5001 lines
372 KiB
Plaintext
5001 lines
372 KiB
Plaintext
5000
|
|
1 1 User-Agent:\s.*.abc.net 2 0 0 1
|
|
2 2 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5 2 0 0 1
|
|
3 3 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980 2 0 0 1
|
|
4 4 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E 2 0 0 1
|
|
5 5 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333 2 0 0 1
|
|
6 6 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C 2 0 0 1
|
|
7 7 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E 2 0 0 1
|
|
8 8 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E 2 0 0 1
|
|
9 9 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E 2 0 0 1
|
|
10 10 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E 2 0 0 1
|
|
11 11 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08 2 0 0 1
|
|
12 12 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42 2 0 0 1
|
|
13 13 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4 2 0 0 1
|
|
14 14 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980 2 0 0 1
|
|
15 15 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3 2 0 0 1
|
|
16 16 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980 2 0 0 1
|
|
17 17 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB 2 0 0 1
|
|
18 18 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E 2 0 0 1
|
|
19 19 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E 2 0 0 1
|
|
20 20 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664 2 0 0 1
|
|
21 21 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C 2 0 0 1
|
|
22 22 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980 2 0 0 1
|
|
23 23 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E 2 0 0 1
|
|
24 24 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E 2 0 0 1
|
|
25 25 (EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters) 2 0 0 1
|
|
26 26 (SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter) 2 0 0 1
|
|
27 27 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3 2 0 0 1
|
|
28 28 (ReadMolFile|SaveasMolFile) 2 0 0 1
|
|
29 29 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
|
|
30 30 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
|
|
31 31 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C 2 0 0 1
|
|
32 32 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
|
|
33 33 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
|
|
34 34 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000 2 0 0 1
|
|
35 35 file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt) 2 0 0 1
|
|
36 36 [0-9]{3,} 2 0 0 1
|
|
37 37 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194 2 0 0 1
|
|
38 38 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2 2 0 0 1
|
|
39 39 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510 2 0 0 1
|
|
40 40 (setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch) 2 0 0 1
|
|
41 41 param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20} 2 0 0 1
|
|
42 42 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C 2 0 0 1
|
|
43 43 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1
|
|
44 44 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79 2 0 0 1
|
|
45 45 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD 2 0 0 1
|
|
46 46 (Text|EditSelText|EditText|CellFontName|Archive) 2 0 0 1
|
|
47 47 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C 2 0 0 1
|
|
48 48 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c 2 0 0 1
|
|
49 49 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B 2 0 0 1
|
|
50 50 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA 2 0 0 1
|
|
51 51 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted) 2 0 0 1
|
|
52 52 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam) 2 0 0 1
|
|
53 53 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E 2 0 0 1
|
|
54 54 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8 2 0 0 1
|
|
55 55 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E 2 0 0 1
|
|
56 56 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726 2 0 0 1
|
|
57 57 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598 2 0 0 1
|
|
58 58 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E 2 0 0 1
|
|
59 59 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E 2 0 0 1
|
|
60 60 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E 2 0 0 1
|
|
61 61 (exe|bat|com|dll|ini) 2 0 0 1
|
|
62 62 (exe|bat|com|dll|ini) 2 0 0 1
|
|
63 63 (exe|bat|com|dll|ini) 2 0 0 1
|
|
64 64 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E 2 0 0 1
|
|
65 65 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7 2 0 0 1
|
|
66 66 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91 2 0 0 1
|
|
67 67 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980 2 0 0 1
|
|
68 68 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02 2 0 0 1
|
|
69 69 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3 2 0 0 1
|
|
70 70 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90 2 0 0 1
|
|
71 71 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E 2 0 0 1
|
|
72 72 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E 2 0 0 1
|
|
73 73 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112 2 0 0 1
|
|
74 74 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1 2 0 0 1
|
|
75 75 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6 2 0 0 1
|
|
76 76 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F 2 0 0 1
|
|
77 77 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C 2 0 0 1
|
|
78 78 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA 2 0 0 1
|
|
79 79 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258 2 0 0 1
|
|
80 80 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B 2 0 0 1
|
|
81 81 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1 2 0 0 1
|
|
82 82 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7 2 0 0 1
|
|
83 83 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D 2 0 0 1
|
|
84 84 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61 2 0 0 1
|
|
85 85 (Src|Background|PackageXml) 2 0 0 1
|
|
86 86 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters) 2 0 0 1
|
|
87 87 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter) 2 0 0 1
|
|
88 88 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1
|
|
89 89 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1
|
|
90 90 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1
|
|
91 91 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755 2 0 0 1
|
|
92 92 (Save|SaveLayoutChanges|SaveMenuUsageData) 2 0 0 1
|
|
93 93 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61 2 0 0 1
|
|
94 94 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3 2 0 0 1
|
|
95 95 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D 2 0 0 1
|
|
96 96 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D 2 0 0 1
|
|
97 97 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9 2 0 0 1
|
|
98 98 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0 2 0 0 1
|
|
99 99 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3 2 0 0 1
|
|
100 100 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679 2 0 0 1
|
|
101 101 (SaveFile|ExportToXML) 2 0 0 1
|
|
102 102 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE 2 0 0 1
|
|
103 103 (SnapShotToFile|SnapShotX) 2 0 0 1
|
|
104 104 (SnapShotToFile|SnapShotX) 2 0 0 1
|
|
105 105 (SnapShotToFile|SnapShotX) 2 0 0 1
|
|
106 106 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E 2 0 0 1
|
|
107 107 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28 2 0 0 1
|
|
108 108 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003 2 0 0 1
|
|
109 109 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
|
|
110 110 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
|
|
111 111 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
|
|
112 112 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
|
|
113 113 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE 2 0 0 1
|
|
114 114 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB 2 0 0 1
|
|
115 115 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile) 2 0 0 1
|
|
116 116 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD 2 0 0 1
|
|
117 117 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA 2 0 0 1
|
|
118 118 (Run|SetRegistryValueAsString|PerformUpdateAsync) 2 0 0 1
|
|
119 119 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C 2 0 0 1
|
|
120 120 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C 2 0 0 1
|
|
121 121 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084 2 0 0 1
|
|
122 122 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6 2 0 0 1
|
|
123 123 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF 2 0 0 1
|
|
124 124 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5 2 0 0 1
|
|
125 125 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C 2 0 0 1
|
|
126 126 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA 2 0 0 1
|
|
127 127 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020 2 0 0 1
|
|
128 128 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020 2 0 0 1
|
|
129 129 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B 2 0 0 1
|
|
130 130 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356 2 0 0 1
|
|
131 131 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520 2 0 0 1
|
|
132 132 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C 2 0 0 1
|
|
133 133 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26 2 0 0 1
|
|
134 134 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0 2 0 0 1
|
|
135 135 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF 2 0 0 1
|
|
136 136 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142 2 0 0 1
|
|
137 137 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB 2 0 0 1
|
|
138 138 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7 2 0 0 1
|
|
139 139 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747 2 0 0 1
|
|
140 140 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456 2 0 0 1
|
|
141 141 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0 2 0 0 1
|
|
142 142 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999 2 0 0 1
|
|
143 143 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899 2 0 0 1
|
|
144 144 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5 2 0 0 1
|
|
145 145 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E 2 0 0 1
|
|
146 146 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F 2 0 0 1
|
|
147 147 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9 2 0 0 1
|
|
148 148 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F 2 0 0 1
|
|
149 149 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448 2 0 0 1
|
|
150 150 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92 2 0 0 1
|
|
151 151 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F 2 0 0 1
|
|
152 152 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED 2 0 0 1
|
|
153 153 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB 2 0 0 1
|
|
154 154 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305 2 0 0 1
|
|
155 155 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7 2 0 0 1
|
|
156 156 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B 2 0 0 1
|
|
157 157 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C 2 0 0 1
|
|
158 158 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627 2 0 0 1
|
|
159 159 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E 2 0 0 1
|
|
160 160 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE 2 0 0 1
|
|
161 161 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496 2 0 0 1
|
|
162 162 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0 2 0 0 1
|
|
163 163 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E 2 0 0 1
|
|
164 164 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C 2 0 0 1
|
|
165 165 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53 2 0 0 1
|
|
166 166 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014 2 0 0 1
|
|
167 167 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A 2 0 0 1
|
|
168 168 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A 2 0 0 1
|
|
169 169 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741 2 0 0 1
|
|
170 170 (SaveToBMP|SaveToFile) 2 0 0 1
|
|
171 171 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2 2 0 0 1
|
|
172 172 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667 2 0 0 1
|
|
173 173 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1
|
|
174 174 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1
|
|
175 175 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E 2 0 0 1
|
|
176 176 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D 2 0 0 1
|
|
177 177 (SaveBarCode|SaveEnhWMF) 2 0 0 1
|
|
178 178 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B 2 0 0 1
|
|
179 179 <object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>) 2 0 0 1
|
|
180 180 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000 2 0 0 1
|
|
181 181 (exe|bat|com|dll|ini) 2 0 0 1
|
|
182 182 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E 2 0 0 1
|
|
183 183 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E 2 0 0 1
|
|
184 184 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87 2 0 0 1
|
|
185 185 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
|
|
186 186 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
|
|
187 187 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
|
|
188 188 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
|
|
189 189 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
|
|
190 190 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E 2 0 0 1
|
|
191 191 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344 2 0 0 1
|
|
192 192 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C 2 0 0 1
|
|
193 193 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30 2 0 0 1
|
|
194 194 (Packagefiles|SaveDna|SetIdentity|AddFile) 2 0 0 1
|
|
195 195 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9 2 0 0 1
|
|
196 196 (_DOWText)|(_MonthText) 2 0 0 1
|
|
197 197 (SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour) 2 0 0 1
|
|
198 198 classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE 2 0 0 1
|
|
199 199 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004 2 0 0 1
|
|
200 200 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004 2 0 0 1
|
|
201 201 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F 2 0 0 1
|
|
202 202 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5 2 0 0 1
|
|
203 203 [\w\W]{2500,} 2 0 0 1
|
|
204 204 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3 2 0 0 1
|
|
205 205 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8 2 0 0 1
|
|
206 206 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04 2 0 0 1
|
|
207 207 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue) 2 0 0 1
|
|
208 208 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356 2 0 0 1
|
|
209 209 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E 2 0 0 1
|
|
210 210 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574 2 0 0 1
|
|
211 211 (WriteIniFileString|ShellExecute) 2 0 0 1
|
|
212 212 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906 2 0 0 1
|
|
213 213 (txt|ini|com|exe|bat|dll|dat) 2 0 0 1
|
|
214 214 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8 2 0 0 1
|
|
215 215 42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733 2 0 0 1
|
|
216 216 (Save|ExportImage) 2 0 0 1
|
|
217 217 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790 2 0 0 1
|
|
218 218 (DeleteFile|write) 2 0 0 1
|
|
219 219 (SaveAsBMP|SaveAsWMF) 2 0 0 1
|
|
220 220 (SaveAsBMP|SaveAsWMF) 2 0 0 1
|
|
221 221 (SaveAsBMP|SaveAsWMF) 2 0 0 1
|
|
222 222 (SaveAsBMP|SaveAsWMF) 2 0 0 1
|
|
223 223 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967 2 0 0 1
|
|
224 224 WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext) 2 0 0 1
|
|
225 225 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9 2 0 0 1
|
|
226 226 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5 2 0 0 1
|
|
227 227 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6 2 0 0 1
|
|
228 228 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1
|
|
229 229 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9 2 0 0 1
|
|
230 230 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24 2 0 0 1
|
|
231 231 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9 2 0 0 1
|
|
232 232 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA 2 0 0 1
|
|
233 233 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec) 2 0 0 1
|
|
234 234 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5 2 0 0 1
|
|
235 235 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1
|
|
236 236 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1
|
|
237 237 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1
|
|
238 238 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83 2 0 0 1
|
|
239 239 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA 2 0 0 1
|
|
240 240 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566 2 0 0 1
|
|
241 241 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000 2 0 0 1
|
|
242 242 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000 2 0 0 1
|
|
243 243 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B 2 0 0 1
|
|
244 244 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F 2 0 0 1
|
|
245 245 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289 2 0 0 1
|
|
246 246 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289 2 0 0 1
|
|
247 247 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED 2 0 0 1
|
|
248 248 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619 2 0 0 1
|
|
249 249 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E 2 0 0 1
|
|
250 250 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258 2 0 0 1
|
|
251 251 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196 2 0 0 1
|
|
252 252 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E 2 0 0 1
|
|
253 253 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD 2 0 0 1
|
|
254 254 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4 2 0 0 1
|
|
255 255 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118 2 0 0 1
|
|
