W 2 0 0 1
1203 1203 \Wcredit\shistor(y|ies)\W 2 0 0 1
1204 1204 \Wtransaction\shistor(y|ies)\W 2 0 0 1
1205 1205 \Wcustomer\slist(s)?\W 2 0 0 1
1206 1206 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1
1207 1207 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1
1208 1208 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1
1209 1209 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1
1210 1210 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1
1211 1211 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1
1212 1212 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1
1213 1213 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1
1214 1214 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1
1215 1215 //((NATO\sSECRET)|NS)//MR 2 0 0 1
1216 1216 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1
1217 1217 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1
1218 1218 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1
1219 1219 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1220 1220 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1221 1221 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1222 1222 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1223 1223 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1224 1224 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
1225 1225 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1226 1226 //FGI[\s\w,/-]*(//X5) 2 0 0 1
1227 1227 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1
1228 1228 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1229 1229 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1230 1230 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1231 1231 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1232 1232 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1233 1233 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1234 1234 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1235 1235 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1236 1236 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1237 1237 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1238 1238 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1239 1239 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1240 1240 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1241 1241 User-Agent\x3a \d{6}\x0d\x0a/H 2 0 0 1
1242 1242 (POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping 2 0 0 1
1243 1243 \.dyndns\.((biz|info|org|tv))\x0d\x0a/iH 2 0 0 1
1244 1244 \.dyndns-((at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH 2 0 0 1
1245 1245 \.jpg\?t\x3d\d\.\d 2 0 0 1
1246 1246 [0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$ 2 0 0 1
1247 1247 ^Content-Length\x3a\s*-\d+ 2 0 0 1
1248 1248 \W[0-9]{5}\.jar 2 0 0 1
1249 1249 machine_id={[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+} 2 0 0 1
1250 1250 [0-9]{1,8}[a-f]{1,8}[0-9]{1,8}$ 2 0 0 1
1251 1251 ^[a-z0-9]{6}..\x00\x00 2 0 0 1
1252 1252 ^[a-z0-9]{7}..\x00\x00 2 0 0 1
1253 1253 \sLOGIN\s[^\n]*?% 2 0 0 1
1254 1254 ({(\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(\d+})) 2 0 0 1
1255 1255 ^\/\?[a-f0-9]{32}$ 2 0 0 1
1256 1256 [a-z]{9}[0-9]\.exe/H 2 0 0 1
1257 1257 \.php\?inst_result=.+&hwid= 2 0 0 1
1258 1258 ^.{1,5}[a-f0-9]{100} 2 0 0 1
1259 1259 \/scr5\.php\?p=\d+&id=\d 2 0 0 1
1260 1260 ^User-Agent\: App\d/Hmi 2 0 0 1
1261 1261 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$ 2 0 0 1
1262 1262 \x00\x07[a-z]{7}\x02eu\x00 2 0 0 1
1263 1263 REGISTER.{400} 2 0 0 1
1264 1264 \/content\/jav\d?\.jar$ 2 0 0 1
1265 1265 ^\/\?[a-f0-9]{32}$ 2 0 0 1
1266 1266 \.php\?[a-z]+=[a-f0-9]{64}&[^\?]+=[a-f0-9]{20}& 2 0 0 1
1267 1267 ^HTTP\x2f1\.[01] 200 2 0 0 1
1268 1268 \.php\?[a-z]+=(([1-2][a-z]|3[0-9])\x3a){3,}([1-2][a-z]|3[0-9])& 2 0 0 1
1269 1269 IP\:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
1270 1270 ^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$ 2 0 0 1
1271 1271 \.(jpg|png|gif|cgi)\?pr= 2 0 0 1
1272 1272 ^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$ 2 0 0 1
1273 1273 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1274 1274 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1275 1275 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1276 1276 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1277 1277 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1278 1278 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1279 1279 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1280 1280 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1281 1281 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1282 1282 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1283 1283 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1284 1284 (POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl 2 0 0 1
1285 1285 \x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$ 2 0 0 1
1286 1286 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1287 1287 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1288 1288 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1289 1289 ^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\/ 2 0 0 1
1290 1290 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$ 2 0 0 1
1291 1291 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$ 2 0 0 1
1292 1292 applet\/code=[\x22\x27](<val1>[a-zA-Z0-9]+)[a-z]\.(=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27] 2 0 0 1
1293 1293 code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22 2 0 0 1
1294 1294 \x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D 2 0 0 1
1295 1295 \x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$ 2 0 0 1
1296 1296 ^[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}= 2 0 0 1
1297 1297 \.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$ 2 0 0 1
1298 1298 ^\d+?.\x00\x00\x00 2 0 0 1
1299 1299 \/[0-9a-f]{32}\.jar$ 2 0 0 1
1300 1300 \/[a-f0-9]{5,}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1
1301 1301 ^[^OGHPDTCMLUVRBAS] 2 0 0 1
1302 1302 &s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi 2 0 0 1
1303 1303 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$ 2 0 0 1
1304 1304 AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1
1305 1305 DELETE.+FROM 2 0 0 1
1306 1306 UNION.+SELECT 2 0 0 1
1307 1307 UPDATE.+SET 2 0 0 1
1308 1308 ASCII\(.+SELECT 2 0 0 1
1309 1309 DELETE.+FROM 2 0 0 1
1310 1310 INSERT.+INTO 2 0 0 1
1311 1311 UNION\s+SELECT 2 0 0 1
1312 1312 SELECT.+FROM 2 0 0 1
1313 1313 UPDATE.+SET 2 0 0 1
1314 1314 ASCII\(.+SELECT 2 0 0 1
1315 1315 DELETE.+FROM 2 0 0 1
1316 1316 INSERT.+INTO 2 0 0 1
1317 1317 SELECT.+FROM 2 0 0 1
1318 1318 \/\S+\.cab 2 0 0 1
1319 1319 User-Agent\x3a[^\n]+AskTB/iH 2 0 0 1
1320 1320 (<p>[0-7]{3})(<d>[0-7]{3})(=p)(=d)([0-7]{3}){10}(<q>[0-7]{3})[0-7]{3}(<dot>[0-7]{3})[0-7]{3}(=dot)[0-7]{3}(=q) 2 0 0 1
1321 1321 (<p>[0-7]{2,4})(<sep>[^0-7])(<d>((=p))[0-7]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-7]{2,4}(=sep)){10}(<q>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(<dot>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(=dot)(=sep)[0-7]{2,4}(=sep)(=q) 2 0 0 1
1322 1322 ^\/(p(a(rs|g)e|rocess)|(securit|quer)y|(defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$ 2 0 0 1
1323 1323 \/gate\.php\?cmd=urls$ 2 0 0 1
1324 1324 \/gate\.php\?cmd=getexe$ 2 0 0 1
1325 1325 ^User-Agent\x3a[^\r\n]*?\sMSIE\s/H 2 0 0 1
1326 1326 ^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email) 2 0 0 1
1327 1327 [^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00 2 0 0 1
1328 1328 [^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00 2 0 0 1
1329 1329 [^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00 2 0 0 1
1330 1330 \x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7} 2 0 0 1
1331 1331 \.php\?label=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
1332 1332 \.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$ 2 0 0 1
1333 1333 ^\/[A-Za-z0-9]{7,8}\/index\.html?$ 2 0 0 1
1334 1334 ^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$ 2 0 0 1
1335 1335 ^Host\x3a\x20www\d+?\.[^\.]+?\.[^\.]+?\.([^\.]+\.)*?[a-z]{2,4}(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
1336 1336 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1337 1337 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1338 1338 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1339 1339 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1340 1340 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1341 1341 ^\/b\/(eve|opt|req)\/[\-f0-9A-F]{24}$ 2 0 0 1
1342 1342 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1
1343 1343 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1
1344 1344 \/[a-z]{1,6}\.html\?0\.[0-9]+[a-z]?$ 2 0 0 1
1345 1345 ^[^\r\n]{15}\x5f[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2} 2 0 0 1
1346 1346 ^Host\x3a[^\r\n]+\.passinggas\.net(\x3a\d{1,5})?\r?$/Hmi 2 0 0 1
1347 1347 Server\: nginx/[a-zA-Z] 2 0 0 1
1348 1348 ^\x23\d\d\d\x2f\x21 2 0 0 1
1349 1349 XPantivirus20\d{2}_v\d{6}\.exe 2 0 0 1
1350 1350 \d\d\d\d\d\d\x0a 2 0 0 1
1351 1351 PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S 2 0 0 1
1352 1352 [0-9A-Z]{240,} 2 0 0 1
1353 1353 \x26[\x00-\xff]\x09\x00 2 0 0 1
1354 1354 \x26[\x00-\xff]\x09\x00 2 0 0 1
1355 1355 \.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt= 2 0 0 1
1356 1356 OS 4_[0-3]_[1-4] like/H 2 0 0 1
1357 1357 \.php\?f=\d+$ 2 0 0 1
1358 1358 Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H 2 0 0 1
1359 1359 User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H 2 0 0 1
1360 1360 \.php\?t=\d{2,7}$ 2 0 0 1
1361 1361 filename=.*facebook.*\.(rar|exe|zip) 2 0 0 1
1362 1362 filename\s*[^\n]*?(UPS|United Parcel Service)[^\n]*?\.(rar|exe|zip) 2 0 0 1
1363 1363 flash-[A-Z0-9]+-plugin\.[A-Z0-9]+\.exe 2 0 0 1
1364 1364 \x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D 2 0 0 1
1365 1365 MalvRem_\d{3,4}\.exe 2 0 0 1
1366 1366 avdistr_\d{3,4}\.exe 2 0 0 1
1367 1367 RunAV_\d{3,4}\.exe 2 0 0 1
1368 1368 installer\.\d{4}\.exe 2 0 0 1
1369 1369 \/stetement_id\.\d+\/ 2 0 0 1
1370 1370 ^\/stream\?\d$ 2 0 0 1
1371 1371 loads2\.php\?r=[0-9]{2}\.[0-9] 2 0 0 1
1372 1372 ^[\x20-\x7e]{5}.{4}\x7c\x01 2 0 0 1
1373 1373 (\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1 2 0 0 1
1374 1374 &cid=\d+$ 2 0 0 1
1375 1375 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1
1376 1376 ^Content-Disposition\x3a\x20attachment\x3b\x20filename=[^\r\n]+?\.[a-z]{2,4}\.exe\r?$/Hmi 2 0 0 1
1377 1377 ^\/[a-z0-9A-Z]{15,35}\/((\d+[A-Z]){3}\d+|null)\/ 2 0 0 1
1378 1378 ^Content-Length\x3a 2\d{2}\r?$/Hmi 2 0 0 1
1379 1379 \/[a-z]{2,9}\.php\?([a-z0-9]{2,4}|[cktw])=[a-zA-Z0-9\x2b\x2f\x5c]{43,56}=?$ 2 0 0 1
1380 1380 \.((testdlls|threads|netstatp|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|stats|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\x|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r]) 2 0 0 1
1381 1381 \x2B\x22l\x22(\x3B|\x5D) 2 0 0 1
1382 1382 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
1383 1383 ^Referer\x3a[^\r\n]+\.swf/Hmi 2 0 0 1
1384 1384 \.jpg\?id=\d+$ 2 0 0 1
1385 1385 ^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){3,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$ 2 0 0 1
1386 1386 ^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$ 2 0 0 1
1387 1387 ^\/[a-z]{4}\.html?(\?[h-j]=\d+)?$ 2 0 0 1
1388 1388 ^\/h[a-z]{3}\.html?$ 2 0 0 1
1389 1389 ^\/[0-9]{8}\.html$ 2 0 0 1
1390 1390 ^\/lists\/\d{15}(\d{5})?$ 2 0 0 1
1391 1391 ^\/[a-z0-9]{2}\.jar$ 2 0 0 1
1392 1392 ^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$ 2 0 0 1
1393 1393 ^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1
1394 1394 ^([a-zA-Z]{0,119}[0-9])(<var>[a-zA-Z0-9]{9,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1
1395 1395 ^\/0[a-z0-9]{13}$ 2 0 0 1
1396 1396 ^\/[-a-zA-Z0-9_]{70,75}==?$ 2 0 0 1
1397 1397 ^User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)/Hmi 2 0 0 1
1398 1398 \/[a-f0-9]{32}\.eot$ 2 0 0 1
1399 1399 ^\/0[a-z0-9]{13}$ 2 0 0 1
1400 1400 ^\/([a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])([A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])([A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\?? 2 0 0 1
1401 1401 ^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00 2 0 0 1
1402 1402 ^(\x62|\x1b) 2 0 0 1
1403 1403 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])3((=sep)|\d)*?$ 2 0 0 1
1404 1404 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])4((=sep)|\d)*?$ 2 0 0 1
1405 1405 ^(\x8b|\xf2) 2 0 0 1
1406 1406 ^[a-z0-9\x02-\x50]{100,}\x00\x00\x01\x00\x01$ 2 0 0 1
1407 1407 ^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi 2 0 0 1
1408 1408 GRANT.{1,5}TO 2 0 0 1
1409 1409 ^\/\?[a-f0-9]{32}$ 2 0 0 1
1410 1410 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])0((=sep)|\d)*?$ 2 0 0 1
1411 1411 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])1((=sep)|\d)*?$ 2 0 0 1
1412 1412 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])2((=sep)|\d)*?$ 2 0 0 1
1413 1413 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])5((=sep)|\d)*?$ 2 0 0 1
1414 1414 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])6((=sep)|\d)*?$ 2 0 0 1
1415 1415 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])7((=sep)|\d)*?$ 2 0 0 1
1416 1416 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])8((=sep)|\d)*?$ 2 0 0 1
1417 1417 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])9((=sep)|\d)*?$ 2 0 0 1
1418 1418 \/\w{1,2}\/\w{1,2}\.class$ 2 0 0 1
1419 1419 User-Agent\:[^\n]+zb-hb-/Hi 2 0 0 1
1420 1420 ^[^\r\n]*\/[0-9a-f]{78}\sHTTP 2 0 0 1
1421 1421 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20((=refhost))/Hsi 2 0 0 1
1422 1422 Host\x3a\x20(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1
1423 1423 ^\/index\.php\?[a-z]{8,80}=(\d{10,13}|\d{15,20})$ 2 0 0 1
1424 1424 Host\x3a\x20([0-9]{0,22}[a-z])([a-z]*?[0-9][a-z]{0,22}[0-9])[a-z0-9]{23}\x2e[^\x2e\r\n]+\x2e[^\x2e\r\n]/H 2 0 0 1
1425 1425 &id=\d+(\x3a([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{10,}\.{0,2})?&catid=\d+&itemid=\d+$ 2 0 0 1
1426 1426 \/pd\.php\?id=[a-f0-9]+$ 2 0 0 1
1427 1427 ^\x2Fsearch\x2F\x3F[a-z]{2,5}\x3D 2 0 0 1
1428 1428 ^Referer\x3a\x20http\x3a\/\/[^\x2f]+\/[a-z0-9]{6}\/[a-z0-9]{5}\.html\r?$/Hm 2 0 0 1
1429 1429 ^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text\/vbscript[\x22\x27]) 2 0 0 1
1430 1430 filename=\x22\d+?\x22/P 2 0 0 1
1431 1431 ^\/log\.php\?f=[0-1](\.[a-z]+)?$ 2 0 0 1
1432 1432 (<p>[0-9a-f]{2,4})(<sep>[\x2e\x2c\x3b\x3a])(<d>((=p))[0-9a-f]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-9a-f]{2,4}(=sep)){10}(<q>(((=p)|(=d)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(<dot>(((=p)|(=d)|(=q)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(=dot)(=sep)[0-9a-f]{2,4}(=sep)(=q) 2 0 0 1
1433 1433 ^Host\x3a[^\r\n]+craigslist\.org[^\r\n]{20,}\r\n/Hmi 2 0 0 1
1434 1434 ^Host\x3a[^\r\n]+\r\nConnection\x3a\x20Keep-Alive\r\n(\r\n)?$/H 2 0 0 1
1435 1435 ^Content-Length\x3a[^\r\n]*?\{([^\r\n]*java\.)[^\r\n]*\.ognl[^\r\n]*\} 2 0 0 1
1436 1436 \/j[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1
1437 1437 \/j[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1
1438 1438 \/j[a-z]+?\?f[a-z]+[a-z]+$ 2 0 0 1
1439 1439 \/f[a-z]+?\?f[a-z]+[a-z]+$ 2 0 0 1
1440 1440 \.php$ 2 0 0 1
1441 1441 \.php$ 2 0 0 1
1442 1442 GET\s[^\r\n]*?(<name>\/[^\.\/]+\.html)\?id\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(:?\d{1,5})?\r\n 2 0 0 1
1443 1443 ^\d{4}\r$ 2 0 0 1
1444 1444 ^Host\x3a\x20[^\r\n]+\-login\.id\-107sbtd9cbhsbt[^\r]+$/Hmi 2 0 0 1
1445 1445 \/form\/submit\/$ 2 0 0 1
1446 1446 pch\.php\?f=\d+$ 2 0 0 1
1447 1447 hcp_vbs\.php\?f=\d+&d=\d+$ 2 0 0 1
1448 1448 \.php\?e=\w+&f=\w+$ 2 0 0 1
1449 1449 pch2.php?c=\d+$ 2 0 0 1
1450 1450 \.jar\?t=\d+&h=[^&]+$ 2 0 0 1
1451 1451 \/adp\d\.php\[0-9a-z]{2,6} 2 0 0 1
1452 1452 attachment\x3b[^\r\n]*?info\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
1453 1453 attachment\x3b[^\r\n]*?contacts\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
1454 1454 attachment\x3b[^\r\n]*?calc\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
1455 1455 attachment\x3b[^\r\n]*?about\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
1456 1456 hhcp.php?c=[a-f0-9]{5}$ 2 0 0 1
1457 1457 attachment\x3b[^\r\n]*?readme\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
1458 1458 \/content\/jav\d?\.jar$ 2 0 0 1
1459 1459 \.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d] 2 0 0 1
1460 1460 =.*[a-f].*$ 2 0 0 1
1461 1461 <title>[a-f0-9]{10}<\/title> 2 0 0 1
1462 1462 =[0-9a-f]{8}\.jar/H 2 0 0 1
1463 1463 \x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}$ 2 0 0 1
1464 1464 \x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}\x3A\x3A[0-9]{1,5}$ 2 0 0 1
1465 1465 display\x3Anone\x3B\x22\x3E[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}[^\r\n]*\x3C\x2Fpre\x3E\x3Cscript\x3E 2 0 0 1
1466 1466 (\x3D|\x5B\x22])e\x22\x2B\x22va 2 0 0 1
1467 1467 (\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a 2 0 0 1
1468 1468 (\x3D|\x5B\x22])ev\x22\x2B\x22a 2 0 0 1
1469 1469 \x2B\x22al\x22(\x3B|\x5D) 2 0 0 1
1470 1470 \x2B\x22val\x22(\x3B|\x5D) 2 0 0 1
1471 1471 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jnlp(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1472 1472 \.php\?[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}= 2 0 0 1
1473 1473 ^.{1,5}[a-f0-9]{100} 2 0 0 1
1474 1474 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.eot(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1475 1475 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jar(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1476 1476 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.exe(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1477 1477 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.php(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1478 1478 \.php\?\w{2,8}\=(0[0-9a-b]|3[0-9]){5,32}\&\w{2,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{1,8}\=\d{2}\&\w{1,8}\=\w{1,8}\&\w{1,8}\=\w{1,8}$ 2 0 0 1
1479 1479 \/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php$ 2 0 0 1
1480 1480 \/news\/enter\/2012-1[0-2]-([0-2][0-9]|3[0-1])\.php 2 0 0 1
1481 1481 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.txt(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1482 1482 \/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php 2 0 0 1
1483 1483 ^\/[0-9a-f]{16}\/q\.php$ 2 0 0 1
1484 1484 ^\/[0-9a-f]{16}\/q\.php 2 0 0 1
1485 1485 ^\/[0-9a-f]{32}\/ff\.php$ 2 0 0 1
1486 1486 ^\/[0-9a-f]{32}\/ff\.php 2 0 0 1
1487 1487 ^\/[0-9a-f]{16}\/ff\.php$ 2 0 0 1
1488 1488 ^\/[0-9a-f]{16}\/ff\.php 2 0 0 1
1489 1489 ^\/closest\/(([a-z]{1,16}[-_]){1,4}[a-z]{1,16}|[a-z0-9]{20,})\.php 2 0 0 1
1490 1490 &jopa=\d+$ 2 0 0 1
1491 1491 \.php\?jnlp=[a-f0-9]{10}(,|$) 2 0 0 1
1492 1492 \/[0-9a-f]{32}\/a\.php$ 2 0 0 1
1493 1493 \/[0-9a-f]{32}\/a\.php 2 0 0 1
1494 1494 \/[0-9a-f]{16}\/a\.php$ 2 0 0 1
1495 1495 \/[0-9a-f]{16}\/a\.php 2 0 0 1
1496 1496 \.php\?[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){5}&[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){10}& 2 0 0 1
1497 1497 \/([^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$ 2 0 0 1
1498 1498 ^([0-9a-z]{8})?(<p>[0-9a-z]{2})(<d>((=p))[0-9a-z]{2})(=p)(=d)([0-9a-z]{2}){10}(<q>[0-9a-z]{2})[0-9a-z]{2}(<dot>[0-9a-z]{2})[0-9a-z]{2}(=dot)[0-9a-z]{2}(=q) 2 0 0 1
1499 1499 \.php\?[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){5}&[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){10}& 2 0 0 1
1500 1500 \.php\?[^=]+=([^&](5[5-9a-e]|8[9a-e])){5}[^=]+=[^&]+&[^=]+=([^&](5[5-9a-f]|8[9a-e])){10}([^&]60[^&]60([^&](5[5-9a-f]|8[9a-e])){10})*?& 2 0 0 1
1501 1501 \.php\?[^=]+=[^&]{10}&[^=]+=[^&]+&[^=]+=[^&]{20}((<sep>[^&]{2})(=sep)[^&]{20})*?& 2 0 0 1
1502 1502 ^\/[a-z0-9]{6,10}\/\?[0-9]{1,2}$ 2 0 0 1
1503 1503 @\x00i\x00m\x00p\x00o\x00r\x00t\x00\x20.{4,20}[^\x00\w\s.] 2 0 0 1
1504 1504 ^\s*?\(\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27] 2 0 0 1
1505 1505 ^\s*?\(\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27] 2 0 0 1
1506 1506 ^Referer\x3a[^\r\n]+\x3a\d+\/([a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,3}|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3})/Hm 2 0 0 1
1507 1507 ^\s*?value\s*\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27] 2 0 0 1
1508 1508 ^\s*?value\s*\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27] 2 0 0 1
1509 1509 ^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$ 2 0 0 1
1510 1510 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1
1511 1511 Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=refhost)/Hsi 2 0 0 1
1512 1512 ^Host\x3a[^\r\n]*?\x3a((80(80)|312[89]))\d+\r$/Hm 2 0 0 1
1513 1513 ^(((<\/object>).)*?<param([^>]*?name\s*\s*?\x22bgcolor\x22)[^>]*?value\s*\s*?\x22#ffffff\x22)((<\/object>).)*?<param([^>]*?name\s*\s*?\x22movie\x22)[^>]*?value\s*\s*?\x22([^\x22]+\.[Ss][Ww][Ff])[^\x22]*?\x22 2 0 0 1
1514 1514 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1
1515 1515 Host\x3a\x20(<host>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(=host)\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi 2 0 0 1
1516 1516 Referer\x3a\x20http\x3a\x2f\x2f(<host>[^\r\n\x3a\x2f]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=host)(\x3a\d{1,5})?\r\n/Hsi 2 0 0 1
1517 1517 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1
1518 1518 ^\s*=\s*(<var1>[\x22\x27][a-z]+[\x22\x27]).+?\sid\s*=\s*(=var1) 2 0 0 1
1519 1519 ^([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$ 2 0 0 1
1520 1520 ^(\s*var\s[a-z]+\s*=\s*\d+\x3b\s*\n)*\s*<\/script>\s*<object([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$ 2 0 0 1
1521 1521 ^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27] 2 0 0 1
1522 1522 ^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|([a-z]*\d+[a-z]+\d)(\d*[a-z]+\d+[a-z])[a-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27] 2 0 0 1
1523 1523 ^\s*=\s*[\x22\x27][a-z]+[\x22\x27] 2 0 0 1
1524 1524 ^\s*=\s*[\x22\x27][a-z]+[\x22\x27] 2 0 0 1
1525 1525 ^\s*=\s*[\x22\x27]\/[^\x22\x27]*\.html\.swf[\x22\x27] 2 0 0 1
1526 1526 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1
1527 1527 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1
1528 1528 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space) 2 0 0 1
1529 1529 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1
1530 1530 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space) 2 0 0 1
1531 1531 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27] 2 0 0 1
1532 1532 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space) 2 0 0 1
1533 1533 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space) 2 0 0 1
1534 1534 \/m[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1
1535 1535 ^h[a-z0-9]{0,10}\x3d[a-f0-9]{24}&p[a-z0-9]{0,10}\x3d[a-z0-9]{1,11}&i/P 2 0 0 1
1536 1536 ^p[a-z0-9]{0,20}\x3d[a-z0-9]{1,20}&i[a-z0-9]{0,20}\x3d%[0-9A-F]{2}/P 2 0 0 1
1537 1537 \x28[\r\n\s]*?(<qa1>[\x22\x27]?)[a-f0-9]{24}(=qa1)[\r\n\s]*?,[\r\n\s]*?(<qa2>[\x22\x27]?)[a-z0-9]{1,20}(=qa2)[\r\n\s]*? 2 0 0 1
1538 1538 =%25[0-9A-F]{2}%25[0-9A-F]{2}/P 2 0 0 1
1539 1539 ^\/a[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?q[a-z]{4,11}=\d{6,7}$ 2 0 0 1
1540 1540 ^\/s[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?d[a-z]{4,11}=\d{6,7}$ 2 0 0 1
1541 1541 ^\/k[a-z]{4,13}\?e[a-z]{4,11}=\d{6,7}$ 2 0 0 1
1542 1542 ^\/g[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?t[a-z]{4,11}=\d{6,7}$ 2 0 0 1
1543 1543 \/r[a-z]+?\?j[a-z]+[a-z]+$ 2 0 0 1
1544 1544 \/f[a-z]+?\?j[a-z]+[a-z]+$ 2 0 0 1
1545 1545 ^\/o[a-z]{4,13}\?h[a-z]{4,11}=\d{6,7}$ 2 0 0 1
1546 1546 \/b[a-z]+?\?n[a-z]+[a-z]+$ 2 0 0 1
1547 1547 \/v[a-z]+?\?n[a-z]+[a-z]+$ 2 0 0 1
1548 1548 ^\/[a-z]{5,14}\?[a-z]{5,12}=\d{6,7}$ 2 0 0 1
1549 1549 ^\/[a-z]{5,14}\?[a-z]{5,12}=[a-z]{6,11}$ 2 0 0 1
1550 1550 ^[\r\n\s]*?\, 2 0 0 1
1551 1551 \bdig\.dll\b 2 0 0 1
1552 1552 ^\/[a-z]+?\?[a-z]+[a-z]+$ 2 0 0 1
1553 1553 ^Host\x3a\x20[^\r\n]+\.(d(yndns\.[a-z]{2,3}|esi)|c(ricket|a?fe?)|(lin|wor)k|s(u|pace)|accountant|t(k|op)|g[aq]|xyz|ml|pw)(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
1554 1554 ^\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)$ 2 0 0 1
1555 1555 ^(<windname>[a-z0-9]+)(<plug1>([sj]|f1))=true.+?window\.(=windname)(<plug2>(((=plug1))([sj]|f1)))=true.+?window\.(=windname)(((=plug1)|(=plug2)))([sj]|f1)=true 2 0 0 1
1556 1556 ^\/1[a-z0-9]{13}$ 2 0 0 1
1557 1557 ^GET \/0(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n 2 0 0 1
1558 1558 ^\/1[a-z0-9]{13}$ 2 0 0 1
1559 1559 ^GET \/4(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n 2 0 0 1
1560 1560 ^\/3[a-z0-9]{13}$ 2 0 0 1
1561 1561 \/4[a-z0-9]{13}\?&xkey= 2 0 0 1
1562 1562 ^[a-zA-Z0-9\/\+]+?ODAvM[a-zA-Z0-9\/\+]{18}(=|%3D)[\x22\x27] 2 0 0 1
1563 1563 ^[a-zA-Z0-9\/\+]+?4MC8x[a-zA-Z0-9\/\+]{18}(=|%3D){2}[\x22\x27] 2 0 0 1
1564 1564 ^[a-zA-Z0-9\/\+]+?OjgwL[a-zA-Z0-9\/\+]{19}[\x22\x27] 2 0 0 1
1565 1565 ^(\s*?|\/\*((\*\/).)*?\*\/)*?\((\s*?|\/\*((\*\/).)*?\*\/)*?(<vname>[^\s>=]+)(\s*?|\/\*((\*\/).)*?\*\/)*?<(\s*?|\/\*((\*\/).)*?\*\/)*?32\b.{0,200}(=vname)(\s*?|\/\*((\*\/).)*?\*\/)*?\x3d(\s*?|\/\*((\*\/).)*?\*\/)*?63\b.{1,200}\+=.{0,200}\((\s*?|\/\*((\*\/).)*?\*\/)*?(=vname) 2 0 0 1
1566 1566 ^[a-zA-Z0-9]+\*\/ 2 0 0 1
1567 1567 [a-z0-9]+?\*\/ 2 0 0 1
1568 1568 ^\s*?<script>\s*?(<func>[A-Za-z0-9]+)\s*?\(\s*?[\x22\x27](<var>[^1\x22\x27]+)1[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)2[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)3[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script> 2 0 0 1
1569 1569 ^\s*?\n\s*?(<func>[^\x28\r\n\s]+)\s*?\(\s*?(<var>[^\+\x29]+)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+ 2 0 0 1
1570 1570 ^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$ 2 0 0 1
1571 1571 ^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$ 2 0 0 1
1572 1572 ^Referer\x3a[^\r\n]+\/([a-z0-9]+\.php|\d+)\r$/Hm 2 0 0 1
1573 1573 Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2039/H 2 0 0 1
1574 1574 Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2040/H 2 0 0 1
1575 1575 ^\W 2 0 0 1
1576 1576 ^\W 2 0 0 1
1577 1577 ^\/[a-z]{3}\?[A-F0-9]{8}$ 2 0 0 1
1578 1578 ^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((<sep>[_-]?)[a-z]{3,20}(=sep)([a-z]{3,20}(=sep))?)?[a-z]{3,20}\/\d{10,20}(\x3a\d{1,5})?\r$/Hm 2 0 0 1
1579 1579 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi 2 0 0 1
1580 1580 Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1
1581 1581 ^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}\r$/Hmi 2 0 0 1
1582 1582 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi 2 0 0 1
1583 1583 Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1
1584 1584 ^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
1585 1585 ^((<\/body).)+?Content\s*?loading.*lease wait.*?<iframe 2 0 0 1
1586 1586 ^(\x4c|\x35) 2 0 0 1
1587 1587 ^(\x76|\x0f) 2 0 0 1
1588 1588 \/wp-(content|admin|includes)\/ 2 0 0 1
1589 1589 ^\d\x00\d 2 0 0 1
1590 1590 \.php\?$ 2 0 0 1
1591 1591 \?showforum=$ 2 0 0 1
1592 1592 ^\s*5a\s*90\s*00\s*03\s*00\s*00\s*00 2 0 0 1
1593 1593 \x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_] 2 0 0 1
1594 1594 (\.\.\/){1,} 2 0 0 1
1595 1595 (\.\.\/){1,} 2 0 0 1
1596 1596 =(https?|ftps?|php)\:\/.{0,100}cmd= 2 0 0 1
1597 1597 MEAS\.TYPE=((link|class)&) 2 0 0 1
1598 1598 url=.{8000} 2 0 0 1
1599 1599 \/ssp\/files\/annonce\.pdf$ 2 0 0 1
1600 1600 \/ssp\/loadjavad\.php$ 2 0 0 1
1601 1601 \/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$ 2 0 0 1
1602 1602 \/xml\/p\.php\?id=\d{2,} 2 0 0 1
1603 1603 ts\/in\.cgi\?pepsi\d+ 2 0 0 1
1604 1604 cs_base_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1
1605 1605 \x0d\x0aHost\: (www\.)?nacha\.org\. 2 0 0 1
1606 1606 \x26n\x3d[a-z]{5}\d{4} 2 0 0 1
1607 1607 name=(https?|ftps?|php) 2 0 0 1
1608 1608 \/script\.php?\d{8} 2 0 0 1
1609 1609 Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a 2 0 0 1
1610 1610 \/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$ 2 0 0 1
1611 1611 UPDATE.+SET 2 0 0 1
1612 1612 ASCII\(.+SELECT 2 0 0 1
1613 1613 DELETE.+FROM 2 0 0 1
1614 1614 INSERT.+INTO 2 0 0 1
1615 1615 UNION\s+SELECT 2 0 0 1
1616 1616 SELECT.+FROM 2 0 0 1
1617 1617 UPDATE.+SET 2 0 0 1
1618 1618 ASCII\(.+SELECT 2 0 0 1
1619 1619 DELETE.+FROM 2 0 0 1
1620 1620 INSERT.+INTO 2 0 0 1
1621 1621 UNION\s+SELECT 2 0 0 1
1622 1622 SELECT.+FROM 2 0 0 1
1623 1623 ver=[v\d]+ 2 0 0 1
1624 1624 \/Setup_[0-9]{3}([A-Z][0-9])?\.exe$ 2 0 0 1
1625 1625 \/\d+\/installer\/Installer(Clean)?\.exe$ 2 0 0 1
1626 1626 \/(nte|ld)\/[0-9A-Z]*trest1[0-9](\.php|\s\.asp|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$ 2 0 0 1
1627 1627 ^[a-z0-9\x40\x2d\x5f]{5,12}..\x00\x00..\x00\x00\x78\x9c 2 0 0 1
1628 1628 =sent$ 2 0 0 1
1629 1629 \.php\?get[^=]*=\d_\d{5,}$ 2 0 0 1
1630 1630 \.php\?[a-z]_info=[a-z0-9]{1,4}_\d+?$ 2 0 0 1
1631 1631 Host\x3A\x20[^\r\n]*.rr.nu/H 2 0 0 1
1632 1632 ^(.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(.{0,62}\x00{2})(.{0,59}[A-Za-z0-9]{5})((<b1>.).{0,63}(=b1).{0,62}(=b1).{0,61}(=b1).{0,60}(=b1))(.(<b2>.).{0,62}(=b2).{0,61}(=b2).{0,60}(=b2).{0,59}(=b2))(..(<b3>.).{0,61}(=b3).{0,60}(=b3).{0,59}(=b3).{0,58}(=b3))(...(<b4>.).{0,60}(=b4).{0,59}(=b4).{0,58}(=b4).{0,57}(=b4))(....(<b5>.).{0,59}(=b5).{0,58}(=b5).{0,57}(=b5).{0,56}(=b5))(.....(<b6>.).{0,58}(=b6).{0,57}(=b6).{0,56}(=b6).{0,55}(=b6))(......(<b7>.).{0,57}(=b7).{0,56}(=b7).{0,55}(=b7).{0,54}(=b7))(.......(<b8>.).{0,56}(=b8).{0,55}(=b8).{0,54}(=b8).{0,53}(=b8))(........(<b9>.).{0,55}(=b9).{0,54}(=b9).{0,53}(=b9).{0,52}(=b9))(.........(<b10>.).{0,54}(=b10).{0,53}(=b10).{0,52}(=b10).{0,51}(=b10)) 2 0 0 1
1633 1633 \.tar$ 2 0 0 1
1634 1634 \x2Fjs\x2F[\r\n]*\x2Eexe$ 2 0 0 1
1635 1635 ^(<mac_addr>[\x00-\xff]{6})(=mac_addr){2,}$ 2 0 0 1
1636 1636 ^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED) 2 0 0 1
1637 1637 ^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED) 2 0 0 1
1638 1638 ^(\\r\\n|\x0d\x0a)C 2 0 0 1
1639 1639 \/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1
1640 1640 <iframe.*?src.*.*?<\/iframe> 2 0 0 1
1641 1641 [a-z]{4,10}\x08velodrivve\x03biz\x00 2 0 0 1
1642 1642 PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help) 2 0 0 1
1643 1643 \/[A-Z]Setup_[0-9]{4}\.exe$ 2 0 0 1
1644 1644 \.php.+?(c((onfi|f)g|alendar)|p(a(ge|th)|rog)|l(ang(uage)?|ib)|f(older|ile|ad)|d(omain|ir|f)|s(ettings|bp)|a(genda|uth)|i(con|ncl|d)|n(ame|ews)|r(oot|f)|gallery|type|ext|mod|[a-z](\[.*\])+?)\s*=\s*https? 2 0 0 1
1645 1645 \/[a-f0-9]{16}\/.+?\.(exe|zip)$ 2 0 0 1
1646 1646 ^\s?\+x=[0-9]*\;\ +y=[0-9] 2 0 0 1
1647 1647 User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H 2 0 0 1
1648 1648 ^\/load.php\?showforum=(ato|obe|rhino|lib)$ 2 0 0 1
1649 1649 ^[a-z]{5}\d=\x5f\d\x5f 2 0 0 1
1650 1650 index.php\?[0-9a-f]{32}$ 2 0 0 1
1651 1651 o/\d{9}\/[0-9a-f]{32}\/[0-9]$ 2 0 0 1
1652 1652 \/out.php\?id=\d$ 2 0 0 1
1653 1653 \/\?[a-z0-9]{5,}=[a-zA-Z0-9\x25]{40,}\x253D$ 2 0 0 1
1654 1654 ^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$ 2 0 0 1
1655 1655 \/((article|contact|new)s|read|(fo|tu)r)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.eot|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.EOT)$ 2 0 0 1
1656 1656 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})1\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}1\.PDF)$ 2 0 0 1
1657 1657 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})2\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}2\.PDF)$ 2 0 0 1
1658 1658 ^(\/[a-z]{3,20})?\/([a-z]{3,20}[-_])+[a-z]{3,20}\.jar$ 2 0 0 1
1659 1659 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})3\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}3\.PDF)$ 2 0 0 1
1660 1660 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/foto\.png$ 2 0 0 1
1661 1661 \.png$ 2 0 0 1
1662 1662 ^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$ 2 0 0 1
1663 1663 \/\d+\.mp3\x3frnd\x3d\d+$ 2 0 0 1
1664 1664 (Is|CheckRemote)DebuggerPresent 2 0 0 1
1665 1665 (Create|Connect|Peek)NamedPipe 2 0 0 1
1666 1666 ftp(open|get)file 2 0 0 1
1667 1667 ^\/r\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1
1668 1668 ^\/t\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1
1669 1669 ^\/[a-f0-9]{32}\.eot$ 2 0 0 1
1670 1670 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/new\.png$ 2 0 0 1
1671 1671 \.gif$ 2 0 0 1
1672 1672 \/(w(hite|orld)|step)\/\d+$ 2 0 0 1
1673 1673 \.psd$ 2 0 0 1
1674 1674 \.jpeg$ 2 0 0 1
1675 1675 \/(w(hite|orld)|step)\/mypic\.dll$ 2 0 0 1
1676 1676 getqq\.jpg$ 2 0 0 1
1677 1677 ^[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(((=q)).)+?\.txt\?e=\d+(&[fh]=\d+)?(=q) 2 0 0 1
1678 1678 \.php\?t[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
1679 1679 ([a-z+-]{0,4}[0-9.*]+[a-z$+-]{0,4},){24} 2 0 0 1
1680 1680 [\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]+ 2 0 0 1
1681 1681 \.php\?spl=[A-Z]{3} 2 0 0 1
1682 1682 \.php\?b[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
1683 1683 \.php\?n[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
1684 1684 ^[^?#]+?\.php\?page[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1
1685 1685 \.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
1686 1686 \.php\?doit[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1
1687 1687 ^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1
1688 1688 (-?\d+\x3a-?\d+\x3a){100} 2 0 0 1
1689 1689 \x2Fsrc\x2Ephp\x3Fcase\x3D[a-f0-9]{16}$ 2 0 0 1
1690 1690 [\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9] 2 0 0 1
1691 1691 value\x3D\x22\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23 2 0 0 1
1692 1692 \x2Fredirect\x2Ephp\x3Fd\x3D[0-9a-f]{8}$ 2 0 0 1
1693 1693 \/\d+\.js\?\d+&[a-f0-9]{16}$ 2 0 0 1
1694 1694 ^\/[a-z0-9_\-]{48}$ 2 0 0 1
1695 1695 \.php\?e=[^&]+?$ 2 0 0 1
1696 1696 \/[a-z]\/[0-9]\/[0-9a-f]{32}$ 2 0 0 1
1697 1697 archive=[^\x3e]+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
1698 1698 ^\/[a-z]+\/$ 2 0 0 1
1699 1699 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/image\.gif$ 2 0 0 1
1700 1700 \/w(hite|orld|step)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$ 2 0 0 1
1701 1701 \/(w(hite|orld)|step)\/get(a+|n+)\.jpg 2 0 0 1
1702 1702 \.php\?usernms=[^@]+@[^\r\n]+$ 2 0 0 1
1703 1703 ^(\x3a\d{1,5})?$ 2 0 0 1