256 256 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616 2 0 0 1
|
|
257 257 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1
|
|
258 258 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1
|
|
259 259 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1
|
|
260 260 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11 2 0 0 1
|
|
261 261 (ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1 2 0 0 1
|
|
262 262 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020 2 0 0 1
|
|
263 263 (PostURL|AddSeperator|AddString|Post) 2 0 0 1
|
|
264 264 (SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF) 2 0 0 1
|
|
265 265 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>) 2 0 0 1
|
|
266 266 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\> 2 0 0 1
|
|
267 267 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\> 2 0 0 1
|
|
268 268 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\> 2 0 0 1
|
|
269 269 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\> 2 0 0 1
|
|
270 270 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
|
|
271 271 (Buildpath|GetDriveName|DriveExists|DeleteFile) 2 0 0 1
|
|
272 272 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
|
|
273 273 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
|
|
274 274 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
|
|
275 275 <object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>) 2 0 0 1
|
|
276 276 \x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission] 2 0 0 1
|
|
277 277 <object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\> 2 0 0 1
|
|
278 278 000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F 2 0 0 1
|
|
279 279 (javascript|http|ftp|vbscript) 2 0 0 1
|
|
280 280 (SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen) 2 0 0 1
|
|
281 281 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000 2 0 0 1
|
|
282 282 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407 2 0 0 1
|
|
283 283 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414 2 0 0 1
|
|
284 284 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1
|
|
285 285 (AddAttachment|SubmitToExpress) 2 0 0 1
|
|
286 286 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6 2 0 0 1
|
|
287 287 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0 2 0 0 1
|
|
288 288 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D 2 0 0 1
|
|
289 289 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile) 2 0 0 1
|
|
290 290 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\> 2 0 0 1
|
|
291 291 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\> 2 0 0 1
|
|
292 292 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC 2 0 0 1
|
|
293 293 src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape 2 0 0 1
|
|
294 294 (LogFile|ClearLogFile|SaveToFile) 2 0 0 1
|
|
295 295 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext) 2 0 0 1
|
|
296 296 ^User-Agent\x3a Downloader \d\.\d\r?$/Hm 2 0 0 1
|
|
297 297 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P 2 0 0 1
|
|
298 298 ^((\r?\n\r?\n).)*?\r?\n\r?\nMZ 2 0 0 1
|
|
299 299 instructions\/\d{2}\.xml 2 0 0 1
|
|
300 300 (GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp 2 0 0 1
|
|
301 301 \/updatestats\/update\d+?\.xml$ 2 0 0 1
|
|
302 302 (GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab 2 0 0 1
|
|
303 303 ctxad-\d+\.sig 2 0 0 1
|
|
304 304 /user\d+/counter\.htm 2 0 0 1
|
|
305 305 (cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr 2 0 0 1
|
|
306 306 (discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe 2 0 0 1
|
|
307 307 loaderadv\d+\.jar 2 0 0 1
|
|
308 308 \/adv\/\d+\/win32\.exe 2 0 0 1
|
|
309 309 \/Message\/\S+\/\S+\.xml 2 0 0 1
|
|
310 310 \/abt\?data=\S{150} 2 0 0 1
|
|
311 311 ^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi 2 0 0 1
|
|
312 312 User-Agent\:[^\n]+wbi_v\d/iH 2 0 0 1
|
|
313 313 User-Agent\x3a[^\n]+AskBar/iH 2 0 0 1
|
|
314 314 \/tbrequest\d+\.php 2 0 0 1
|
|
315 315 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
|
|
316 316 sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
|
|
317 317 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
|
|
318 318 cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
|
|
319 319 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
|
|
320 320 UID=\d 2 0 0 1
|
|
321 321 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
|
|
322 322 REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P 2 0 0 1
|
|
323 323 victim\.php\?\d\d\d\d\d 2 0 0 1
|
|
324 324 \/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d 2 0 0 1
|
|
325 325 \/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+ 2 0 0 1
|
|
326 326 &ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d 2 0 0 1
|
|
327 327 \/sd\?s=\d+&f=\d&C=\d 2 0 0 1
|
|
328 328 \.txt$ 2 0 0 1
|
|
329 329 \.cfg$ 2 0 0 1
|
|
330 330 User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H 2 0 0 1
|
|
331 331 ^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi 2 0 0 1
|
|
332 332 \x00[\x02-\x1E][0-9]{2,30}\x02cn\x00 2 0 0 1
|
|
333 333 \x00[\x02-\x1E][0-9]{2,30}\x02ru\x00 2 0 0 1
|
|
334 334 ^[A-F0-9]+$ 2 0 0 1
|
|
335 335 \/sd\?s=\d+&f=\d 2 0 0 1
|
|
336 336 loadadv\d+\.exe 2 0 0 1
|
|
337 337 \/ms\d\d\dcfg\.jsp 2 0 0 1
|
|
338 338 ^0x[0-9a-f]+$ 2 0 0 1
|
|
339 339 ^[^a-z]*?[0-9]{2,30}\.ru$ 2 0 0 1
|
|
340 340 filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe 2 0 0 1
|
|
341 341 ^MM \d\.\d+$ 2 0 0 1
|
|
342 342 ^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4} 2 0 0 1
|
|
343 343 ^\w+pcsetup_\w+ 2 0 0 1
|
|
344 344 \x2Fv[0-9]{3,4}[\x2F\x3F] 2 0 0 1
|
|
345 345 [a-f0-9]{32}\?v= 2 0 0 1
|
|
346 346 ^\/[a-z]{2}\x3Fv\x3D[0-9]$ 2 0 0 1
|
|
347 347 ^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$ 2 0 0 1
|
|
348 348 ^\/entrance\?s1=[a-f0-9]{100,}$ 2 0 0 1
|
|
349 349 ^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report= 2 0 0 1
|
|
350 350 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
351 351 ^[0-9][a-z]+ 2 0 0 1
|
|
352 352 \.php$ 2 0 0 1
|
|
353 353 ^\/([^\x2f]+\/)*log\/\?[bc]= 2 0 0 1
|
|
354 354 ^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/)) 2 0 0 1
|
|
355 355 ^\/\?pcrc=\d+&v=[\d.]+$ 2 0 0 1
|
|
356 356 ^\/\?v=[\d.]+&pcrc=\d+$ 2 0 0 1
|
|
357 357 \/v\d\/[^.]+\.asp$ 2 0 0 1
|
|
358 358 \/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$ 2 0 0 1
|
|
359 359 \/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$ 2 0 0 1
|
|
360 360 ^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$ 2 0 0 1
|
|
361 361 ^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$ 2 0 0 1
|
|
362 362 \?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4}) 2 0 0 1
|
|
363 363 ^Downloader\s\d+\.\d+$ 2 0 0 1
|
|
364 364 ^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100} 2 0 0 1
|
|
365 365 \/get_xml\?(file_id|stb)= 2 0 0 1
|
|
366 366 (_[a-z]{2}){1,3}_[a-z]{3}_install\.exe 2 0 0 1
|
|
367 367 \d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows 2 0 0 1
|
|
368 368 ^[a-zA-Z0-9_-]+$ 2 0 0 1
|
|
369 369 ^\/([a-zA-Z0-9]|%2[fb]){400,}$ 2 0 0 1
|
|
370 370 User-Agent\:[^\n]+searchengine 2 0 0 1
|
|
371 371 User-Agent\:[^\n]+SurferPlugin 2 0 0 1
|
|
372 372 User-Agent\:[^\n]+THNALL[^\n]+\.EXE 2 0 0 1
|
|
373 373 User-Agent\:[^\n]+XupiterToolbar 2 0 0 1
|
|
374 374 User-Agent\:[^\n]+spywareaxe 2 0 0 1
|
|
375 375 User-Agent\:[^\n]+iMeshBar 2 0 0 1
|
|
376 376 User-Agent\:[^\n]+Oemji 2 0 0 1
|
|
377 377 ^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$ 2 0 0 1
|
|
378 378 ^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$ 2 0 0 1
|
|
379 379 ^\/(get|install)\/\?q= 2 0 0 1
|
|
380 380 ^\/[a-f0-9]{50,}$ 2 0 0 1
|
|
381 381 ^\/[\w-]{50,}$ 2 0 0 1
|
|
382 382 ^\/\?pcrc=[0-9]{7,10}$ 2 0 0 1
|
|
383 383 ^Downloader \d\.\d$ 2 0 0 1
|
|
384 384 \/Socks[45]\.txt$ 2 0 0 1
|
|
385 385 ^Feat[^\r\n]+(Install|Updat)er 2 0 0 1
|
|
386 386 User-Agent\:[^\n]+host(ie|oe|oi|ol) 2 0 0 1
|
|
387 387 User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2} 2 0 0 1
|
|
388 388 ^BWL(\sToplist|\d_UPDATE) 2 0 0 1
|
|
389 389 ^\x2F[A-F0-9]{25,40}$ 2 0 0 1
|
|
390 390 ^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$ 2 0 0 1
|
|
391 391 ^\d+\sHTTP/1.1$ 2 0 0 1
|
|
392 392 ^[a-zA-Z0-9_-]+ 2 0 0 1
|
|
393 393 [a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12} 2 0 0 1
|
|
394 394 \/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id= 2 0 0 1
|
|
395 395 \{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\} 2 0 0 1
|
|
396 396 CN=([^\r\n]+?\.)?showmypc\.com(\.) 2 0 0 1
|
|
397 397 ^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$ 2 0 0 1
|
|
398 398 (SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk) 2 0 0 1
|
|
399 399 (DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog) 2 0 0 1
|
|
400 400 \d{13}$ 2 0 0 1
|
|
401 401 ^[a-f0-9]{32} 2 0 0 1
|
|
402 402 ^[a-f0-9]{32}\" 2 0 0 1
|
|
403 403 ^([A-F0-9]{2}\:){5}[A-F0-9]{2} 2 0 0 1
|
|
404 404 ^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12} 2 0 0 1
|
|
405 405 ^([A-F0-9]{2}\:){5}[A-F0-9]{2} 2 0 0 1
|
|
406 406 ^[A-F0-9]{12} 2 0 0 1
|
|
407 407 ^[A-Z0-9]{9} 2 0 0 1
|
|
408 408 ^\d+[^\r\n\s]+ 2 0 0 1
|
|
409 409 ^ SQL[-_ ]Server 2 0 0 1
|
|
410 410 ^ \d+ Driver 2 0 0 1
|
|
411 411 ORA-\d{4} 2 0 0 1
|
|
412 412 Warning.*\Woci_ 2 0 0 1
|
|
413 413 Warning.*\Wora_ 2 0 0 1
|
|
414 414 CLI Driver.*DB2 2 0 0 1
|
|
415 415 bdb2_\w+\( 2 0 0 1
|
|
416 416 Exception.*Informix 2 0 0 1
|
|
417 417 Warning.*SQLite3:: 2 0 0 1
|
|
418 418 SQL error.*POS\([0-9]+\) 2 0 0 1
|
|
419 419 Warning.*maxdb 2 0 0 1
|
|
420 420 i?Warning.*sybase 2 0 0 1
|
|
421 421 Warning.*ingres_ 2 0 0 1
|
|
422 422 Warning.*sqlite_ 2 0 0 1
|
|
423 423 Ingres\W.*Driver 2 0 0 1
|
|
424 424 Exception (condition )\d+\. Transaction rollback\. 2 0 0 1
|
|
425 425 SQL Server.*?error \x27[0-9a-f]{8} 2 0 0 1
|
|
426 426 ^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$ 2 0 0 1
|
|
427 427 ^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll 2 0 0 1
|
|
428 428 ^...\x30\x82..\x02\x82...{256,257} 2 0 0 1
|
|
429 429 \/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php 2 0 0 1
|
|
430 430 \/notify\/(single|mass)$ 2 0 0 1
|
|
431 431 a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php) 2 0 0 1
|
|
432 432 Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a 2 0 0 1
|
|
433 433 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
434 434 [-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10} 2 0 0 1
|
|
435 435 ^\d+(\+|\-|\\|\*)\d+ 2 0 0 1
|
|
436 436 ^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9 2 0 0 1
|
|
437 437 ^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u 2 0 0 1
|
|
438 438 ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b 2 0 0 1
|
|
439 439 ^\d{4}[01] 2 0 0 1
|
|
440 440 ^\d{4}[01] 2 0 0 1
|
|
441 441 ^\d{4}[01] 2 0 0 1
|
|
442 442 ^\d{4}[01] 2 0 0 1
|
|
443 443 ^\d{4}[01] 2 0 0 1
|
|
444 444 ^\d{4}[01] 2 0 0 1
|
|
445 445 ^\d{4}[01] 2 0 0 1
|
|
446 446 ^\d{4}[01] 2 0 0 1
|
|
447 447 ^\d{4}[01] 2 0 0 1
|
|
448 448 ^\d{4}[01] 2 0 0 1
|
|
449 449 ^\d{4}[01] 2 0 0 1
|
|
450 450 ^\d{4}[01] 2 0 0 1
|
|
451 451 ^\d{4}[01] 2 0 0 1
|
|
452 452 ^\d{4}[01] 2 0 0 1
|
|
453 453 ^\d{4}[01] 2 0 0 1
|
|
454 454 ^\d{4}[01] 2 0 0 1
|
|
455 455 ^\d{4}[01] 2 0 0 1
|
|
456 456 ^\d{4}[01] 2 0 0 1
|
|
457 457 ^\d{4}[01] 2 0 0 1
|
|
458 458 ^\d{4}[01] 2 0 0 1
|
|
459 459 ^\d{4}[01] 2 0 0 1
|
|
460 460 ^\d{4}[01] 2 0 0 1
|
|
461 461 ^\d{4}[01] 2 0 0 1
|
|
462 462 ^\d{4}[01] 2 0 0 1
|
|
463 463 ^\d{4}[01] 2 0 0 1
|
|
464 464 ^\d{4}[01] 2 0 0 1
|
|
465 465 ^\d{4}[01] 2 0 0 1
|
|
466 466 ^\d{4}[01] 2 0 0 1
|
|
467 467 ^\d{4}[01] 2 0 0 1
|
|
468 468 ^\d{4}[01] 2 0 0 1
|
|
469 469 ^\d{4}[01] 2 0 0 1
|
|
470 470 ^\d{4}[01] 2 0 0 1
|
|
471 471 ^\d{4}[01] 2 0 0 1
|
|
472 472 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
473 473 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
474 474 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
475 475 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
476 476 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
477 477 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
478 478 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
479 479 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
480 480 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
481 481 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
482 482 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
483 483 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
484 484 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
485 485 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
486 486 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
487 487 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
488 488 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
489 489 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
490 490 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
491 491 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
492 492 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
493 493 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
494 494 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
495 495 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
496 496 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
497 497 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
498 498 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
499 499 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
500 500 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
501 501 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
502 502 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
503 503 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
504 504 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
505 505 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
506 506 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
507 507 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
508 508 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
509 509 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
510 510 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
511 511 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
512 512 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
513 513 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
514 514 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
515 515 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
516 516 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
517 517 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
518 518 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
519 519 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
520 520 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
521 521 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
522 522 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
523 523 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
524 524 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
525 525 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
526 526 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
527 527 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
528 528 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
529 529 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
530 530 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
531 531 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
532 532 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
533 533 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
534 534 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
535 535 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
536 536 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
537 537 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
538 538 ^\d{4}[01] 2 0 0 1
|
|
539 539 ^\d{4}[01] 2 0 0 1
|
|
540 540 ^\d{4}[01] 2 0 0 1
|
|
541 541 ^\d{4}[01] 2 0 0 1
|
|
542 542 ^\d{4}[01] 2 0 0 1
|
|
543 543 ^\d{4}[01] 2 0 0 1
|
|
544 544 ^\d{4}[01] 2 0 0 1
|
|
545 545 ^\d{4}[01] 2 0 0 1
|
|
546 546 ^\d{4}[01] 2 0 0 1
|
|
547 547 ^\d{4}[01] 2 0 0 1
|
|
548 548 ^\d{4}[01] 2 0 0 1
|
|
549 549 ^\d{4}[01] 2 0 0 1
|
|
550 550 ^\d{4}[01] 2 0 0 1
|
|
551 551 ^\d{4}[01] 2 0 0 1
|
|
552 552 ^\d{4}[01] 2 0 0 1
|
|
553 553 ^\d{4}[01] 2 0 0 1
|
|
554 554 ^\d{4}[01] 2 0 0 1
|
|
555 555 ^\d{4}[01] 2 0 0 1
|
|
556 556 ^\d{4}[01] 2 0 0 1
|
|
557 557 ^\d{4}[01] 2 0 0 1
|
|
558 558 ^\d{4}[01] 2 0 0 1
|
|
559 559 ^\d{4}[01] 2 0 0 1
|
|
560 560 ^\d{4}[01] 2 0 0 1
|
|
561 561 ^\d{4}[01] 2 0 0 1
|
|
562 562 ^\d{4}[01] 2 0 0 1
|
|
563 563 ^\d{4}[01] 2 0 0 1
|
|
564 564 ^\d{4}[01] 2 0 0 1
|
|
565 565 ^\d{4}[01] 2 0 0 1
|
|
566 566 ^\d{4}[01] 2 0 0 1
|
|
567 567 ^\d{4}[01] 2 0 0 1
|
|
568 568 ^\d{4}[01] 2 0 0 1
|
|
569 569 ^\d{4}[01] 2 0 0 1
|
|
570 570 ^\d{4}[01] 2 0 0 1
|
|
571 571 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
572 572 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
573 573 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
574 574 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
575 575 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
576 576 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
577 577 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
578 578 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
579 579 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
580 580 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
581 581 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
582 582 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
583 583 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
584 584 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
585 585 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
586 586 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
587 587 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
588 588 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
589 589 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
590 590 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
591 591 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
592 592 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
593 593 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
594 594 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
595 595 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
596 596 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
597 597 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
598 598 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
599 599 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
600 600 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
601 601 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
602 602 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
603 603 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
604 604 ^\d{4}[01] 2 0 0 1
|
|
605 605 ^\d{4}[01] 2 0 0 1
|
|
606 606 ^\d{4}[01] 2 0 0 1
|
|
607 607 ^\d{4}[01] 2 0 0 1
|
|
608 608 ^\d{4}[01] 2 0 0 1
|
|
609 609 ^\d{4}[01] 2 0 0 1
|
|
610 610 ^\d{4}[01] 2 0 0 1
|
|
611 611 ^\d{4}[01] 2 0 0 1
|
|
612 612 ^\d{4}[01] 2 0 0 1
|
|
613 613 ^\d{4}[01] 2 0 0 1
|
|
614 614 ^\d{4}[01] 2 0 0 1
|
|
615 615 ^\d{4}[01] 2 0 0 1
|
|
616 616 ^\d{4}[01] 2 0 0 1
|
|
617 617 ^\d{4}[01] 2 0 0 1
|
|
618 618 ^\d{4}[01] 2 0 0 1
|
|
619 619 ^\d{4}[01] 2 0 0 1
|
|
620 620 ^\d{4}[01] 2 0 0 1
|
|
621 621 ^\d{4}[01] 2 0 0 1
|
|
622 622 ^\d{4}[01] 2 0 0 1
|
|
623 623 ^\d{4}[01] 2 0 0 1
|
|
624 624 ^\d{4}[01] 2 0 0 1
|
|
625 625 ^\d{4}[01] 2 0 0 1
|
|
626 626 ^\d{4}[01] 2 0 0 1
|
|
627 627 ^\d{4}[01] 2 0 0 1
|
|
628 628 ^\d{4}[01] 2 0 0 1
|
|
629 629 ^\d{4}[01] 2 0 0 1
|
|
630 630 ^\d{4}[01] 2 0 0 1
|
|
631 631 ^\d{4}[01] 2 0 0 1
|
|
632 632 ^\d{4}[01] 2 0 0 1
|
|
633 633 ^\d{4}[01] 2 0 0 1
|
|
634 634 ^\d{4}[01] 2 0 0 1
|
|
635 635 ^\d{4}[01] 2 0 0 1
|
|
636 636 ^\d{4}[01] 2 0 0 1
|
|
637 637 ^\d{4}[01] 2 0 0 1
|
|
638 638 ^\d{4}[01] 2 0 0 1
|
|
639 639 ^\d{4}[01] 2 0 0 1
|
|
640 640 ^\d{4}[01] 2 0 0 1
|
|
641 641 ^\d{4}[01] 2 0 0 1
|
|
642 642 ^\d{4}[01] 2 0 0 1
|
|
643 643 ^\d{4}[01] 2 0 0 1
|
|
644 644 ^\d{4}[01] 2 0 0 1
|
|
645 645 ^\d{4}[01] 2 0 0 1
|
|
646 646 ^\d{4}[01] 2 0 0 1
|
|
647 647 ^\d{4}[01] 2 0 0 1
|
|
648 648 ^\d{4}[01] 2 0 0 1
|
|
649 649 ^\d{4}[01] 2 0 0 1
|
|
650 650 ^\d{4}[01] 2 0 0 1
|
|
651 651 ^\d{4}[01] 2 0 0 1
|
|
652 652 ^\d{4}[01] 2 0 0 1
|
|
653 653 ^\d{4}[01] 2 0 0 1
|
|
654 654 ^\d{4}[01] 2 0 0 1
|
|
655 655 ^\d{4}[01] 2 0 0 1
|
|
656 656 ^\d{4}[01] 2 0 0 1
|
|
657 657 ^\d{4}[01] 2 0 0 1
|
|
658 658 ^\d{4}[01] 2 0 0 1
|
|
659 659 ^\d{4}[01] 2 0 0 1
|
|
660 660 ^\d{4}[01] 2 0 0 1
|
|
661 661 ^\d{4}[01] 2 0 0 1
|
|
662 662 ^\d{4}[01] 2 0 0 1
|
|
663 663 ^\d{4}[01] 2 0 0 1
|
|
664 664 ^\d{4}[01] 2 0 0 1
|
|
665 665 ^\d{4}[01] 2 0 0 1
|
|
666 666 ^\d{4}[01] 2 0 0 1
|
|
667 667 ^\d{4}[01] 2 0 0 1
|
|
668 668 ^\d{4}[01] 2 0 0 1
|
|
669 669 ^\d{4}[01] 2 0 0 1
|
|
670 670 ^\d{4}[01] 2 0 0 1
|
|
671 671 ^\d{4}[01] 2 0 0 1
|
|
672 672 ^\d{4}[01] 2 0 0 1
|
|
673 673 ^\d{4}[01] 2 0 0 1
|
|
674 674 ^\d{4}[01] 2 0 0 1
|
|
675 675 ^\d{4}[01] 2 0 0 1
|
|
676 676 ^\d{4}[01] 2 0 0 1
|
|
677 677 ^\d{4}[01] 2 0 0 1
|
|
678 678 ^\d{4}[01] 2 0 0 1
|
|
679 679 ^\d{4}[01] 2 0 0 1
|
|
680 680 ^\d{4}[01] 2 0 0 1
|
|
681 681 ^\d{4}[01] 2 0 0 1
|
|
682 682 ^\d{4}[01] 2 0 0 1
|
|
683 683 ^\d{4}[01] 2 0 0 1
|
|
684 684 ^\d{4}[01] 2 0 0 1
|
|
685 685 ^\d{4}[01] 2 0 0 1
|
|
686 686 ^\d{4}[01] 2 0 0 1
|
|
687 687 ^\d{4}[01] 2 0 0 1
|
|
688 688 ^\d{4}[01] 2 0 0 1
|
|
689 689 ^\d{4}[01] 2 0 0 1
|
|
690 690 ^\d{4}[01] 2 0 0 1
|
|
691 691 ^\d{4}[01] 2 0 0 1
|
|
692 692 ^\d{4}[01] 2 0 0 1
|
|
693 693 ^\d{4}[01] 2 0 0 1
|
|
694 694 ^\d{4}[01] 2 0 0 1
|
|
695 695 ^\d{4}[01] 2 0 0 1
|
|
696 696 ^\d{4}[01] 2 0 0 1
|
|
697 697 ^\d{4}[01] 2 0 0 1
|
|
698 698 ^\d{4}[01] 2 0 0 1
|
|
699 699 ^\d{4}[01] 2 0 0 1
|
|
700 700 ^\d{4}[01] 2 0 0 1
|
|
701 701 ^\d{4}[01] 2 0 0 1
|
|
702 702 ^\d{4}[01] 2 0 0 1
|
|
703 703 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
704 704 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
705 705 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
706 706 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
707 707 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
708 708 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
709 709 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
710 710 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
711 711 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
712 712 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
713 713 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
714 714 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
715 715 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
716 716 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
717 717 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
718 718 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
719 719 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
720 720 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
721 721 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
722 722 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
723 723 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
724 724 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
725 725 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
726 726 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
727 727 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
728 728 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
729 729 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
730 730 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
731 731 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
732 732 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
733 733 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
734 734 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
735 735 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
736 736 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
737 737 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
738 738 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
739 739 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
740 740 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
741 741 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
742 742 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
743 743 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
744 744 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
745 745 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
746 746 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
747 747 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
748 748 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
749 749 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
750 750 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
751 751 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
752 752 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
753 753 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
754 754 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
755 755 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
756 756 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
757 757 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
758 758 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
759 759 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
760 760 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
761 761 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
762 762 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
763 763 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
764 764 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
765 765 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
766 766 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
767 767 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
768 768 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
769 769 ^\d{4}[01] 2 0 0 1
|
|
770 770 ^\d{4}[01] 2 0 0 1
|
|
771 771 ^\d{4}[01] 2 0 0 1
|
|
772 772 ^\d{4}[01] 2 0 0 1
|
|
773 773 ^\d{4}[01] 2 0 0 1
|
|
774 774 ^\d{4}[01] 2 0 0 1
|
|
775 775 ^\d{4}[01] 2 0 0 1
|
|
776 776 ^\d{4}[01] 2 0 0 1
|
|
777 777 ^\d{4}[01] 2 0 0 1
|
|
778 778 ^\d{4}[01] 2 0 0 1
|
|
779 779 ^\d{4}[01] 2 0 0 1
|
|
780 780 ^\d{4}[01] 2 0 0 1
|
|
781 781 ^\d{4}[01] 2 0 0 1
|
|
782 782 ^\d{4}[01] 2 0 0 1
|
|
783 783 ^\d{4}[01] 2 0 0 1
|
|
784 784 ^\d{4}[01] 2 0 0 1
|
|
785 785 ^\d{4}[01] 2 0 0 1
|
|
786 786 ^\d{4}[01] 2 0 0 1
|
|
787 787 ^\d{4}[01] 2 0 0 1
|
|
788 788 ^\d{4}[01] 2 0 0 1
|
|
789 789 ^\d{4}[01] 2 0 0 1
|
|
790 790 ^\d{4}[01] 2 0 0 1
|
|
791 791 ^\d{4}[01] 2 0 0 1
|
|
792 792 ^\d{4}[01] 2 0 0 1
|
|
793 793 ^\d{4}[01] 2 0 0 1
|
|
794 794 ^\d{4}[01] 2 0 0 1
|
|
795 795 ^\d{4}[01] 2 0 0 1
|
|
796 796 ^\d{4}[01] 2 0 0 1
|
|
797 797 ^\d{4}[01] 2 0 0 1
|
|
798 798 ^\d{4}[01] 2 0 0 1
|
|
799 799 ^\d{4}[01] 2 0 0 1
|
|
800 800 ^\d{4}[01] 2 0 0 1
|
|
801 801 ^\d{4}[01] 2 0 0 1
|
|
802 802 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
803 803 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
804 804 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
805 805 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
806 806 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
807 807 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
808 808 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
809 809 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
810 810 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
811 811 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
812 812 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
813 813 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
814 814 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
815 815 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
816 816 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
817 817 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
818 818 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
819 819 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
820 820 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
821 821 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
822 822 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
823 823 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
824 824 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
825 825 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
826 826 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
827 827 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
828 828 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
829 829 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
830 830 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
831 831 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
832 832 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
833 833 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
834 834 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
835 835 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
836 836 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
837 837 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
838 838 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
839 839 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
840 840 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
841 841 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
842 842 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
843 843 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
844 844 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
845 845 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
846 846 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
847 847 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
848 848 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
849 849 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
850 850 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
851 851 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
852 852 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
853 853 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
854 854 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
855 855 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
856 856 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
857 857 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
858 858 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
859 859 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
860 860 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
861 861 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
862 862 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
863 863 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
864 864 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
865 865 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
866 866 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
867 867 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
|
|
868 868 ^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22 2 0 0 1
|
|
869 869 ^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22 2 0 0 1
|
|
870 870 \x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,} 2 0 0 1
|
|
871 871 ^\x3c(REQIMG|RVWCFG)\x3e 2 0 0 1
|
|
872 872 appid\x3a\s+2 2 0 0 1
|
|
873 873 ^\x3c(REQIMG|RVWCFG)\x3e 2 0 0 1
|
|
874 874 \x22mining\x2E(subscribe|authorize)\x22 2 0 0 1
|
|
875 875 ^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start 2 0 0 1
|
|
876 876 ^\/api\/(bit|lite)coin\/balance\/ 2 0 0 1
|
|
877 877 miner[^a-z] 2 0 0 1
|
|
878 878 (\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22) 2 0 0 1
|
|
879 879 (\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22) 2 0 0 1
|
|
880 880 ([0-9]{1,3}\.){3}[0-9]{1,3} 2 0 0 1
|
|
881 881 \/tmp\/[^\/]+\.swf$ 2 0 0 1
|
|
882 882 name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22 2 0 0 1
|
|
883 883 name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22 2 0 0 1
|
|
884 884 =[0-9a-f]{8}\.jar/H 2 0 0 1
|
|
885 885 ^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\? 2 0 0 1
|
|
886 886 ^\/[a-z0-9]{32}\?s=1$ 2 0 0 1
|
|
887 887 ^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s]))) 2 0 0 1
|
|
888 888 ^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>] 2 0 0 1
|
|
889 889 ^(mous)?\.class 2 0 0 1
|
|
890 890 \/chrome\/google_chrome_(update|installer)\.exe$ 2 0 0 1
|
|
891 891 ^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f) 2 0 0 1
|
|
892 892 ^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P 2 0 0 1
|
|
893 893 findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$ 2 0 0 1
|
|
894 894 ^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m 2 0 0 1
|
|
895 895 \.php\?cashe=\d+$ 2 0 0 1
|
|
896 896 \.jar\?m=[1-2]$ 2 0 0 1
|
|
897 897 \.pdf\?p=1&s=[1-2]$ 2 0 0 1
|
|
898 898 ^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi 2 0 0 1
|
|
899 899 ^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$ 2 0 0 1
|
|
900 900 \/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$ 2 0 0 1
|
|
901 901 \/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$ 2 0 0 1
|
|
902 902 \/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$ 2 0 0 1
|
|
903 903 \/tds\/[a-f0-9]{32}$ 2 0 0 1
|
|
904 904 ^[a-f0-9]{32}[\x22\x27] 2 0 0 1
|
|
905 905 Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi 2 0 0 1
|
|
906 906 (\.\.\/)+kboxwww\/tmp\/ 2 0 0 1
|
|
907 907 ^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22 2 0 0 1
|
|
908 908 ^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs 2 0 0 1
|
|
909 909 ^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs 2 0 0 1
|
|
910 910 \/\?[0-9a-f]{60,66}[\;\d\x2c]*$ 2 0 0 1
|
|
911 911 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15} 2 0 0 1
|
|
912 912 \/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php 2 0 0 1
|
|
913 913 debugenableplugins=[a-zA-Z0-9]+?\x3b 2 0 0 1
|
|
914 914 ^\/[a-z0-9]+\/load\.php$ 2 0 0 1
|
|
915 915 ^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H 2 0 0 1
|
|
916 916 ^\/xteas\/code$ 2 0 0 1
|
|
917 917 \/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash= 2 0 0 1
|
|
918 918 =\w{8}\.pdf/Hi 2 0 0 1
|
|
919 919 ^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$ 2 0 0 1
|
|
920 920 ^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H 2 0 0 1
|
|
921 921 ^Host\x3a\s.+\.in\r?$/Hmi 2 0 0 1
|
|
922 922 name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22 2 0 0 1
|
|
923 923 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$ 2 0 0 1
|
|
924 924 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$ 2 0 0 1
|
|
925 925 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$ 2 0 0 1
|
|
926 926 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$ 2 0 0 1
|
|
927 927 ^Location\x3a\x20[a-f0-9]{32}\/e\.html\r$/Hm 2 0 0 1
|
|
928 928 ^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket)) 2 0 0 1
|
|
929 929 ^(\/updates|\/license\/eula|\/docs\/office|\/software-activation) 2 0 0 1
|
|
930 930 ^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google)) 2 0 0 1
|
|
931 931 ^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b 2 0 0 1
|
|
932 932 ^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2) 2 0 0 1
|
|
933 933 \/api\/v1\/user\/(512|124)\/avatar 2 0 0 1
|
|
934 934 ^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01] 2 0 0 1
|
|
935 935 ^\/v1\/(queue|profile|docs\/wsdl|pull) 2 0 0 1
|
|
936 936 ^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/) 2 0 0 1
|
|
937 937 ^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check) 2 0 0 1
|
|
938 938 ^[^\n]*[\x00-\x08\x0e-\x1f] 2 0 0 1
|
|
939 939 (TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
940 940 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
941 941 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
942 942 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
943 943 (TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
944 944 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR)) 2 0 0 1
|
|
945 945 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
|
|
946 946 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
947 947 (TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
948 948 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