1704 1704 ^[^\r\n]+?\.(c(o(l(leg(e((confidential|-station|prowler)\.net|s?explained\.com)|iate(explained|info)\.com)|(o(rado-springs-jobs|nexplained)|umnexplore)\.com)|m(p(uter(explained\.com|themes\.net)|assiondefinition\.com)|m(oditylingerie|unesinfo|ercekid)\.com)|n(ce(rtparis\.net|ptsets\.com)|trolwedding\.com)|((rnell|upon)explained|peguide)\.com|7\.us)|a(((mpaign|talog|det)explained|n(cersexplained|adadaycore)|p(itali[sz]eguide|ricornhi)|b(leexplained|indynamic))\.com|r((tograph(yanalysis|erwhat)|cinomas?explained|scratch-remover|eblack)\.com|insurance-compare\.net)|ce\.us)|h((a(r(med-episodes|les-proxy|tpixel)|p(elsinfo|terball)|nnelexplained)|ristmas(gift-ideas|motion)|inesenewyearboom|eckingwatch)\.com|(orizo|urros)\.es)|(e(l(lularexplained|iac-diet)|ntigrade(explained|info))|(li(nical|ck)|ustomized)explained|r(uiseshipdating|iticsmart)|pu-benchmark|nc-cs)\.com|8\.biz|z\.cc)|a((ll(about(((collegi|gradu)at|yal)e|s(eminary|tudent)|(facul|varsi)ty|bestsellers|academic|teaching|harvard|ucla|pro)|babyours)|n((tip 2 0 0 1
1705 1705 desbi|alyzelan)d|onymous-film)|(mericas-nexttopmode|gentsbal)l|r(chitectureice|lingtonwriter)|c(ademicexplaine|tionmo)d|ero(flotinfo|bicfund))\.com|u((toma(tedexplained|kers24)|stralia-airlines|xiliaryverb)\.com|di(t(jewellery\.com|report\.net)|o-planet\.com))|p((rilfools(hotel|spin)|ple-airport)\.com|[fh]i\.biz)|ir((bnb-coupon|waysinfo)\.com|portshuttleseattle\.net)|v(enue(domain|hello)\.com|li\.biz)|\.e\.gy)|b((a(c(helorexplained|kpackscope)|by(online-shop|revision)|(rcelonarea|ggagecoo)l|s(icexplained|escope)|ttle-field-3)|e((st-hoteldeal|er-calorie|t-award)s|nefitexplained)|u(y-invite|dgetyep)|logger-com)\.com|r((o(adbandinternet-providers|king(explained|guide))|unomarsalbum|yan-college)\.com|ea(st(cancertattoos\.net|explained\.com)|dmachine-recipes\.com))|o(((om(ing|s)|nd)explained|tany(explained|info)|dybuildingdomains|rrowings?24)\.com|stoncolleges\.net)|irthcertificatetemplate\.net|3g\.biz)|d(e((((benture|posit)explaine|alershipislan)d|n(guefevertreatment|verhowto)|ductguide|veloptea)\.com|(xterstre 2 0 0 1
1706 1706 ming|ciduoustrees)\.net)|o((ctorate(s?explained|info)|llar-converter|gwalking-jobs|texplained|mainsknow)\.com|wnload(starcraft|-films|ubuntu)\.net)|(a(ncecentralsonglist|rtmouthexplained)|na-replication|hcp-server|vd-codec|rivewww)\.com|i((s(count|ease)explained|nnerparty-recipes|walifile)\.com|rect-golf\.net))|e((a(r(fulexplained|th-clinic)|sy(-costumes|repayment))|conomic(save|24))\.com|\.gy)|4((4qs|h5)\.com|[jp]\.org|ql\.biz)|3(vt\.info|gb\.biz|q\.org)|2(eat\.com|sf\.biz|u\.se)|8(c1\.net|x\.biz)|7(c\.org|p\.biz)|11r\.(biz|us))(\x3a\d{1,5})?$ 2 0 0 1
1707 1707 ^[^\r\n]+?\.(f((a(c(ultyexplained|e-bok)|(ncy-font|ke-nail)s|ir(explained|fuse)|shion-wallpaper|lterguide)|i(nanc(i(al|ng)explained|epets)|rm(explained|s24)|lter-coffee)|o(r(umexplained|ecastbooks|ceestate)|x-drama)|udaninfo)\.com|re(e(-(((foodcoupon|angrybird)s|s(oundclips|tock)|photoeditor)\.com|music-download\.net)|(p(owerpointthem|roduct-sampl)es|dom-ofspeech)\.com|fileconverter\.net)|snoever\.com)|l(a(shplayerdownload\.net|tbelly-diet\.com)|oridaunemploymentclaim\.com|v-downloader\.net)|e(rtility-calculator\.net|stivalexplained\.com)|b(-smileys\.com|skins\.net))|l((i(n(k(explained|master)|colnsbirthdaytea)|(ability|ver)explained|(berty-saf|ftmov)e|stings(biz|red)|teraturemulti)|u(ng(explained|abscess)|ggageboom)|o(cationssecure|ndon-riots|gback))\.com|e((a(singexplained|ther-trousers)|(edsunited-new|d-candle)s|cturer(explained|info)|nd(ing|er)explained|isure-diving)\.com|u(kemiaexplained\.com|e\.biz)|tup\.org)|a(guay\.(com|es)|-gazzetta\.com)|6\.org)|i(n(s((ur(er(s(explained|24)|explained)|ancesexplain 2 0 0 1
1708 1708 d)|ide-film)\.com|(pection-camera|taflex)\.net)|d(e(pendenceday(portal|realty)|mnityexplained)\.com|ividual-healthinsurance\.net)|t(er(estexplained\.com|trigo\.net)|ranet(explained|pm)\.com)|((vestment|centive)explained|expensivehyper)\.com|f(ections?explained\.com|o\.se))|((mmersio|sd)nexplained|ronmancom|pone-5)\.com|i(nkai|lg)\.biz)|m((e(tropolis((cruis|fac|mov)e|pixel)|(lanoma|dical)explained|r(idiantotal|cedes-cls)|ntal-healthjobs|morialdaycon|ssenger-mac|ansgift)|i(ami(-holidays|what)|di-editor)|baexplained)\.com|a(r((tial-empires|ket-hq)\.com|iogames-online\.net)|n((agejoin|ualzap)\.com|ipal-university\.net)|(lignanthypertension|gazinedownload)\.net|s(on(wave|car)|tersexplained)\.com|c2\.org))|e((s(ta(tes(mob|fx)|blishstyle)|lexplained)|mploy(e(eexplained|r24)|mentexplained))\.com|n(((gagement-photo|able-cookie)s|rollexplained)\.com|trepreneur-ideas\.net)|x(((hibition|po)explained|ecutive-decision)\.com|tremedeal\.net)|l(ect(ronicexplained|orate123)\.com|guay\.(com|es))|q(uityexplained\.com|8\.biz))| 2 0 0 1
1709 1709 ((o(a(d(minister|vertize|just)|cademic|llocate)|(thic-literatur|handl)e|(bailou|conduc)t|govern)|r(a(duate(explained|sinfo)|ndparentsdayplan)|oceryexplained|4)|ym(glas|car)s|m[69])\.com|a(((llaudet|te)explained|mevelocity|rnerguide)\.com|511\.net)|cwsa\.org)|h(o((me(made-biscuits|pageexplained)|(nours|tline|using)explained|6)\.com|stel-barcelona\.net)|a(r(dback(city|yoga)|vardexplained)|n(dlechange|ukkahbio)|lloweenorange)\.com|y(perthyroidsymptoms\.net|d\.me)|ellokittypictures\.net)|j((o(urnalism(explained|info)|hn-grisham|ker-tattoo)|query-examples)\.com|a(cksonvillepath\.com|vacollection\.net)|(vvg|6)\.org)|k(ilometersreach|udosexplained|jyg)\.com)(\x3a\d{1,5})?$ 2 0 0 1
1710 1710 ^[^\r\n]+?\.(p(r(o(pert(ies(-forsale\.net|winters\.com)|y-(singapore|rental)\.net)|(fessors|state)explained\.com)|e(miums(e(xplained|ek)|guide)|(acher|cinct|late)sinfo|pexplained)\.com|i(va(te(car-sales|explained)\.com|do\.info)|nceton\.me))|e((n(sionexplained|thousepal|cetruck)|diatricsexplained)\.com|rsonal(trainer-certification\.net|-injuryclaims\.com)|tardo\.es)|o((wer(borrowings?|repayment|debts)|rt(land-holidays|alexplained)|intexplained|litical24)\.com|kertexas-holdem\.net)|a((ss(engersinfo|agepix)|ge(explained|as)|cemaker-surgery|ttinson-robert|rk-edu)\.com|loaltocollege\.net)|(u(blicationgift|pils?info)|ickups(articles|gen)|neumoniaexplained|sychologyquotes|lus-sign)\.com|h(o(toedit(orfreedownload\.net|ingsite\.com)|neexplained\.com)|pbb-themes\.com|yscology\.net)|cbp\.net|9\.org)|o(n(line(((f(o(ster|rce)|irstborn|raternal|ulltime)|b(r(idegroom|owse)|oxoffice)|e((valuat|xpress)e|fficient)|-(collegecourse|radiostation)|d(escendant|aughter|iscusse)|v(illage|acant)|re(sidence|al))s|c((r(iti(c(ize|al)| 2 0 0 1
1711 1711 ue)|ew)|o(nsider|usin)|a(pture|meo)|elluloid)s|ha(racters|teau))|a(((vailabl|doptiv|llianc|pprais)e|ss(esse|ay)|unt)s|n((cestor|alyze)s|imated)|way)|per(sonal-trainer|manents))\.com|mediaconverter\.net)|e-lyrics\.com|amia\.biz)|(ver(seasexplained|drawnreal)|(wnership|ffline)explained|cean(ic-cable|you)|rphanagesinfo|klahomafuse)\.com|a(klandour\.com|pg\.org))|r(e((s(idenc(e(attorney|dating|cook|food)|yexplained)|erves(development|core))|(c(o(ver(ing|ed)|up)|laim)guid|laxationhyp|bateventur)e|g(i(on(private|mentor)|stercommunity)|ainguide)|t(r(ainingexplained|ieveguide)|ailexplained)|motecontrol-helicopter|viewwinters|payment24)\.com|alestate-perth\.net)|(a(cetracksinfo|veexplained|iserepair|tetask)|ising-antivirus|bnnetwork)\.com|o((o(m(sfootball|mateco)|fcute)|admodern)\.com|yallondonhospital\.net))|s((o((lventsourc|ftenguid)e|urceexplained|cietiesinfo|ng-india)|a(n(antoniosource|diegodiscover)|l(aryexplaine|euploa)d)|ta(nford(explained|info)|(bilis|v)eguide|r-treck)|p(ecialtyexplained|iralwatch|orts-tab)| 2 0 0 1
1712 1712 h(oolexplained|eduleedu)|ites?explained)\.com|e((minar(y(explained|info)|explained)|c((urities|tor)explained|what)|aworld-coupons)\.com|rvertransfer\.net)|m(ier\.org|oz\.us)|hellgascard\.net|gba\.biz)|m(o((t(oristsinfo|iveshare)|ntre-breitling|dernexplained|squesinfo)\.com|hamed\.me)|(y(borrowings|-husband)|ultimediaexplained|inistriesinfo)\.com|mcd\.us)|n((a(ming(mac|our)|uticalfit|vigateadd)|e(tworkexplained|w-college))\.com|8\.biz))(\x3a\d{1,5})?$ 2 0 0 1
1713 1713 ^[^\r\n]+?\.(t(e((l(e(phoneexplained|comsguide)|learth)|n(ured(explained|info)|nis-ranking))\.com|mp(l(ates-gratis\.com|ecollege\.net)|converter\.net)|a(ching(-certificate\.net|explained\.com)|m\.pro))|r(a(((nsferbyt|de-)e|in(eesinf|ge)o|mray)\.com|vel(insurance-comparison\.net|agentnerd\.com))|e(k-bicycles|nd-online)\.net|uckstool\.com|onco\.es)|(o(wn(housepic|study|euro|meta)|(tal-tool|memap)s|pgamebook|olboxsol)|u(mors?explained|lsatrain|rn-ons)|attoo-websites|ype-racer|wainfo)\.com|h((anksgivinggaming|riftexplained)\.com|e(sis-examples\.com|atreparis\.net))|i(mezonevendor\.com|dl\.net)|cmn\.biz)|w(e(b((b(estseller|ailout)|administer)\.com|site(downloader\.net|explained\.com)|developertoolbar\.net)|(l(lesley|fare)explained|akenguide)\.com)|or(th(voice|war)\.com|ld-records\.net)|ater(front-property\.net|-plants\.com)|(riterpics|hoiscan)\.com|pbh\.org|sse\.us)|s((t(ud(ent(financecontact|s?explained)|yexplained)|r(eetmaphub|ongat)|patricksweightloss|onewhat)|wissairinfo)\.com|u((mmertimelyrics|nset-wallpape 2 0 0 1
1714 1714 |per-committee|itegraphic)\.com|b\.(name|cat|es)))|v((i(llage((in|na)no|crystal)|deo(-mediaset|explained)|ta(minssms|lwow)|rtualexplained)|o(lumesynergy|ucheragent|ters24)|a(rsityexplained|lentinesproxy)|entureexplained)\.com|qtel\.net|f1\.us)|u(n(i(versityexplained\.com|nstalltool\.net|\.me)|((secured|am)explained|ravelguide)\.com|limited-web-hosting\.net)|(cla(explained|info)|s-inflation|alinfo|zdom)\.com|[04]\.org)|y((o(u(ngstersinfo|rbroking)|mkippursocial)|(eshiva|ale)explained|vxs)\.com|nna\.biz)|zwr\.org)(\x3a\d{1,5})?$ 2 0 0 1
1715 1715 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
1716 1716 [a-z]{8}.(:?tif|gif) 2 0 0 1
1717 1717 ^.{2}[a-zA-Z0-9]+\x2e[01] 2 0 0 1
1718 1718 (\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\( 2 0 0 1
1719 1719 ^\w+?\[[^\]]+?\]\.src[\r\n\s]*= 2 0 0 1
1720 1720 (\/(php)?|\.php)\?[\s\+]*\-[A-Za-z] 2 0 0 1
1721 1721 ^[A-Z]=[A-Za-z/+0-9=]{200,400}$ 2 0 0 1
1722 1722 ^\{?[a-fA-F0-9]{4}\}?(\x5cu\{?[a-fA-F0-9]{4}\}?){20} 2 0 0 1
1723 1723 ^\{?[a-fA-F0-9]{4}\}?(\x25u\{?[a-fA-F0-9]{4}\}?){20} 2 0 0 1
1724 1724 [^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class 2 0 0 1
1725 1725 ^[\r\n\s]*?\\?\(.+?\\?\)\.keep\.previous[\r\n\s]*[\r\n\s]*?[\x22\x27]contentArea 2 0 0 1
1726 1726 \/vw\.php\?i=[a-fA-F0-9]+?\-[a-fA-F0-9]+?$ 2 0 0 1
1727 1727 ^[\x11\x21-\x26\x41\x45\x70-\x79] 2 0 0 1
1728 1728 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
1729 1729 ^.{0,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.jsp\x22 2 0 0 1
1730 1730 ^..[\x81\x82\x83\x84\x85\x86\x87]\x81 2 0 0 1
1731 1731 ^..[\x81\x82\x83\x84\x85\x86\x87]\x83 2 0 0 1
1732 1732 ^..[\x81\x82\x83\x84\x85\x86\x87]\x84 2 0 0 1
1733 1733 ^..[\x81\x82\x83\x84\x85\x86\x87]\x85 2 0 0 1
1734 1734 REGISTER.{400} 2 0 0 1
1735 1735 SELECT.+geometrycollectionfromwkb 2 0 0 1
1736 1736 SELECT.+WHERE.+SELECT.+\x60 2 0 0 1
1737 1737 ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA 2 0 0 1
1738 1738 ^Authorization\x3A Basic.{120}/Hmi 2 0 0 1
1739 1739 ^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi 2 0 0 1
1740 1740 ^[^\x00]+?\x00 2 0 0 1
1741 1741 ^[^\x00]+?\x00 2 0 0 1
1742 1742 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E 2 0 0 1
1743 1743 ^Cache-Control\x3a\x20(max-age=0|no-cache)\r?$ 2 0 0 1
1744 1744 ^\/\?id=[0-9]{13}&msg= 2 0 0 1
1745 1745 ^13\d{11} 2 0 0 1
1746 1746 ^Callback\x3a\x20<http[^>]+><http 2 0 0 1
1747 1747 ^[^\r\n]*uuid\x3a[^\r\n\x3a]{181} 2 0 0 1
1748 1748 ^[^\r\n]+#[^\x22\r\n]{2049} 2 0 0 1
1749 1749 ^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181} 2 0 0 1
1750 1750 ^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181} 2 0 0 1
1751 1751 ^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181} 2 0 0 1
1752 1752 ^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181} 2 0 0 1
1753 1753 M-SEARCH\s+[^\n]{500} 2 0 0 1
1754 1754 (\/\.){70,} 2 0 0 1
1755 1755 [\w]{70,} 2 0 0 1
1756 1756 \xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF] 2 0 0 1
1757 1757 ^.{27} 2 0 0 1
1758 1758 [0-9a-zA-Z]{200,} 2 0 0 1
1759 1759 (GET).\/%.{1586,} 2 0 0 1
1760 1760 ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE) 2 0 0 1
1761 1761 [^a-zA-Z0-9]+\.message 2 0 0 1
1762 1762 \x3d[^\x26]{720} 2 0 0 1
1763 1763 ENTER\x20LANGUAGE\x20\x3D.{55} 2 0 0 1
1764 1764 [a-zA-Z0-9]{1000,} 2 0 0 1
1765 1765 \xbc[\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4] 2 0 0 1
1766 1766 \xae[\xef\xcf][\xf0\xd0][\xe5\xc5][\xee\xce]\xa0\xa2[\xe7\xc7][\xe5\xc5][\xf4\xd4]\xa2 2 0 0 1
1767 1767 [\xf3\xd3][\xe8\xc8][\xe5\xc5][\xec\xcc][\xec\xcc][\xe5\xc5][\xf8\xd8][\xe5\xc5][\xe3\xc3][\xf5\xd5][\xf4\xd4][\xe5\xc5] 2 0 0 1
1768 1768 [\xf6\xd6][\xe2\xc2][\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4] 2 0 0 1
1769 1769 Cookie\:\ +REMOTE_ADDR= 2 0 0 1
1770 1770 Authorization\x3a\s*Basic\s*[a-zA-Z0-9]{255,}== 2 0 0 1
1771 1771 \x2findex\x2etmpl(\x3a\x3a\x24DATA|\x2f|\x2e)\x0d\x0a 2 0 0 1
1772 1772 \/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+& 2 0 0 1
1773 1773 \.php\?sex=\d+&children=\d+&userid= 2 0 0 1
1774 1774 ^SSH-\s[^\n]{200} 2 0 0 1
1775 1775 value\x22[^\x22]*\x2Eswf\x3finfo\x3D 2 0 0 1
1776 1776 ^(CLIENT|MACHINE)_INFO 2 0 0 1
1777 1777 Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H 2 0 0 1
1778 1778 \/tmp\/[^\/]+\.pdf$ 2 0 0 1
1779 1779 \/tmp\/[^\/]+\.jar$ 2 0 0 1
1780 1780 ^Directory 2 0 0 1
1781 1781 ^HEAD[^s]{432} 2 0 0 1
1782 1782 ^PUT[^s]{432} 2 0 0 1
1783 1783 ^POST[^s]{432} 2 0 0 1
1784 1784 ^TRACE[^s]{432} 2 0 0 1
1785 1785 ^DELETE[^s]{432} 2 0 0 1
1786 1786 ^LOCK[^s]{432} 2 0 0 1
1787 1787 ^MKCOL[^s]{432} 2 0 0 1
1788 1788 ^COPY[^s]{432} 2 0 0 1
1789 1789 ^MOVE[^s]{432} 2 0 0 1
1790 1790 \x2Frequests\x2Fstatus\x2Exml\x3F[^\x0A\x0D]*input\x3D[^\x0A\x0D\x26\x3B]{1000} 2 0 0 1
1791 1791 ^\/[0-9]{5}\.jar$ 2 0 0 1
1792 1792 Host\x3a \d{4,}[^A-Za-z\.] 2 0 0 1
1793 1793 ^\/[0-9]$ 2 0 0 1
1794 1794 ^\/[a-z]{13,14}\.jar$ 2 0 0 1
1795 1795 ^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$ 2 0 0 1
1796 1796 ^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$ 2 0 0 1
1797 1797 T.*?T.*?Y.*.*?R.*?O.*?M.*.*?T 2 0 0 1
1798 1798 [0-9a-zA-Z]{10} 2 0 0 1
1799 1799 [0-9a-zA-Z]{10} 2 0 0 1
1800 1800 Host\x3a \d{4,}[^A-Za-z\.] 2 0 0 1
1801 1801 ^\/m[a-zA-Z0-9-_]{3,14}\/[a-zA-Z0-9-_]{3,17}$ 2 0 0 1
1802 1802 SELECT data FROM [^\x20]+?\x20INTO DUMPFILE [\x27\x22]c\x3a\/windows\/system32\/[a-z0-9_-]+?\.exe[\x27\x22] 2 0 0 1
1803 1803 [a-zA-Z0-9]{5} 2 0 0 1
1804 1804 [0-9a-zA-Z]{50} 2 0 0 1
1805 1805 \x90{200} 2 0 0 1
1806 1806 ^\s+A{500} 2 0 0 1
1807 1807 ^[\r\n\s]*?\x28[^\x29]*?shellcode 2 0 0 1
1808 1808 ^[\r\n\s]*?\x28[^\x29]*?shellcode 2 0 0 1
1809 1809 \.(php|asp|py|exe|htm|html)\/[joewxy](U[0-9a-f]{8})?H[0-9a-f]{8}V[0-9a-f]{8}\d{3}R[0-9a-f]{8}\d{3}T[0-9a-f]{8,} 2 0 0 1
1810 1810 [\r\n\s]+(<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(=var1)\.run 2 0 0 1
1811 1811 ^((>>).)+?#([46][1-9a-fA-F]|[57][\daA]) 2 0 0 1
1812 1812 ^\s*?fun\s*?\( 2 0 0 1
1813 1813 [\?&]mail=[^&]+?[\x3b\x2c\x7c\x27] 2 0 0 1
1814 1814 WSH\.run\x28\x5c+?[\x22\x27][a-z0-9_-]+?\.exe 2 0 0 1
1815 1815 ^(90|0x5a|0+?132)\s*?,\s*?(71|0x47|0+?107)\s*?,\s*?(70|0x46|0+?106)\s*?,\s*?(48|0x30|0+?60)\s*?,\s*?(89|0x59|0+?131)\s*?,\s*?(84|0x54|0+?124)\s*?,\s*?(112|0x70|0+?160) 2 0 0 1
1816 1816 \/\??[a-f0-9]{60,}(\x3b\d+){1,4}$ 2 0 0 1
1817 1817 \/\??[a-f0-9]{60,}\x3b4[0-1]\d{5}$ 2 0 0 1
1818 1818 ^\/([a-z0-9]{3,7}\/)?[a-z]{3,7}\.swf$ 2 0 0 1
1819 1819 ^(25)?282176\x25(25)?29\x25(25)?26chrw\x25(25)?2801 2 0 0 1
1820 1820 ^Referer\x3a[^\r\n]+\/gate.php\r$/Hm 2 0 0 1
1821 1821 Host\x3a\x20(\.*[a-f0-9]\.*){32}\./Hm 2 0 0 1
1822 1822 ^( Systems|\.com\/techsupport) 2 0 0 1
1823 1823 ^\s*?(<v1>[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(=v1)\s*?\x29\s*?(dim\s*?)?(<v2>[^\s\x3d]+)\s*?\x3d\s*?(=v2)\+Cstr\x28\s*?Chr\x28(=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(=v2) 2 0 0 1
1824 1824 ^[0-9][^=] 2 0 0 1
1825 1825 ^\s*?\d[\d\x2e]{255} 2 0 0 1
1826 1826 ^\s*?\d[\d\x2e]{255} 2 0 0 1
1827 1827 \s+?trigger\s+?[^\x20]+?\s+?after\s+?insert\s+?on\s+? 2 0 0 1
1828 1828 ^..[^\x00]+\x00 2 0 0 1
1829 1829 ^..[^\x00]+\x00 2 0 0 1
1830 1830 ^..[^\x00]+\x00 2 0 0 1
1831 1831 ^..[^\x00]+\x00 2 0 0 1
1832 1832 ^([^>]*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])([^>]*?\swidth\s*\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*\s*?[\x22\x27]0[\x22\x27] 2 0 0 1
1833 1833 ^(<addr1>.{4})(<addr2>.{4})(=addr2)(=addr1) 2 0 0 1
1834 1834 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1
1835 1835 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1
1836 1836 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1
1837 1837 Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true 2 0 0 1
1838 1838 ^=\s*\x22\s*[^\s\x22\x28]{1000} 2 0 0 1
1839 1839 ^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1}){300} 2 0 0 1
1840 1840 ^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d+?&){3,}[a-z\_\-]{4,10}=-?[a-z0-9]+$ 2 0 0 1
1841 1841 ^\s*\[\s*[\x22\x27]\\u[a-f0-9]{4}\\u[a-f0-9]{4} 2 0 0 1
1842 1842 ^[^\x00]+\x00\x00\x01 2 0 0 1
1843 1843 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1
1844 1844 ^.{6}[^\x00]+ 2 0 0 1
1845 1845 ^.{6}[^\x00]+ 2 0 0 1
1846 1846 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1
1847 1847 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1
1848 1848 ^\x20+\x3a\x20([0-9A-F]{2}\x3a){5}[0-9A-F]{2}\x0d\x00\x0a 2 0 0 1