949 949 (TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
950 950 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
|
|
951 951 (TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
952 952 (TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
953 953 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
954 954 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
955 955 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
956 956 (TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
957 957 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
958 958 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
959 959 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
960 960 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
961 961 (TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
962 962 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
963 963 (TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
964 964 (TOP|//)\Wsecret[^\w/a] 2 0 0 1
|
|
965 965 \[\[\d{1,3}\,\[\\\"\w\\\"\,\\\".+@gmail.com.+\\\"\,\\\" 2 0 0 1
|
|
966 966 User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER 2 0 0 1
|
|
967 967 \x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20) 2 0 0 1
|
|
968 968 PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20) 2 0 0 1
|
|
969 969 \x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A 2 0 0 1
|
|
970 970 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000 2 0 0 1
|
|
971 971 filename\s*=\s*"WU_Details_.....\.zip 2 0 0 1
|
|
972 972 filename\s*=\s*MySpace_document_[0-9]{5}\.zip 2 0 0 1
|
|
973 973 filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22 2 0 0 1
|
|
974 974 filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22 2 0 0 1
|
|
975 975 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E 2 0 0 1
|
|
976 976 MyValue=[a-f0-9]{32} 2 0 0 1
|
|
977 977 \x0d\x0aUser-Agent\: 0\:0\:[^\n]{120} 2 0 0 1
|
|
978 978 User-Agent\: 0\:0\:[^\x0a|\x0d]{128} 2 0 0 1
|
|
979 979 01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20 2 0 0 1
|
|
980 980 (\.\.\/){1,} 2 0 0 1
|
|
981 981 \/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172} 2 0 0 1
|
|
982 982 03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C 2 0 0 1
|
|
983 983 4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B 2 0 0 1
|
|
984 984 php\?r=\d+&p= 2 0 0 1
|
|
985 985 \/socks\.php\?name=[^&]+&port=\d{1,5}$ 2 0 0 1
|
|
986 986 SELECT.+FROM 2 0 0 1
|
|
987 987 UNION\s+SELECT 2 0 0 1
|
|
988 988 INSERT.+INTO 2 0 0 1
|
|
989 989 DELETE.+FROM 2 0 0 1
|
|
990 990 ASCII\(.+SELECT 2 0 0 1
|
|
991 991 UPDATE.+SET 2 0 0 1
|
|
992 992 EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5 2 0 0 1
|
|
993 993 BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5 2 0 0 1
|
|
994 994 6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41 2 0 0 1
|
|
995 995 index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3) 2 0 0 1
|
|
996 996 (file=\|.+\|) 2 0 0 1
|
|
997 997 SELECT.+FROM 2 0 0 1
|
|
998 998 UNION\s+SELECT 2 0 0 1
|
|
999 999 INSERT.+INTO 2 0 0 1
|
|
1000 1000 DELETE.+FROM 2 0 0 1
|
|
1001 1001 ASCII\(.+SELECT 2 0 0 1
|
|
1002 1002 UPDATE.+SET 2 0 0 1
|
|
1003 1003 SELECT.+FROM 2 0 0 1
|
|
1004 1004 UNION\s+SELECT 2 0 0 1
|
|
1005 1005 INSERT.+INTO 2 0 0 1
|
|
1006 1006 DELETE.+FROM 2 0 0 1
|
|
1007 1007 ASCII\(.+SELECT 2 0 0 1
|
|
1008 1008 UPDATE.+SET 2 0 0 1
|
|
1009 1009 SELECT.+FROM 2 0 0 1
|
|
1010 1010 UNION\s+SELECT 2 0 0 1
|
|
1011 1011 INSERT.+INTO 2 0 0 1
|
|
1012 1012 DELETE.+FROM 2 0 0 1
|
|
1013 1013 ASCII\(.+SELECT 2 0 0 1
|
|
1014 1014 UPDATE.+SET 2 0 0 1
|
|
1015 1015 (TOP|//)\Wsecret[^\w/a] 2 0 0 1
|
|
1016 1016 filename=\x22Facebook_(Password|Support|Document)_[A-Z0-9]{4,7}\.zip\x22 2 0 0 1
|
|
1017 1017 \x2FU3D\x2FLength\x20172[0-5][0-9]{2} 2 0 0 1
|
|
1018 1018 \/000[a-z][0-9]{3}\x2Eso 2 0 0 1
|
|
1019 1019 \/000[a-z][0-9]{3}\x2Eexe 2 0 0 1
|
|
1020 1020 UPDATE.+SET 2 0 0 1
|
|
1021 1021 PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F] 2 0 0 1
|
|
1022 1022 ^FOLD\s[^\n]{256} 2 0 0 1
|
|
1023 1023 ^FOLD\s+\/ 2 0 0 1
|
|
1024 1024 ^Username\:[^\n]{100} 2 0 0 1
|
|
1025 1025 ^http\x3a\x2f\x2f[^\n]{400} 2 0 0 1
|
|
1026 1026 ^http\x3a\x2f\x2f[^\n]{400} 2 0 0 1
|
|
1027 1027 ^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\} 2 0 0 1
|
|
1028 1028 ^file\x3a\x2f\x2f[^\n]{400} 2 0 0 1
|
|
1029 1029 \x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65) 2 0 0 1
|
|
1030 1030 OS 4_[0-3]_[1-4] like/H 2 0 0 1
|
|
1031 1031 [a-f0-9]{16}$ 2 0 0 1
|
|
1032 1032 mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1
|
|
1033 1033 (/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration) 2 0 0 1
|
|
1034 1034 \x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02 2 0 0 1
|
|
1035 1035 \x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02 2 0 0 1
|
|
1036 1036 NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A 2 0 0 1
|
|
1037 1037 \x3a.4\x7c.12.\x3a.4 2 0 0 1
|
|
1038 1038 (cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta) 2 0 0 1
|
|
1039 1039 keepalive([0-9]{4}|\x7c[0-9]{4}) 2 0 0 1
|
|
1040 1040 User-Agent\x3a[^\n]+sbu-hb- 2 0 0 1
|
|
1041 1041 User-Agent\:[^\n]+Peer Points/iH 2 0 0 1
|
|
1042 1042 User-Agent\:[^\n]+zbu-hb-/Hi 2 0 0 1
|
|
1043 1043 User-Agent\:[^\n]+HSN/iH 2 0 0 1
|
|
1044 1044 User-Agent\:[^\n]+Wildtangent/iH 2 0 0 1
|
|
1045 1045 ^RMD\s+\x2f$ 2 0 0 1
|
|
1046 1046 User-Agent\x3A[^\n]+TheWorld/H 2 0 0 1
|
|
1047 1047 ^Max-dotdot[\s\r\n]*\d{3,} 2 0 0 1
|
|
1048 1048 ^Authorization\x3a Basic\s+= 2 0 0 1
|
|
1049 1049 ^Authorization\x3a Basic\s+= 2 0 0 1
|
|
1050 1050 Host\x3a\s[a-z]{16}\.ru/H 2 0 0 1
|
|
1051 1051 CREATE.+ENDPOINT 2 0 0 1
|
|
1052 1052 \/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir= 2 0 0 1
|
|
1053 1053 MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w 2 0 0 1
|
|
1054 1054 MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w 2 0 0 1
|
|
1055 1055 \x00[0-9]{4,7}\x02co\x00 2 0 0 1
|
|
1056 1056 \x2fsogou(config)?\x2f 2 0 0 1
|
|
1057 1057 \/\d{8,}\/\d{4,}\/\d{4,}\.jsp 2 0 0 1
|
|
1058 1058 adv\d+\.php 2 0 0 1
|
|
1059 1059 a=\%[0-9a-fA-F]{2}\&b 2 0 0 1
|
|
1060 1060 \Wcustomer\slist(s)?\W 2 0 0 1
|
|
1061 1061 \Wtransaction\shistor(y|ies)\W 2 0 0 1
|
|
1062 1062 \Wcredit\shistor(y|ies)\W 2 0 0 1
|
|
1063 1063 \Wannual\sincome(s)?\W 2 0 0 1
|
|
1064 1064 \Wpayment\shistory\W 2 0 0 1
|
|
1065 1065 \Waccount\sbalance(s)?\W 2 0 0 1
|
|
1066 1066 \Wappraisal(s)?\W 2 0 0 1
|
|
1067 1067 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1
|
|
1068 1068 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1
|
|
1069 1069 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1
|
|
1070 1070 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1
|
|
1071 1071 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1
|
|
1072 1072 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1
|
|
1073 1073 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1
|
|
1074 1074 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1
|
|
1075 1075 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1
|
|
1076 1076 \Winternal\suse\sonly\W 2 0 0 1
|
|
1077 1077 \Wlaw\senforcement\ssensitive\W 2 0 0 1
|
|
1078 1078 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1
|
|
1079 1079 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1
|
|
1080 1080 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1
|
|
1081 1081 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1
|
|
1082 1082 (//)\Wtop\ssecret[^\w/a] 2 0 0 1
|
|
1083 1083 (//)\Wconfidential[^\w/] 2 0 0 1
|
|
1084 1084 (//)\Wrestricted[^\w/] 2 0 0 1
|
|
1085 1085 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1
|
|
1086 1086 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1
|
|
1087 1087 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1
|
|
1088 1088 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1
|
|
1089 1089 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1
|
|
1090 1090 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1
|
|
1091 1091 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1
|
|
1092 1092 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1
|
|
1093 1093 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1
|
|
1094 1094 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1
|
|
1095 1095 //((NATO\sSECRET)|NS)//MR 2 0 0 1
|
|
1096 1096 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1
|
|
1097 1097 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1
|
|
1098 1098 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1
|
|
1099 1099 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1100 1100 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1101 1101 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1102 1102 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1103 1103 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1104 1104 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
|
|
1105 1105 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1106 1106 //FGI[\s\w,/-]*(//X5) 2 0 0 1
|
|
1107 1107 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1
|
|
1108 1108 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1109 1109 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1110 1110 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1111 1111 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1112 1112 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1113 1113 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1114 1114 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1115 1115 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
|
|
1116 1116 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
|
|
1117 1117 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1118 1118 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1119 1119 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1120 1120 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1121 1121 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1
|
|
1122 1122 (//)\Wrestricted[^\w/] 2 0 0 1
|
|
1123 1123 (//)\Wtop\ssecret[^\w/a] 2 0 0 1
|
|
1124 1124 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1
|
|
1125 1125 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1
|
|
1126 1126 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1
|
|
1127 1127 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1
|
|
1128 1128 \Wlaw\senforcement\ssensitive\W 2 0 0 1
|
|
1129 1129 \Winternal\suse\sonly\W 2 0 0 1
|
|
1130 1130 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1
|
|
1131 1131 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1
|
|
1132 1132 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1
|
|
1133 1133 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1
|
|
1134 1134 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1
|
|
1135 1135 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1
|
|
1136 1136 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1
|
|
1137 1137 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1
|
|
1138 1138 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1
|
|
1139 1139 \Wappraisal(s)?\W 2 0 0 1
|
|
1140 1140 \Waccount\sbalance(s)?\W 2 0 0 1
|
|
1141 1141 \Wannual\sincome(s)?\W 2 0 0 1
|
|
1142 1142 \Wcredit\shistor(y|ies)\W 2 0 0 1
|
|
1143 1143 \Wtransaction\shistor(y|ies)\W 2 0 0 1
|
|
1144 1144 \Wcustomer\slist(s)?\W 2 0 0 1
|
|
1145 1145 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1
|
|
1146 1146 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1
|
|
1147 1147 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1
|
|
1148 1148 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1
|
|
1149 1149 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1
|
|
1150 1150 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1
|
|
1151 1151 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1
|
|
1152 1152 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1
|
|
1153 1153 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1
|
|
1154 1154 //((NATO\sSECRET)|NS)//MR 2 0 0 1
|
|
1155 1155 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1
|
|
1156 1156 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1
|
|
1157 1157 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1
|
|
1158 1158 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1159 1159 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1160 1160 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1161 1161 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1162 1162 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1163 1163 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
|
|
1164 1164 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1165 1165 //FGI[\s\w,/-]*(//X5) 2 0 0 1
|
|
1166 1166 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1
|
|
1167 1167 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1168 1168 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1169 1169 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1170 1170 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1171 1171 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1172 1172 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1173 1173 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1174 1174 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
|
|
1175 1175 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
|
|
1176 1176 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1177 1177 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1178 1178 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1179 1179 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1180 1180 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1
|
|
1181 1181 (//)\Wrestricted[^\w/] 2 0 0 1
|
|
1182 1182 (//)\Wconfidential[^\w/] 2 0 0 1
|
|
1183 1183 (//)\Wtop\ssecret[^\w/a] 2 0 0 1
|
|
1184 1184 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1
|
|
1185 1185 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1
|
|
1186 1186 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1
|
|
1187 1187 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1
|
|
1188 1188 \Wlaw\senforcement\ssensitive\W 2 0 0 1
|
|
1189 1189 \Winternal\suse\sonly\W 2 0 0 1
|
|
1190 1190 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1
|
|
1191 1191 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1
|
|
1192 1192 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1
|
|
1193 1193 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1
|
|
1194 1194 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1
|
|
1195 1195 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1
|
|
1196 1196 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1
|
|
1197 1197 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1
|
|
1198 1198 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1
|
|
1199 1199 \Wappraisal(s)?\W 2 0 0 1
|
|
1200 1200 \Waccount\sbalance(s)?\W 2 0 0 1
|
|
1201 1201 \Wpayment\shistory\W 2 0 0 1
|
|
1202 1202 \Wannual\sincome(s)?\W 2 0 0 1
|
|
1203 1203 \Wcredit\shistor(y|ies)\W 2 0 0 1
|
|
1204 1204 \Wtransaction\shistor(y|ies)\W 2 0 0 1
|
|
1205 1205 \Wcustomer\slist(s)?\W 2 0 0 1
|
|
1206 1206 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1
|
|
1207 1207 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1
|
|
1208 1208 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1
|
|
1209 1209 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1
|
|
1210 1210 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1
|
|
1211 1211 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1
|
|
1212 1212 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1
|
|
1213 1213 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1
|
|
1214 1214 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1
|
|
1215 1215 //((NATO\sSECRET)|NS)//MR 2 0 0 1
|
|
1216 1216 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1
|
|
1217 1217 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1
|
|
1218 1218 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1
|
|
1219 1219 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1220 1220 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1221 1221 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1222 1222 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1223 1223 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1224 1224 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
|
|
1225 1225 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1226 1226 //FGI[\s\w,/-]*(//X5) 2 0 0 1
|
|
1227 1227 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1
|
|
1228 1228 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1229 1229 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1230 1230 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1231 1231 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1232 1232 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1233 1233 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1234 1234 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1235 1235 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
|
|
1236 1236 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
|
|
1237 1237 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1238 1238 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1239 1239 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1240 1240 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
|
|
1241 1241 User-Agent\x3a \d{6}\x0d\x0a/H 2 0 0 1
|
|
1242 1242 (POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping 2 0 0 1
|
|
1243 1243 \.dyndns\.((biz|info|org|tv))\x0d\x0a/iH 2 0 0 1
|
|
1244 1244 \.dyndns-((at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH 2 0 0 1
|
|
1245 1245 \.jpg\?t\x3d\d\.\d 2 0 0 1
|
|
1246 1246 [0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$ 2 0 0 1
|
|
1247 1247 ^Content-Length\x3a\s*-\d+ 2 0 0 1
|
|
1248 1248 \W[0-9]{5}\.jar 2 0 0 1
|
|
1249 1249 machine_id={[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+} 2 0 0 1
|
|
1250 1250 [0-9]{1,8}[a-f]{1,8}[0-9]{1,8}$ 2 0 0 1
|
|
1251 1251 ^[a-z0-9]{6}..\x00\x00 2 0 0 1
|
|
1252 1252 ^[a-z0-9]{7}..\x00\x00 2 0 0 1
|
|
1253 1253 \sLOGIN\s[^\n]*?% 2 0 0 1
|
|
1254 1254 ({(\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(\d+})) 2 0 0 1
|
|
1255 1255 ^\/\?[a-f0-9]{32}$ 2 0 0 1
|
|
1256 1256 [a-z]{9}[0-9]\.exe/H 2 0 0 1
|
|
1257 1257 \.php\?inst_result=.+&hwid= 2 0 0 1
|
|
1258 1258 ^.{1,5}[a-f0-9]{100} 2 0 0 1
|
|
1259 1259 \/scr5\.php\?p=\d+&id=\d 2 0 0 1
|
|
1260 1260 ^User-Agent\: App\d/Hmi 2 0 0 1
|
|
1261 1261 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$ 2 0 0 1
|
|
1262 1262 \x00\x07[a-z]{7}\x02eu\x00 2 0 0 1
|
|
1263 1263 REGISTER.{400} 2 0 0 1
|
|
1264 1264 \/content\/jav\d?\.jar$ 2 0 0 1
|
|
1265 1265 ^\/\?[a-f0-9]{32}$ 2 0 0 1
|
|
1266 1266 \.php\?[a-z]+=[a-f0-9]{64}&[^\?]+=[a-f0-9]{20}& 2 0 0 1
|
|
1267 1267 ^HTTP\x2f1\.[01] 200 2 0 0 1
|
|
1268 1268 \.php\?[a-z]+=(([1-2][a-z]|3[0-9])\x3a){3,}([1-2][a-z]|3[0-9])& 2 0 0 1
|
|
1269 1269 IP\:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
|
|
1270 1270 ^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$ 2 0 0 1
|
|
1271 1271 \.(jpg|png|gif|cgi)\?pr= 2 0 0 1
|
|
1272 1272 ^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$ 2 0 0 1
|
|
1273 1273 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1274 1274 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1275 1275 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1276 1276 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1277 1277 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1278 1278 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1279 1279 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1280 1280 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1281 1281 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1282 1282 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1283 1283 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1284 1284 (POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl 2 0 0 1
|
|
1285 1285 \x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$ 2 0 0 1
|
|
1286 1286 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
|
|
1287 1287 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1288 1288 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
|
|
1289 1289 ^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\/ 2 0 0 1
|
|
1290 1290 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$ 2 0 0 1
|
|
1291 1291 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$ 2 0 0 1
|
|
1292 1292 applet\/code=[\x22\x27](<val1>[a-zA-Z0-9]+)[a-z]\.(=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27] 2 0 0 1
|
|
1293 1293 code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22 2 0 0 1
|
|
1294 1294 \x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D 2 0 0 1
|
|
1295 1295 \x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$ 2 0 0 1
|
|
1296 1296 ^[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}= 2 0 0 1
|
|
1297 1297 \.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$ 2 0 0 1
|
|
1298 1298 ^\d+?.\x00\x00\x00 2 0 0 1
|
|
1299 1299 \/[0-9a-f]{32}\.jar$ 2 0 0 1
|
|
1300 1300 \/[a-f0-9]{5,}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1
|
|
1301 1301 ^[^OGHPDTCMLUVRBAS] 2 0 0 1
|
|
1302 1302 &s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi 2 0 0 1
|
|
1303 1303 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$ 2 0 0 1
|
|
1304 1304 AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1
|
|
1305 1305 DELETE.+FROM 2 0 0 1
|
|
1306 1306 UNION.+SELECT 2 0 0 1
|
|
1307 1307 UPDATE.+SET 2 0 0 1
|
|
1308 1308 ASCII\(.+SELECT 2 0 0 1
|
|
1309 1309 DELETE.+FROM 2 0 0 1
|
|
1310 1310 INSERT.+INTO 2 0 0 1
|
|
1311 1311 UNION\s+SELECT 2 0 0 1
|
|
1312 1312 SELECT.+FROM 2 0 0 1
|
|
1313 1313 UPDATE.+SET 2 0 0 1
|
|
1314 1314 ASCII\(.+SELECT 2 0 0 1
|
|
1315 1315 DELETE.+FROM 2 0 0 1
|
|
1316 1316 INSERT.+INTO 2 0 0 1
|
|
1317 1317 SELECT.+FROM 2 0 0 1
|
|
1318 1318 \/\S+\.cab 2 0 0 1
|
|
1319 1319 User-Agent\x3a[^\n]+AskTB/iH 2 0 0 1
|
|
1320 1320 (<p>[0-7]{3})(<d>[0-7]{3})(=p)(=d)([0-7]{3}){10}(<q>[0-7]{3})[0-7]{3}(<dot>[0-7]{3})[0-7]{3}(=dot)[0-7]{3}(=q) 2 0 0 1
|
|
1321 1321 (<p>[0-7]{2,4})(<sep>[^0-7])(<d>((=p))[0-7]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-7]{2,4}(=sep)){10}(<q>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(<dot>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(=dot)(=sep)[0-7]{2,4}(=sep)(=q) 2 0 0 1
|
|
1322 1322 ^\/(p(a(rs|g)e|rocess)|(securit|quer)y|(defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$ 2 0 0 1
|
|
1323 1323 \/gate\.php\?cmd=urls$ 2 0 0 1
|
|
1324 1324 \/gate\.php\?cmd=getexe$ 2 0 0 1
|
|
1325 1325 ^User-Agent\x3a[^\r\n]*?\sMSIE\s/H 2 0 0 1
|
|
1326 1326 ^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email) 2 0 0 1
|
|
1327 1327 [^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00 2 0 0 1
|
|
1328 1328 [^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00 2 0 0 1
|
|
1329 1329 [^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00 2 0 0 1
|
|
1330 1330 \x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7} 2 0 0 1
|
|
1331 1331 \.php\?label=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
1332 1332 \.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$ 2 0 0 1
|
|
1333 1333 ^\/[A-Za-z0-9]{7,8}\/index\.html?$ 2 0 0 1
|
|
1334 1334 ^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$ 2 0 0 1
|
|
1335 1335 ^Host\x3a\x20www\d+?\.[^\.]+?\.[^\.]+?\.([^\.]+\.)*?[a-z]{2,4}(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
|
|
1336 1336 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
|
|
1337 1337 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
|
|
1338 1338 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
|
|
1339 1339 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
|
|
1340 1340 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
|
|
1341 1341 ^\/b\/(eve|opt|req)\/[\-f0-9A-F]{24}$ 2 0 0 1
|
|
1342 1342 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1
|
|
1343 1343 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1
|
|
1344 1344 \/[a-z]{1,6}\.html\?0\.[0-9]+[a-z]?$ 2 0 0 1
|
|
1345 1345 ^[^\r\n]{15}\x5f[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2} 2 0 0 1
|
|
1346 1346 ^Host\x3a[^\r\n]+\.passinggas\.net(\x3a\d{1,5})?\r?$/Hmi 2 0 0 1
|
|
1347 1347 Server\: nginx/[a-zA-Z] 2 0 0 1
|
|
1348 1348 ^\x23\d\d\d\x2f\x21 2 0 0 1
|
|
1349 1349 XPantivirus20\d{2}_v\d{6}\.exe 2 0 0 1
|
|
1350 1350 \d\d\d\d\d\d\x0a 2 0 0 1
|
|
1351 1351 PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S 2 0 0 1
|
|
1352 1352 [0-9A-Z]{240,} 2 0 0 1
|
|
1353 1353 \x26[\x00-\xff]\x09\x00 2 0 0 1
|
|
1354 1354 \x26[\x00-\xff]\x09\x00 2 0 0 1
|
|
1355 1355 \.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt= 2 0 0 1
|
|
1356 1356 OS 4_[0-3]_[1-4] like/H 2 0 0 1
|
|
1357 1357 \.php\?f=\d+$ 2 0 0 1
|
|
1358 1358 Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H 2 0 0 1
|
|
1359 1359 User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H 2 0 0 1
|
|
1360 1360 \.php\?t=\d{2,7}$ 2 0 0 1
|
|
1361 1361 filename=.*facebook.*\.(rar|exe|zip) 2 0 0 1
|
|
1362 1362 filename\s*[^\n]*?(UPS|United Parcel Service)[^\n]*?\.(rar|exe|zip) 2 0 0 1
|
|
1363 1363 flash-[A-Z0-9]+-plugin\.[A-Z0-9]+\.exe 2 0 0 1
|
|
1364 1364 \x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D 2 0 0 1
|
|
1365 1365 MalvRem_\d{3,4}\.exe 2 0 0 1
|
|
1366 1366 avdistr_\d{3,4}\.exe 2 0 0 1
|
|
1367 1367 RunAV_\d{3,4}\.exe 2 0 0 1
|
|
1368 1368 installer\.\d{4}\.exe 2 0 0 1
|
|
1369 1369 \/stetement_id\.\d+\/ 2 0 0 1
|
|
1370 1370 ^\/stream\?\d$ 2 0 0 1
|
|
1371 1371 loads2\.php\?r=[0-9]{2}\.[0-9] 2 0 0 1
|
|
1372 1372 ^[\x20-\x7e]{5}.{4}\x7c\x01 2 0 0 1
|
|
1373 1373 (\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1 2 0 0 1
|
|
1374 1374 &cid=\d+$ 2 0 0 1
|
|
1375 1375 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1
|
|
1376 1376 ^Content-Disposition\x3a\x20attachment\x3b\x20filename=[^\r\n]+?\.[a-z]{2,4}\.exe\r?$/Hmi 2 0 0 1
|
|
1377 1377 ^\/[a-z0-9A-Z]{15,35}\/((\d+[A-Z]){3}\d+|null)\/ 2 0 0 1
|
|
1378 1378 ^Content-Length\x3a 2\d{2}\r?$/Hmi 2 0 0 1
|
|
1379 1379 \/[a-z]{2,9}\.php\?([a-z0-9]{2,4}|[cktw])=[a-zA-Z0-9\x2b\x2f\x5c]{43,56}=?$ 2 0 0 1
|
|
1380 1380 \.((testdlls|threads|netstatp|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|stats|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\x|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r]) 2 0 0 1
|
|
1381 1381 \x2B\x22l\x22(\x3B|\x5D) 2 0 0 1
|
|
1382 1382 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
1383 1383 ^Referer\x3a[^\r\n]+\.swf/Hmi 2 0 0 1
|
|
1384 1384 \.jpg\?id=\d+$ 2 0 0 1
|
|
1385 1385 ^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){3,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$ 2 0 0 1
|
|
1386 1386 ^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$ 2 0 0 1
|
|
1387 1387 ^\/[a-z]{4}\.html?(\?[h-j]=\d+)?$ 2 0 0 1
|
|
1388 1388 ^\/h[a-z]{3}\.html?$ 2 0 0 1
|
|
1389 1389 ^\/[0-9]{8}\.html$ 2 0 0 1
|
|
1390 1390 ^\/lists\/\d{15}(\d{5})?$ 2 0 0 1
|
|
1391 1391 ^\/[a-z0-9]{2}\.jar$ 2 0 0 1
|
|
1392 1392 ^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$ 2 0 0 1
|
|
1393 1393 ^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1
|
|
1394 1394 ^([a-zA-Z]{0,119}[0-9])(<var>[a-zA-Z0-9]{9,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1
|
|
1395 1395 ^\/0[a-z0-9]{13}$ 2 0 0 1
|
|
1396 1396 ^\/[-a-zA-Z0-9_]{70,75}==?$ 2 0 0 1
|
|
1397 1397 ^User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)/Hmi 2 0 0 1
|
|
1398 1398 \/[a-f0-9]{32}\.eot$ 2 0 0 1
|
|
1399 1399 ^\/0[a-z0-9]{13}$ 2 0 0 1
|
|
1400 1400 ^\/([a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])([A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])([A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\?? 2 0 0 1
|
|
1401 1401 ^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00 2 0 0 1
|
|
1402 1402 ^(\x62|\x1b) 2 0 0 1
|
|
1403 1403 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])3((=sep)|\d)*?$ 2 0 0 1
|
|
1404 1404 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])4((=sep)|\d)*?$ 2 0 0 1
|
|
1405 1405 ^(\x8b|\xf2) 2 0 0 1
|
|
1406 1406 ^[a-z0-9\x02-\x50]{100,}\x00\x00\x01\x00\x01$ 2 0 0 1
|
|
1407 1407 ^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi 2 0 0 1
|
|
1408 1408 GRANT.{1,5}TO 2 0 0 1
|
|
1409 1409 ^\/\?[a-f0-9]{32}$ 2 0 0 1
|
|
1410 1410 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])0((=sep)|\d)*?$ 2 0 0 1
|
|
1411 1411 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])1((=sep)|\d)*?$ 2 0 0 1
|
|
1412 1412 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])2((=sep)|\d)*?$ 2 0 0 1
|
|
1413 1413 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])5((=sep)|\d)*?$ 2 0 0 1
|
|
1414 1414 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])6((=sep)|\d)*?$ 2 0 0 1
|
|
1415 1415 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])7((=sep)|\d)*?$ 2 0 0 1
|
|
1416 1416 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])8((=sep)|\d)*?$ 2 0 0 1
|
|
1417 1417 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])9((=sep)|\d)*?$ 2 0 0 1
|
|
1418 1418 \/\w{1,2}\/\w{1,2}\.class$ 2 0 0 1
|
|
1419 1419 User-Agent\:[^\n]+zb-hb-/Hi 2 0 0 1
|
|
1420 1420 ^[^\r\n]*\/[0-9a-f]{78}\sHTTP 2 0 0 1
|
|
1421 1421 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20((=refhost))/Hsi 2 0 0 1
|
|
1422 1422 Host\x3a\x20(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1
|
|
1423 1423 ^\/index\.php\?[a-z]{8,80}=(\d{10,13}|\d{15,20})$ 2 0 0 1
|
|
1424 1424 Host\x3a\x20([0-9]{0,22}[a-z])([a-z]*?[0-9][a-z]{0,22}[0-9])[a-z0-9]{23}\x2e[^\x2e\r\n]+\x2e[^\x2e\r\n]/H 2 0 0 1
|
|
1425 1425 &id=\d+(\x3a([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{10,}\.{0,2})?&catid=\d+&itemid=\d+$ 2 0 0 1
|
|
1426 1426 \/pd\.php\?id=[a-f0-9]+$ 2 0 0 1
|
|
1427 1427 ^\x2Fsearch\x2F\x3F[a-z]{2,5}\x3D 2 0 0 1
|
|
1428 1428 ^Referer\x3a\x20http\x3a\/\/[^\x2f]+\/[a-z0-9]{6}\/[a-z0-9]{5}\.html\r?$/Hm 2 0 0 1
|
|
1429 1429 ^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text\/vbscript[\x22\x27]) 2 0 0 1
|
|
1430 1430 filename=\x22\d+?\x22/P 2 0 0 1
|
|
1431 1431 ^\/log\.php\?f=[0-1](\.[a-z]+)?$ 2 0 0 1
|
|
1432 1432 (<p>[0-9a-f]{2,4})(<sep>[\x2e\x2c\x3b\x3a])(<d>((=p))[0-9a-f]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-9a-f]{2,4}(=sep)){10}(<q>(((=p)|(=d)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(<dot>(((=p)|(=d)|(=q)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(=dot)(=sep)[0-9a-f]{2,4}(=sep)(=q) 2 0 0 1
|
|
1433 1433 ^Host\x3a[^\r\n]+craigslist\.org[^\r\n]{20,}\r\n/Hmi 2 0 0 1
|
|
1434 1434 ^Host\x3a[^\r\n]+\r\nConnection\x3a\x20Keep-Alive\r\n(\r\n)?$/H 2 0 0 1
|
|
1435 1435 ^Content-Length\x3a[^\r\n]*?\{([^\r\n]*java\.)[^\r\n]*\.ognl[^\r\n]*\} 2 0 0 1
|
|
1436 1436 \/j[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1
|
|
1437 1437 \/j[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1
|
|
1438 1438 \/j[a-z]+?\?f[a-z]+[a-z]+$ 2 0 0 1
|
|
1439 1439 \/f[a-z]+?\?f[a-z]+[a-z]+$ 2 0 0 1
|
|
1440 1440 \.php$ 2 0 0 1
|
|
1441 1441 \.php$ 2 0 0 1
|
|
1442 1442 GET\s[^\r\n]*?(<name>\/[^\.\/]+\.html)\?id\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(:?\d{1,5})?\r\n 2 0 0 1
|
|
1443 1443 ^\d{4}\r$ 2 0 0 1
|
|
1444 1444 ^Host\x3a\x20[^\r\n]+\-login\.id\-107sbtd9cbhsbt[^\r]+$/Hmi 2 0 0 1
|
|
1445 1445 \/form\/submit\/$ 2 0 0 1
|
|
1446 1446 pch\.php\?f=\d+$ 2 0 0 1
|
|
1447 1447 hcp_vbs\.php\?f=\d+&d=\d+$ 2 0 0 1
|
|
1448 1448 \.php\?e=\w+&f=\w+$ 2 0 0 1
|
|
1449 1449 pch2.php?c=\d+$ 2 0 0 1
|
|
1450 1450 \.jar\?t=\d+&h=[^&]+$ 2 0 0 1
|
|
1451 1451 \/adp\d\.php\[0-9a-z]{2,6} 2 0 0 1
|
|
1452 1452 attachment\x3b[^\r\n]*?info\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
|
|
1453 1453 attachment\x3b[^\r\n]*?contacts\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
|
|
1454 1454 attachment\x3b[^\r\n]*?calc\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
|
|
1455 1455 attachment\x3b[^\r\n]*?about\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
|
|
1456 1456 hhcp.php?c=[a-f0-9]{5}$ 2 0 0 1
|
|
1457 1457 attachment\x3b[^\r\n]*?readme\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
|
|
1458 1458 \/content\/jav\d?\.jar$ 2 0 0 1
|
|
1459 1459 \.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d] 2 0 0 1
|
|
1460 1460 =.*[a-f].*$ 2 0 0 1
|
|
1461 1461 <title>[a-f0-9]{10}<\/title> 2 0 0 1
|
|
1462 1462 =[0-9a-f]{8}\.jar/H 2 0 0 1
|
|
1463 1463 \x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}$ 2 0 0 1
|
|
1464 1464 \x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}\x3A\x3A[0-9]{1,5}$ 2 0 0 1
|
|
1465 1465 display\x3Anone\x3B\x22\x3E[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}[^\r\n]*\x3C\x2Fpre\x3E\x3Cscript\x3E 2 0 0 1
|
|
1466 1466 (\x3D|\x5B\x22])e\x22\x2B\x22va 2 0 0 1
|
|
1467 1467 (\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a 2 0 0 1
|
|
1468 1468 (\x3D|\x5B\x22])ev\x22\x2B\x22a 2 0 0 1
|
|
1469 1469 \x2B\x22al\x22(\x3B|\x5D) 2 0 0 1
|
|
1470 1470 \x2B\x22val\x22(\x3B|\x5D) 2 0 0 1
|
|
1471 1471 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jnlp(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
|
|
1472 1472 \.php\?[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}= 2 0 0 1
|
|
1473 1473 ^.{1,5}[a-f0-9]{100} 2 0 0 1
|
|
1474 1474 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.eot(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
|
|
1475 1475 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jar(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
|
|
1476 1476 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.exe(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
|
|
1477 1477 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.php(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
|
|
1478 1478 \.php\?\w{2,8}\=(0[0-9a-b]|3[0-9]){5,32}\&\w{2,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{1,8}\=\d{2}\&\w{1,8}\=\w{1,8}\&\w{1,8}\=\w{1,8}$ 2 0 0 1
|
|
1479 1479 \/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php$ 2 0 0 1
|
|
1480 1480 \/news\/enter\/2012-1[0-2]-([0-2][0-9]|3[0-1])\.php 2 0 0 1
|
|
1481 1481 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.txt(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
|
|
1482 1482 \/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php 2 0 0 1
|
|
1483 1483 ^\/[0-9a-f]{16}\/q\.php$ 2 0 0 1
|
|
1484 1484 ^\/[0-9a-f]{16}\/q\.php 2 0 0 1
|
|
1485 1485 ^\/[0-9a-f]{32}\/ff\.php$ 2 0 0 1
|
|
1486 1486 ^\/[0-9a-f]{32}\/ff\.php 2 0 0 1
|
|
1487 1487 ^\/[0-9a-f]{16}\/ff\.php$ 2 0 0 1
|
|
1488 1488 ^\/[0-9a-f]{16}\/ff\.php 2 0 0 1
|
|
1489 1489 ^\/closest\/(([a-z]{1,16}[-_]){1,4}[a-z]{1,16}|[a-z0-9]{20,})\.php 2 0 0 1
|
|
1490 1490 &jopa=\d+$ 2 0 0 1
|
|
1491 1491 \.php\?jnlp=[a-f0-9]{10}(,|$) 2 0 0 1
|
|
1492 1492 \/[0-9a-f]{32}\/a\.php$ 2 0 0 1
|
|
1493 1493 \/[0-9a-f]{32}\/a\.php 2 0 0 1
|
|
1494 1494 \/[0-9a-f]{16}\/a\.php$ 2 0 0 1
|
|
1495 1495 \/[0-9a-f]{16}\/a\.php 2 0 0 1
|
|
1496 1496 \.php\?[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){5}&[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){10}& 2 0 0 1
|
|
1497 1497 \/([^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$ 2 0 0 1
|
|
1498 1498 ^([0-9a-z]{8})?(<p>[0-9a-z]{2})(<d>((=p))[0-9a-z]{2})(=p)(=d)([0-9a-z]{2}){10}(<q>[0-9a-z]{2})[0-9a-z]{2}(<dot>[0-9a-z]{2})[0-9a-z]{2}(=dot)[0-9a-z]{2}(=q) 2 0 0 1
|
|
1499 1499 \.php\?[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){5}&[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){10}& 2 0 0 1
|
|
1500 1500 \.php\?[^=]+=([^&](5[5-9a-e]|8[9a-e])){5}[^=]+=[^&]+&[^=]+=([^&](5[5-9a-f]|8[9a-e])){10}([^&]60[^&]60([^&](5[5-9a-f]|8[9a-e])){10})*?& 2 0 0 1
|
|
1501 1501 \.php\?[^=]+=[^&]{10}&[^=]+=[^&]+&[^=]+=[^&]{20}((<sep>[^&]{2})(=sep)[^&]{20})*?& 2 0 0 1
|
|
1502 1502 ^\/[a-z0-9]{6,10}\/\?[0-9]{1,2}$ 2 0 0 1
|
|
1503 1503 @\x00i\x00m\x00p\x00o\x00r\x00t\x00\x20.{4,20}[^\x00\w\s.] 2 0 0 1
|
|
1504 1504 ^\s*?\(\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27] 2 0 0 1
|
|
1505 1505 ^\s*?\(\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27] 2 0 0 1
|
|
1506 1506 ^Referer\x3a[^\r\n]+\x3a\d+\/([a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,3}|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3})/Hm 2 0 0 1
|
|
1507 1507 ^\s*?value\s*\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27] 2 0 0 1
|
|
1508 1508 ^\s*?value\s*\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27] 2 0 0 1