1849 1849 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1850 1850 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1851 1851 ^(\x01((\x01((\x04((\x03(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x04(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?|\x02(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?))?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|\x02([\x01\x02\x03\x04])?|\x03([\x01\x02])?))?|\x03((\x03(\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e])?)?)?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13])?|\x02([\x01\x02])?))?|\x05((\x02(\x01([\x01\x02\x03\x04\x05\x06\x07])?)?|\x01([\x01\x02\x03])?))?|\x02(([\x01\x02]|\x03(\x01([\x01\x02\x03])?)?))?|\x06(\x01([\x01\x02\x03\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x07([\x01\x02])?|\x04))?|\x02((\x02([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|(\x01)?\x01))?) 2 0 0 1
1852 1852 ^(\x41\xd8\x41\xd8\x41\xdc){2,}\x41\x00 2 0 0 1
1853 1853 ^\s*\x28\s*retPtrAddr\.add\s*\x28\s*i\s*\*\s*8\s*\x29\s*,\s*rop\s*\x5b 2 0 0 1
1854 1854 ^\S+?drivestoredirect 2 0 0 1
1855 1855 ^\s*(f0VMR|9FTE|\/RUxG) 2 0 0 1
1856 1856 ^\s*=\s*[\x27\x22]\s*POST 2 0 0 1
1857 1857 ^.*?[\x24\x60] 2 0 0 1
1858 1858 ^\s*=\s*[^>]*file\x3a[^>]*\/\x24MFT\/ 2 0 0 1
1859 1859 ^\s*(\x28|\%28)s 2 0 0 1
1860 1860 ^\s*\d*[^\x20-\x7e\r\n\t] 2 0 0 1
1861 1861 ^[\x30-\x3f\x7D] 2 0 0 1
1862 1862 ^[\x30-\x3f\x7D] 2 0 0 1
1863 1863 AUTH\s+\S+\s+([a-zA-Z0-9\+\/=]{4})*[a-zA-Z0-9\+\/=]{3}\s 2 0 0 1
1864 1864 ^\s*((>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(document|s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1
1865 1865 legal[^x7B]*\x7B[^\x7D]*restore 2 0 0 1
1866 1866 legal[^x7B]*\x7B[^\x7D]*restore 2 0 0 1
1867 1867 errordict\s+\x2Finvalidfileaccess 2 0 0 1
1868 1868 errordict\s+\x2Finvalidfileaccess 2 0 0 1
1869 1869 \x2Ebindnow[^\x7D]*\x7D\s*stopped 2 0 0 1
1870 1870 \x2Ebindnow[^\x7D]+\x7D\s*stopped 2 0 0 1
1871 1871 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
1872 1872 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
1873 1873 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
1874 1874 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
1875 1875 ^\s* 2 0 0 1
1876 1876 ^\s* 2 0 0 1
1877 1877 ^\s* 2 0 0 1
1878 1878 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){5} 2 0 0 1
1879 1879 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7} 2 0 0 1
1880 1880 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7} 2 0 0 1
1881 1881 Template=.*\.\. 2 0 0 1
1882 1882 act\x3D[^\x26\s\r\n]{257} 2 0 0 1
1883 1883 app\x3D[^\x26\s\r\n]{257} 2 0 0 1
1884 1884 [\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,} 2 0 0 1
1885 1885 ^[\x50-\x59] 2 0 0 1
1886 1886 ^[^\r\n]*?\x60[^\x60]*?\$\{IFS\} 2 0 0 1
1887 1887 \bsolusvmc-node\b 2 0 0 1
1888 1888 ^\s*?\(\s*?[^,\s]*?\s*?,\s*?[\x22\x27][a-f0-9]{100} 2 0 0 1
1889 1889 ^mail\s*?from\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b 2 0 0 1
1890 1890 ^(\x25(25)*?20|\s)*?runmumaa\W 2 0 0 1
1891 1891 ^\s*?(<var>[^=\s\x3b]+)\s*\s*?getBits\(\s*?\)\x3b.+?flashvars\s*\s*?\x5c\x22(=var)\s*\s*?\x22\s*?\+\s*?(=var)\s*?\+\s*?\x22\x5c\x22 2 0 0 1
1892 1892 ^[a-z-]+\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b.*\x3b.*\x7d\s*\x3b(=[\r\n]) 2 0 0 1
1893 1893 ^\s*\x28\s*[\x22\x27]\s*message 2 0 0 1
1894 1894 ^(\.|\[\s*?[\x22\x27])defineProperties\s*?\x28 2 0 0 1
1895 1895 ^[^\r\n]+\.hta\r?\n 2 0 0 1
1896 1896 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1
1897 1897 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1
1898 1898 ^(<num_value>\d+)\x7d,\x22id\x22\x3a(=num_value) 2 0 0 1
1899 1899 ^[(\x60|%60)(\x27|%27)] 2 0 0 1
1900 1900 ^\/(home\/a3user|root)\/agile3\/patches\/ 2 0 0 1
1901 1901 ^.*?\x26 2 0 0 1
1902 1902 (\x0a|\\n)\/s1Caa6 2 0 0 1
1903 1903 ^(\\r\\n|\x0d\x0a)C 2 0 0 1
1904 1904 ^\d{3} 2 0 0 1
1905 1905 ^(https\/\/|(\d{1,3}\.){3}\d{1,3}|([a-z0-9-]+\.)+[a-z]{1,8}) 2 0 0 1
1906 1906 ^(==[A-Z0-9+/]{2}|=[A-Z0-9+/]{3}|[A-Z0-9+/]{4})([A-Z0-9+/]{4})*$ 2 0 0 1
1907 1907 ^[A-Za-z0-9+/]{2}([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
1908 1908 [\?\&]cmd_param=[^\&\r\n]{500} 2 0 0 1
1909 1909 (%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))) 2 0 0 1
1910 1910 ^.{11}([\xC0-\xC1]|[\xF5-\xFF]|\xE0[\x80-\x9F]|\xF0[\x80-\x8F]|[\xC2-\xDF]([\x80-\xBF])|[\xE0-\xEF]([\x80-\xBF]{2})|[\xF0-\xF4]([\x80-\xBF]{3})|([\x00-\x7F\xF5-\xFF])[\x80-\xBF]|([\xC2-\xDF]|[\xE0-\xEF]|[\xE0-\xEF][\x80-\xBF]|[\xF0-\xF4]|[\xF0-\xF4][\x80-\xBF]|[\xF0-\xF4][\x80-\xBF]{2})[\x80-\xBF]|([\xE0-\xEF])[\x80-\xBF]([\x80-\xBF])|([\xF0-\xF4])[\x80-\xBF]([\x80-\xBF]{2})|([\xF0-\xF4][\x80-\xBF])[\x80-\xBF]([\x80-\xBF])) 2 0 0 1
1911 1911 ^[^\x22]*[\x24\x60]+ 2 0 0 1
1912 1912 ^[^\x22]*[\x24\x60]+ 2 0 0 1
1913 1913 ^[a-z0-9\-_\.\/]+\x00 2 0 0 1
1914 1914 ^SOAPAction\x3a\s+?[^\r\n]*?http\x3a\/\/purenetworks\.com\/HNAP1\/([^\x2f]+?[\x2f])?[^\x2f] 2 0 0 1
1915 1915 \/dev-report-overview\.html[^\"]*?\x3b 2 0 0 1
1916 1916 ^\s*\x22{2} 2 0 0 1
1917 1917 ^[\x22\x27]t(eamviewer(\d+|api)|v(c(hat|ontrol)|filetransfer|joinv|present|s(endfile|q(customer|support))|v(ideocall|pn))\d) 2 0 0 1
1918 1918 ^Host\x3a[^\n]{0,50}?\x3b 2 0 0 1
1919 1919 ^[\s>] 2 0 0 1
1920 1920 ^[\s>] 2 0 0 1
1921 1921 ^((\x0d\x0a).)+\x22(https?|file):\x2f\x2f 2 0 0 1
1922 1922 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1923 1923 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1924 1924 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1925 1925 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1926 1926 ^\s*?\x29 2 0 0 1
1927 1927 ^\s*?\(x\s*,\s*1,\s*24000\s*\x29 2 0 0 1
1928 1928 ^\s*[\x22\x27][^\x22\x27]{0,128}\x2e\x2e 2 0 0 1
1929 1929 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1
1930 1930 =\s*\x25\s*\{\s*.+?\bProcessBuilder\b 2 0 0 1
1931 1931 ^[ a-zA-Z0-9+_]*[\x27\x3b] 2 0 0 1
1932 1932 destination=[^&]*\x24\x28 2 0 0 1
1933 1933 name=[^&]*\x24\x28 2 0 0 1
1934 1934 ^[^&]+\x2527(UNION|SELECT) 2 0 0 1
1935 1935 [^&]*(\x60|\x24) 2 0 0 1
1936 1936 (\x60|\x24) 2 0 0 1
1937 1937 (\/GponForm\/diag_FORM\?images\/|\.html\?images\/) 2 0 0 1
1938 1938 ^((\S\:\\){2,}|\S\:\\\S\:\S\:|S\:\\\\\\([0-9]{1,3}\.){3}[0-9]{1,3}|\S\:\\\\\\([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8}) 2 0 0 1
1939 1939 ^(www\.)?(cisco|linksys)\.com\/jnap\/ 2 0 0 1
1940 1940 ^.{1,10}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) 2 0 0 1
1941 1941 (\%3C){1000} 2 0 0 1
1942 1942 A{1000} 2 0 0 1
1943 1943 id\=[^\r\n]*?(select|delete|union|update|insert) 2 0 0 1
1944 1944 ^\d{2,5}(\&|\d) 2 0 0 1
1945 1945 ^(8=|9BQQ==)\r?\n? 2 0 0 1
1946 1946 =\s*\x25\s*\{\s*(.+?\bgetRunTime\b).+?\bexec\b 2 0 0 1
1947 1947 ^[0-9]+ 2 0 0 1
1948 1948 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\[[^\x5d]*?\W 2 0 0 1
1949 1949 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\%5b[^\x5d]*?\W 2 0 0 1
1950 1950 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\[[^\x5d]*?\W 2 0 0 1
1951 1951 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\%5b[^\x5d]*?\W 2 0 0 1
1952 1952 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\[[^\x5d]*?\W 2 0 0 1
1953 1953 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\%5b[^\x5d]*?\W 2 0 0 1
1954 1954 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\[[^\x5d]*?\W 2 0 0 1
1955 1955 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
1956 1956 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\[[^\x5d]*?\W 2 0 0 1
1957 1957 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\%5b[^\x5d]*?\W 2 0 0 1
1958 1958 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\[[^\x5d]*?\W 2 0 0 1
1959 1959 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\%5b[^\x5d]*?\W 2 0 0 1
1960 1960 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\[[^\x5d]*?\W 2 0 0 1
1961 1961 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\%5b[^\x5d]*?\W 2 0 0 1
1962 1962 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\[[^\x5d]*?\W 2 0 0 1
1963 1963 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
1964 1964 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\[[^\x5d]*?\W 2 0 0 1
1965 1965 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\%5b[^\x5d]*?\W 2 0 0 1
1966 1966 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\[[^\x5d]*?\W 2 0 0 1
1967 1967 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\%5b[^\x5d]*?\W 2 0 0 1
1968 1968 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\[[^\x5d]*?\W 2 0 0 1
1969 1969 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\%5b[^\x5d]*?\W 2 0 0 1
1970 1970 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\[[^\x5d]*?\W 2 0 0 1
1971 1971 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
1972 1972 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\[[^\x5d]*?\W 2 0 0 1
1973 1973 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\%5b[^\x5d]*?\W 2 0 0 1
1974 1974 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\[[^\x5d]*?\W 2 0 0 1
1975 1975 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\%5b[^\x5d]*?\W 2 0 0 1
1976 1976 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\[[^\x5d]*?\W 2 0 0 1
1977 1977 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\%5b[^\x5d]*?\W 2 0 0 1
1978 1978 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\[[^\x5d]*?\W 2 0 0 1
1979 1979 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
1980 1980 ping_addr=[\d.]*[^\d.] 2 0 0 1
1981 1981 \?write_(m(ac|sn)|hdv|pid|tan)&[^&]*\x3b 2 0 0 1
1982 1982 ^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\} 2 0 0 1
1983 1983 ^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\} 2 0 0 1
1984 1984 pjl\x5Fready\x5Fmessage\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1
1985 1985 ^[^=]{1,}$ 2 0 0 1
1986 1986 ^\x22[^\x22]*\x3b[^\x22]*\x22/P 2 0 0 1
1987 1987 ^\s*[\x22\x27] 2 0 0 1
1988 1988 \.hta([?&]|$) 2 0 0 1
1989 1989 ^[A-Za-z0-9+/]{0,4}?[^\x20-\x7e] 2 0 0 1
1990 1990 \%(25)?temp\% 2 0 0 1
1991 1991 ^[a-zA-Z0-9]+$ 2 0 0 1
1992 1992 [^&]*(\x60|\x24) 2 0 0 1
1993 1993 ^User-Agent\x3a[^\r\n]*JDatabaseDriverMysqli/Hmi 2 0 0 1
1994 1994 (localhost|127\.0\.0\.1)/W 2 0 0 1
1995 1995 ^[^\r\n]{128,}\r\n 2 0 0 1
1996 1996 ^[^\+]+\+0A 2 0 0 1
1997 1997 ^[^\+]+(\+[A-F0-9]{2}){4,} 2 0 0 1
1998 1998 ^.{0,100}\+0A.{0,100}\x40 2 0 0 1
1999 1999 ^[^\r\n]{50,} 2 0 0 1
2000 2000 ^\S{0,7}\/(meeting|fb\/smb|namedusers|metric) 2 0 0 1
2001 2001 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1
2002 2002 ^(((:?0x[a-f0-9]{2}|0+?\d{1,3})\s*?,\s*?)*?\d{1,3})(((:?0x[a-f0-9]{2}|\d{1,3})\s*?,\s*?)*?0+?\d{1,3})(((:?0+?\d{1,3}|\d{1,3})\s*?,\s*?)*?0x[a-f0-9]{2})((:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?,\s*?)+(:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?\) 2 0 0 1
2003 2003 ^form(Ping|Tracert)$ 2 0 0 1
2004 2004 ^form(Ping|Tracert)$ 2 0 0 1
2005 2005 ^.{1,50}\/uapi-cgi\/ 2 0 0 1
2006 2006 ^.{1,50}\/uapi-cgi\/ 2 0 0 1
2007 2007 ^[^&]{150,} 2 0 0 1
2008 2008 ^[^&]{150,} 2 0 0 1
2009 2009 \bexec\b 2 0 0 1
2010 2010 parent=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1
2011 2011 oId=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1
2012 2012 [^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1
2013 2013 ^\s+?[^\s\>]+?\s+?SYSTEM\s 2 0 0 1
2014 2014 ^[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1
2015 2015 ^[A-Z]{8}\x3a 2 0 0 1
2016 2016 ^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5bnull\x5d 2 0 0 1
2017 2017 ^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5b\x5d 2 0 0 1
2018 2018 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
2019 2019 ^.{0,5}(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
2020 2020 ^\s*(<worker>[A-Za-z0-9_-]{1,20})\s*=\s*null\x3b.{1,300}(=worker)\s*=\s*document\.getElementById\([\x22\x27](=worker)[\x22\x27]\)\x3b.{1,300}\.addEventListener\([\x22\x27]DOMNodeInserted[\x22\x27]\s*,\s*(<callback0>[A-Za-z0-9_-]{1,20}).{0,300}(=worker)(<worker_ext>(\.\w{1,20})+)\s*=\s*\d+\x3b.{1,300}function\s*(=callback0)\([^\)]+\)\s*\{\s*.{1,300}\.requestAnimationFrame\((<callback>[A-Za-z0-9_-]{1,20})\)\x3b.{1,300}function\s*(<garbagecollector>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*.{0,100}for\s*\(let\s*(<gc_counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=gc_counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=gc_counter)(\+{2}|-{2})\s*\)\s*.{1,300}function\s*(=callback)\([^\)]+\)\s*\{\s*.{1,300}(=garbagecollector)\(\)\s*\x3b\s*.{1,300}\((=worker)(=worker_ext)\) 2 0 0 1
2021 2021 ^\s*(<opt>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*let\s*(<o_var>[A-Za-z0-9_-]{1,20})\s*=\s*\{\}\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=o_var)\.(<x_prop>[A-Za-z0-9_-]{1,20}).{1,300}for\s*\(\s*let\s*(<counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)(\+{2}|-{2})\).{1,100}(=opt)\(\).{1,300}let\s*(<leaked_stack_obj>[A-Za-z0-9_-]{1,20})\s*=\s*null.{1,100}let\s*(<obj_proto>[A-Za-z0-9_-]{1,20})\s*=\s*\(\{\}\)\.__proto__\x3b.{1,300}(=obj_proto)\.__defineGetter__\([\x22\x27](=x_prop)[\x22\x27],\s*Error\.prototype\.toString\)\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=obj_proto)\.__defineGetter__\([\x22\x27](<message_proto>[A-Za-z0-9_-]{1,20})[\x22\x27].{1,300}delete\s*(=obj_proto)\.(=message_proto)\x3b.{1,300}(=obj_proto)\.\w+\s*=\s*Array\.prototype.{1,300}(=opt) 2 0 0 1
2022 2022 ^\s*(<func_opt>[\w-]{1,20})\((<var_a>[\w-]{1,20})\s*,\s*(<var_b>[\w-]{1,20}).{1,300}((=var_a)\.(=var_b)|(=var_b)\.(=var_a))\s*=\s*\d+\x3b\s*((=var_a)|(=var_b))\.push\(\d+\)\x3b\s*((=var_a)\.(=var_a)|(=var_b)\.(=var_b))\s*=\s*0x.{1,300}Object\.prototype\.push\s*=\s*Array\.prototype\.push\x3b\s*for\s*\(\s*let\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\).{1,300}let\s*((=var_a)|(=var_b))\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}\x3b.{1,300}(=func_opt)\(((=var_a)|(=var_b)),\s*\{\}.{1,300}let\s*(<var_o>[\w-]{1,20})\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}.{1,300}(=func_opt)\((=var_o) 2 0 0 1
2023 2023 ^\s*(<func_a>[\w-]{1,20})\((<obj1>[\w-]{1,20})\s*,\s*(<tmp_obj>[\w-]{1,20})\s*,\s*(<value>[\w-]{1,20})\).{1,300}(=obj1)\.\w+\s*=\s*\d+\.\d+\x3b\s*var\s*\w+\s*=\s*\{__proto__:\s*(=tmp_obj)\}\x3b\s*(=obj1)\.\w+\s*=\s*(=value)\x3b.{1,300}var\s*(=obj1)\s*=\s*\{\w+:\s*\d+\.\d+\s*,\s*\w+:\s*\d+\.\d+\}\x3b\s*for\s*\(\s*var\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\)\s*\{\s*(=func_a)\((=obj1)\s*,\s*(\x22{2}|\x27{2})\s*,\s*(\x22{2}|\x27{2})\)\x3b.{1,300}(=func_a)\((=obj1)\s*,\s*(=obj1)\s*,\s*\d+\.\d{8,}.{1,300}eval\((=obj1)\. 2 0 0 1
2024 2024 ^form(RebootCheck|Wsc)$ 2 0 0 1
2025 2025 ^[^&]{42,} 2 0 0 1
2026 2026 ^[^&]{512,} 2 0 0 1
2027 2027 ^Callback\x3a\x20\x3chttp[^\x3a]+\x3a\d{1,5}[^\/]/Hmi 2 0 0 1
2028 2028 ^[^&]{90,} 2 0 0 1
2029 2029 ^\d[012345] 2 0 0 1
2030 2030 ^\d[012345] 2 0 0 1
2031 2031 ^\d[012345] 2 0 0 1
2032 2032 ^\d[012345] 2 0 0 1
2033 2033 ^\d[012345] 2 0 0 1
2034 2034 ^\d[012345] 2 0 0 1
2035 2035 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e) 2 0 0 1
2036 2036 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e) 2 0 0 1
2037 2037 ^[^&\x0d\r]+[\n\x0a] 2 0 0 1
2038 2038 ^\s*(<func_a>[\w\-]{1,20})\((<obj_1>[\w\-]{1,20})\s*,\s*(<obj_2>[\w\-]{1,20}).{1,300}(=obj_1)\.(<prop_2>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,300}?(=obj_2)\.pop\(\).{1,300}?(=obj_1)\.(<prop_1>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,500}Object\.prototype\.p(op|ush)\s*=\s*Array\.prototype\.p(op|ush)\x3b.{1,500}var\s*(<obj_3>[\w\-]{1,20})\s*=\s*\{\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)?\s*,\s*((=prop_2)\s*\x3a\s*\d+(\.\d+)?|(=prop_2)\s*\x3a\s*\d+(\.\d+)?\s*,\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)).{1,500}(=func_a)\(\s*((=obj_3)\s*,\s*new\s*Object\(\)|\s*new\s*Object\(\)\s*,\s*(=obj_3)\s*).{1,500}?(=func_a)\((=obj_3) 2 0 0 1
2039 2039 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
2040 2040 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
2041 2041 ^[^&\r\n]+(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
2042 2042 ^(%[a-f0-9]{2}){5,} 2 0 0 1
2043 2043 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
2044 2044 ^%(3b|0a|26|60|7C|24) 2 0 0 1
2045 2045 ^\/(icons|cgi-bin) 2 0 0 1
2046 2046 ^\/(icons|cgi-bin) 2 0 0 1
2047 2047 ^\/(icons|cgi-bin) 2 0 0 1
2048 2048 [^\r\n]*true 2 0 0 1
2049 2049 \x2f(FURUKAWA|APROS)\x2f 2 0 0 1
2050 2050 [^\r\n]*(\x60|\x24|\x7c|\bsh\b) 2 0 0 1
2051 2051 ^[^\r\n=]*(union|select) 2 0 0 1
2052 2052 ^[^&=]*(union|select) 2 0 0 1
2053 2053 ^(<class>[A-Z0-9_-]{1,20})\s*.*?(<var>[A-Z0-9_-]{1,15})\s*=\s*(&amp\x3b|0x|\\x|&?h)*\d{8}\s*.*?(ReDim|Dim)\s*(=var)\(\d{4,20}\).*?set\s*(=var)\(\d+\)\s*=\s*new\s*(=class).*?Erase\s*(=var).*?Erase\s*(=var) 2 0 0 1
2054 2054 ^[^\x22]+\.jsp\x22 2 0 0 1
2055 2055 ([\x60\x3b\x7c]|%60|%3b|%7c|%26|(\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
2056 2056 ^[\s\x22\x27]*check_ping\b 2 0 0 1
2057 2057 ^\s*(<obj>[\w\-]{1,20})\s*=\s*document\.getElementById\(.{1,500}Class\s*(<class>[\w\-]{1,20}).{1,500}End\s*Class.{1,500}set\s*(=obj)\.scroll((Left|Top)(Max)?|Height|Width)\s*=\s*New\s*(=class) 2 0 0 1
2058 2058 [^\r\n]*\x5c(n|c)[^\r\n]{0,100}[\x60\x24] 2 0 0 1
2059 2059 ([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
2060 2060 ^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
2061 2061 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1
2062 2062 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1
2063 2063 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
2064 2064 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
2065 2065 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
2066 2066 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
2067 2067 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
2068 2068 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