|
|
1509 1509 ^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$ 2 0 0 1
|
|
1510 1510 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1
|
|
1511 1511 Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=refhost)/Hsi 2 0 0 1
|
|
1512 1512 ^Host\x3a[^\r\n]*?\x3a((80(80)|312[89]))\d+\r$/Hm 2 0 0 1
|
|
1513 1513 ^(((<\/object>).)*?<param([^>]*?name\s*\s*?\x22bgcolor\x22)[^>]*?value\s*\s*?\x22#ffffff\x22)((<\/object>).)*?<param([^>]*?name\s*\s*?\x22movie\x22)[^>]*?value\s*\s*?\x22([^\x22]+\.[Ss][Ww][Ff])[^\x22]*?\x22 2 0 0 1
|
|
1514 1514 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1
|
|
1515 1515 Host\x3a\x20(<host>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(=host)\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi 2 0 0 1
|
|
1516 1516 Referer\x3a\x20http\x3a\x2f\x2f(<host>[^\r\n\x3a\x2f]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=host)(\x3a\d{1,5})?\r\n/Hsi 2 0 0 1
|
|
1517 1517 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1
|
|
1518 1518 ^\s*=\s*(<var1>[\x22\x27][a-z]+[\x22\x27]).+?\sid\s*=\s*(=var1) 2 0 0 1
|
|
1519 1519 ^([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$ 2 0 0 1
|
|
1520 1520 ^(\s*var\s[a-z]+\s*=\s*\d+\x3b\s*\n)*\s*<\/script>\s*<object([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$ 2 0 0 1
|
|
1521 1521 ^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27] 2 0 0 1
|
|
1522 1522 ^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|([a-z]*\d+[a-z]+\d)(\d*[a-z]+\d+[a-z])[a-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27] 2 0 0 1
|
|
1523 1523 ^\s*=\s*[\x22\x27][a-z]+[\x22\x27] 2 0 0 1
|
|
1524 1524 ^\s*=\s*[\x22\x27][a-z]+[\x22\x27] 2 0 0 1
|
|
1525 1525 ^\s*=\s*[\x22\x27]\/[^\x22\x27]*\.html\.swf[\x22\x27] 2 0 0 1
|
|
1526 1526 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1
|
|
1527 1527 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1
|
|
1528 1528 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space) 2 0 0 1
|
|
1529 1529 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1
|
|
1530 1530 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space) 2 0 0 1
|
|
1531 1531 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27] 2 0 0 1
|
|
1532 1532 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space) 2 0 0 1
|
|
1533 1533 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space) 2 0 0 1
|
|
1534 1534 \/m[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1
|
|
1535 1535 ^h[a-z0-9]{0,10}\x3d[a-f0-9]{24}&p[a-z0-9]{0,10}\x3d[a-z0-9]{1,11}&i/P 2 0 0 1
|
|
1536 1536 ^p[a-z0-9]{0,20}\x3d[a-z0-9]{1,20}&i[a-z0-9]{0,20}\x3d%[0-9A-F]{2}/P 2 0 0 1
|
|
1537 1537 \x28[\r\n\s]*?(<qa1>[\x22\x27]?)[a-f0-9]{24}(=qa1)[\r\n\s]*?,[\r\n\s]*?(<qa2>[\x22\x27]?)[a-z0-9]{1,20}(=qa2)[\r\n\s]*? 2 0 0 1
|
|
1538 1538 =%25[0-9A-F]{2}%25[0-9A-F]{2}/P 2 0 0 1
|
|
1539 1539 ^\/a[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?q[a-z]{4,11}=\d{6,7}$ 2 0 0 1
|
|
1540 1540 ^\/s[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?d[a-z]{4,11}=\d{6,7}$ 2 0 0 1
|
|
1541 1541 ^\/k[a-z]{4,13}\?e[a-z]{4,11}=\d{6,7}$ 2 0 0 1
|
|
1542 1542 ^\/g[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?t[a-z]{4,11}=\d{6,7}$ 2 0 0 1
|
|
1543 1543 \/r[a-z]+?\?j[a-z]+[a-z]+$ 2 0 0 1
|
|
1544 1544 \/f[a-z]+?\?j[a-z]+[a-z]+$ 2 0 0 1
|
|
1545 1545 ^\/o[a-z]{4,13}\?h[a-z]{4,11}=\d{6,7}$ 2 0 0 1
|
|
1546 1546 \/b[a-z]+?\?n[a-z]+[a-z]+$ 2 0 0 1
|
|
1547 1547 \/v[a-z]+?\?n[a-z]+[a-z]+$ 2 0 0 1
|
|
1548 1548 ^\/[a-z]{5,14}\?[a-z]{5,12}=\d{6,7}$ 2 0 0 1
|
|
1549 1549 ^\/[a-z]{5,14}\?[a-z]{5,12}=[a-z]{6,11}$ 2 0 0 1
|
|
1550 1550 ^[\r\n\s]*?\, 2 0 0 1
|
|
1551 1551 \bdig\.dll\b 2 0 0 1
|
|
1552 1552 ^\/[a-z]+?\?[a-z]+[a-z]+$ 2 0 0 1
|
|
1553 1553 ^Host\x3a\x20[^\r\n]+\.(d(yndns\.[a-z]{2,3}|esi)|c(ricket|a?fe?)|(lin|wor)k|s(u|pace)|accountant|t(k|op)|g[aq]|xyz|ml|pw)(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
|
|
1554 1554 ^\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)$ 2 0 0 1
|
|
1555 1555 ^(<windname>[a-z0-9]+)(<plug1>([sj]|f1))=true.+?window\.(=windname)(<plug2>(((=plug1))([sj]|f1)))=true.+?window\.(=windname)(((=plug1)|(=plug2)))([sj]|f1)=true 2 0 0 1
|
|
1556 1556 ^\/1[a-z0-9]{13}$ 2 0 0 1
|
|
1557 1557 ^GET \/0(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n 2 0 0 1
|
|
1558 1558 ^\/1[a-z0-9]{13}$ 2 0 0 1
|
|
1559 1559 ^GET \/4(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n 2 0 0 1
|
|
1560 1560 ^\/3[a-z0-9]{13}$ 2 0 0 1
|
|
1561 1561 \/4[a-z0-9]{13}\?&xkey= 2 0 0 1
|
|
1562 1562 ^[a-zA-Z0-9\/\+]+?ODAvM[a-zA-Z0-9\/\+]{18}(=|%3D)[\x22\x27] 2 0 0 1
|
|
1563 1563 ^[a-zA-Z0-9\/\+]+?4MC8x[a-zA-Z0-9\/\+]{18}(=|%3D){2}[\x22\x27] 2 0 0 1
|
|
1564 1564 ^[a-zA-Z0-9\/\+]+?OjgwL[a-zA-Z0-9\/\+]{19}[\x22\x27] 2 0 0 1
|
|
1565 1565 ^(\s*?|\/\*((\*\/).)*?\*\/)*?\((\s*?|\/\*((\*\/).)*?\*\/)*?(<vname>[^\s>=]+)(\s*?|\/\*((\*\/).)*?\*\/)*?<(\s*?|\/\*((\*\/).)*?\*\/)*?32\b.{0,200}(=vname)(\s*?|\/\*((\*\/).)*?\*\/)*?\x3d(\s*?|\/\*((\*\/).)*?\*\/)*?63\b.{1,200}\+=.{0,200}\((\s*?|\/\*((\*\/).)*?\*\/)*?(=vname) 2 0 0 1
|
|
1566 1566 ^[a-zA-Z0-9]+\*\/ 2 0 0 1
|
|
1567 1567 [a-z0-9]+?\*\/ 2 0 0 1
|
|
1568 1568 ^\s*?<script>\s*?(<func>[A-Za-z0-9]+)\s*?\(\s*?[\x22\x27](<var>[^1\x22\x27]+)1[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)2[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)3[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script> 2 0 0 1
|
|
1569 1569 ^\s*?\n\s*?(<func>[^\x28\r\n\s]+)\s*?\(\s*?(<var>[^\+\x29]+)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+ 2 0 0 1
|
|
1570 1570 ^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$ 2 0 0 1
|
|
1571 1571 ^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$ 2 0 0 1
|
|
1572 1572 ^Referer\x3a[^\r\n]+\/([a-z0-9]+\.php|\d+)\r$/Hm 2 0 0 1
|
|
1573 1573 Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2039/H 2 0 0 1
|
|
1574 1574 Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2040/H 2 0 0 1
|
|
1575 1575 ^\W 2 0 0 1
|
|
1576 1576 ^\W 2 0 0 1
|
|
1577 1577 ^\/[a-z]{3}\?[A-F0-9]{8}$ 2 0 0 1
|
|
1578 1578 ^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((<sep>[_-]?)[a-z]{3,20}(=sep)([a-z]{3,20}(=sep))?)?[a-z]{3,20}\/\d{10,20}(\x3a\d{1,5})?\r$/Hm 2 0 0 1
|
|
1579 1579 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi 2 0 0 1
|
|
1580 1580 Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1
|
|
1581 1581 ^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}\r$/Hmi 2 0 0 1
|
|
1582 1582 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi 2 0 0 1
|
|
1583 1583 Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1
|
|
1584 1584 ^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
|
|
1585 1585 ^((<\/body).)+?Content\s*?loading.*lease wait.*?<iframe 2 0 0 1
|
|
1586 1586 ^(\x4c|\x35) 2 0 0 1
|
|
1587 1587 ^(\x76|\x0f) 2 0 0 1
|
|
1588 1588 \/wp-(content|admin|includes)\/ 2 0 0 1
|
|
1589 1589 ^\d\x00\d 2 0 0 1
|
|
1590 1590 \.php\?$ 2 0 0 1
|
|
1591 1591 \?showforum=$ 2 0 0 1
|
|
1592 1592 ^\s*5a\s*90\s*00\s*03\s*00\s*00\s*00 2 0 0 1
|
|
1593 1593 \x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_] 2 0 0 1
|
|
1594 1594 (\.\.\/){1,} 2 0 0 1
|
|
1595 1595 (\.\.\/){1,} 2 0 0 1
|
|
1596 1596 =(https?|ftps?|php)\:\/.{0,100}cmd= 2 0 0 1
|
|
1597 1597 MEAS\.TYPE=((link|class)&) 2 0 0 1
|
|
1598 1598 url=.{8000} 2 0 0 1
|
|
1599 1599 \/ssp\/files\/annonce\.pdf$ 2 0 0 1
|
|
1600 1600 \/ssp\/loadjavad\.php$ 2 0 0 1
|
|
1601 1601 \/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$ 2 0 0 1
|
|
1602 1602 \/xml\/p\.php\?id=\d{2,} 2 0 0 1
|
|
1603 1603 ts\/in\.cgi\?pepsi\d+ 2 0 0 1
|
|
1604 1604 cs_base_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1
|
|
1605 1605 \x0d\x0aHost\: (www\.)?nacha\.org\. 2 0 0 1
|
|
1606 1606 \x26n\x3d[a-z]{5}\d{4} 2 0 0 1
|
|
1607 1607 name=(https?|ftps?|php) 2 0 0 1
|
|
1608 1608 \/script\.php?\d{8} 2 0 0 1
|
|
1609 1609 Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a 2 0 0 1
|
|
1610 1610 \/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$ 2 0 0 1
|
|
1611 1611 UPDATE.+SET 2 0 0 1
|
|
1612 1612 ASCII\(.+SELECT 2 0 0 1
|
|
1613 1613 DELETE.+FROM 2 0 0 1
|
|
1614 1614 INSERT.+INTO 2 0 0 1
|
|
1615 1615 UNION\s+SELECT 2 0 0 1
|
|
1616 1616 SELECT.+FROM 2 0 0 1
|
|
1617 1617 UPDATE.+SET 2 0 0 1
|
|
1618 1618 ASCII\(.+SELECT 2 0 0 1
|
|
1619 1619 DELETE.+FROM 2 0 0 1
|
|
1620 1620 INSERT.+INTO 2 0 0 1
|
|
1621 1621 UNION\s+SELECT 2 0 0 1
|
|
1622 1622 SELECT.+FROM 2 0 0 1
|
|
1623 1623 ver=[v\d]+ 2 0 0 1
|
|
1624 1624 \/Setup_[0-9]{3}([A-Z][0-9])?\.exe$ 2 0 0 1
|
|
1625 1625 \/\d+\/installer\/Installer(Clean)?\.exe$ 2 0 0 1
|
|
1626 1626 \/(nte|ld)\/[0-9A-Z]*trest1[0-9](\.php|\s\.asp|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$ 2 0 0 1
|
|
1627 1627 ^[a-z0-9\x40\x2d\x5f]{5,12}..\x00\x00..\x00\x00\x78\x9c 2 0 0 1
|
|
1628 1628 =sent$ 2 0 0 1
|
|
1629 1629 \.php\?get[^=]*=\d_\d{5,}$ 2 0 0 1
|
|
1630 1630 \.php\?[a-z]_info=[a-z0-9]{1,4}_\d+?$ 2 0 0 1
|
|
1631 1631 Host\x3A\x20[^\r\n]*.rr.nu/H 2 0 0 1
|
|
1632 1632 ^(.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(.{0,62}\x00{2})(.{0,59}[A-Za-z0-9]{5})((<b1>.).{0,63}(=b1).{0,62}(=b1).{0,61}(=b1).{0,60}(=b1))(.(<b2>.).{0,62}(=b2).{0,61}(=b2).{0,60}(=b2).{0,59}(=b2))(..(<b3>.).{0,61}(=b3).{0,60}(=b3).{0,59}(=b3).{0,58}(=b3))(...(<b4>.).{0,60}(=b4).{0,59}(=b4).{0,58}(=b4).{0,57}(=b4))(....(<b5>.).{0,59}(=b5).{0,58}(=b5).{0,57}(=b5).{0,56}(=b5))(.....(<b6>.).{0,58}(=b6).{0,57}(=b6).{0,56}(=b6).{0,55}(=b6))(......(<b7>.).{0,57}(=b7).{0,56}(=b7).{0,55}(=b7).{0,54}(=b7))(.......(<b8>.).{0,56}(=b8).{0,55}(=b8).{0,54}(=b8).{0,53}(=b8))(........(<b9>.).{0,55}(=b9).{0,54}(=b9).{0,53}(=b9).{0,52}(=b9))(.........(<b10>.).{0,54}(=b10).{0,53}(=b10).{0,52}(=b10).{0,51}(=b10)) 2 0 0 1
|
|
1633 1633 \.tar$ 2 0 0 1
|
|
1634 1634 \x2Fjs\x2F[\r\n]*\x2Eexe$ 2 0 0 1
|
|
1635 1635 ^(<mac_addr>[\x00-\xff]{6})(=mac_addr){2,}$ 2 0 0 1
|
|
1636 1636 ^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED) 2 0 0 1
|
|
1637 1637 ^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED) 2 0 0 1
|
|
1638 1638 ^(\\r\\n|\x0d\x0a)C 2 0 0 1
|
|
1639 1639 \/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1
|
|
1640 1640 <iframe.*?src.*.*?<\/iframe> 2 0 0 1
|
|
1641 1641 [a-z]{4,10}\x08velodrivve\x03biz\x00 2 0 0 1
|
|
1642 1642 PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help) 2 0 0 1
|
|
1643 1643 \/[A-Z]Setup_[0-9]{4}\.exe$ 2 0 0 1
|
|
1644 1644 \.php.+?(c((onfi|f)g|alendar)|p(a(ge|th)|rog)|l(ang(uage)?|ib)|f(older|ile|ad)|d(omain|ir|f)|s(ettings|bp)|a(genda|uth)|i(con|ncl|d)|n(ame|ews)|r(oot|f)|gallery|type|ext|mod|[a-z](\[.*\])+?)\s*=\s*https? 2 0 0 1
|
|
1645 1645 \/[a-f0-9]{16}\/.+?\.(exe|zip)$ 2 0 0 1
|
|
1646 1646 ^\s?\+x=[0-9]*\;\ +y=[0-9] 2 0 0 1
|
|
1647 1647 User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H 2 0 0 1
|
|
1648 1648 ^\/load.php\?showforum=(ato|obe|rhino|lib)$ 2 0 0 1
|
|
1649 1649 ^[a-z]{5}\d=\x5f\d\x5f 2 0 0 1
|
|
1650 1650 index.php\?[0-9a-f]{32}$ 2 0 0 1
|
|
1651 1651 o/\d{9}\/[0-9a-f]{32}\/[0-9]$ 2 0 0 1
|
|
1652 1652 \/out.php\?id=\d$ 2 0 0 1
|
|
1653 1653 \/\?[a-z0-9]{5,}=[a-zA-Z0-9\x25]{40,}\x253D$ 2 0 0 1
|
|
1654 1654 ^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$ 2 0 0 1
|
|
1655 1655 \/((article|contact|new)s|read|(fo|tu)r)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.eot|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.EOT)$ 2 0 0 1
|
|
1656 1656 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})1\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}1\.PDF)$ 2 0 0 1
|
|
1657 1657 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})2\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}2\.PDF)$ 2 0 0 1
|
|
1658 1658 ^(\/[a-z]{3,20})?\/([a-z]{3,20}[-_])+[a-z]{3,20}\.jar$ 2 0 0 1
|
|
1659 1659 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})3\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}3\.PDF)$ 2 0 0 1
|
|
1660 1660 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/foto\.png$ 2 0 0 1
|
|
1661 1661 \.png$ 2 0 0 1
|
|
1662 1662 ^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$ 2 0 0 1
|
|
1663 1663 \/\d+\.mp3\x3frnd\x3d\d+$ 2 0 0 1
|
|
1664 1664 (Is|CheckRemote)DebuggerPresent 2 0 0 1
|
|
1665 1665 (Create|Connect|Peek)NamedPipe 2 0 0 1
|
|
1666 1666 ftp(open|get)file 2 0 0 1
|
|
1667 1667 ^\/r\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1
|
|
1668 1668 ^\/t\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1
|
|
1669 1669 ^\/[a-f0-9]{32}\.eot$ 2 0 0 1
|
|
1670 1670 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/new\.png$ 2 0 0 1
|
|
1671 1671 \.gif$ 2 0 0 1
|
|
1672 1672 \/(w(hite|orld)|step)\/\d+$ 2 0 0 1
|
|
1673 1673 \.psd$ 2 0 0 1
|
|
1674 1674 \.jpeg$ 2 0 0 1
|
|
1675 1675 \/(w(hite|orld)|step)\/mypic\.dll$ 2 0 0 1
|
|
1676 1676 getqq\.jpg$ 2 0 0 1
|
|
1677 1677 ^[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(((=q)).)+?\.txt\?e=\d+(&[fh]=\d+)?(=q) 2 0 0 1
|
|
1678 1678 \.php\?t[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
|
|
1679 1679 ([a-z+-]{0,4}[0-9.*]+[a-z$+-]{0,4},){24} 2 0 0 1
|
|
1680 1680 [\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]+ 2 0 0 1
|
|
1681 1681 \.php\?spl=[A-Z]{3} 2 0 0 1
|
|
1682 1682 \.php\?b[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
|
|
1683 1683 \.php\?n[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
|
|
1684 1684 ^[^?#]+?\.php\?page[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1
|
|
1685 1685 \.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
|
|
1686 1686 \.php\?doit[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1
|
|
1687 1687 ^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1
|
|
1688 1688 (-?\d+\x3a-?\d+\x3a){100} 2 0 0 1
|
|
1689 1689 \x2Fsrc\x2Ephp\x3Fcase\x3D[a-f0-9]{16}$ 2 0 0 1
|
|
1690 1690 [\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9] 2 0 0 1
|
|
1691 1691 value\x3D\x22\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23 2 0 0 1
|
|
1692 1692 \x2Fredirect\x2Ephp\x3Fd\x3D[0-9a-f]{8}$ 2 0 0 1
|
|
1693 1693 \/\d+\.js\?\d+&[a-f0-9]{16}$ 2 0 0 1
|
|
1694 1694 ^\/[a-z0-9_\-]{48}$ 2 0 0 1
|
|
1695 1695 \.php\?e=[^&]+?$ 2 0 0 1
|
|
1696 1696 \/[a-z]\/[0-9]\/[0-9a-f]{32}$ 2 0 0 1
|
|
1697 1697 archive=[^\x3e]+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
|
|
1698 1698 ^\/[a-z]+\/$ 2 0 0 1
|
|
1699 1699 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/image\.gif$ 2 0 0 1
|
|
1700 1700 \/w(hite|orld|step)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$ 2 0 0 1
|
|
1701 1701 \/(w(hite|orld)|step)\/get(a+|n+)\.jpg 2 0 0 1
|
|
1702 1702 \.php\?usernms=[^@]+@[^\r\n]+$ 2 0 0 1
|
|
1703 1703 ^(\x3a\d{1,5})?$ 2 0 0 1
|
|
1704 1704 ^[^\r\n]+?\.(c(o(l(leg(e((confidential|-station|prowler)\.net|s?explained\.com)|iate(explained|info)\.com)|(o(rado-springs-jobs|nexplained)|umnexplore)\.com)|m(p(uter(explained\.com|themes\.net)|assiondefinition\.com)|m(oditylingerie|unesinfo|ercekid)\.com)|n(ce(rtparis\.net|ptsets\.com)|trolwedding\.com)|((rnell|upon)explained|peguide)\.com|7\.us)|a(((mpaign|talog|det)explained|n(cersexplained|adadaycore)|p(itali[sz]eguide|ricornhi)|b(leexplained|indynamic))\.com|r((tograph(yanalysis|erwhat)|cinomas?explained|scratch-remover|eblack)\.com|insurance-compare\.net)|ce\.us)|h((a(r(med-episodes|les-proxy|tpixel)|p(elsinfo|terball)|nnelexplained)|ristmas(gift-ideas|motion)|inesenewyearboom|eckingwatch)\.com|(orizo|urros)\.es)|(e(l(lularexplained|iac-diet)|ntigrade(explained|info))|(li(nical|ck)|ustomized)explained|r(uiseshipdating|iticsmart)|pu-benchmark|nc-cs)\.com|8\.biz|z\.cc)|a((ll(about(((collegi|gradu)at|yal)e|s(eminary|tudent)|(facul|varsi)ty|bestsellers|academic|teaching|harvard|ucla|pro)|babyours)|n((tip 2 0 0 1
|
|
1705 1705 desbi|alyzelan)d|onymous-film)|(mericas-nexttopmode|gentsbal)l|r(chitectureice|lingtonwriter)|c(ademicexplaine|tionmo)d|ero(flotinfo|bicfund))\.com|u((toma(tedexplained|kers24)|stralia-airlines|xiliaryverb)\.com|di(t(jewellery\.com|report\.net)|o-planet\.com))|p((rilfools(hotel|spin)|ple-airport)\.com|[fh]i\.biz)|ir((bnb-coupon|waysinfo)\.com|portshuttleseattle\.net)|v(enue(domain|hello)\.com|li\.biz)|\.e\.gy)|b((a(c(helorexplained|kpackscope)|by(online-shop|revision)|(rcelonarea|ggagecoo)l|s(icexplained|escope)|ttle-field-3)|e((st-hoteldeal|er-calorie|t-award)s|nefitexplained)|u(y-invite|dgetyep)|logger-com)\.com|r((o(adbandinternet-providers|king(explained|guide))|unomarsalbum|yan-college)\.com|ea(st(cancertattoos\.net|explained\.com)|dmachine-recipes\.com))|o(((om(ing|s)|nd)explained|tany(explained|info)|dybuildingdomains|rrowings?24)\.com|stoncolleges\.net)|irthcertificatetemplate\.net|3g\.biz)|d(e((((benture|posit)explaine|alershipislan)d|n(guefevertreatment|verhowto)|ductguide|veloptea)\.com|(xterstre 2 0 0 1
|
|
1706 1706 ming|ciduoustrees)\.net)|o((ctorate(s?explained|info)|llar-converter|gwalking-jobs|texplained|mainsknow)\.com|wnload(starcraft|-films|ubuntu)\.net)|(a(ncecentralsonglist|rtmouthexplained)|na-replication|hcp-server|vd-codec|rivewww)\.com|i((s(count|ease)explained|nnerparty-recipes|walifile)\.com|rect-golf\.net))|e((a(r(fulexplained|th-clinic)|sy(-costumes|repayment))|conomic(save|24))\.com|\.gy)|4((4qs|h5)\.com|[jp]\.org|ql\.biz)|3(vt\.info|gb\.biz|q\.org)|2(eat\.com|sf\.biz|u\.se)|8(c1\.net|x\.biz)|7(c\.org|p\.biz)|11r\.(biz|us))(\x3a\d{1,5})?$ 2 0 0 1
|
|
1707 1707 ^[^\r\n]+?\.(f((a(c(ultyexplained|e-bok)|(ncy-font|ke-nail)s|ir(explained|fuse)|shion-wallpaper|lterguide)|i(nanc(i(al|ng)explained|epets)|rm(explained|s24)|lter-coffee)|o(r(umexplained|ecastbooks|ceestate)|x-drama)|udaninfo)\.com|re(e(-(((foodcoupon|angrybird)s|s(oundclips|tock)|photoeditor)\.com|music-download\.net)|(p(owerpointthem|roduct-sampl)es|dom-ofspeech)\.com|fileconverter\.net)|snoever\.com)|l(a(shplayerdownload\.net|tbelly-diet\.com)|oridaunemploymentclaim\.com|v-downloader\.net)|e(rtility-calculator\.net|stivalexplained\.com)|b(-smileys\.com|skins\.net))|l((i(n(k(explained|master)|colnsbirthdaytea)|(ability|ver)explained|(berty-saf|ftmov)e|stings(biz|red)|teraturemulti)|u(ng(explained|abscess)|ggageboom)|o(cationssecure|ndon-riots|gback))\.com|e((a(singexplained|ther-trousers)|(edsunited-new|d-candle)s|cturer(explained|info)|nd(ing|er)explained|isure-diving)\.com|u(kemiaexplained\.com|e\.biz)|tup\.org)|a(guay\.(com|es)|-gazzetta\.com)|6\.org)|i(n(s((ur(er(s(explained|24)|explained)|ancesexplain 2 0 0 1
|
|
1708 1708 d)|ide-film)\.com|(pection-camera|taflex)\.net)|d(e(pendenceday(portal|realty)|mnityexplained)\.com|ividual-healthinsurance\.net)|t(er(estexplained\.com|trigo\.net)|ranet(explained|pm)\.com)|((vestment|centive)explained|expensivehyper)\.com|f(ections?explained\.com|o\.se))|((mmersio|sd)nexplained|ronmancom|pone-5)\.com|i(nkai|lg)\.biz)|m((e(tropolis((cruis|fac|mov)e|pixel)|(lanoma|dical)explained|r(idiantotal|cedes-cls)|ntal-healthjobs|morialdaycon|ssenger-mac|ansgift)|i(ami(-holidays|what)|di-editor)|baexplained)\.com|a(r((tial-empires|ket-hq)\.com|iogames-online\.net)|n((agejoin|ualzap)\.com|ipal-university\.net)|(lignanthypertension|gazinedownload)\.net|s(on(wave|car)|tersexplained)\.com|c2\.org))|e((s(ta(tes(mob|fx)|blishstyle)|lexplained)|mploy(e(eexplained|r24)|mentexplained))\.com|n(((gagement-photo|able-cookie)s|rollexplained)\.com|trepreneur-ideas\.net)|x(((hibition|po)explained|ecutive-decision)\.com|tremedeal\.net)|l(ect(ronicexplained|orate123)\.com|guay\.(com|es))|q(uityexplained\.com|8\.biz))| 2 0 0 1
|
|
1709 1709 ((o(a(d(minister|vertize|just)|cademic|llocate)|(thic-literatur|handl)e|(bailou|conduc)t|govern)|r(a(duate(explained|sinfo)|ndparentsdayplan)|oceryexplained|4)|ym(glas|car)s|m[69])\.com|a(((llaudet|te)explained|mevelocity|rnerguide)\.com|511\.net)|cwsa\.org)|h(o((me(made-biscuits|pageexplained)|(nours|tline|using)explained|6)\.com|stel-barcelona\.net)|a(r(dback(city|yoga)|vardexplained)|n(dlechange|ukkahbio)|lloweenorange)\.com|y(perthyroidsymptoms\.net|d\.me)|ellokittypictures\.net)|j((o(urnalism(explained|info)|hn-grisham|ker-tattoo)|query-examples)\.com|a(cksonvillepath\.com|vacollection\.net)|(vvg|6)\.org)|k(ilometersreach|udosexplained|jyg)\.com)(\x3a\d{1,5})?$ 2 0 0 1
|
|
1710 1710 ^[^\r\n]+?\.(p(r(o(pert(ies(-forsale\.net|winters\.com)|y-(singapore|rental)\.net)|(fessors|state)explained\.com)|e(miums(e(xplained|ek)|guide)|(acher|cinct|late)sinfo|pexplained)\.com|i(va(te(car-sales|explained)\.com|do\.info)|nceton\.me))|e((n(sionexplained|thousepal|cetruck)|diatricsexplained)\.com|rsonal(trainer-certification\.net|-injuryclaims\.com)|tardo\.es)|o((wer(borrowings?|repayment|debts)|rt(land-holidays|alexplained)|intexplained|litical24)\.com|kertexas-holdem\.net)|a((ss(engersinfo|agepix)|ge(explained|as)|cemaker-surgery|ttinson-robert|rk-edu)\.com|loaltocollege\.net)|(u(blicationgift|pils?info)|ickups(articles|gen)|neumoniaexplained|sychologyquotes|lus-sign)\.com|h(o(toedit(orfreedownload\.net|ingsite\.com)|neexplained\.com)|pbb-themes\.com|yscology\.net)|cbp\.net|9\.org)|o(n(line(((f(o(ster|rce)|irstborn|raternal|ulltime)|b(r(idegroom|owse)|oxoffice)|e((valuat|xpress)e|fficient)|-(collegecourse|radiostation)|d(escendant|aughter|iscusse)|v(illage|acant)|re(sidence|al))s|c((r(iti(c(ize|al)| 2 0 0 1
|
|
1711 1711 ue)|ew)|o(nsider|usin)|a(pture|meo)|elluloid)s|ha(racters|teau))|a(((vailabl|doptiv|llianc|pprais)e|ss(esse|ay)|unt)s|n((cestor|alyze)s|imated)|way)|per(sonal-trainer|manents))\.com|mediaconverter\.net)|e-lyrics\.com|amia\.biz)|(ver(seasexplained|drawnreal)|(wnership|ffline)explained|cean(ic-cable|you)|rphanagesinfo|klahomafuse)\.com|a(klandour\.com|pg\.org))|r(e((s(idenc(e(attorney|dating|cook|food)|yexplained)|erves(development|core))|(c(o(ver(ing|ed)|up)|laim)guid|laxationhyp|bateventur)e|g(i(on(private|mentor)|stercommunity)|ainguide)|t(r(ainingexplained|ieveguide)|ailexplained)|motecontrol-helicopter|viewwinters|payment24)\.com|alestate-perth\.net)|(a(cetracksinfo|veexplained|iserepair|tetask)|ising-antivirus|bnnetwork)\.com|o((o(m(sfootball|mateco)|fcute)|admodern)\.com|yallondonhospital\.net))|s((o((lventsourc|ftenguid)e|urceexplained|cietiesinfo|ng-india)|a(n(antoniosource|diegodiscover)|l(aryexplaine|euploa)d)|ta(nford(explained|info)|(bilis|v)eguide|r-treck)|p(ecialtyexplained|iralwatch|orts-tab)| 2 0 0 1
|
|
1712 1712 h(oolexplained|eduleedu)|ites?explained)\.com|e((minar(y(explained|info)|explained)|c((urities|tor)explained|what)|aworld-coupons)\.com|rvertransfer\.net)|m(ier\.org|oz\.us)|hellgascard\.net|gba\.biz)|m(o((t(oristsinfo|iveshare)|ntre-breitling|dernexplained|squesinfo)\.com|hamed\.me)|(y(borrowings|-husband)|ultimediaexplained|inistriesinfo)\.com|mcd\.us)|n((a(ming(mac|our)|uticalfit|vigateadd)|e(tworkexplained|w-college))\.com|8\.biz))(\x3a\d{1,5})?$ 2 0 0 1
|
|
1713 1713 ^[^\r\n]+?\.(t(e((l(e(phoneexplained|comsguide)|learth)|n(ured(explained|info)|nis-ranking))\.com|mp(l(ates-gratis\.com|ecollege\.net)|converter\.net)|a(ching(-certificate\.net|explained\.com)|m\.pro))|r(a(((nsferbyt|de-)e|in(eesinf|ge)o|mray)\.com|vel(insurance-comparison\.net|agentnerd\.com))|e(k-bicycles|nd-online)\.net|uckstool\.com|onco\.es)|(o(wn(housepic|study|euro|meta)|(tal-tool|memap)s|pgamebook|olboxsol)|u(mors?explained|lsatrain|rn-ons)|attoo-websites|ype-racer|wainfo)\.com|h((anksgivinggaming|riftexplained)\.com|e(sis-examples\.com|atreparis\.net))|i(mezonevendor\.com|dl\.net)|cmn\.biz)|w(e(b((b(estseller|ailout)|administer)\.com|site(downloader\.net|explained\.com)|developertoolbar\.net)|(l(lesley|fare)explained|akenguide)\.com)|or(th(voice|war)\.com|ld-records\.net)|ater(front-property\.net|-plants\.com)|(riterpics|hoiscan)\.com|pbh\.org|sse\.us)|s((t(ud(ent(financecontact|s?explained)|yexplained)|r(eetmaphub|ongat)|patricksweightloss|onewhat)|wissairinfo)\.com|u((mmertimelyrics|nset-wallpape 2 0 0 1
|
|
1714 1714 |per-committee|itegraphic)\.com|b\.(name|cat|es)))|v((i(llage((in|na)no|crystal)|deo(-mediaset|explained)|ta(minssms|lwow)|rtualexplained)|o(lumesynergy|ucheragent|ters24)|a(rsityexplained|lentinesproxy)|entureexplained)\.com|qtel\.net|f1\.us)|u(n(i(versityexplained\.com|nstalltool\.net|\.me)|((secured|am)explained|ravelguide)\.com|limited-web-hosting\.net)|(cla(explained|info)|s-inflation|alinfo|zdom)\.com|[04]\.org)|y((o(u(ngstersinfo|rbroking)|mkippursocial)|(eshiva|ale)explained|vxs)\.com|nna\.biz)|zwr\.org)(\x3a\d{1,5})?$ 2 0 0 1
|
|
1715 1715 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
1716 1716 [a-z]{8}.(:?tif|gif) 2 0 0 1
|
|
1717 1717 ^.{2}[a-zA-Z0-9]+\x2e[01] 2 0 0 1
|
|
1718 1718 (\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\( 2 0 0 1
|
|
1719 1719 ^\w+?\[[^\]]+?\]\.src[\r\n\s]*= 2 0 0 1
|
|
1720 1720 (\/(php)?|\.php)\?[\s\+]*\-[A-Za-z] 2 0 0 1
|
|
1721 1721 ^[A-Z]=[A-Za-z/+0-9=]{200,400}$ 2 0 0 1
|
|
1722 1722 ^\{?[a-fA-F0-9]{4}\}?(\x5cu\{?[a-fA-F0-9]{4}\}?){20} 2 0 0 1
|
|
1723 1723 ^\{?[a-fA-F0-9]{4}\}?(\x25u\{?[a-fA-F0-9]{4}\}?){20} 2 0 0 1
|
|
1724 1724 [^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class 2 0 0 1
|
|
1725 1725 ^[\r\n\s]*?\\?\(.+?\\?\)\.keep\.previous[\r\n\s]*[\r\n\s]*?[\x22\x27]contentArea 2 0 0 1
|
|
1726 1726 \/vw\.php\?i=[a-fA-F0-9]+?\-[a-fA-F0-9]+?$ 2 0 0 1
|
|
1727 1727 ^[\x11\x21-\x26\x41\x45\x70-\x79] 2 0 0 1
|
|
1728 1728 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
1729 1729 ^.{0,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.jsp\x22 2 0 0 1
|
|
1730 1730 ^..[\x81\x82\x83\x84\x85\x86\x87]\x81 2 0 0 1
|
|
1731 1731 ^..[\x81\x82\x83\x84\x85\x86\x87]\x83 2 0 0 1
|
|
1732 1732 ^..[\x81\x82\x83\x84\x85\x86\x87]\x84 2 0 0 1
|
|
1733 1733 ^..[\x81\x82\x83\x84\x85\x86\x87]\x85 2 0 0 1
|
|
1734 1734 REGISTER.{400} 2 0 0 1
|
|
1735 1735 SELECT.+geometrycollectionfromwkb 2 0 0 1
|
|
1736 1736 SELECT.+WHERE.+SELECT.+\x60 2 0 0 1
|
|
1737 1737 ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA 2 0 0 1
|
|
1738 1738 ^Authorization\x3A Basic.{120}/Hmi 2 0 0 1
|
|
1739 1739 ^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi 2 0 0 1
|
|
1740 1740 ^[^\x00]+?\x00 2 0 0 1
|
|
1741 1741 ^[^\x00]+?\x00 2 0 0 1
|
|
1742 1742 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E 2 0 0 1
|
|
1743 1743 ^Cache-Control\x3a\x20(max-age=0|no-cache)\r?$ 2 0 0 1
|
|
1744 1744 ^\/\?id=[0-9]{13}&msg= 2 0 0 1
|
|
1745 1745 ^13\d{11} 2 0 0 1
|
|
1746 1746 ^Callback\x3a\x20<http[^>]+><http 2 0 0 1
|
|
1747 1747 ^[^\r\n]*uuid\x3a[^\r\n\x3a]{181} 2 0 0 1
|
|
1748 1748 ^[^\r\n]+#[^\x22\r\n]{2049} 2 0 0 1
|
|
1749 1749 ^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181} 2 0 0 1
|
|
1750 1750 ^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181} 2 0 0 1
|
|
1751 1751 ^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181} 2 0 0 1
|
|
1752 1752 ^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181} 2 0 0 1
|
|
1753 1753 M-SEARCH\s+[^\n]{500} 2 0 0 1
|
|
1754 1754 (\/\.){70,} 2 0 0 1
|
|
1755 1755 [\w]{70,} 2 0 0 1
|
|
1756 1756 \xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF] 2 0 0 1
|
|
1757 1757 ^.{27} 2 0 0 1
|
|
1758 1758 [0-9a-zA-Z]{200,} 2 0 0 1
|
|
1759 1759 (GET).\/%.{1586,} 2 0 0 1
|
|
1760 1760 ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE) 2 0 0 1
|
|
1761 1761 [^a-zA-Z0-9]+\.message 2 0 0 1
|
|
1762 1762 \x3d[^\x26]{720} 2 0 0 1
|
|
1763 1763 ENTER\x20LANGUAGE\x20\x3D.{55} 2 0 0 1
|
|
1764 1764 [a-zA-Z0-9]{1000,} 2 0 0 1
|
|
1765 1765 \xbc[\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4] 2 0 0 1
|
|
1766 1766 \xae[\xef\xcf][\xf0\xd0][\xe5\xc5][\xee\xce]\xa0\xa2[\xe7\xc7][\xe5\xc5][\xf4\xd4]\xa2 2 0 0 1
|
|
1767 1767 [\xf3\xd3][\xe8\xc8][\xe5\xc5][\xec\xcc][\xec\xcc][\xe5\xc5][\xf8\xd8][\xe5\xc5][\xe3\xc3][\xf5\xd5][\xf4\xd4][\xe5\xc5] 2 0 0 1
|
|
1768 1768 [\xf6\xd6][\xe2\xc2][\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4] 2 0 0 1
|
|
1769 1769 Cookie\:\ +REMOTE_ADDR= 2 0 0 1
|
|
1770 1770 Authorization\x3a\s*Basic\s*[a-zA-Z0-9]{255,}== 2 0 0 1
|
|
1771 1771 \x2findex\x2etmpl(\x3a\x3a\x24DATA|\x2f|\x2e)\x0d\x0a 2 0 0 1
|
|
1772 1772 \/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+& 2 0 0 1
|
|
1773 1773 \.php\?sex=\d+&children=\d+&userid= 2 0 0 1
|
|
1774 1774 ^SSH-\s[^\n]{200} 2 0 0 1
|
|
1775 1775 value\x22[^\x22]*\x2Eswf\x3finfo\x3D 2 0 0 1
|
|
1776 1776 ^(CLIENT|MACHINE)_INFO 2 0 0 1
|
|
1777 1777 Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H 2 0 0 1
|
|
1778 1778 \/tmp\/[^\/]+\.pdf$ 2 0 0 1
|
|
1779 1779 \/tmp\/[^\/]+\.jar$ 2 0 0 1
|
|
1780 1780 ^Directory 2 0 0 1
|
|
1781 1781 ^HEAD[^s]{432} 2 0 0 1
|
|
1782 1782 ^PUT[^s]{432} 2 0 0 1
|
|
1783 1783 ^POST[^s]{432} 2 0 0 1
|
|
1784 1784 ^TRACE[^s]{432} 2 0 0 1
|
|
1785 1785 ^DELETE[^s]{432} 2 0 0 1
|
|
1786 1786 ^LOCK[^s]{432} 2 0 0 1
|
|
1787 1787 ^MKCOL[^s]{432} 2 0 0 1
|
|
1788 1788 ^COPY[^s]{432} 2 0 0 1
|
|
1789 1789 ^MOVE[^s]{432} 2 0 0 1
|
|
1790 1790 \x2Frequests\x2Fstatus\x2Exml\x3F[^\x0A\x0D]*input\x3D[^\x0A\x0D\x26\x3B]{1000} 2 0 0 1
|
|
1791 1791 ^\/[0-9]{5}\.jar$ 2 0 0 1
|
|
1792 1792 Host\x3a \d{4,}[^A-Za-z\.] 2 0 0 1
|
|
1793 1793 ^\/[0-9]$ 2 0 0 1
|
|
1794 1794 ^\/[a-z]{13,14}\.jar$ 2 0 0 1
|
|
1795 1795 ^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$ 2 0 0 1
|
|
1796 1796 ^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$ 2 0 0 1
|
|
1797 1797 T.*?T.*?Y.*.*?R.*?O.*?M.*.*?T 2 0 0 1
|
|
1798 1798 [0-9a-zA-Z]{10} 2 0 0 1
|
|
1799 1799 [0-9a-zA-Z]{10} 2 0 0 1
|
|
1800 1800 Host\x3a \d{4,}[^A-Za-z\.] 2 0 0 1
|
|
1801 1801 ^\/m[a-zA-Z0-9-_]{3,14}\/[a-zA-Z0-9-_]{3,17}$ 2 0 0 1
|
|
1802 1802 SELECT data FROM [^\x20]+?\x20INTO DUMPFILE [\x27\x22]c\x3a\/windows\/system32\/[a-z0-9_-]+?\.exe[\x27\x22] 2 0 0 1
|
|
1803 1803 [a-zA-Z0-9]{5} 2 0 0 1
|
|
1804 1804 [0-9a-zA-Z]{50} 2 0 0 1
|
|
1805 1805 \x90{200} 2 0 0 1
|
|
1806 1806 ^\s+A{500} 2 0 0 1
|
|
1807 1807 ^[\r\n\s]*?\x28[^\x29]*?shellcode 2 0 0 1
|
|
1808 1808 ^[\r\n\s]*?\x28[^\x29]*?shellcode 2 0 0 1
|
|
1809 1809 \.(php|asp|py|exe|htm|html)\/[joewxy](U[0-9a-f]{8})?H[0-9a-f]{8}V[0-9a-f]{8}\d{3}R[0-9a-f]{8}\d{3}T[0-9a-f]{8,} 2 0 0 1
|
|
1810 1810 [\r\n\s]+(<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(=var1)\.run 2 0 0 1
|
|
1811 1811 ^((>>).)+?#([46][1-9a-fA-F]|[57][\daA]) 2 0 0 1
|
|
1812 1812 ^\s*?fun\s*?\( 2 0 0 1
|
|
1813 1813 [\?&]mail=[^&]+?[\x3b\x2c\x7c\x27] 2 0 0 1
|
|
1814 1814 WSH\.run\x28\x5c+?[\x22\x27][a-z0-9_-]+?\.exe 2 0 0 1
|
|
1815 1815 ^(90|0x5a|0+?132)\s*?,\s*?(71|0x47|0+?107)\s*?,\s*?(70|0x46|0+?106)\s*?,\s*?(48|0x30|0+?60)\s*?,\s*?(89|0x59|0+?131)\s*?,\s*?(84|0x54|0+?124)\s*?,\s*?(112|0x70|0+?160) 2 0 0 1
|
|
1816 1816 \/\??[a-f0-9]{60,}(\x3b\d+){1,4}$ 2 0 0 1
|
|
1817 1817 \/\??[a-f0-9]{60,}\x3b4[0-1]\d{5}$ 2 0 0 1
|
|
1818 1818 ^\/([a-z0-9]{3,7}\/)?[a-z]{3,7}\.swf$ 2 0 0 1
|
|
1819 1819 ^(25)?282176\x25(25)?29\x25(25)?26chrw\x25(25)?2801 2 0 0 1
|
|
1820 1820 ^Referer\x3a[^\r\n]+\/gate.php\r$/Hm 2 0 0 1
|
|
1821 1821 Host\x3a\x20(\.*[a-f0-9]\.*){32}\./Hm 2 0 0 1
|
|
1822 1822 ^( Systems|\.com\/techsupport) 2 0 0 1
|
|
1823 1823 ^\s*?(<v1>[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(=v1)\s*?\x29\s*?(dim\s*?)?(<v2>[^\s\x3d]+)\s*?\x3d\s*?(=v2)\+Cstr\x28\s*?Chr\x28(=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(=v2) 2 0 0 1
|
|
1824 1824 ^[0-9][^=] 2 0 0 1
|
|
1825 1825 ^\s*?\d[\d\x2e]{255} 2 0 0 1
|
|
1826 1826 ^\s*?\d[\d\x2e]{255} 2 0 0 1
|
|
1827 1827 \s+?trigger\s+?[^\x20]+?\s+?after\s+?insert\s+?on\s+? 2 0 0 1
|
|
1828 1828 ^..[^\x00]+\x00 2 0 0 1
|
|
1829 1829 ^..[^\x00]+\x00 2 0 0 1
|
|
1830 1830 ^..[^\x00]+\x00 2 0 0 1
|
|
1831 1831 ^..[^\x00]+\x00 2 0 0 1
|
|
1832 1832 ^([^>]*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])([^>]*?\swidth\s*\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*\s*?[\x22\x27]0[\x22\x27] 2 0 0 1
|
|
1833 1833 ^(<addr1>.{4})(<addr2>.{4})(=addr2)(=addr1) 2 0 0 1
|
|
1834 1834 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1
|
|
1835 1835 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1
|
|
1836 1836 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1
|
|
1837 1837 Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true 2 0 0 1
|
|
1838 1838 ^=\s*\x22\s*[^\s\x22\x28]{1000} 2 0 0 1
|
|
1839 1839 ^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1}){300} 2 0 0 1
|
|
1840 1840 ^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d+?&){3,}[a-z\_\-]{4,10}=-?[a-z0-9]+$ 2 0 0 1
|
|
1841 1841 ^\s*\[\s*[\x22\x27]\\u[a-f0-9]{4}\\u[a-f0-9]{4} 2 0 0 1
|
|
1842 1842 ^[^\x00]+\x00\x00\x01 2 0 0 1
|
|
1843 1843 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1
|
|
1844 1844 ^.{6}[^\x00]+ 2 0 0 1
|
|
1845 1845 ^.{6}[^\x00]+ 2 0 0 1
|
|
1846 1846 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1
|
|
1847 1847 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1
|
|
1848 1848 ^\x20+\x3a\x20([0-9A-F]{2}\x3a){5}[0-9A-F]{2}\x0d\x00\x0a 2 0 0 1
|
|
1849 1849 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
|
|
1850 1850 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
|
|
1851 1851 ^(\x01((\x01((\x04((\x03(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x04(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?|\x02(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?))?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|\x02([\x01\x02\x03\x04])?|\x03([\x01\x02])?))?|\x03((\x03(\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e])?)?)?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13])?|\x02([\x01\x02])?))?|\x05((\x02(\x01([\x01\x02\x03\x04\x05\x06\x07])?)?|\x01([\x01\x02\x03])?))?|\x02(([\x01\x02]|\x03(\x01([\x01\x02\x03])?)?))?|\x06(\x01([\x01\x02\x03\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x07([\x01\x02])?|\x04))?|\x02((\x02([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|(\x01)?\x01))?) 2 0 0 1
|
|
1852 1852 ^(\x41\xd8\x41\xd8\x41\xdc){2,}\x41\x00 2 0 0 1
|
|
1853 1853 ^\s*\x28\s*retPtrAddr\.add\s*\x28\s*i\s*\*\s*8\s*\x29\s*,\s*rop\s*\x5b 2 0 0 1
|
|
1854 1854 ^\S+?drivestoredirect 2 0 0 1
|
|
1855 1855 ^\s*(f0VMR|9FTE|\/RUxG) 2 0 0 1
|
|
1856 1856 ^\s*=\s*[\x27\x22]\s*POST 2 0 0 1
|
|
1857 1857 ^.*?[\x24\x60] 2 0 0 1
|
|
1858 1858 ^\s*=\s*[^>]*file\x3a[^>]*\/\x24MFT\/ 2 0 0 1
|
|
1859 1859 ^\s*(\x28|\%28)s 2 0 0 1
|
|
1860 1860 ^\s*\d*[^\x20-\x7e\r\n\t] 2 0 0 1
|
|
1861 1861 ^[\x30-\x3f\x7D] 2 0 0 1
|
|
1862 1862 ^[\x30-\x3f\x7D] 2 0 0 1
|
|
1863 1863 AUTH\s+\S+\s+([a-zA-Z0-9\+\/=]{4})*[a-zA-Z0-9\+\/=]{3}\s 2 0 0 1
|
|
1864 1864 ^\s*((>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(document|s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1
|
|
1865 1865 legal[^x7B]*\x7B[^\x7D]*restore 2 0 0 1
|
|
1866 1866 legal[^x7B]*\x7B[^\x7D]*restore 2 0 0 1
|
|
1867 1867 errordict\s+\x2Finvalidfileaccess 2 0 0 1
|
|
1868 1868 errordict\s+\x2Finvalidfileaccess 2 0 0 1
|
|
1869 1869 \x2Ebindnow[^\x7D]*\x7D\s*stopped 2 0 0 1
|
|
1870 1870 \x2Ebindnow[^\x7D]+\x7D\s*stopped 2 0 0 1
|
|
1871 1871 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
|
|
1872 1872 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
|
|
1873 1873 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
|
|
1874 1874 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
|
|
1875 1875 ^\s* 2 0 0 1
|
|
1876 1876 ^\s* 2 0 0 1
|
|
1877 1877 ^\s* 2 0 0 1
|
|
1878 1878 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){5} 2 0 0 1
|
|
1879 1879 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7} 2 0 0 1
|
|
1880 1880 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7} 2 0 0 1
|
|
1881 1881 Template=.*\.\. 2 0 0 1
|
|
1882 1882 act\x3D[^\x26\s\r\n]{257} 2 0 0 1
|
|
1883 1883 app\x3D[^\x26\s\r\n]{257} 2 0 0 1
|
|
1884 1884 [\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,} 2 0 0 1
|
|
1885 1885 ^[\x50-\x59] 2 0 0 1
|
|
1886 1886 ^[^\r\n]*?\x60[^\x60]*?\$\{IFS\} 2 0 0 1
|
|
1887 1887 \bsolusvmc-node\b 2 0 0 1
|
|
1888 1888 ^\s*?\(\s*?[^,\s]*?\s*?,\s*?[\x22\x27][a-f0-9]{100} 2 0 0 1
|
|
1889 1889 ^mail\s*?from\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b 2 0 0 1
|
|
1890 1890 ^(\x25(25)*?20|\s)*?runmumaa\W 2 0 0 1
|
|
1891 1891 ^\s*?(<var>[^=\s\x3b]+)\s*\s*?getBits\(\s*?\)\x3b.+?flashvars\s*\s*?\x5c\x22(=var)\s*\s*?\x22\s*?\+\s*?(=var)\s*?\+\s*?\x22\x5c\x22 2 0 0 1
|
|
1892 1892 ^[a-z-]+\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b.*\x3b.*\x7d\s*\x3b(=[\r\n]) 2 0 0 1
|
|
1893 1893 ^\s*\x28\s*[\x22\x27]\s*message 2 0 0 1
|
|
1894 1894 ^(\.|\[\s*?[\x22\x27])defineProperties\s*?\x28 2 0 0 1
|
|
1895 1895 ^[^\r\n]+\.hta\r?\n 2 0 0 1
|
|
1896 1896 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1
|
|
1897 1897 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1
|
|
1898 1898 ^(<num_value>\d+)\x7d,\x22id\x22\x3a(=num_value) 2 0 0 1
|
|
1899 1899 ^[(\x60|%60)(\x27|%27)] 2 0 0 1
|
|