2069 2069 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
2070 2070 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
2071 2071 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
2072 2072 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
2073 2073 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
2074 2074 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
2075 2075 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
2076 2076 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
2077 2077 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
2078 2078 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
2079 2079 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1
2080 2080 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1
2081 2081 \.((php\d{0,}|phps|pht|phtm|phtml|shtml|htaccess|phar|inc)) 2 0 0 1
2082 2082 ^[^&]{100,} 2 0 0 1
2083 2083 ^[a-zA-Z0-9]+\.(zip|7z|gz) 2 0 0 1
2084 2084 ^(\x28|\x29|\x3c|\x3e|\x26|\x2a|\xe2|\x80|\x98|\x7c|\x3f|\x3b|\x5b|\x5d|\x5e|\x7e|\x21|\x2e|\xe2|\x80|\x9d|\x25|\x40|\x2f|\x5c|\x3a|\x2b|\x2c|\x60) 2 0 0 1
2085 2085 ^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr) 2 0 0 1
2086 2086 ^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr) 2 0 0 1
2087 2087 ^[0-9]{1,10}\x3b 2 0 0 1
2088 2088 ^(%2e|\.)exec 2 0 0 1
2089 2089 ^[a-zA-Z0-9]{5,40} 2 0 0 1
2090 2090 ^[a-zA-Z0-9]{7,200} 2 0 0 1
2091 2091 ^\d+..([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))-XX:OnOutOfMemoryError= 2 0 0 1
2092 2092 ^[^&=]*(union|select|update|insert|delete) 2 0 0 1
2093 2093 ^[^&=]*(union|select|update|insert|delete) 2 0 0 1
2094 2094 ((%2F|\/)(\.|%2E){2}(%2F|\/)) 2 0 0 1
2095 2095 ((%2F|\/)(\.|%2E){2}(%2F|\/)) 2 0 0 1
2096 2096 ^(%2E%2E%2F|\.\.\/) 2 0 0 1
2097 2097 ^[a-zA-Z0-9]{5,45} 2 0 0 1
2098 2098 ^([A-Z]\x00){20}\x00\x00 2 0 0 1
2099 2099 (InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI) 2 0 0 1
2100 2100 (InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI) 2 0 0 1
2101 2101 (InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI) 2 0 0 1
2102 2102 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
2103 2103 ^SOAPAction\x3a\x20\x22?urn\x3aNETGEAR-ROUTER\x3aservice\x3a.{128,}(:\d#)/Hm 2 0 0 1
2104 2104 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
2105 2105 ^[a-zA-Z0-9+/]{1000,} 2 0 0 1
2106 2106 \We[\s\x22\x27,+]*?v[\s\x22\x27,+]*?a[\s\x22\x27,+]*?l\W 2 0 0 1
2107 2107 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
2108 2108 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
2109 2109 ^[^<]{30,}<\/NewMACAddress> 2 0 0 1
2110 2110 ^0+(&|$) 2 0 0 1
2111 2111 ^0+(&|$) 2 0 0 1
2112 2112 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
2113 2113 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
2114 2114 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
2115 2115 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
2116 2116 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
2117 2117 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
2118 2118 ^\/(icons|cgi-bin) 2 0 0 1
2119 2119 ^\/(icons|cgi-bin) 2 0 0 1
2120 2120 ^\/(icons|cgi-bin) 2 0 0 1
2121 2121 ^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
2122 2122 (yJ0eXAiOiJKV1Qi|InR5cCI6IkpXVCJ)/H 2 0 0 1
2123 2123 ^(CREATE|SELECT|INSERT|UPDATE|EXEC) 2 0 0 1
2124 2124 ^["']\s*:\s*["']\s*[^0-9]+ 2 0 0 1
2125 2125 ^\s?([\x3b\x0a\x26\x60\x7c\x24]|%(3b|0a|26|60|7c|24)) 2 0 0 1
2126 2126 ^\s*=\s*[\x22\x27]\s*ms-msdt\x3a 2 0 0 1
2127 2127 (\x2e|%2e)(\x2e|%2e)(\x2f|%2f) 2 0 0 1
2128 2128 myname=[^&]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
2129 2129 ^\x2fdefault\x2fen_US\x2fframe(\x2eA100)?\x2ehtml\?(content|sidebar)=.*\x2e\x2e\x2f 2 0 0 1
2130 2130 ^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
2131 2131 ^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
2132 2132 [^a-zA-Z0-9_\-\.][a-zA-Z]{8}\.jar 2 0 0 1
2133 2133 ^\s?(file|https?)\x3a 2 0 0 1
2134 2134 ^(\/?\.\.?\/){2} 2 0 0 1
2135 2135 \b(<xps>[a-zA-Z]{7})\.classPK.+?\b(=xps)\[a-zA-Z]{12}\.classPK.+?\b(=xps)\$[a-zA-Z]{12}\.classPK 2 0 0 1
2136 2136 ^[\r\n\s\+]*.+?\}[\r\n\s]*?catch 2 0 0 1
2137 2137 ^(application\/(x-)?|text\/)xml 2 0 0 1
2138 2138 ^(application\/(x-)?|text\/)xml 2 0 0 1
2139 2139 \/((index|toc)\.html?)?\?\/\/ 2 0 0 1
2140 2140 ^.{0,10}[\x3b\x0a\x26\x60\x7c\x24] 2 0 0 1
2141 2141 [?&]ap= 2 0 0 1
2142 2142 ^\d+\s*[^\r\n]{50,} 2 0 0 1
2143 2143 (web|decorators|seraph-config)\x2exml$ 2 0 0 1
2144 2144 com.atlassian.jira\x2f(jira\x2dwebapp\x2ddist|atlassian\x2djira\x2dwebapp)\x2fpom\x2e(properties|xml)$ 2 0 0 1
2145 2145 ^[^\x3c]{,100}\x27 2 0 0 1
2146 2146 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
2147 2147 ^(Begin|End)\=/P 2 0 0 1
2148 2148 \/\?[a-f0-9]{64}\;\d\;\d 2 0 0 1
2149 2149 \x7b?(visibility\x3ahidden|display\x3anone)\x3b?\x7d?\x22><div>\d{16} 2 0 0 1
2150 2150 \/[a-z]\/[0-9a-f]{32}$ 2 0 0 1
2151 2151 \/dl\/\w{1,4}\.php\?[0-9]$ 2 0 0 1
2152 2152 \/[a-f0-9]{60,}_js\? 2 0 0 1
2153 2153 \/[a-f0-9]{60,}_jar$ 2 0 0 1
2154 2154 \/[a-f0-9]{60,}_exe$ 2 0 0 1
2155 2155 ,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+, 2 0 0 1
2156 2156 ^\/showthread\.php\?t=\d+$ 2 0 0 1
2157 2157 function\x20booom[1-3]{1}\x28\x29 2 0 0 1
2158 2158 var\x20Cute(Money|Power|Shine) 2 0 0 1
2159 2159 iframe[^\r\n]*\x2FCUTE-IE\x2Ehtml 2 0 0 1
2160 2160 ^\/[a-z][0-9a-z_+=-]{10,30}\?\w=[0-9.]+\&\w=1.6.0_\d\d$ 2 0 0 1
2161 2161 \.php\?(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+$ 2 0 0 1
2162 2162 \/[a-z0-9]+\.[a-z0-9]{2,4}\/eH[a-z0-9]{60,}$ 2 0 0 1
2163 2163 \/[a-z0-9]+\.[a-z0-9]{2,4}\/oH[a-z0-9]{60,}$ 2 0 0 1
2164 2164 \/indigo\?\d+ 2 0 0 1
2165 2165 ^\/\?[a-f0-9]{32}$ 2 0 0 1
2166 2166 =[.\"]\w{8}\.jar/Hi 2 0 0 1
2167 2167 \.php\?showtopic=[0-9]{6}$ 2 0 0 1
2168 2168 \/[0-9]\.html$ 2 0 0 1
2169 2169 ^\?[a-f0-9]{32}\" 2 0 0 1
2170 2170 ^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$ 2 0 0 1
2171 2171 ^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$ 2 0 0 1
2172 2172 ^\/t\/[a-f0-9]{32} 2 0 0 1
2173 2173 \/[A-Z]{20,}\?[A-Z]=\d$ 2 0 0 1
2174 2174 ^\/q[a-zA-Z0-9+-]{3,14}\/[a-zA-Z0-9+-]{3,16}\?[a-z]{1,6}=[a-zA-Z0-9+-\._]{7,18}$ 2 0 0 1
2175 2175 ^\/Applet\.jar$ 2 0 0 1
2176 2176 \/beacon\/[a-f0-9]{8}\.htm$ 2 0 0 1
2177 2177 \/t\/[a-f0-9]{32}$ 2 0 0 1
2178 2178 ^\/[0-9]{3}\.jar$ 2 0 0 1
2179 2179 ^[\r\n\s]*[\d\x5b] 2 0 0 1
2180 2180 ^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.jar$ 2 0 0 1
2181 2181 ^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.pdf$ 2 0 0 1
2182 2182 \/[0-9]{3}\.pdf 2 0 0 1
2183 2183 \(\x22[0-9\x3a\x3b\x3c\x3d\x3e\x3fa-k]{50,100}\x22\).{0,200}\)\x3b<\/script><\/body> 2 0 0 1
2184 2184 ^[a-f0-9]{32} 2 0 0 1
2185 2185 ^((<\/applet>).)+?\/.{1,12}\/.{1,12}\x3a.{1,12}p.{1,12}t.{1,12}t.{1,12}h 2 0 0 1
2186 2186 ^(\s*=\s*|[\x22\x27]\s*,\s*)[\x22\x27] 2 0 0 1
2187 2187 ^[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])(((=q)).)+?\.(gif|jpe?g|p(ng|sd))(=q) 2 0 0 1
2188 2188 ^((<\/applet>).)+[\r\n\s]value[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])[a-f0-9]{32}(=q1) 2 0 0 1
2189 2189 ^\/[a-z0-9A-Z]{25,35}\/(([tZFBeDauxR]+q){3}[tZFBeDauxR]+(_[tZFBeDauxR]+)?|O7dd)k(([tZFBeDauxR]+q){3}[tZFBeDauxR]+|O7dd)\/ 2 0 0 1
2190 2190 EGYPACK_CRYPT\d 2 0 0 1
2191 2191 \/\?[0-9a-f]{60,66}\x3b(1(0[0-3]|1\d)|90)\d{1,3}\x3b\d{1,3}$ 2 0 0 1
2192 2192 ^(ckwm)*?(Exp|cc)\.class 2 0 0 1
2193 2193 ^\/command\/[a-zA-Z]{6}$ 2 0 0 1
2194 2194 &b=[a-f0-9]{7}&k=[a-f0-9]{32} 2 0 0 1
2195 2195 ^(a(ttack|dEx[xp])|([a-z]))\.class 2 0 0 1
2196 2196 ^(a(ttack|dEx[xp])|([a-z]))\.class 2 0 0 1
2197 2197 ^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27]((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){10}|(=ascii){10}) 2 0 0 1
2198 2198 ^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27][^\x22\x27]+?[\x22\x27][^>]*((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){9,20}|(=ascii){9,20})%3C 2 0 0 1
2199 2199 ^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$ 2 0 0 1
2200 2200 ^\/[0-9]{1,2}\/red[0-9]{1,4}\.php[0-9]{0,1}$ 2 0 0 1
2201 2201 \.php\?(b=[a-fA-F0-9]{6}&)?v=1\.((4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{1,2})$ 2 0 0 1
2202 2202 &k=\d{16}(&|$) 2 0 0 1
2203 2203 ^(((?i:<\/applet>)).)+?[\r\n\s]value[\r\n\s]*[\r\n\s]*?[\x22\x27]?(\d{2,3})?(<sep>([^a-zA-Z0-9]{1,100}|[a-zA-Z0-9]{1,100}))\d{2,3}((=sep)\d{2,3}){20} 2 0 0 1
2204 2204 ^(((?i:<\/applet>)).)+?[\r\n\s]archive[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27] 2 0 0 1
2205 2205 &b=[a-f0-9]{7}&k=[a-f0-9]{32} 2 0 0 1
2206 2206 if.{1,10}[<>]=?\s*(<quot>[\x22\x27])1(<sep>[^0-9a-zA-Z])7((=sep)\d+)?(=quot).{1,10}[<>]=?\s*(=quot)1(=sep)7((=sep)\d+)?(=quot) 2 0 0 1
2207 2207 ^[\r\n\s]*[\r\n\s]*?[\x22\x27]http\x3a\/\/[^\/]+?\/\?[A-Za-z0-9]+=[A-Za-z0-9%]{60,}[\x22\x27] 2 0 0 1
2208 2208 ^[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\x22\x27]\.replace\([\r\n\s]*?(<q1>[\x22\x27]?)\/.+?\/g[\r\n\s]*?,[\r\n\s]*?(<q2>[\x22\x27]?)%(=q2)[\r\n\s]*?\) 2 0 0 1
2209 2209 (<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{12,16}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a) 2 0 0 1
2210 2210 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27] 2 0 0 1
2211 2211 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(<dot>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<p>((=dot))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<h>(((=p)|(=dot)))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=p).+?value[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(=dot)([^a-f0-9]{2}){1,20}(<e>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<x>((=e))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=e)(([^a-f0-9]{2}){1,20})?[\x22\x27] 2 0 0 1
2212 2212 \/[a-f0-9]{32}\/[a-z]+?\-[a-z]+?\.php 2 0 0 1
2213 2213 \.php\?e=\d+(&|$) 2 0 0 1
2214 2214 ^[\r\n\s]*?[\x22\x27][a-f0-9]{2}(<sep>[^a-f0-9]{1,10})(<a>[a-f0-9]{2})(=sep)(<p>[a-f0-9]{2})(=sep)(=p)(=sep)(<l>[a-f0-9]{2})(=sep)(<e>[a-f0-9]{2})[^\x22\x27]+?(=sep)(=p)(=sep)(=a)(=sep)[a-f0-9]{2}(=sep)(=a)(=sep)[^\x22\x27]+?(=sep)(=a)(=sep)(=l)(=sep)[a-f0-9]{2}(=sep)(=e) 2 0 0 1
2215 2215 \/cod\/[^\x2f]+\.vbs$ 2 0 0 1
2216 2216 [a-f0-9]{32}\.jar 2 0 0 1
2217 2217 ^[^a-z0-9] 2 0 0 1
2218 2218 \.php\?dwl=[a-z]+$ 2 0 0 1
2219 2219 ^[\r\n\s]*[\r\n\s]*?[\x22\x27]h(<sep>\d{2})t(=sep)t(=sep)p(=sep)\x3a 2 0 0 1
2220 2220 ^[\r\n\s]*?[\x22\x27]<([\x27\x22]\s*?\+\s*?[\x22\x27])?a([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?l([\x27\x22]\s*?\+\s*?[\x22\x27])?e([\x27\x22]\s*?\+\s*?[\x27\x22])?t 2 0 0 1
2221 2221 ^\/ep\/cl\.php$ 2 0 0 1
2222 2222 ^[\r\n\s]*?[\x22\x27]<applet 2 0 0 1
2223 2223 =\d+&e=\d+$ 2 0 0 1
2224 2224 \/\d+\/\d\.zip$ 2 0 0 1
2225 2225 (<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{10,20}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a) 2 0 0 1
2226 2226 (<a>[0-9a-z]{2})(<s>((=a))[0-9a-z]{2})[0-9a-z]{2}(=s)[0-9a-z]{2}(<y>[0-9a-z]{2})[0-9a-z]{4}(<dot>[0-9a-z]{2})(=a)(<r>[0-9a-z]{2})(=r)(=a)(=y)(=dot) 2 0 0 1
2227 2227 ^[\r\n\s]*?\( 2 0 0 1
2228 2228 \/[a-z0-9]{32}\.jar$ 2 0 0 1
2229 2229 ^[^\s]*?\s*?\/[^\r\n\s]*?\?src= 2 0 0 1
2230 2230 ^\/([\/_]*?[a-f0-9][\/_]*?){32}\/\d+?$ 2 0 0 1
2231 2231 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?\/([\/_]*?[a-f0-9][\/_]*?){64}[\x22\x27] 2 0 0 1
2232 2232 ^\/([\/_]*?[a-f0-9][\/_]*?){32}$ 2 0 0 1
2233 2233 ^\/[a-zA-Z0-9_\x2f-]{300,}\.jar$ 2 0 0 1
2234 2234 ^\/[a-zA-Z0-9_\x2f-]{300,}\.eot$ 2 0 0 1
2235 2235 ^((<\/applet>).)+?[\x22\x27]687474703a2f2f 2 0 0 1
2236 2236 \.html\?sv=[1-5](\,\d+?){1,3}$ 2 0 0 1
2237 2237 \/(d|xie|fla)\.php\?[a-z]+687474703a2f2f 2 0 0 1
2238 2238 \.html\?jar$ 2 0 0 1
2239 2239 ^\/\d{4,5}\/\d{7}$ 2 0 0 1
2240 2240 \/\{0,2}[A-Za-z0-9\+\/]+?LvoDc0RHa8NnZ$ 2 0 0 1
2241 2241 ^[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*?\.charCodeAt[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*[\r\n\s]*?\)[\r\n\s]*?\^[\r\n\s]*?[a-zA-Z_$][^\r\n\s]*\.charCodeAt[\r\n\s]*?\( 2 0 0 1
2242 2242 ^(<sep>[^\x22\x27]{1,10})100(=sep)97(=sep)115(=sep)104(=sep)115(=sep)116(=sep)121(=sep)108(=sep)101(=sep)46(=sep)97(=sep)114(=sep)114(=sep)97(=sep)121(=sep) 2 0 0 1
2243 2243 ^[a-z0-9]{1,500}?(<s>[a-z0-9]{2})(<t>((=s))[a-z0-9]{2})(<r>(((=s)|(=t)))[a-z0-9]{2})(=t)(<o>(((=s)|(=t)|(=r)))[a-z0-9]{2})(<b>(((=s)|(=t)|(=r)|(=o)))[a-z0-9]{2})(<y>(((=s)|(=t)|(=r)|(=o)|(=b)))[a-z0-9]{2})(=t)((((=s)|(=t)|(=r)))[a-z0-9]{4})(=s)(=t)(=r) 2 0 0 1
2244 2244 ^\/[a-z0-9]+?\?thread=\d+?&x?key=[A-F0-9]{32}$ 2 0 0 1
2245 2245 ^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x) 2 0 0 1
2246 2246 ^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x) 2 0 0 1
2247 2247 ^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x) 2 0 0 1
2248 2248 \/[A-Z]\.xml$ 2 0 0 1
2249 2249 ^(<sep>((100).){1,20})100(=sep)101(=sep)102(=sep)97(=sep)117(=sep)108(=sep)116(=sep)35(=sep)86(=sep)77(=sep)76(=sep) 2 0 0 1
2250 2250 \.php\?a=[^&]+&f=[a-f0-9]{32}&u=[^&]+$ 2 0 0 1
2251 2251 \.php\?a=(dw[a-z0-9]|[hr][2-7])$ 2 0 0 1
2252 2252 (PK\x01\x02.{24}\x0a\x00.{16}[a-z]{4}.class){4} 2 0 0 1
2253 2253 ^(((?i:<\/applet>)).)+?(?i:value)[\r\n\s]*=[\r\n\s]*\x5c?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]+(=slash) 2 0 0 1
2254 2254 ^\d+u\d+s\d+h\d 2 0 0 1
2255 2255 ^((<\/applet>).)+?&#(0*?(1([0-1]\d|2[0-2])|[78][0-9]|9[07-9]|4[8-9]|5[0-7]|6[5-9])|x0*?([46][1-9A-F]|[57][0-9A]|3[0-9]))(\x3b|&#) 2 0 0 1
2256 2256 ^\s*?\d 2 0 0 1
2257 2257 ^\s*\s*?[\x22\x27][^\x22\x27\x3d]{1,20}=[a-f0-9]{20} 2 0 0 1
2258 2258 ^[^\d]{1,20}100[^\d]{1,20}101[^\d]{1,20}102[^\d]{1,20}97[^\d]{1,20}117[^\d]{1,20}108[^\d]{1,20}116[^\d]{1,20}35[^\d]{1,20}86[^\d]{1,20}77[^\d]{1,20}76 2 0 0 1
2259 2259 ^\s*?<<\s*?\/[A-Z0-9a-z]+\([A-Z0-9a-z]+\)\s*? 2 0 0 1
2260 2260 ^\/[a-f0-9]{32}\.php\?q=[a-f0-9]{32}$ 2 0 0 1
2261 2261 \.php\?req=(swf(IE)?|x(ap|ml)|jar|mp3)& 2 0 0 1
2262 2262 (\0[a-z]{3}\.classPK.{43}){4} 2 0 0 1
2263 2263 ^[\x22\x27] 2 0 0 1
2264 2264 ^\s*\s*?window\.document\.createElement 2 0 0 1
2265 2265 ^(<sep>[^\x22\x27]{0,10})6f(=sep)6c(=sep)6c(=sep)65(=sep)63(=sep)74(=sep)47(=sep)61(=sep)72(=sep)62(=sep)61(=sep)67(=sep)65(=sep) 2 0 0 1
2266 2266 \/3\/[a-f0-9]{32}\/http\x3a\x2f 2 0 0 1
2267 2267 \/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+)?$ 2 0 0 1
2268 2268 ^\x2Fload\x5Fmodule\x2Ephp\x3Fuser\x3D(n1|11?|2)$ 2 0 0 1
2269 2269 ^\x2Fmodules\x2F(n[u3]|1|2)\x2Eswf$ 2 0 0 1
2270 2270 ^\x2Fmodules\x2F(1|2)\x2Ejar$ 2 0 0 1
2271 2271 ^\s*?\(\s*?[\x22\x27]Flash[\x22\x27] 2 0 0 1
2272 2272 ^\s*?[\x22\x27][A-Za-z0-9\s]{500} 2 0 0 1
2273 2273 ^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}<script>var 2 0 0 1
2274 2274 ^[\r\n\s]*?<script>[\r\n\s]*?[A-Za-z]+[\r\n\s]*[\r\n\s]*?[\x22\x27][A-Za-z]{9}\x20[A-Za-z\x20]{300} 2 0 0 1
2275 2275 ^\/[a-z]\?[a-z]=[0-9]{5,}$ 2 0 0 1
2276 2276 [^0-9a-f]{1,3}68[^0-9a-f]{1,3}74[^0-9a-f]{1,3}74[^0-9a-f]{1,3}70[0-9a-f]{1,3}3a 2 0 0 1
2277 2277 ^[\x22\x27] 2 0 0 1
2278 2278 ^(e(vtmgr|ext)|actmon|nciesc|EBC32|comm|tdi)\.sys[\x22\x27] 2 0 0 1
2279 2279 ^([\x22\x27]\s*?\])?\(\s*?(\[[\x22\x27])?rc4([\x22\x27]\s*?\])?\(\s*?[\x22\x27][^\x22\x27]+?[\x22\x27]\s*?,\s*?(\[[\x22\x27])?hex2bin([\x22\x27]\s*?\])?\( 2 0 0 1
2280 2280 ^[\x22\x27] 2 0 0 1
2281 2281 ^[\x22\x27] 2 0 0 1
2282 2282 ^[\x22\x27] 2 0 0 1
2283 2283 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\?\&]e=\d+[\x22\x27] 2 0 0 1
2284 2284 ^[\r\n\s]*?\,[\r\n\s]*?[\x22\x27][\%\\]u" 2 0 0 1
2285 2285 ^(((<\/object>).)+?codebase\s*\s*?[\x22\x27]spl[\x22\x27])(((<\/object>).)+?\/x-java-applet) 2 0 0 1
2286 2286 ^[\w.]*?\.class 2 0 0 1
2287 2287 ^\s*\s*?[\x22\x27]\- 2 0 0 1
2288 2288 ^\s*\s*?[\x22\x27]\- 2 0 0 1
2289 2289 \/Fqxzdh\.jar$ 2 0 0 1
2290 2290 ^\s*?\(\s*?[\x22\x27](AgControl\.AgControl)[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?\.[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?[\x22\x27]\s*?\.\s*?replace\s*?\( 2 0 0 1
2291 2291 ^id=[^&]+&dom=687474703a2f2f[a-f0-9]+2e706870\s*?$/Ps 2 0 0 1
2292 2292 [^=]+(([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+?2e)+([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+\s*?/P 2 0 0 1
2293 2293 \.php\?spl=[\w_]+$ 2 0 0 1
2294 2294 ^Content-Disposition\x3a[^\r\n]+\.swf/Hm 2 0 0 1
2295 2295 Referer\x3a[^\r\n]+\.php\/\[\[DYNAMIC\]\]\/\d/Hm 2 0 0 1
2296 2296 ^\s*?[\x3a\x3d]\s*?[\x22\x27]?\- 2 0 0 1
2297 2297 ^\/f(\/[^\x2f]+)?\/14\d{8}(\/\d{9,10})?(\/\d)+(\/x[a-f0-9]+(\x3b\d)+?)?$ 2 0 0 1
2298 2298 ^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{14,}\.html(\x3a\d{1,5})?\r$/Hm 2 0 0 1
2299 2299 ^(<sep>.{1,50})u(=sep)n(=sep)c(=sep)t(=sep)i(=sep)o(=sep)n(=sep)\s 2 0 0 1
2300 2300 ^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}(\r\n)*?<script>[^\r\n]+?\We[\x22\x27\+]*?v[\x22\x27\+]*?a[\x22\x27\+]*?l\W 2 0 0 1
2301 2301 ^(<sep>.{1,20})\.___\+(=sep)\._\\\+(=sep)\._\\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+(=sep)\.\\\_\+(=sep)\.\\__\+(=sep)\.__\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.___\+(=sep)\.\\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\\_\+(=sep)\._\_\+(=sep)\.\_\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\__\+(=sep)\.\\\\+(=sep)\.\\\$_\+ 2 0 0 1
2302 2302 ^\/(pruncd)?flashhigh\.swf$ 2 0 0 1
2303 2303 ^\/(pruncd)?flashlow\.swf$ 2 0 0 1
2304 2304 ^\/(pruncd)?silverapp1\.xap$ 2 0 0 1
2305 2305 \?action=lnd$ 2 0 0 1
2306 2306 \?action=(pld|exp)&exp= 2 0 0 1
2307 2307 ^Referer\x3a[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+\d/Hm 2 0 0 1
2308 2308 \/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Z-a-z]{18}\.jnlp$ 2 0 0 1
2309 2309 \/k\?t[a-z]*=\d{5,}$ 2 0 0 1
2310 2310 ^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f 2 0 0 1
2311 2311 ^\/[^\x2f]*?flashhigh\.swf$ 2 0 0 1
2312 2312 ^\/[^\x2f]*?flashlow\.swf$ 2 0 0 1
2313 2313 ^\/[^\x2f]*?iebasic\.html$ 2 0 0 1
2314 2314 ^\/[^\x2f]*?silverapp1\.xap$ 2 0 0 1
2315 2315 \/[a-z]{3,7}\.php$ 2 0 0 1
2316 2316 \/([a-z0-9]{1,7}\.php)?\?zho= 2 0 0 1
2317 2317 ^\/[a-f0-9]{32}\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Za-z]+\.(html|jar|swf)$ 2 0 0 1
2318 2318 ^\/Drop2(-\d+)\.swf$ 2 0 0 1
2319 2319 ^[^\r\n]*?(<name>\/[^\.\/]+\.html)\?[a-z]+?\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(\d{1,5})?\r\n 2 0 0 1
2320 2320 ^Content-Disposition\x3a[^\r\n]+\.swf/Hm 2 0 0 1
2321 2321 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi 2 0 0 1
2322 2322 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi 2 0 0 1
2323 2323 ^\s*?\x28\s*?[a-z0-9]{4,6}\s*?\x28\s*?[a-z0-9]{1,3}\s*?,\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x29\s*?\x3b\s*?(<var>[a-z0-9]{1,3})\s*?\x3d\s*?\x28\s*?(=var)\s*?\x2b\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x25\s*?[a-z0-9]{1,3}\.length\x3b 2 0 0 1
2324 2324 ^[A-Za-z0-9]+\x27\s*?src=\x27http\x3a[^\x27]+[\x27]\s*width=1\d\s+height=1\d\s+ 2 0 0 1
2325 2325 ^Last-Modified\x3a\x20[^A-Za-z]{2}/Hm 2 0 0 1
2326 2326 ^\/ABs[A-Za-z0-9_]+(\/x?[a-f0-9]+(\x3b\d+)+)?$ 2 0 0 1
2327 2327 ^\/AwoVG[A-Za-z0-9_]+$ 2 0 0 1
2328 2328 ^[a-z0-9]+\x2A\x2F\x22\x6F\x66\x74\x2E 2 0 0 1
2329 2329 ^Referer\x3a[^\r\n]+?rowedmedia\.com\/search\.php\r?$/Hmi 2 0 0 1
2330 2330 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r\n)/Hmi 2 0 0 1
2331 2331 ^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f 2 0 0 1
2332 2332 ^[a-zA-Z0-9]{9}<\/[^>]+>\s+?<[^\s]+\sid=\x22[a-zA-Z]{3,5}\x22\sstyle=\x22display\x3anone\x22>[A-Za-z0-9]{500} 2 0 0 1
2333 2333 ^[a-z]{7}(\s*?[a-z]+\s*?)*?[a-z]{7,}\x2a\x2f 2 0 0 1
2334 2334 nb[\d+]=Yes 2 0 0 1
2335 2335 ^(<vname>[A-Za-z0-9]+)\s*\s*?navigator.userAgent.toLowerCase\x28\x29\x3b.+?if\(document.cookie[^\r\n]+\([^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]b[\x22\x27+\s]*o[\x22\x27+\s]*t[\x22\x27+\s]*[\x22\x27][^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]s[\x22\x27+\s]*p[\x22\x27+\s]*i[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*r[\x22\x27+\s]*[\x22\x27] 2 0 0 1
2336 2336 ^Referer\x3a[^\r\n]+?\x3a\d+[^\r\n]*?\/[a-z0-9]+\.php\?[a-z0-9]+=\d+(\r\n|&)/Hm 2 0 0 1
2337 2337 ^GET \/(<name>a[a-z]{9,})\/.+?\r\nHost\x3a\x20(=name)\. 2 0 0 1
2338 2338 ^\s*?[\x22\x27][^\x22\x27]+\.php\?id=\d+[\x22\x27] 2 0 0 1
2339 2339 ^\W 2 0 0 1
2340 2340 ^[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(<arg>[a-z0-9]{3,})(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28[^\x29]+\x29\x3b\x2f\x2a[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(=arg)(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28 2 0 0 1
2341 2341 ^\s*?\d+,\s*?\d 2 0 0 1
2342 2342 ^\s*?\d+,\s*?\d 2 0 0 1
2343 2343 \/14\d{8}(\.jar)?$ 2 0 0 1
2344 2344 ^[a-z0-9]*\r\n/H 2 0 0 1
2345 2345 ^[a-z0-9]*\r\n/H 2 0 0 1
2346 2346 filename=[a-z0-9]*\r\n/H 2 0 0 1
2347 2347 \/\??4c2H($|[&?]utm_source=) 2 0 0 1
2348 2348 (Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P 2 0 0 1
2349 2349 (Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P 2 0 0 1
2350 2350 (Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P 2 0 0 1
2351 2351 \/([A-Za-z]{0,3}\d)(\d{0,3}[A-Za-z])[A-Za-z0-9]{4,5}\.swf$ 2 0 0 1
2352 2352 ^\s*[^>]*?[a-zA-Z]+\s*\s*?[\x22\x27]([a-z]{0,20}[A-Z])([A-Z]{0,20}[a-z])[A-Za-z]{15,21}[\x22\x27][^>]*([A-Za-z_]{0,200}[0-9])([0-9a-z_]{0,200}[A-Z])([0-9A-Z_]{0,200}[a-z])[A-Za-z0-9_]{200} 2 0 0 1
2353 2353 \/5\/[a-f0-9]{32}\/\x20*http\x3a\x2f 2 0 0 1
2354 2354 ^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f 2 0 0 1
2355 2355 ^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/Hm 2 0 0 1
2356 2356 ^\s*?[\x22\x27][^\x22\x27a-f0-9]68[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]70[^\x22\x27a-f0-9]3a[^\x22\x27a-f0-9]2f[^\x22\x27a-f0-9]2f[^\x22\x27]+?[^\x22\x27a-f0-9]00[\x22\x27] 2 0 0 1
2357 2357 ^\/[a-f0-9]{32}\/e\.html$ 2 0 0 1
2358 2358 Host\x3a\x20a[a-z]{10}\.[a-z]{5}\./H 2 0 0 1
2359 2359 \.js\?ver=[0-9]\.[0-9]{2}\.[0-9]{4}$ 2 0 0 1
2360 2360 \/\d\/?[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.html&[a-z]+=[^&]+&[a-z]+=\d{3}\.\d{3}\.\d{3,}(\.\d{3,})?$ 2 0 0 1
2361 2361 \/\d\/?[A-Z]+\/[a-f0-9]{40}\/$ 2 0 0 1
2362 2362 \/([a-z0-9]{0,10}[A-Z])([A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,20}\.jar$ 2 0 0 1
2363 2363 \?([a-z\d\x3d&\x2e]*?[A-Z])([A-Z\d=&\x2e]*?[a-z])([A-Za-z=&\x2e]*?\d)[A-Za-z\d=&\x2e]{50,}$ 2 0 0 1
2364 2364 ^\/([a-z0-9]+\/)?[^\x2f]+\?[a-z]{1,40}_id=\d{2,5}?&[a-z]{1,40}_id=\d{2,5}&[^&\x3d]+(_id)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$ 2 0 0 1
2365 2365 &cat_no=\d{2,5}?&no=\d{2,5}&[^&\x3d]+(_no)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$ 2 0 0 1
2366 2366 \x3capplet[^\x3e]+visibility[^\x3e]+hidden[^\x3e] 2 0 0 1
2367 2367 ^\s*?[a-z]+\s*\s*?\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b] 2 0 0 1
2368 2368 ^\s*? 2 0 0 1
2369 2369 ^\/[0-9a-f]{32}\.html$ 2 0 0 1
2370 2370 ^\/[a-z\_\-]{4,20}\.php\?([a-z\_\-]{4,20}=\d+?&){3,}[a-z\_\-]{4,20}=-?\d+$ 2 0 0 1
2371 2371 ^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{4,10}=\d{1,3}&){7,}[a-z\_\-]{4,10}=-?\d+$ 2 0 0 1
2372 2372 ^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d{1,3}&){3,}[a-z\_\-]{4,10}=-?\d+$ 2 0 0 1
2373 2373 \.jpg$ 2 0 0 1
2374 2374 ^\s+\d+\x3b\s*\} 2 0 0 1
2375 2375 ^\/([a-z][a-z\x2f]*\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d)[a-z0-9\x2f]+\/$ 2 0 0 1
2376 2376 ^\/([a-z][a-z\x2f]*-[a-z\x2f]+-)[a-z\x2f-]+\/$ 2 0 0 1
2377 2377 ^http\x3a\/\/[^\x2f]+\/[A-Z]([a-z0-9]+[A-Z])([A-Z0-9]+[a-z])[A-Za-z0-9]{9,}\.html?\r?$/Hmi 2 0 0 1
2378 2378 \.js\?chebstr=0\.\d+$ 2 0 0 1
2379 2379 \.js\?chbstr=0\.\d+$ 2 0 0 1
2380 2380 ^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*script\s*\)\x3b 2 0 0 1
2381 2381 ^\/([a-z\d]+[+-][a-z\d]+[+-][a-z\d]+[+-])[a-z\d+-]*\/$ 2 0 0 1
2382 2382 ^\s*\(\s*[\x22\x27][\x00-\x09\x80-\xff][\x22\x27]\s*\)\s*\x3b\s*[A-Za-z0-9]+\s*=\s*[\x22\x27] 2 0 0 1
2383 2383 ^\s*\x27[^\x27]+\x27width=\x27250\x27\sheight=\x27250\x27>\s*<\/iframe>\s*<\/div> 2 0 0 1
2384 2384 ^[\x3b\x2c]postRequest\x28cfg\.urlSoftDetectorCallback 2 0 0 1
2385 2385 ^[\r\n\s]*?Base64\.decode[\r\n\s]*?\x28[\r\n\s]*?[\x22\x27] 2 0 0 1
2386 2386 Referer\x3a\x20http\x3a\x2f\x2f[^\r\n\x2f]+\/index\.php\?[^\x3d&]+=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=)?\r\n/H 2 0 0 1
2387 2387 ^[^\n]*\x29\x3b$ 2 0 0 1
2388 2388 ^\s*(<var>[^\r\n\s\x3d\x2c\x3b]+)\s*=[^\n]*<iframe([^\n>]*top\x3a-\d+px\x3b)[^\n>]+src\s*=\s*\x5c?[\x22\x27]http[^\n>]+>\s*<\/iframe>\x22\x3bdocument\.write\((=var)\)\x3b\s*$ 2 0 0 1
2389 2389 ^[^\x2f\x22\x27]+\/\?[^=&\x22\x27]+=l3S 2 0 0 1
2390 2390 ^.{16}[a-z]{3}\.dll 2 0 0 1
2391 2391 ^.{16}[a-z]{4}\.dll 2 0 0 1
2392 2392 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{7,8}\d{2,3}\.pdf\r\n/Hm 2 0 0 1
2393 2393 \.php\?setup=d&s=\d+&r=\d+$ 2 0 0 1
2394 2394 \/\?[a-z0-9]{65,}\x3b \d\x3b \d 2 0 0 1
2395 2395 ^\/wordpress\/\?[A-Za-z0-9]{4}(&utm_source=le)?$ 2 0 0 1
2396 2396 (NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp) 2 0 0 1
2397 2397 (NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp) 2 0 0 1
2398 2398 \/\?nbVykj$ 2 0 0 1
2399 2399 ^s?\x3a\x2f\x2f[^\x22\x27]+\/\?[A-Za-z0-9]{5,6}(=[^&\x22\x27]+)?[\x22\x27]\x29\x3bsetCookie\(\x22popundr\x22,1,864e5\)\} 2 0 0 1
2400 2400 ^(<var>[A-Z0-9a-z]{1,20})\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29 2 0 0 1
2401 2401 ^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.[a-z]+\?time=[^&]+&stamp=[a-z]*\d+(\.[a-z]*\d+)+$ 2 0 0 1
2402 2402 ^[^\r\n]+\/%(3A|20)http%3A%2F%2F/Hmi 2 0 0 1
2403 2403 ^\/\?3b[A-Z0-9a-z]{2}(&subid=[^&]*)?$ 2 0 0 1
2404 2404 ^\/[a-z]+\/$ 2 0 0 1
2405 2405 ^\s*\([\x22\x27][A-F0-9a-f]{32}[\x22\x27]\s*\)\s*\x3b\s*}\s*catch\s*\(e\)\s*\{\s*\}\s*\}\s*<\/script>\s*<\/body> 2 0 0 1
2406 2406 ^([^>]*? name\s*=\s*[\x22\x27]flashvars)[^>]*? value\s*=\s*[\x22\x27]url=https?\x3a[^\x22\x27]*?\.wasm 2 0 0 1
2407 2407 ^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22(\!(\x22\s*?\+\s*?\x22)?)?Q(\x22\s*?\+\s*?\x22)?Q\x22 2 0 0 1
2408 2408 ^(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{2}(<J>[0-9a-z]{2})[0-9a-z]{4}(=v)[0-9a-z]{6}(=space)[0-9a-z]{2}(=space)[0-9a-z]{64}(=J)(=a)(=v)(=a) 2 0 0 1
2409 2409 ^\d{3}px\x3b\swidth\x3a3\d{2}px\x3b\sheight\x3a3\d{2}px\x3b\x22>[^<>]*?<iframe src=[\x22\x27][^\x22\x27]+[\x22\x27]\swidth=[\x22\x27]2\d{2}[\x22\x27]\sheight=[\x22\x27]2\d{2}[\x22\x27]><\/iframe>[^<>]*?\n[^<>]*?<\/span> 2 0 0 1
2410 2410 \/[a-z]{4,20}-a\.[a-z]{4,20}\.jar$ 2 0 0 1
2411 2411 \/view.php\?i=\d&key=[0-9a-f]{32}$ 2 0 0 1
2412 2412 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.jar$ 2 0 0 1
2413 2413 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$ 2 0 0 1
2414 2414 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$ 2 0 0 1
2415 2415 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$ 2 0 0 1
2416 2416 ^\/[a-z]\/f\.php\?k=\d(&e=\d&f=\d)?$ 2 0 0 1
2417 2417 ^\/[a-z]+\/$ 2 0 0 1
2418 2418 \.php\?j=1&k=[0-9](i=[0-9])?$ 2 0 0 1
2419 2419 ^\/[a-zA-Z]{7}\.jar$ 2 0 0 1
2420 2420 \/lpdf\.php\?i=[a-zA-Z0-9]+&?$ 2 0 0 1
2421 2421 [a-z0-9]{32}\.jar 2 0 0 1
2422 2422 \/inf\.php\?id=[a-f0-9]{32}$ 2 0 0 1
2423 2423 ^\s*=\s*[\x22\x27] 2 0 0 1
2424 2424 \/vd\/\d+\x3b[a-f0-9]{32} 2 0 0 1
2425 2425 \.php\?pprec$ 2 0 0 1
2426 2426 \.php\?c002$ 2 0 0 1
2427 2427 [a-f0-9]{32}\.jar 2 0 0 1
2428 2428 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1) 2 0 0 1
2429 2429 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1) 2 0 0 1
2430 2430 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1) 2 0 0 1
2431 2431 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1) 2 0 0 1
2432 2432 [a-f0-9]{32,64}\/[a-f0-9]{32,64}/\w$ 2 0 0 1
2433 2433 \?(s|page|id)=\d+$ 2 0 0 1
2434 2434 ^[\r\n\s\+]*[\r\n\s\+]*?(<func>[_a-zA-Z][a-zA-Z0-9_-]+)\([\r\n\s]*?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]*?[\x22\x27][\r\n\s]*?,[\r\n\s]*?[\x22\x27][^\x22\x27]+[\x22\x27][\r\n\s]*?\)\+(=func) 2 0 0 1
2435 2435 \/FlashPlayer\.cpl$ 2 0 0 1
2436 2436 ^((<\/applet>).)+?[\x22\x27]1337\.exe 2 0 0 1
2437 2437 filename=[a-z]{4}\.txt\x0D\x0A/H 2 0 0 1
2438 2438 &p=\d+\.\d+\.\d+\.\d+&j=\d+\.\d+\.\d+\.\d+&f=\d+\.\d+\.\d+\.\d+$ 2 0 0 1
2439 2439 ^[\r\n\s]*[\r\n\s]*?(<q>[\x22\x27])[a-f0-9]{9,16}\.(jar|zip)(=q) 2 0 0 1
2440 2440 ^\x2Fclicker\x2Ephp$ 2 0 0 1
2441 2441 ^(<var>.{1,10})\.\\_\\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\(\!\[\]\+\x22\x22\)\[(=var)\.\_\\_\]\+(=var)\.\\\$\_\+(=var)\.\_\_\+ 2 0 0 1
2442 2442 \?(s|page|id)=\d+&text=\d+$ 2 0 0 1
2443 2443 ^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)j51[a-f0-9]{21}\.jar(=q)\r?$/Hm 2 0 0 1
2444 2444 ^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)e51[a-f0-9]{21}\.exe(=q)\r?$/Hm 2 0 0 1
2445 2445 \/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$ 2 0 0 1
2446 2446 \/\{0,2}[A-Za-z0-9\+\/]+?voDc0RHa8NnZ$ 2 0 0 1
2447 2447 ^[^\x3b\r\n\x22\x27]+?[A-Za-z0-9\/\_\-]{60,}\.exe\? 2 0 0 1
2448 2448 ^[^\x3b\r\n\x22\x27]+?\.txt\?e=\d+(&[fh]=\d)? 2 0 0 1
2449 2449 ^[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?) 2 0 0 1
2450 2450 [a-z] 2 0 0 1
2451 2451 \.exe\?(e=)?\d+$ 2 0 0 1
2452 2452 \/j\d{2}\.php\?i= 2 0 0 1
2453 2453 \/\?whole=\d+$ 2 0 0 1
2454 2454 ^\/search\/[0-9]{64} 2 0 0 1
2455 2455 \/m1[1-6]\.jar$ 2 0 0 1
2456 2456 \/[0-9]{4}\.html$ 2 0 0 1
2457 2457 \/\d+\.pkg$ 2 0 0 1
2458 2458 \/j_[a-z0-9]+_(0422|1723|3544|5076)\.jar$ 2 0 0 1
2459 2459 \/[a-z0-9]{3}\.php\?[a-z]=[a-zA-Z0-9]{10}$ 2 0 0 1
2460 2460 amor\d{0,2}\.jar 2 0 0 1
2461 2461 [a-f] 2 0 0 1
2462 2462 =(3[0-9a]|2e)+3a313[3-9](3[0-9]){8}$ 2 0 0 1
2463 2463 (<m>[0-9a-f]{2})(<sep>[^0-9a-f])(<e>((=m))[0-9a-f]{2})(=sep)([0-9a-f]{2}(=sep)){7}(=e)(=sep)(=m)(=sep)[0-9a-f]{2}(=sep)(=e)(=sep)(<d>((=e))[0-9a-f]{2})(=sep)(=d)(=sep)(=e)(=sep)(=d) 2 0 0 1
2464 2464 ^[\r\n\s]*?\([\r\n\s]*?(<q>[\x22\x27])(<m>(((=q)).)+)(=q).+?<(=m)?a(=m)?p(=m)?p(=m)l(=m)?e(=m)?t 2 0 0 1
2465 2465 \/[a-f0-9]{32}\/[a-f0-9]{32}\.jar$ 2 0 0 1
2466 2466 ^\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$ 2 0 0 1
2467 2467 \.jar\?java=\d+$ 2 0 0 1
2468 2468 ^((<\/applet>).)+?\.jar\?java=\d+ 2 0 0 1
2469 2469 ^((<\/applet>).)+?[\x22\x27]aHR0cDov 2 0 0 1
2470 2470 ^[a-f0-9]{32}=\d{1,10}\r\n/H 2 0 0 1
2471 2471 \/1[34]\d{8}\.tpl$ 2 0 0 1
2472 2472 ^[\r\n\s]*?\([\r\n\s]*?[\x22\x27]f([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?m([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?C([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?h([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?a([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?c([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?d([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?e[\x22\x27] 2 0 0 1
2473 2473 ^\/\d{1,2}(<l>[A-Z])\d{1,2}(=l)\d{1,2}(=l)\d{1,2}\.pdf$ 2 0 0 1
2474 2474 \/java\.php\?eid=[a-f0-9]{32}& 2 0 0 1
2475 2475 \/pdf\.php\?pdf=[a-f0-9]{32}& 2 0 0 1
2476 2476 [&?]type=\d+($|&) 2 0 0 1
2477 2477 ^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{32,}\.html(\x3a\d{1,5})?\r$/Hm 2 0 0 1
2478 2478 ^\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?m\d+([\x22\x27]\s*?,\s*[\x22\x27])?C\d+([\x22\x27]\s*?,\s*[\x22\x27])?h\d+([\x22\x27]\s*?,\s*[\x22\x27])?a\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?c\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?d\d+([\x22\x27]\s*?,\s*[\x22\x27])?e\d+[\x22\x27] 2 0 0 1
2479 2479 \/13[89]\d{7}.swf$ 2 0 0 1
2480 2480 \/[a-z]+\.php\?[a-z]+\d{7}&[a-z]+\d{7,8}$ 2 0 0 1
2481 2481 ^(<sep>[^\x22\x27]{0,10})75(=sep)6e(=sep)63(=sep)74(=sep)69(=sep)6f(=sep)6e(=sep)20 2 0 0 1
2482 2482 ^\d+?\*\/\s*?(<vname>[^\s\(\x3b]{1,20})\s*?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)\s*?(\/\*\d+?\*\/\s*?)?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname) 2 0 0 1
2483 2483 [&?]v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)= 2 0 0 1
2484 2484 \/1(3[89]\d{7}|4\d{8})\.xap$ 2 0 0 1
2485 2485 &dr=\d+$ 2 0 0 1
2486 2486 &nrk=\d+$ 2 0 0 1
2487 2487 ^Content-Disposition\x3a[^\r\n]+(\W14\d{8})\.pdf\r?$/Hm 2 0 0 1
2488 2488 ^(((<\/iframe>).)+?src\s*\s*?\x22http\x3a[^\x22]+16\.html\x22)(((<\/iframe>).)+?left\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)(((<\/iframe>).)+?top\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)((<\/iframe>).)+?<\/iframe>\x27\x29 2 0 0 1
2489 2489 ^\s*?[A-Z0-9a-z\+]+?\s*?\x7d 2 0 0 1
2490 2490 ^((\/[a-z]+?)*?\/\d+\/)((\/\d+?)*?\/[a-z]+?\/)(\/([a-z]+|\d+)){4,}\/[a-z]+\.pack\.gz$ 2 0 0 1
2491 2491 ^\s*?\x28\s*?(<q>[\x22\x27])(((=q)).)+?(=q)\s*?\,\s*?[\x22\x27]container[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27],\s*?[\x22\x27]9\.0\.0[\x22\x27]\s*?,\s*?false\s*?,\s*?flashvars,\s*?params\s*?,\s*?attributes\s*?\x29\s*?\x3b\s*?<\/script>\s*?<\/head> 2 0 0 1
2492 2492 \/14\d{8}(\.swf)?$ 2 0 0 1
2493 2493 \/14\d{8}(\.pdf)?$ 2 0 0 1
2494 2494 ^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.exe/Hm 2 0 0 1
2495 2495 ^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.dll/Hm 2 0 0 1
2496 2496 \/14\d{8}(\/\d+)*?(\/x[a-f0-9]+[\x3b0-9]*)?$ 2 0 0 1
2497 2497 ^\s[^\r\n]*?[\x28\x5b]\s*?[\x22\x27][^\x22\x27]?s[^\x22\x27]?u[^\x22\x27]?b[^\x22\x27]?s[^\x22\x27]?t[^\x22\x27]?r[^\x22\x27]?[\x22\x27]\s*?[\x29\x5d]\s*?(\x5d\s*?)?\x28 2 0 0 1
2498 2498 \/video.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1
2499 2499 \/player.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1
2500 2500 \/search.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1
2501 2501 ^\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28(=var1)\s*\!\s*=\s*[\x27\x22][\x22\x27]\s*?\x29\s*?\{\s*?(<var2>[^\s\x3d]+)\s*\s*?(=var1)\s*?\[ 2 0 0 1
2502 2502 \/1\.php\?r$ 2 0 0 1
2503 2503 ^[^a-z]?\x65[^a-z]?\x6e[^a-z]?\x67[^a-z]?\x74[^a-z]?\x68 2 0 0 1
2504 2504 ^\s*?[\x22\x27](<char>[^\x22\x27]+)[\x22\x27]\.replace\x28\s*?[\x22\x27](=char)[\x22\x27]\s*?, 2 0 0 1
2505 2505 \/banner.php\?sid=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1
2506 2506 \/blog.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1
2507 2507 \/main\.html$ 2 0 0 1
2508 2508 \.php\?id=[0-9A-F]{44,54}&rnd=[0-9]{3,7}$ 2 0 0 1
2509 2509 ^\/tdstest\/[a-f0-9]{32,}\/?$ 2 0 0 1
2510 2510 \/content\/dl\.php\?sl=vbs[a-z0-9]{32}$ 2 0 0 1
2511 2511 \/content\/getvbslink\.php\?d=[a-z0-9]{32}$ 2 0 0 1
2512 2512 Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H 2 0 0 1
2513 2513 ^[a-z0-9]*\r\n/H 2 0 0 1
2514 2514 ^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22 2 0 0 1
2515 2515 ^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22 2 0 0 1
2516 2516 \/street[1-5]\.php$ 2 0 0 1
2517 2517 \/XV-\d+\.exe$ 2 0 0 1
2518 2518 \/bad\/[A-Z0-9]+\.swf$ 2 0 0 1
2519 2519 \/\d\/[A-Z]+\/[a-f0-9]{32}\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?$ 2 0 0 1
2520 2520 ^\s*?[^\x28\s]*?\x28\s*?(<a1>[^\s,\x29]+)\s*?,\s*?(<a2>[^\s,\x29]+)\s*?\x29\{[^\r\n]*?[\+=]String.fromCharCode\((=a2)\)[^\r\n]*?\} 2 0 0 1
2521 2521 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.jar\r\n/Hm 2 0 0 1
2522 2522 ^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D)) 2 0 0 1
2523 2523 \b[a-z]{2}\d+\s*\s*?Yes 2 0 0 1
2524 2524 ^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x20http\x3a\x2f 2 0 0 1
2525 2525 ^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?(\.[a-z]+)?$ 2 0 0 1
2526 2526 ^[^\r\n]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?/H 2 0 0 1
2527 2527 ^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x3ahttp\x3a\x2f 2 0 0 1
2528 2528 ^Referer\x3a[^\r\n]+\/4\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?$/Hm 2 0 0 1
2529 2529 ^\s*\s*?[\x22\x27]8\.8\.8\.8[\x22\x27] 2 0 0 1
2530 2530 ^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D)) 2 0 0 1
2531 2531 Host\x3a\x20([\x2eg-z]*[a-f0-9][\x2eg-z]*){32}\./H 2 0 0 1
2532 2532 \/e\.html$ 2 0 0 1
2533 2533 ^(<var>[a-f0-9]{6})-->\s*?<script\s*?type=[\x22\x27]text\/javascript[\x22\x27]\s*?src=[\x22\x27]http\x3a\x2f[^\x22\x27]*?\/[a-z\d]{8}\.php\?id=\d+[\x22\x27]\s*<\/script><!--\/(=var)--> 2 0 0 1
2534 2534 [&?]t=[a-f0-9]{32}(&|$) 2 0 0 1
2535 2535 \/5\/[A-Z]{3,}\/[a-f0-9]{32}(\.[^\x2f]+|\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?|\/\d+\/?)?$ 2 0 0 1
2536 2536 ^\s*?[_$]+\x28\x29 2 0 0 1
2537 2537 ^\s*?[_$]+\x28\x29 2 0 0 1
2538 2538 Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)[^\r\n]*?\/search\?q=([A-Z&=\d]*?[a-z])([a-zA-Z\d&=]*?[A-Za-z=&]\d[A-Za-z])([a-zA-Z\d&=]*?[a-z\d][A-Z][A-Za-z\d])[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+[&=A-Za-z0-9]*?\r\n.*?Host\x3a\x20(=refhost)/Hsi 2 0 0 1
2539 2539 ^\s*?\w+\s*?\.\s*?charCodeAt 2 0 0 1
2540 2540 ^\/\?[a-f0-9]{32,64}$ 2 0 0 1
2541 2541 ^[^>]*?id\s*[\x22\x27][a-z0-9]+[\x22\x27][^>]*\s*?[\x2a\d]{100} 2 0 0 1
2542 2542 Referer\x3a\x20http\x3a\x2f+(<dl1>[^\x2e\r\n]+)\x2e[^\x2f\r\n]*?(<dl2>\x2e[^\x2e\r\n\x2f]+\x2e[^\x2e\x2f\r\n]+)\x2f(\??[a-f0-9]{32,64}\/?)?\r\n.*?Host\x3a\x20((=dl1))[^\r\n]*?(=dl2)\r\n/Hsm 2 0 0 1
2543 2543 Referer\x3a\x20[^\r\n]*?\/[a-f0-9]{32,64}\.swf/H 2 0 0 1
2544 2544 \.php\?id=[0-9A-F]{32,}&rnd=\d+$ 2 0 0 1
2545 2545 ^((<\/div).)+?top\x3a\s*?\x2d[0-9]+px\x3b.+left\x3a\s*?\x2d[0-9]+px\x3b.+<iframe\x20.+?stack=\d+ 2 0 0 1
2546 2546 ^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)str2long(=sep)).+?(=sep)long2str(=sep) 2 0 0 1
2547 2547 ^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)str2long(=sep) 2 0 0 1
2548 2548 ^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)long2str(=sep) 2 0 0 1
2549 2549 ^([^>]*?\sname\s*?\x3d\s*?[\x22\x27]?movie[\x22\x27]?)[^>]*?\svalue\s*?\x3d\s*?[\x22\x27][^\x22\x27]+\/(\??[a-f0-9]+)?[\x22\x27] 2 0 0 1
2550 2550 ^Host\x3a[^\r\n]*?\.pw\r$/Hmi 2 0 0 1
2551 2551 ^Host\x3a\x20[a-z0-9]+\.(g[aq]|cf|ml|tk|xyz|info|space)(\x3a\d{1,5})?\r$/Hm 2 0 0 1
2552 2552 ^\s*[a-z]+\s*\s*?(<q1>[\x22\x27])(((=q1)).)+?(=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*\s*?(<q2>[\x22\x27])(((=q2)).)+?(=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr 2 0 0 1
2553 2553 ^(<ccode>[a-f0-9]{6})-->.*?<script.+?<\/script>.*--/(=ccode)--> 2 0 0 1
2554 2554 ^\/[a-z]{2,20}\/[a-z]{2,20}\/(((featur|quot)e|ip)s|d(ropdown|etect)|co(mpiled|re)|header|jquery|lang|min|ga)\.js$ 2 0 0 1
2555 2555 ^\s*?<script>\s*?([A-Za-z][A-Za-z\d+]+\s*?\+\s*([A-Za-z][A-Za-z\d]+|[\x22\x27]\\x[2-7][0-9a-fA-F](\\x[2-7][0-9a-fA-F]){0,4}[\x22\x27])\s*?\x3b){20} 2 0 0 1
2556 2556 ^\/js\/analytic\.php\?id=\d+&tz=\-?\d+&rs=\d+x\d+$ 2 0 0 1
2557 2557 ^[\x22\x27](<script)[\x22\x27+\s]*<[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[^\r\n]+\.php\?id=\d+&tz=\x27\+tzSignature\x28\x29\+\x27&rs= 2 0 0 1
2558 2558 ^\/promo\d+(x\d+)?\/promo\.swf\?t=\d+$ 2 0 0 1
2559 2559 Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H 2 0 0 1
2560 2560 ^\s*\x28\s*[\x22\x27]<div\s*style\s*=\s*[\x22\x27]([^\x22\x27\r\n]*position\x3aabsolute\x3b)([^\x22\x27\r\n]*top\x3a\s\-\d+px\x3b)([^\x22\x27\r\n]*left\x3a\s0px\x3b)[^\r\n]*?<iframe[^\r\n>]*\s><\/i[\x22\x27]\+[\x22\x27]frame>[^\r\n]*<\/div>[\x22\x27]\s*\x29\x3b$ 2 0 0 1
2561 2561 ^#?\d+ 2 0 0 1
2562 2562 ^#?\d+ 2 0 0 1
2563 2563 ^\s*var\s*(<var>[^\s=]+)\s*=\s*document.createElement\(\s*[\x22\x27]iframe[\x22\x27](.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b 2 0 0 1
2564 2564 ^\s*\([^\x29]*(\%2F|\/)(\%5B|\[)(\%5E|)([^\x29]*(%3C|\<))([^\x29]*(%3E|\>))([^\x29]*(\%5C|\\)(\%6E|n)) 2 0 0 1
2565 2565 ^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27] 2 0 0 1
2566 2566 ^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Chrome_Font\.exe/Hmi 2 0 0 1
2567 2567 ^[^\x2f\x22\x27]+\/([^\x22\x27]*?[?&]oq=[A-Za-z0-9+\x2f_-]+([\x22\x27]|&))([^\x22\x27]*?[&?][a-z]+_[a-z]+=\d+)([^\x22\x27]*?[&?]q=) 2 0 0 1
2568 2568 ^\s*=\s*[\x27\x22](sh(ell(32)?)?|exec)=6wLrBej5\x2f\x2f 2 0 0 1
2569 2569 (value=[\x22\x27](sh(ell(32)?)?|exec)=|unescape\(EscapeHexString\(.)EB02EB05E8F9FFFFFF 2 0 0 1
2570 2570 ^\s*=\s*[\x22\x27][Hh][Tt][Tt][Pp][Ss]?\x3a\x2f\x2f[^\x2f]+\x2f([^\x2f\x22\x27]+=[^\x2f\x22\x27&]{0,5}QMvXcJ)[^\x2f\x22\x27]{90} 2 0 0 1
2571 2571 ^(rocket|java)script\x22>\s*var\s*(<ifr>[^\s=]+)\s*=\s*[\x22\x27]iframe[\x22\x27].*?\s*var\s*(<var>[^\s=]+)\s*=\s*document\.createElement\(\s*(=ifr)(.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b 2 0 0 1
2572 2572 ^[a-z]\d{3}\(new Array\( 2 0 0 1
2573 2573 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27]iddqd?\s*= 2 0 0 1
2574 2574 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=]*\s*=EB02EB05E8F9FFFFFF 2 0 0 1
2575 2575 ^[a-zA-Z0-9]{4}NzgzNDI[a-zA-Z0-9]{8}=\x22 2 0 0 1
2576 2576 ^\d{1,2}\.php$ 2 0 0 1
2577 2577 &b=[a-f0-9]{7}&k=[a-f0-9]{32} 2 0 0 1
2578 2578 ^\/[a-z]+\/$ 2 0 0 1
2579 2579 ^\/[a-z]+\/$ 2 0 0 1
2580 2580 ^GET\s*?\/stat\/load((?-i)[a-z0-9]*?[A-Z])((?-i)[A-Z0-9]*?[a-z])(<hname>[a-z0-9]+)\.php\s.+?Host\x3a\x20(=hname)\. 2 0 0 1
2581 2581 ^[0-9a-fA-F]{25}$ 2 0 0 1
2582 2582 ^[-_\w]+$ 2 0 0 1
2583 2583 \/[a-z]{2}[0-9]{3}[a-z]{2}\/LoginFacebook\.php$ 2 0 0 1
2584 2584 ^\d+$ 2 0 0 1
2585 2585 \x2Fgetfile\x2Ephp\x3Fi\x3D[0-9]\x26key\x3D[a-f0-9]{32}$ 2 0 0 1
2586 2586 ^\/[a-z]{15}[0-9]\.php$ 2 0 0 1
2587 2587 ^\d$ 2 0 0 1
2588 2588 \/\?[a-f0-9]{32}=[^&]+&[a-f0-9]{32}=[^&]+$ 2 0 0 1
2589 2589 ^\/\d{5}$ 2 0 0 1
2590 2590 \/[0-9]{2}\.html$ 2 0 0 1
2591 2591 \.php\?[a-z]=.{2}KAhFXlx9.{2}Oj[^&]+$ 2 0 0 1
2592 2592 \x2F[0-9]{3}\.pdf$ 2 0 0 1
2593 2593 ^\d{1,2}=[a-zA-Z0-9+=]{100} 2 0 0 1
2594 2594 ^\/[a-z]\.jar$ 2 0 0 1
2595 2595 \/[a-f0-9]+\.zip$ 2 0 0 1
2596 2596 ^\/\d{2,}\.[a-z0-9]+$ 2 0 0 1
2597 2597 ^\/\?[a-f0-9]{32}$ 2 0 0 1
2598 2598 \/(java(db|im|rh)|silver|flash|msie)\.php\?id= 2 0 0 1
2599 2599 ^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}\r\n<script>(var [a-zA-Z0-9]{1,20}\x3b){1,20}[a-zA-Z0-9]{1,20}\s* 2 0 0 1
2600 2600 ^Host\x3a\x20[^\.\r\n]+?\.[a-z]{2,4}\r\n 2 0 0 1
2601 2601 \/\??[a-f0-9]{60,}\x3b1\d{5}\x3b\d{1,3}$ 2 0 0 1
2602 2602 \/\??[a-f0-9]{60,}\x3b5[0-1]\d{5}$ 2 0 0 1
2603 2603 ^\/[^\x2f]+?\/\??[a-f0-9]{60,66}(\x3b\d+){1,4}$ 2 0 0 1
2604 2604 (\/[A-Z][a-z][A-Z][a-z][A-Z][a-z]|(b(m(nw|wn)|n(mw|wm)|w(mn|nm))|m(b(nw|wn)|n(bw|wb)|w(bn|nb))|n(b(mw|wm)|m(bw|wb)|w(bm|mb))|w(b(mn|nm)|m(bn|nb)|n(bm|mb))))\.jar$ 2 0 0 1
2605 2605 ^\/index\.php\?[A-Za-z0-9_-]{15}=l3S 2 0 0 1
2606 2606 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.swf\r\n 2 0 0 1
2607 2607 ^\/\?[A-Za-z0-9_-]{15}=l3S 2 0 0 1
2608 2608 \x20filename=\r\n(\r\n)?$ 2 0 0 1
2609 2609 PK\x01\x02.{42}(<dir>[a-z]{7,}\/)([a-z]+\.class)?(\xfe\xca\x00\x00)?(PK\x01\x02.{42}(=dir)[a-z]+\.class){6,}(PK\x01\x02.{42}[0-9a-z]{5,}(\.[a-z]{3})?)K\x05\x06.{18}$ 2 0 0 1
2610 2610 ^\/index\.php\?[A-Za-z0-9_-]{15}=l3S 2 0 0 1
2611 2611 \w_\.jar\?[a-f0-9]{8}$ 2 0 0 1
2612 2612 ^\d+[\r\n\x2f] 2 0 0 1
2613 2613 ^\d+[\r\n\x2f] 2 0 0 1
2614 2614 ^\d+[\r\n\x2f] 2 0 0 1
2615 2615 ^\d+[\r\n\x2f] 2 0 0 1
2616 2616 ^\d+[\r\n\x2f] 2 0 0 1
2617 2617 ^\d+[\r\n\x2f] 2 0 0 1
2618 2618 ^\d+[\r\n\x2f] 2 0 0 1
2619 2619 ^\d+[\r\n\x2f] 2 0 0 1
2620 2620 ^\d+[\r\n\x2f] 2 0 0 1
2621 2621 ^\d+[\r\n\x2f] 2 0 0 1
2622 2622 Content-Disposition\x3a[^\r\n]+\.exe-rc4\.exe\r\n 2 0 0 1
2623 2623 ^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/[a-zA-Z0-9]{12}\.php(\?[^&=]+=([a-zA-Z0-9]{8}|0(189|037)|flash|2(551|419)|6332))?$ 2 0 0 1
2624 2624 ^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/test\.mp3$ 2 0 0 1
2625 2625 ^\/\d{9,10}\/\d{4,5}$ 2 0 0 1
2626 2626 \/index\.html\?p=\d+$ 2 0 0 1
2627 2627 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?[a-f0-9] 2 0 0 1
2628 2628 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a/Hmi 2 0 0 1
2629 2629 ^(<split>.{1,10})2f(=split)64(=split)69(=split)76(=split)3e(=split)?[^\x22\x27]*[\x22\x27]\.replace\s*\(\s*[\x22\x27]?\/(=split)\/g[\x22\x27]?\s*,\s*[\x22\x27]\x25[\x22\x27]\s*\x29\s*\x3b 2 0 0 1
2630 2630 ^\s*=\s*[\x22\x27]?(10|127|172\.(1[6-9]|2[0-9]|3[01])|192\.168)\. 2 0 0 1
2631 2631 \.php\?hash=I3QxW[A-Za-z0-9\+\/]+={0,2}$ 2 0 0 1
2632 2632 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\/[a-zA-Z0-9\/\-\_]{60,}\/[a-zA-Z0-9]+\.exe\?[a-zA-Z0-9]+=[a-zA-Z0-9]+(&h=\d+)?[\x22\x27] 2 0 0 1
2633 2633 ^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27] 2 0 0 1
2634 2634 ^\s*type\s*=\s*[\x22\x27]\s*text\/javascript\s*[\x22\x27]\s*>\s+var\s*(<timestamp>[A-Za-z0-9]{1,25})\s*=\s*\(new\sDate\(\)\)\.getTime\(\)\;\s+(<url>[A-Za-z0-9]{1,25})\s*=\s*[\x22\x27]\s*[^\r\n]+\.php\?JBOSSESSION=\s*[\x22\x27]\s+(<urlvar2>[A-Za-z0-9]{1,25})\s*=\s*(=url)\s*\+\s*(=timestamp)\s+window\.location\.href\s*=\s*(=urlvar2)\s+ 2 0 0 1
2635 2635 ^\s*[\x22\x27][^\r\n]+\/[a-z0-9]{20,40}\.js[\x22\x27]\s*>\s*<\/script>\s*<\/body> 2 0 0 1
2636 2636 ^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html 2 0 0 1
2637 2637 ^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html 2 0 0 1
2638 2638 ^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html 2 0 0 1
2639 2639 ^http\:\/\/[^\r\n\x2f]+\/\?s=[a-f0-9]{32}[a-z]{2}$ 2 0 0 1
2640 2640 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
2641 2641 ^(<vars>[a-z0-9]{1,20})\s*=\s*new\s*Array\x3b\r\n((=vars)\[\d{1,3}\]\s*=\s*\d{4,12}\x3b\r\n){5,40} 2 0 0 1
2642 2642 ^\/([\/_]*?[a-f0-9][\/_]*?){64}$ 2 0 0 1
2643 2643 src\s*=\s*https?\x3A\x2f+[^\x2f]*?((((static)?flick|blogge)r|p(hotobucket|icasa)|wordpress|tinypic)\.com|im(g(\.youtube|ur)\.com|ageshack\.us)|upload\.wikimedia\.org)[^\x2f] 2 0 0 1
2644 2644 ^[a-f0-9]{32}$ 2 0 0 1
2645 2645 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/ 2 0 0 1
2646 2646 [=\"]\w{8}\.jar 2 0 0 1
2647 2647 ^[a-z]{2}\. 2 0 0 1
2648 2648 \/jdb\/[^\/]+\.class$ 2 0 0 1
2649 2649 \/lib\/adobe\.php\?id=[a-f0-9]{32}$ 2 0 0 1
2650 2650 \/i.php?token=[a-z0-9]+$ 2 0 0 1
2651 2651 \x2Fjerk\x2Ecgi\x3F[0-9]$ 2 0 0 1
2652 2652 ^(\?[^=]{1,10}=[^&\r\n]{100,})?$ 2 0 0 1
2653 2653 \.php\?e=[^&]+?$ 2 0 0 1
2654 2654 \.txt\?e=\d+(&[fh]=\d+)?$ 2 0 0 1
2655 2655 ^\x2F\x3Fwps\x3D[0-9]$ 2 0 0 1
2656 2656 ^[^\r\n]+\/[A-Fa-f0-9]+\.js\?cp= 2 0 0 1
2657 2657 ^\/[a-z0-9]{1,4}\.jnlp$ 2 0 0 1
2658 2658 \.php\?id=[a-f0-9]{32}$ 2 0 0 1
2659 2659 ^\/[a-f0-9]{32}\/[a-f0-9]{32}\.swf$ 2 0 0 1
2660 2660 \.php\?[^=]+=([^&]?[a-z0-9]{2}){5}&[^=]+=([^&]?[a-z0-9]{2}){10}& 2 0 0 1
2661 2661 \/[A-F0-9]{8}\.js\?cp= 2 0 0 1
2662 2662 ^\/[a-z0-9]+[0-9][a-z0-9]+\/\?\d$ 2 0 0 1
2663 2663 \.exe(\?[a-zA-Z0-9]+=[a-zA-Z0-9]+)?&h=\d+$ 2 0 0 1
2664 2664 ^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$ 2 0 0 1
2665 2665 ^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$ 2 0 0 1
2666 2666 \/\d{6}\.mp3$ 2 0 0 1
2667 2667 \/14\d{8}(\.xap)?$ 2 0 0 1
2668 2668 \.swf\?myid=[a-zA-Z0-9]+$ 2 0 0 1
2669 2669 \.php\?rnd=[0-9]{3,7}&id=[0-9A-F]{44,54}$ 2 0 0 1
2670 2670 \/(Flash[23]?|Ink|New|One|HQ).exe$ 2 0 0 1
2671 2671 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.xap\r\n 2 0 0 1
2672 2672 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?[^\r\n]*?\/(index.html)?\r\n.*?\r\nHost\x3a\x20(=refhost)[\x3a\r] 2 0 0 1
2673 2673 \/\d{2,}\.xap$ 2 0 0 1
2674 2674 \.php\?rnd=\d+&id=[0-9A-F]{32,}$ 2 0 0 1
2675 2675 \/\?keyword=(([a-f]{0,31}[0-9])([0-9]{0,31}[a-f])[a-f0-9]{32}|\d{5})$ 2 0 0 1
2676 2676 ^\/(.*?[&?][a-z]{2}_[a-z]{2}=\d+(&))(.*?[&?]q=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&))(.*?[&?]oq=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&)).*?[&?][a-z]{3}=[A-Za-z_]{3,20}([a-z\d]*\x2e)([a-z\x2e]*\d)[a-z\d\x2e]+(&|$) 2 0 0 1
2677 2677 ^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Font_Update\.exe 2 0 0 1
2678 2678 ^\s*[\x22\x27]\s*http[^\x22\x27]+\.php\s*[\x22\x27]\s*\x2c\s*[\x22\x27]\s*uylzJB3mWrFjellI9iDFGQjO 2 0 0 1
2679 2679 =[a-f0-9]{32,}(&|$) 2 0 0 1
2680 2680 \&e=(cve|flash) 2 0 0 1
2681 2681 ^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.htm$ 2 0 0 1
2682 2682 ^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.swf$ 2 0 0 1
2683 2683 ^(0x[a-f0-9]{1,2}, ){500} 2 0 0 1
2684 2684 ^[0-9_,{AbZwP&-]{2000} 2 0 0 1
2685 2685 ^[A-F0-9]+ 2 0 0 1
2686 2686 ^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_ 2 0 0 1
2687 2687 ^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_ 2 0 0 1
2688 2688 ^[a-z0-9]{13}\.[a-z]{3}$ 2 0 0 1
2689 2689 ^\d+$ 2 0 0 1
2690 2690 Host\x3a\x20(<refhost>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f(=refhost)(\x3a\d{1,5})?\/? 2 0 0 1
2691 2691 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\r$|\x3a) 2 0 0 1
2692 2692 ^\/[a-z]{3,20}\.php\?sid=[A-F0-9]{40,200}$ 2 0 0 1
2693 2693 ^\/[a-z]{3,20}\.php\?id=4[A-F0-9]{39,200}$ 2 0 0 1
2694 2694 ^\/\?o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+$ 2 0 0 1
2695 2695 (.*?[?&]oq=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&)).*?[?&]q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$) 2 0 0 1
2696 2696 (.*[^&]{3,4}QMvXcJ).*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&.*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$) 2 0 0 1
2697 2697 ^[HX3][^&]Q[cdM][^&]{3}[ab]R 2 0 0 1
2698 2698 ^\/\?[a-f0-9]{114}$ 2 0 0 1
2699 2699 Date\x3a\x20(<dstring>[^\r\n]+)\r\n.*?Last-Modified\x3a\x20(=dstring)\r\n 2 0 0 1
2700 2700 ^\/[a-f0-9]{16}$ 2 0 0 1
2701 2701 ^GET (<uri>(\/[A-Za-z0-9]+)?\/\d+\/\d+)\sHTTP\/1\.1\r\nUser-Agent\x3a\x20http\x3a\/\/(<host>[^\r\n]+)(=uri)\r\nHost\x3a\x20(=host)\r\n(\r\n)?$ 2 0 0 1
2702 2702 ^Referer\x3a[^\r\n]+?\/[a-z0-9A-Z\_\-]{26,}\.html(\x3a\d{1,5})?\r$ 2 0 0 1
2703 2703 \/3\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+|\/\d+\.\d+\.\d+\.\d+\/?)?$ 2 0 0 1
2704 2704 ^\/([A-Za-z_-]*?\d)([a-z0-9_-]*?[A-Z])([A-Za-z0-9_-]{4}){15,}([[A-Za-z0-9_-]{2}\x2e?\x2e|[A-Za-z0-9_-]{3}\x2e)$ 2 0 0 1
2705 2705 ^\d$ 2 0 0 1
2706 2706 ^[A-F0-9]{16}\x22> 2 0 0 1
2707 2707 ^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-zA-Z0-9]{16}\/[a-f0-9]{40}\/[a-zA-Z0-9]+\.jpg$ 2 0 0 1
2708 2708 ^[A-F0-9]{16}(&|&amp\x3b)id=\d+(&|&amp\x3b)gid=[A-F0-9\-]+\x22> 2 0 0 1
2709 2709 ^[^>]*?\> 2 0 0 1
2710 2710 ^-?\d+=([a-zA-Z0-9]|%[A-F0-9]{2}){2}(<var1>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){6}(<var2>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){2}(=var2)([a-zA-Z0-9]|%[A-F0-9]{2}){4}(=var1)/P 2 0 0 1
2711 2711 ^\s*?[\x22\x27]([A-Z]{0,19}[a-z]{1,19}[A-Z])[a-zA-Z]{14,20}[\x22\x27][^<>]*([A-Za-z]{0,99}\d)[A-Za-z0-9\x20]{100} 2 0 0 1
2712 2712 ^\s*?(<var1>[^\x29]+)\x29[^\n]*\s*?(=var1)\s*?\x7c{2}\s*?\d+?\s*?\x2c 2 0 0 1
2713 2713 ^\s+\d{1,2}\x3b\s+else\s+(<var>[a-z]+)\s+\-=\s+\d{1,2}\x3b\s+return\s+[a-z]+\.charAt\x28(=var)\/\d{1,2}\x29\x7d 2 0 0 1
2714 2714 ^[a-z0-9_-]+\.([0-9_-]*[A-Z])[A-Z0-9_-]+\.[^\x22]+\x22\s 2 0 0 1
2715 2715 ^[a-z]{10}\.[a-z]{3}\r?$/Hm 2 0 0 1
2716 2716 Last-Modified\x3a Mon, ((0[29]|16|23|30))\d{2} Jul 2001/H 2 0 0 1
2717 2717 ^\d+\x3b 2 0 0 1
2718 2718 ^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500} 2 0 0 1
2719 2719 ^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f 2 0 0 1
2720 2720 ^[^\x27]+[\x27]\s* 2 0 0 1
2721 2721 ^\d+\x3b 2 0 0 1
2722 2722 ^([A-Z0-9]*?[a-z])([a-z0-9]*?[A-Z])[A-Za-z0-9]+\x2a\x2f[^\n]*?Function\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28\s*?(=var1)\s*[=!]{2}\s*?[\x27\x22][\x22\x27]\s*?\x29\s*?\{ 2 0 0 1
2723 2723 ^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500} 2 0 0 1
2724 2724 ^\s*\x27[^\x27\x3b\r\n]+\x27width=\x27250\x27\sheight=\x27250\x27\> 2 0 0 1
2725 2725 ^[^A-Za-z0-9] 2 0 0 1
2726 2726 ^http\x3a\x2f[^\x27]+[\x27](\swidth=\d{1,2}\sheight=\d{1,2}\s|\sheight=\d{1,2}\swidth=\d{1,2}\s) 2 0 0 1
2727 2727 ^\s*\(\s*[\x22\x27]id[\x22\x27]\s*,\s*?(<var>[^,\x29\s\x3b]+)\s*\x29.*?\.appendChild\s*\(\s*(=var) 2 0 0 1
2728 2728 ^[^<]+\x0d\x0a<\/script> 2 0 0 1
2729 2729 \?src=[a-z]+snet$ 2 0 0 1
2730 2730 ^[0-9a-f]{6} 2 0 0 1
2731 2731 ^(\x20id=\x22\d+\x22)?\x20style=\x22([^\x22\r\n]*top\x3a\x20-\d{3}px\x3b)([^\x22\r\n]*left\x3a-\d{3}px\x3b)([^\x22\r\n]*position\x3a\x20absolute\x3b)[^\x22\r\n]*\x22>\x20<iframe[^\r\n>]*><\x2f 2 0 0 1
2732 2732 ^(\s+style=\x27hidden\x27)?\s+src=\x27https?\x3a[^>\x22\x27]+[\x22\x27]\s*width=\x270\x27\s+ 2 0 0 1
2733 2733 (NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp) 2 0 0 1
2734 2734 ^[^\d](.{0,20}[^\d])?100[^\d](.{0,20}[^\d])?101[^\d](.{0,20}[^\d])?102[^\d](.{0,20}[^\d])?97[^\d](.{0,20}[^\d])?117[^\d](.{1,20}[^\d])?108[^\d](.{0,20}[^\d])?116[^\d](.{0,20}[^\d])?35[^\d]([^\d].{0,20}[^\d])?86[^\d](.{0,20}[^\d])?77[^\d](.{0,20}[^\d])?76[^\d] 2 0 0 1
2735 2735 ^(<sep>((\.\\_\\+).){1,10})\.\\_\\+(=sep)\.___\+(=sep)\.\\\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\_\\_\+(=sep)\.\_\\\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\\+(=sep)\.\_\_\$ 2 0 0 1
2736 2736 ^[\r\n\s]*[\r\n\s]*?(-[\r\n\s]*?\d|0[\r\n\s]*?-) 2 0 0 1
2737 2737 SELECT.+FROM 2 0 0 1
2738 2738 DELETE.+FROM 2 0 0 1
2739 2739 INSERT.+INTO 2 0 0 1
2740 2740 UPDATE.+SET 2 0 0 1
2741 2741 UNION.+SELECT 2 0 0 1
2742 2742 INTO.+OUTFILE 2 0 0 1
2743 2743 ^SITE\s+EXEC\s[^\n]*?%[^\n]*?% 2 0 0 1
2744 2744 ^PASS\s[^\n]{100} 2 0 0 1
2745 2745 ^MKD\s[^\n]{100} 2 0 0 1
2746 2746 ^REST\s[^\n]{100} 2 0 0 1
2747 2747 ^DELE\s[^\n]{100} 2 0 0 1
2748 2748 ^RMD\s[^\n]{100} 2 0 0 1
2749 2749 ^RMDIR\s[^\n]{100} 2 0 0 1
2750 2750 ^SITE\s+NEWER\s[^\n]{100} 2 0 0 1
2751 2751 ^SITE\s+ZIPCHK\s[^\n]{100} 2 0 0 1
2752 2752 ^USER\s+w0rm 2 0 0 1
2753 2753 ^ALLO\s[^\n]{100} 2 0 0 1
2754 2754 ^CEL\s[^\n]{100} 2 0 0 1
2755 2755 ^CMD\s[^\n]{100} 2 0 0 1
2756 2756 ^CWD\s[^\n]{100} 2 0 0 1
2757 2757 ^SITE\s+CPWD\s[^\n]{100} 2 0 0 1
2758 2758 ^SITE\s+NEWER 2 0 0 1
2759 2759 ^STAT\s+[^\n]*\x3f 2 0 0 1
2760 2760 ^APPE\s[^\n]{100} 2 0 0 1
2761 2761 ^CWD\s+~ 2 0 0 1
2762 2762 ^MODE\s+[^ABSC]{1} 2 0 0 1
2763 2763 ^SITE\s[^\n]{100} 2 0 0 1
2764 2764 ^SITE\s+CHOWN\s[^\n]{100} 2 0 0 1
2765 2765 ^SITE\s+EXEC 2 0 0 1
2766 2766 ^XCWD\s[^\n]{100} 2 0 0 1
2767 2767 ^STOR\s[^\n]{100} 2 0 0 1
2768 2768 ^SITE\s+CHMOD\s[^\n]{100} 2 0 0 1
2769 2769 ^LIST\s[^\n]{100,} 2 0 0 1
2770 2770 ^RENAME\s[^\n]*?%[^\n]*?% 2 0 0 1
2771 2771 ^MKDIR\s[^\n]*?%[^\n]*?% 2 0 0 1
2772 2772 ^PASS\s[^\n]*?%[^\n]*?% 2 0 0 1
2773 2773 ^USER\s[^\n]*?%[^\n]*?% 2 0 0 1
2774 2774 ^MDTM\s[^\n]{100} 2 0 0 1
2775 2775 ^RETR\s[^\n]*?%[^\n]*?% 2 0 0 1
2776 2776 ^CWD\s[^\n]*?\.\.\. 2 0 0 1
2777 2777 ^CWD\s+~root 2 0 0 1
2778 2778 ^NLST\s[^\n]{100} 2 0 0 1
2779 2779 ^PORT 2 0 0 1
2780 2780 REST\s+[0-9]+\n 2 0 0 1
2781 2781 ^RETR\s[^\n]{100} 2 0 0 1
2782 2782 ^RNFR\s[^\n]{100} 2 0 0 1
2783 2783 ^RNTO\s[^\n]{100} 2 0 0 1
2784 2784 ^STAT\s[^\n]{100} 2 0 0 1
2785 2785 ^STOU\s[^\n]{100} 2 0 0 1
2786 2786 ^XMKD\s[^\n]{100} 2 0 0 1
2787 2787 \s+.*?%.*?% 2 0 0 1
2788 2788 ^530\s+(Login|User) 2 0 0 1
2789 2789 ^PASS\s*\n 2 0 0 1
2790 2790 ^LIST\s+\x22-W\s+\d 2 0 0 1
2791 2791 ^USER\x20[^\x00\x20\x0a\x0d]{100} 2 0 0 1
2792 2792 ^STAT\s+[^\n]*\x2a 2 0 0 1
2793 2793 ^MDTM \d+[-+]\D 2 0 0 1
2794 2794 ^[^\r\n]+\.jar 2 0 0 1
2795 2795 ^\d\.\d(_\d+)?\@\r\n 2 0 0 1
2796 2796 \x5csecure\x5c[^\x00]{50} 2 0 0 1
2797 2797 \x5C[^\x5C\x00]{257} 2 0 0 1
2798 2798 ^\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[x])|c(rt|[ho]m|li|pl|md|pp)|d(iz|ll)|e(m[fl]|xe|bs)|h(lp|sq|ta)|jse?|m(d[abzew]|s[tcgip]|htm|ht)|p(cd|if|l[xsc]|[lm]|ot)|r(eg|ar)|s(cr|ct|[hy]s|wf)|v(b[es]?|xd)|w(m[dfsz]|p[msz]|s[cfh])|xl[tw]|folder|fol|ba[st]|i(sp|n[sif])|lnk|nws|ocx|zip|url)[\x27\x22\n\r\s] 2 0 0 1
2799 2799 (a|#61)(p|#70)(p|#70)(l|#6C)(i|#69)(c|#63)(a|#61)(t|#74)(i|#69)(o|#6F)(n|#6E)(\x2F|#2F)x-shockwave-flash 2 0 0 1
2800 2800 ^[^\r\n]*[\[\|\{][A-Z]{3}[\]\|\}] 2 0 0 1
2801 2801 ^[^\r\n]*win 2 0 0 1
2802 2802 ^[^\r\n]*-PC 2 0 0 1
2803 2803 ^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl) 2 0 0 1
2804 2804 ^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl) 2 0 0 1
2805 2805 ^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb) 2 0 0 1
2806 2806 ^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb) 2 0 0 1
2807 2807 ^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3) 2 0 0 1
2808 2808 ^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3) 2 0 0 1
2809 2809 User-Agent\x3a.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi 2 0 0 1
2810 2810 User-Agent\:.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi 2 0 0 1
2811 2811 ^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}B[\x0d\x0a]{0,2}0[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}t[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}u[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}3[\x0d\x0a]{0,2}M[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}x[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}T[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}q[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}N[\x0d\x0a]{0,2}0 2 0 0 1
2812 2812 ^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}Q[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}1[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}5[\x0d\x0a]{0,2}n[\x0d\x0a]{0,2}c[\x0d\x0a]{0,2}y[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}P[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}3 2 0 0 1
2813 2813 ^[A-Za-z0-9\/\+\x0D\x0A]+?B[\x0d\x0a]{0,2}w[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}C[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}z[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}s[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}U[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}j[\x0d\x0a]{0,2}d 2 0 0 1
2814 2814 \d*?\.bin 2 0 0 1
2815 2815 ^[^\r\n]*(W(in(dows)?)?[^a-z0-9]?(XP|[7-8])|Vista) 2 0 0 1
2816 2816 ^\d+/V 2 0 0 1
2817 2817 ^\s*,\s*[a-zA-Z]\x3a[\x2f\x5c] 2 0 0 1
2818 2818 ^((PK).)*?\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00 2 0 0 1
2819 2819 (UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH) 2 0 0 1
2820 2820 U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud 2 0 0 1
2821 2821 U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud 2 0 0 1
2822 2822 U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud 2 0 0 1
2823 2823 (UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH) 2 0 0 1
2824 2824 (UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH) 2 0 0 1
2825 2825 \bshell\b 2 0 0 1
2826 2826 \benable\b 2 0 0 1
2827 2827 ^[^\r\n]+\.(t(ar|gz)|exe|zip) 2 0 0 1
2828 2828 ^([\x7f-\xff]){100}/Hi 2 0 0 1
2829 2829 ^((<\/script>).)*?src\s*=\s*\x5c?[\x22\x27]https?\x3a\/\/(www\.)?pastebin\.com\/raw(\/|\.php\?i=)[A-Z-a-z0-9]{8}[\x22\x27] 2 0 0 1
2830 2830 ^.{42}[\x20-\x7f]{1,500}\.jsPK\x05\x06.{4}\x01\x00\x01\x00 2 0 0 1
2831 2831 \/[0-9]{1,2}\.dat$ 2 0 0 1
2832 2832 \.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$ 2 0 0 1
2833 2833 \.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$ 2 0 0 1
2834 2834 \.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or 2 0 0 1
2835 2835 ))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$ 2 0 0 1
2836 2836 \.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or 2 0 0 1
2837 2837 ))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$ 2 0 0 1
2838 2838 \.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils 2 0 0 1
2839 2839 .in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$ 2 0 0 1
2840 2840 \.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils 2 0 0 1
2841 2841 .in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$ 2 0 0 1
2842 2842 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1
2843 2843 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1
2844 2844 Content-Disposition\x3a[^\r\n]*?\.xla[\s\x22\x27] 2 0 0 1
2845 2845 \.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)(\x3a\d{1,5})?$ 2 0 0 1
2846 2846 ^[\d\s] 2 0 0 1
2847 2847 ^USER [^\r\n]*?\x22 2 0 0 1
2848 2848 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
2849 2849 ^(\x3a\d{1,5})?$ 2 0 0 1
2850 2850 \.(gif|jpe?g|png)$ 2 0 0 1
2851 2851 ^((jp|pn)g|bmp) 2 0 0 1
2852 2852 ^(logins|c(cdata|ookie)) 2 0 0 1
2853 2853 ^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1
2854 2854 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
2855 2855 \/winhost(32|64)\.(exe|pack)$ 2 0 0 1
2856 2856 \/pony\.(exe|pack)$ 2 0 0 1
2857 2857 ^[^>]+url=sms\x3a 2 0 0 1
2858 2858 \/[^\x2f]+\.[^\x2f]+\.wsf$ 2 0 0 1
2859 2859 ^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4}) 2 0 0 1
2860 2860 ^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4}) 2 0 0 1
2861 2861 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
2862 2862 ^[^\r\n]+\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz) 2 0 0 1
2863 2863 ^((jp|pn)g|bmp) 2 0 0 1
2864 2864 ^(logins|c(cdata|ookie)) 2 0 0 1
2865 2865 ^(m(ultipart|essage|odel)|a(pplication|udio|ccept)|(exampl|imag)e|video|text|\*) 2 0 0 1
2866 2866 ^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$ 2 0 0 1
2867 2867 ^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$ 2 0 0 1
2868 2868 ^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$ 2 0 0 1
2869 2869 ^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$ 2 0 0 1
2870 2870 ^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$ 2 0 0 1
2871 2871 ^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$ 2 0 0 1
2872 2872 ^[a-f0-9]{8,}\.duckdns\.org$ 2 0 0 1
2873 2873 ^[^\x3b\x2f\x28]+$ 2 0 0 1
2874 2874 ^[^\r\n]{100,} 2 0 0 1
2875 2875 ^[^\r\n]{100,} 2 0 0 1
2876 2876 ^[^\r\n]{100,} 2 0 0 1
2877 2877 ^[^\r\n]{100,} 2 0 0 1
2878 2878 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
2879 2879 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
2880 2880 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
2881 2881 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
2882 2882 [a-z]{8}.[a-z]{3} 2 0 0 1
2883 2883 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.zip$ 2 0 0 1
2884 2884 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.vbs$ 2 0 0 1
2885 2885 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.pif$ 2 0 0 1
2886 2886 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.exe$ 2 0 0 1
2887 2887 CN=ssl\d{1,2}.ovh.net($|,) 2 0 0 1
2888 2888 (\.[a-z]{2}|$) 2 0 0 1
2889 2889 [a-f0-9]{32}$ 2 0 0 1
2890 2890 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P 2 0 0 1
2891 2891 ^(\x3b|\r\n) 2 0 0 1
2892 2892 CN=([^\r\n]+?\.)?\.gov\.procurement\.(\.) 2 0 0 1
2893 2893 ^[a-f0-9]+ 2 0 0 1
2894 2894 ^[a-f0-9]+ 2 0 0 1
2895 2895 ^[a-f0-9]+ 2 0 0 1
2896 2896 ^Agent\d{5,6}$ 2 0 0 1
2897 2897 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
2898 2898 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
2899 2899 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
2900 2900 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2901 2901 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2902 2902 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2903 2903 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2904 2904 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2905 2905 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2906 2906 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2907 2907 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2908 2908 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2909 2909 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2910 2910 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2911 2911 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2912 2912 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2913 2913 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2914 2914 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2915 2915 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2916 2916 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2917 2917 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
2918 2918 .*[^A-Za-z0-9]edu\.rf\.gd$ 2 0 0 1
2919 2919 \x2edoc[xm]?$ 2 0 0 1
2920 2920 \x2exls[xm]?$ 2 0 0 1
2921 2921 \/\d+$ 2 0 0 1
2922 2922 function(\s_0x[0-9a-f]{4})?\(_0x[0-9a-f]{6},_0x[0-9a-f]{6}\){var _0x[0-9a-f]{6}=/Qi 2 0 0 1
2923 2923 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
2924 2924 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
2925 2925 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
2926 2926 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
2927 2927 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
2928 2928 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
2929 2929 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
2930 2930 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
2931 2931 \sLOGIN\s[^\n]*?\s\{ 2 0 0 1
2932 2932 \sLSUB\s[^\n]*?\s\{ 2 0 0 1
2933 2933 \sRENAME\s[^\n]{100} 2 0 0 1
2934 2934 \sFIND\s[^\n]{100} 2 0 0 1
2935 2935 \sFETCH\s[^\n]{500} 2 0 0 1
2936 2936 \sLOGIN\s[^\n]{100} 2 0 0 1
2937 2937 \sAUTHENTICATE\s[^\n]{100} 2 0 0 1
2938 2938 \sLIST\s[^\n]*?\s\{ 2 0 0 1
2939 2939 \sPARTIAL.*BODY\[[^\]]{1024} 2 0 0 1
2940 2940 AUTH\s[^\n]{100} 2 0 0 1
2941 2941 \sCREATE\s*\{ 2 0 0 1
2942 2942 \sRENAME\s[^\n]*?\s\{ 2 0 0 1
2943 2943 \sLIST\s[^\n]{100} 2 0 0 1
2944 2944 \sCREATE\s[^\n]{1024} 2 0 0 1
2945 2945 \sLSUB\s[^\n]{100} 2 0 0 1
2946 2946 \sAUTHENTICATE\s[^\n]*?\{ 2 0 0 1
2947 2947 \sPARTIAL.*BODY\.PEEK\[[^\]]{1024} 2 0 0 1
2948 2948 \sUNSUBSCRIBE\s[^\n]{100} 2 0 0 1
2949 2949 \sUNSUBSCRIBE\s[^\n]*?\s\{ 2 0 0 1
2950 2950 \sSUBSCRIBE\s[^\n]{100} 2 0 0 1
2951 2951 \sSUBSCRIBE\s[^\n]*?\s\{ 2 0 0 1
2952 2952 \sSTATUS\s[^\n]{100} 2 0 0 1
2953 2953 \sSTATUS\s[^\n]*?\s\{ 2 0 0 1
2954 2954 \sFETCH\s[^\n]*?\s\{ 2 0 0 1
2955 2955 \sEXAMINE\s[^\n]{100} 2 0 0 1
2956 2956 \sEXAMINE\s[^\n]*?\s\{ 2 0 0 1
2957 2957 \sAPPEND\s[^\n]{256} 2 0 0 1
2958 2958 \sCOPY\s[^\n]*?\{ 2 0 0 1
2959 2959 \sDELETE\s[^\n]*?\{ 2 0 0 1
2960 2960 \sDELETE\s[^\n]{100} 2 0 0 1
2961 2961 \sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?% 2 0 0 1
2962 2962 (FREE XXX|dildo|masturbat|oral sex|ejaculat|up skirt|tits|bondage|lolita|clitoris|cock suck|hardcore (teen|anal|sex|porn)|raw sex|((fuck|sex|porn|xxx) (movies|dvd))|((naked|nude) (celeb|lesbian)))\b 2 0 0 1
2963 2963 ^RETR\s+[^\r\n]+?\x2eexe\r?$ 2 0 0 1
2964 2964 \<xdp\x3axdp(\s+[^\>]*)?\>((\<\/xdp[^\>]*\>).)*?\<pdf 2 0 0 1
2965 2965 SELECT @@version_compile_os\s*?\x3b 2 0 0 1
2966 2966 ^Server\x3a[^\r\n]*Portable SDK for UPnP devices(\/?\s*$|\/1\.([0-5]\..|8\.0.|(6\.[0-9]|6\.1[0-7]))) 2 0 0 1
2967 2967 ^Server\x3a[^\r\n]*Intel SDK for UPnP devices 2 0 0 1
2968 2968 ^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27] 2 0 0 1
2969 2969 ^[8-9]\.0 2 0 0 1
2970 2970 ^(<global_var>(((\]\,__\\x3a\+\+)).)+)]\,__\$\x3a\+\+(=global_var) 2 0 0 1
2971 2971 ^Host\x3a\x20[^\r\n]+\.((b(bsindex|0ne)|chatnook|gotgeeks|3d-game|4irc)\.com|s((cieron|uroot)\.com|lyip\.(com|net))|d(arktech\.org|eaftone\.com|tdns\.net)|e(towns\.(net|org)|ffers\.com)|flnet\.org)(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
2972 2972 ^Host\x3a\x20[^\r\n]+\.cd\.am(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
2973 2973 ^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}[^\r\n]*\x3C\x2Fiframe\x3E 2 0 0 1
2974 2974 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1
2975 2975 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1
2976 2976 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1
2977 2977 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1
2978 2978 ^(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?m(\x22\s*?\+\s*?\x22)?C(\x22\s*?\+\s*?\x22)?h(\x22\s*?\+\s*?\x22)?a(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?c(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?d(\x22\s*?\+\s*?\x22)?e 2 0 0 1
2979 2979 ^(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?m(\x27\s*?\+\s*?\x27)?C(\x27\s*?\+\s*?\x27)?h(\x27\s*?\+\s*?\x27)?a(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?c(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?d(\x27\s*?\+\s*?\x27)?e 2 0 0 1
2980 2980 for\x28[^\x3D\r\n]*[0-9]{1,6}\x2D[0-9]{1,5}\x3B[^\x3D\r\n]\x3E\x3D0\x3B[^\x29\r\n]\x2D\x2D\x29 2 0 0 1
2981 2981 ^User-Agent\x3a[^\r\n]*?Googlebot/Hmi 2 0 0 1
2982 2982 ^\s*?\([^\)]*?(<var>[^\.]+)\s*?\.\s*?length\s*<\s*(0?[0-9]{5,}|0x[a-z0-9]{3,})[^)]+\)\s*?\{\s*?(=var)\s*\s*?(=var)\s*?\+\s*?(=var)\s*?\} 2 0 0 1
2983 2983 ^(nc)?\s*([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=) 2 0 0 1
2984 2984 \x00[0-9]{4,7}\x02in\x00 2 0 0 1
2985 2985 ^Server\x3a[^\r\n]*miniupnpd\/1\.[0-3] 2 0 0 1
2986 2986 ^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27] 2 0 0 1
2987 2987 ^\s+?(<vname>[^\s\x3d]+)\s*\s*?(0x((6[4-9a-f]|[7-9a-f])|\d{3,})|\d{3,}).+?[\s\x3b]for\s*?\([^\x3b\)]*?\x3b[^\x3b\)]+?\s*?(=vname)[^\)]+?\)\s*?(\{[^}]*?|[^\r\n]*?)document\s*\.\s*createElement 2 0 0 1
2988 2988 ^((<\/title).)*\x26\x23x1F512 2 0 0 1
2989 2989 ^\/tmp\/.+\.exe$ 2 0 0 1
2990 2990 ^(&). 2 0 0 1
2991 2991 ((\?|&))pasa=(&). 2 0 0 1
2992 2992 \.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp)\.com|m(inecraft\.net|p3\.com)|b(eer\.com|log\.net))|curity(exploit|tactic)s\.com)|tufftoread\.com|ytes\.net)|m(y(((dissen|effec)t|mediapc|psx)\.net|securitycamera\.(com|net|org)|(activedirectory|vnc)\.com|ftp\.(biz|org))|lbfan\.org|mafan\.biz)|d((itchyourip|amnserver|ynns)\.com|dns(\.(net|me)|king\.com)|ns(iskinky\.com|for\.me)|vrcam\.info)|n(o(-ip\.(c(o\.uk|a)|info|biz|net|org)|ip\.(me|us))|et-freaks\.com|flfan\.org|hlfan\.net)|h(o(mesecurity(ma|p)c\.com|pto\.(org|me))|ealth-carereform\.com)|p((rivatizehealthinsurance|gafan)\.net|oint(2this\.com|to\.us))|c((o(uchpotatofries|llegefan)|able-modem)\.org|iscofreak\.com)|g(o(lffan\.us|tdns\.ch)|eekgalaxy\.com)|b(logsyte\.com|ounceme\.net|rasilia\.me)|re(ad-books\.org|directme\.net)|u(nusualperson\.com|fcfan\.org)|w(orkisboring\.com|ebhop\.me)|(3utiliti|quicksyt)es\.com|eating-organic\.net|ilovecollege\.info|fantasyleague\.cc|loginto\.me|zapto\.org)(\x3a\d{1,5})?$ 2 0 0 1
2993 2993 \.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or 2 0 0 1
2994 2994 ))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$ 2 0 0 1
2995 2995 \.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils 2 0 0 1
2996 2996 .in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$ 2 0 0 1
2997 2997 ^(\d{1,3}\.){3}\d{1,3}(\x3a\d+)?$ 2 0 0 1
2998 2998 \.jpg(\?\d+)?$ 2 0 0 1
2999 2999 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
3000 3000 ^[^0-9] 2 0 0 1
Reference in New Issue Copy Permalink