1900 1900 ^\/(home\/a3user|root)\/agile3\/patches\/ 2 0 0 1
|
|
1901 1901 ^.*?\x26 2 0 0 1
|
|
1902 1902 (\x0a|\\n)\/s1Caa6 2 0 0 1
|
|
1903 1903 ^(\\r\\n|\x0d\x0a)C 2 0 0 1
|
|
1904 1904 ^\d{3} 2 0 0 1
|
|
1905 1905 ^(https\/\/|(\d{1,3}\.){3}\d{1,3}|([a-z0-9-]+\.)+[a-z]{1,8}) 2 0 0 1
|
|
1906 1906 ^(==[A-Z0-9+/]{2}|=[A-Z0-9+/]{3}|[A-Z0-9+/]{4})([A-Z0-9+/]{4})*$ 2 0 0 1
|
|
1907 1907 ^[A-Za-z0-9+/]{2}([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
1908 1908 [\?\&]cmd_param=[^\&\r\n]{500} 2 0 0 1
|
|
1909 1909 (%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))) 2 0 0 1
|
|
1910 1910 ^.{11}([\xC0-\xC1]|[\xF5-\xFF]|\xE0[\x80-\x9F]|\xF0[\x80-\x8F]|[\xC2-\xDF]([\x80-\xBF])|[\xE0-\xEF]([\x80-\xBF]{2})|[\xF0-\xF4]([\x80-\xBF]{3})|([\x00-\x7F\xF5-\xFF])[\x80-\xBF]|([\xC2-\xDF]|[\xE0-\xEF]|[\xE0-\xEF][\x80-\xBF]|[\xF0-\xF4]|[\xF0-\xF4][\x80-\xBF]|[\xF0-\xF4][\x80-\xBF]{2})[\x80-\xBF]|([\xE0-\xEF])[\x80-\xBF]([\x80-\xBF])|([\xF0-\xF4])[\x80-\xBF]([\x80-\xBF]{2})|([\xF0-\xF4][\x80-\xBF])[\x80-\xBF]([\x80-\xBF])) 2 0 0 1
|
|
1911 1911 ^[^\x22]*[\x24\x60]+ 2 0 0 1
|
|
1912 1912 ^[^\x22]*[\x24\x60]+ 2 0 0 1
|
|
1913 1913 ^[a-z0-9\-_\.\/]+\x00 2 0 0 1
|
|
1914 1914 ^SOAPAction\x3a\s+?[^\r\n]*?http\x3a\/\/purenetworks\.com\/HNAP1\/([^\x2f]+?[\x2f])?[^\x2f] 2 0 0 1
|
|
1915 1915 \/dev-report-overview\.html[^\"]*?\x3b 2 0 0 1
|
|
1916 1916 ^\s*\x22{2} 2 0 0 1
|
|
1917 1917 ^[\x22\x27]t(eamviewer(\d+|api)|v(c(hat|ontrol)|filetransfer|joinv|present|s(endfile|q(customer|support))|v(ideocall|pn))\d) 2 0 0 1
|
|
1918 1918 ^Host\x3a[^\n]{0,50}?\x3b 2 0 0 1
|
|
1919 1919 ^[\s>] 2 0 0 1
|
|
1920 1920 ^[\s>] 2 0 0 1
|
|
1921 1921 ^((\x0d\x0a).)+\x22(https?|file):\x2f\x2f 2 0 0 1
|
|
1922 1922 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
|
|
1923 1923 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
|
|
1924 1924 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
|
|
1925 1925 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
|
|
1926 1926 ^\s*?\x29 2 0 0 1
|
|
1927 1927 ^\s*?\(x\s*,\s*1,\s*24000\s*\x29 2 0 0 1
|
|
1928 1928 ^\s*[\x22\x27][^\x22\x27]{0,128}\x2e\x2e 2 0 0 1
|
|
1929 1929 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1
|
|
1930 1930 =\s*\x25\s*\{\s*.+?\bProcessBuilder\b 2 0 0 1
|
|
1931 1931 ^[ a-zA-Z0-9+_]*[\x27\x3b] 2 0 0 1
|
|
1932 1932 destination=[^&]*\x24\x28 2 0 0 1
|
|
1933 1933 name=[^&]*\x24\x28 2 0 0 1
|
|
1934 1934 ^[^&]+\x2527(UNION|SELECT) 2 0 0 1
|
|
1935 1935 [^&]*(\x60|\x24) 2 0 0 1
|
|
1936 1936 (\x60|\x24) 2 0 0 1
|
|
1937 1937 (\/GponForm\/diag_FORM\?images\/|\.html\?images\/) 2 0 0 1
|
|
1938 1938 ^((\S\:\\){2,}|\S\:\\\S\:\S\:|S\:\\\\\\([0-9]{1,3}\.){3}[0-9]{1,3}|\S\:\\\\\\([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8}) 2 0 0 1
|
|
1939 1939 ^(www\.)?(cisco|linksys)\.com\/jnap\/ 2 0 0 1
|
|
1940 1940 ^.{1,10}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) 2 0 0 1
|
|
1941 1941 (\%3C){1000} 2 0 0 1
|
|
1942 1942 A{1000} 2 0 0 1
|
|
1943 1943 id\=[^\r\n]*?(select|delete|union|update|insert) 2 0 0 1
|
|
1944 1944 ^\d{2,5}(\&|\d) 2 0 0 1
|
|
1945 1945 ^(8=|9BQQ==)\r?\n? 2 0 0 1
|
|
1946 1946 =\s*\x25\s*\{\s*(.+?\bgetRunTime\b).+?\bexec\b 2 0 0 1
|
|
1947 1947 ^[0-9]+ 2 0 0 1
|
|
1948 1948 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\[[^\x5d]*?\W 2 0 0 1
|
|
1949 1949 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\%5b[^\x5d]*?\W 2 0 0 1
|
|
1950 1950 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\[[^\x5d]*?\W 2 0 0 1
|
|
1951 1951 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\%5b[^\x5d]*?\W 2 0 0 1
|
|
1952 1952 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\[[^\x5d]*?\W 2 0 0 1
|
|
1953 1953 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\%5b[^\x5d]*?\W 2 0 0 1
|
|
1954 1954 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\[[^\x5d]*?\W 2 0 0 1
|
|
1955 1955 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
|
|
1956 1956 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\[[^\x5d]*?\W 2 0 0 1
|
|
1957 1957 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\%5b[^\x5d]*?\W 2 0 0 1
|
|
1958 1958 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\[[^\x5d]*?\W 2 0 0 1
|
|
1959 1959 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\%5b[^\x5d]*?\W 2 0 0 1
|
|
1960 1960 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\[[^\x5d]*?\W 2 0 0 1
|
|
1961 1961 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\%5b[^\x5d]*?\W 2 0 0 1
|
|
1962 1962 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\[[^\x5d]*?\W 2 0 0 1
|
|
1963 1963 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
|
|
1964 1964 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\[[^\x5d]*?\W 2 0 0 1
|
|
1965 1965 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\%5b[^\x5d]*?\W 2 0 0 1
|
|
1966 1966 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\[[^\x5d]*?\W 2 0 0 1
|
|
1967 1967 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\%5b[^\x5d]*?\W 2 0 0 1
|
|
1968 1968 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\[[^\x5d]*?\W 2 0 0 1
|
|
1969 1969 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\%5b[^\x5d]*?\W 2 0 0 1
|
|
1970 1970 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\[[^\x5d]*?\W 2 0 0 1
|
|
1971 1971 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
|
|
1972 1972 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\[[^\x5d]*?\W 2 0 0 1
|
|
1973 1973 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\%5b[^\x5d]*?\W 2 0 0 1
|
|
1974 1974 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\[[^\x5d]*?\W 2 0 0 1
|
|
1975 1975 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\%5b[^\x5d]*?\W 2 0 0 1
|
|
1976 1976 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\[[^\x5d]*?\W 2 0 0 1
|
|
1977 1977 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\%5b[^\x5d]*?\W 2 0 0 1
|
|
1978 1978 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\[[^\x5d]*?\W 2 0 0 1
|
|
1979 1979 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
|
|
1980 1980 ping_addr=[\d.]*[^\d.] 2 0 0 1
|
|
1981 1981 \?write_(m(ac|sn)|hdv|pid|tan)&[^&]*\x3b 2 0 0 1
|
|
1982 1982 ^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\} 2 0 0 1
|
|
1983 1983 ^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\} 2 0 0 1
|
|
1984 1984 pjl\x5Fready\x5Fmessage\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1
|
|
1985 1985 ^[^=]{1,}$ 2 0 0 1
|
|
1986 1986 ^\x22[^\x22]*\x3b[^\x22]*\x22/P 2 0 0 1
|
|
1987 1987 ^\s*[\x22\x27] 2 0 0 1
|
|
1988 1988 \.hta([?&]|$) 2 0 0 1
|
|
1989 1989 ^[A-Za-z0-9+/]{0,4}?[^\x20-\x7e] 2 0 0 1
|
|
1990 1990 \%(25)?temp\% 2 0 0 1
|
|
1991 1991 ^[a-zA-Z0-9]+$ 2 0 0 1
|
|
1992 1992 [^&]*(\x60|\x24) 2 0 0 1
|
|
1993 1993 ^User-Agent\x3a[^\r\n]*JDatabaseDriverMysqli/Hmi 2 0 0 1
|
|
1994 1994 (localhost|127\.0\.0\.1)/W 2 0 0 1
|
|
1995 1995 ^[^\r\n]{128,}\r\n 2 0 0 1
|
|
1996 1996 ^[^\+]+\+0A 2 0 0 1
|
|
1997 1997 ^[^\+]+(\+[A-F0-9]{2}){4,} 2 0 0 1
|
|
1998 1998 ^.{0,100}\+0A.{0,100}\x40 2 0 0 1
|
|
1999 1999 ^[^\r\n]{50,} 2 0 0 1
|
|
2000 2000 ^\S{0,7}\/(meeting|fb\/smb|namedusers|metric) 2 0 0 1
|
|
2001 2001 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1
|
|
2002 2002 ^(((:?0x[a-f0-9]{2}|0+?\d{1,3})\s*?,\s*?)*?\d{1,3})(((:?0x[a-f0-9]{2}|\d{1,3})\s*?,\s*?)*?0+?\d{1,3})(((:?0+?\d{1,3}|\d{1,3})\s*?,\s*?)*?0x[a-f0-9]{2})((:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?,\s*?)+(:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?\) 2 0 0 1
|
|
2003 2003 ^form(Ping|Tracert)$ 2 0 0 1
|
|
2004 2004 ^form(Ping|Tracert)$ 2 0 0 1
|
|
2005 2005 ^.{1,50}\/uapi-cgi\/ 2 0 0 1
|
|
2006 2006 ^.{1,50}\/uapi-cgi\/ 2 0 0 1
|
|
2007 2007 ^[^&]{150,} 2 0 0 1
|
|
2008 2008 ^[^&]{150,} 2 0 0 1
|
|
2009 2009 \bexec\b 2 0 0 1
|
|
2010 2010 parent=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1
|
|
2011 2011 oId=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1
|
|
2012 2012 [^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1
|
|
2013 2013 ^\s+?[^\s\>]+?\s+?SYSTEM\s 2 0 0 1
|
|
2014 2014 ^[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1
|
|
2015 2015 ^[A-Z]{8}\x3a 2 0 0 1
|
|
2016 2016 ^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5bnull\x5d 2 0 0 1
|
|
2017 2017 ^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5b\x5d 2 0 0 1
|
|
2018 2018 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
|
|
2019 2019 ^.{0,5}(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
|
|
2020 2020 ^\s*(<worker>[A-Za-z0-9_-]{1,20})\s*=\s*null\x3b.{1,300}(=worker)\s*=\s*document\.getElementById\([\x22\x27](=worker)[\x22\x27]\)\x3b.{1,300}\.addEventListener\([\x22\x27]DOMNodeInserted[\x22\x27]\s*,\s*(<callback0>[A-Za-z0-9_-]{1,20}).{0,300}(=worker)(<worker_ext>(\.\w{1,20})+)\s*=\s*\d+\x3b.{1,300}function\s*(=callback0)\([^\)]+\)\s*\{\s*.{1,300}\.requestAnimationFrame\((<callback>[A-Za-z0-9_-]{1,20})\)\x3b.{1,300}function\s*(<garbagecollector>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*.{0,100}for\s*\(let\s*(<gc_counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=gc_counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=gc_counter)(\+{2}|-{2})\s*\)\s*.{1,300}function\s*(=callback)\([^\)]+\)\s*\{\s*.{1,300}(=garbagecollector)\(\)\s*\x3b\s*.{1,300}\((=worker)(=worker_ext)\) 2 0 0 1
|
|
2021 2021 ^\s*(<opt>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*let\s*(<o_var>[A-Za-z0-9_-]{1,20})\s*=\s*\{\}\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=o_var)\.(<x_prop>[A-Za-z0-9_-]{1,20}).{1,300}for\s*\(\s*let\s*(<counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)(\+{2}|-{2})\).{1,100}(=opt)\(\).{1,300}let\s*(<leaked_stack_obj>[A-Za-z0-9_-]{1,20})\s*=\s*null.{1,100}let\s*(<obj_proto>[A-Za-z0-9_-]{1,20})\s*=\s*\(\{\}\)\.__proto__\x3b.{1,300}(=obj_proto)\.__defineGetter__\([\x22\x27](=x_prop)[\x22\x27],\s*Error\.prototype\.toString\)\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=obj_proto)\.__defineGetter__\([\x22\x27](<message_proto>[A-Za-z0-9_-]{1,20})[\x22\x27].{1,300}delete\s*(=obj_proto)\.(=message_proto)\x3b.{1,300}(=obj_proto)\.\w+\s*=\s*Array\.prototype.{1,300}(=opt) 2 0 0 1
|
|
2022 2022 ^\s*(<func_opt>[\w-]{1,20})\((<var_a>[\w-]{1,20})\s*,\s*(<var_b>[\w-]{1,20}).{1,300}((=var_a)\.(=var_b)|(=var_b)\.(=var_a))\s*=\s*\d+\x3b\s*((=var_a)|(=var_b))\.push\(\d+\)\x3b\s*((=var_a)\.(=var_a)|(=var_b)\.(=var_b))\s*=\s*0x.{1,300}Object\.prototype\.push\s*=\s*Array\.prototype\.push\x3b\s*for\s*\(\s*let\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\).{1,300}let\s*((=var_a)|(=var_b))\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}\x3b.{1,300}(=func_opt)\(((=var_a)|(=var_b)),\s*\{\}.{1,300}let\s*(<var_o>[\w-]{1,20})\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}.{1,300}(=func_opt)\((=var_o) 2 0 0 1
|
|
2023 2023 ^\s*(<func_a>[\w-]{1,20})\((<obj1>[\w-]{1,20})\s*,\s*(<tmp_obj>[\w-]{1,20})\s*,\s*(<value>[\w-]{1,20})\).{1,300}(=obj1)\.\w+\s*=\s*\d+\.\d+\x3b\s*var\s*\w+\s*=\s*\{__proto__:\s*(=tmp_obj)\}\x3b\s*(=obj1)\.\w+\s*=\s*(=value)\x3b.{1,300}var\s*(=obj1)\s*=\s*\{\w+:\s*\d+\.\d+\s*,\s*\w+:\s*\d+\.\d+\}\x3b\s*for\s*\(\s*var\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\)\s*\{\s*(=func_a)\((=obj1)\s*,\s*(\x22{2}|\x27{2})\s*,\s*(\x22{2}|\x27{2})\)\x3b.{1,300}(=func_a)\((=obj1)\s*,\s*(=obj1)\s*,\s*\d+\.\d{8,}.{1,300}eval\((=obj1)\. 2 0 0 1
|
|
2024 2024 ^form(RebootCheck|Wsc)$ 2 0 0 1
|
|
2025 2025 ^[^&]{42,} 2 0 0 1
|
|
2026 2026 ^[^&]{512,} 2 0 0 1
|
|
2027 2027 ^Callback\x3a\x20\x3chttp[^\x3a]+\x3a\d{1,5}[^\/]/Hmi 2 0 0 1
|
|
2028 2028 ^[^&]{90,} 2 0 0 1
|
|
2029 2029 ^\d[012345] 2 0 0 1
|
|
2030 2030 ^\d[012345] 2 0 0 1
|
|
2031 2031 ^\d[012345] 2 0 0 1
|
|
2032 2032 ^\d[012345] 2 0 0 1
|
|
2033 2033 ^\d[012345] 2 0 0 1
|
|
2034 2034 ^\d[012345] 2 0 0 1
|
|
2035 2035 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e) 2 0 0 1
|
|
2036 2036 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e) 2 0 0 1
|
|
2037 2037 ^[^&\x0d\r]+[\n\x0a] 2 0 0 1
|
|
2038 2038 ^\s*(<func_a>[\w\-]{1,20})\((<obj_1>[\w\-]{1,20})\s*,\s*(<obj_2>[\w\-]{1,20}).{1,300}(=obj_1)\.(<prop_2>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,300}?(=obj_2)\.pop\(\).{1,300}?(=obj_1)\.(<prop_1>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,500}Object\.prototype\.p(op|ush)\s*=\s*Array\.prototype\.p(op|ush)\x3b.{1,500}var\s*(<obj_3>[\w\-]{1,20})\s*=\s*\{\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)?\s*,\s*((=prop_2)\s*\x3a\s*\d+(\.\d+)?|(=prop_2)\s*\x3a\s*\d+(\.\d+)?\s*,\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)).{1,500}(=func_a)\(\s*((=obj_3)\s*,\s*new\s*Object\(\)|\s*new\s*Object\(\)\s*,\s*(=obj_3)\s*).{1,500}?(=func_a)\((=obj_3) 2 0 0 1
|
|
2039 2039 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
2040 2040 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
2041 2041 ^[^&\r\n]+(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
|
|
2042 2042 ^(%[a-f0-9]{2}){5,} 2 0 0 1
|
|
2043 2043 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
|
|
2044 2044 ^%(3b|0a|26|60|7C|24) 2 0 0 1
|
|
2045 2045 ^\/(icons|cgi-bin) 2 0 0 1
|
|
2046 2046 ^\/(icons|cgi-bin) 2 0 0 1
|
|
2047 2047 ^\/(icons|cgi-bin) 2 0 0 1
|
|
2048 2048 [^\r\n]*true 2 0 0 1
|
|
2049 2049 \x2f(FURUKAWA|APROS)\x2f 2 0 0 1
|
|
2050 2050 [^\r\n]*(\x60|\x24|\x7c|\bsh\b) 2 0 0 1
|
|
2051 2051 ^[^\r\n=]*(union|select) 2 0 0 1
|
|
2052 2052 ^[^&=]*(union|select) 2 0 0 1
|
|
2053 2053 ^(<class>[A-Z0-9_-]{1,20})\s*.*?(<var>[A-Z0-9_-]{1,15})\s*=\s*(&\x3b|0x|\\x|&?h)*\d{8}\s*.*?(ReDim|Dim)\s*(=var)\(\d{4,20}\).*?set\s*(=var)\(\d+\)\s*=\s*new\s*(=class).*?Erase\s*(=var).*?Erase\s*(=var) 2 0 0 1
|
|
2054 2054 ^[^\x22]+\.jsp\x22 2 0 0 1
|
|
2055 2055 ([\x60\x3b\x7c]|%60|%3b|%7c|%26|(\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
|
|
2056 2056 ^[\s\x22\x27]*check_ping\b 2 0 0 1
|
|
2057 2057 ^\s*(<obj>[\w\-]{1,20})\s*=\s*document\.getElementById\(.{1,500}Class\s*(<class>[\w\-]{1,20}).{1,500}End\s*Class.{1,500}set\s*(=obj)\.scroll((Left|Top)(Max)?|Height|Width)\s*=\s*New\s*(=class) 2 0 0 1
|
|
2058 2058 [^\r\n]*\x5c(n|c)[^\r\n]{0,100}[\x60\x24] 2 0 0 1
|
|
2059 2059 ([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
|
|
2060 2060 ^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
|
|
2061 2061 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1
|
|
2062 2062 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1
|
|
2063 2063 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
|
|
2064 2064 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
|
|
2065 2065 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
|
|
2066 2066 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
|
|
2067 2067 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
|
|
2068 2068 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
|
|
2069 2069 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
|
|
2070 2070 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
|
|
2071 2071 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
|
|
2072 2072 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
|
|
2073 2073 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
|
|
2074 2074 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
|
|
2075 2075 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
|
|
2076 2076 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1
|
|
2077 2077 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
|
|
2078 2078 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1
|
|
2079 2079 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1
|
|
2080 2080 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1
|
|
2081 2081 \.((php\d{0,}|phps|pht|phtm|phtml|shtml|htaccess|phar|inc)) 2 0 0 1
|
|
2082 2082 ^[^&]{100,} 2 0 0 1
|
|
2083 2083 ^[a-zA-Z0-9]+\.(zip|7z|gz) 2 0 0 1
|
|
2084 2084 ^(\x28|\x29|\x3c|\x3e|\x26|\x2a|\xe2|\x80|\x98|\x7c|\x3f|\x3b|\x5b|\x5d|\x5e|\x7e|\x21|\x2e|\xe2|\x80|\x9d|\x25|\x40|\x2f|\x5c|\x3a|\x2b|\x2c|\x60) 2 0 0 1
|
|
2085 2085 ^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr) 2 0 0 1
|
|
2086 2086 ^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr) 2 0 0 1
|
|
2087 2087 ^[0-9]{1,10}\x3b 2 0 0 1
|
|
2088 2088 ^(%2e|\.)exec 2 0 0 1
|
|
2089 2089 ^[a-zA-Z0-9]{5,40} 2 0 0 1
|
|
2090 2090 ^[a-zA-Z0-9]{7,200} 2 0 0 1
|
|
2091 2091 ^\d+..([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))-XX:OnOutOfMemoryError= 2 0 0 1
|
|
2092 2092 ^[^&=]*(union|select|update|insert|delete) 2 0 0 1
|
|
2093 2093 ^[^&=]*(union|select|update|insert|delete) 2 0 0 1
|
|
2094 2094 ((%2F|\/)(\.|%2E){2}(%2F|\/)) 2 0 0 1
|
|
2095 2095 ((%2F|\/)(\.|%2E){2}(%2F|\/)) 2 0 0 1
|
|
2096 2096 ^(%2E%2E%2F|\.\.\/) 2 0 0 1
|
|
2097 2097 ^[a-zA-Z0-9]{5,45} 2 0 0 1
|
|
2098 2098 ^([A-Z]\x00){20}\x00\x00 2 0 0 1
|
|
2099 2099 (InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI) 2 0 0 1
|
|
2100 2100 (InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI) 2 0 0 1
|
|
2101 2101 (InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI) 2 0 0 1
|
|
2102 2102 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
|
|
2103 2103 ^SOAPAction\x3a\x20\x22?urn\x3aNETGEAR-ROUTER\x3aservice\x3a.{128,}(:\d#)/Hm 2 0 0 1
|
|
2104 2104 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
|
|
2105 2105 ^[a-zA-Z0-9+/]{1000,} 2 0 0 1
|
|
2106 2106 \We[\s\x22\x27,+]*?v[\s\x22\x27,+]*?a[\s\x22\x27,+]*?l\W 2 0 0 1
|
|
2107 2107 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
|
|
2108 2108 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
|
|
2109 2109 ^[^<]{30,}<\/NewMACAddress> 2 0 0 1
|
|
2110 2110 ^0+(&|$) 2 0 0 1
|
|
2111 2111 ^0+(&|$) 2 0 0 1
|
|
2112 2112 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
|
|
2113 2113 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
|
|
2114 2114 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
|
|
2115 2115 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1
|
|
2116 2116 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
|
|
2117 2117 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1
|
|
2118 2118 ^\/(icons|cgi-bin) 2 0 0 1
|
|
2119 2119 ^\/(icons|cgi-bin) 2 0 0 1
|
|
2120 2120 ^\/(icons|cgi-bin) 2 0 0 1
|
|
2121 2121 ^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
|
|
2122 2122 (yJ0eXAiOiJKV1Qi|InR5cCI6IkpXVCJ)/H 2 0 0 1
|
|
2123 2123 ^(CREATE|SELECT|INSERT|UPDATE|EXEC) 2 0 0 1
|
|
2124 2124 ^["']\s*:\s*["']\s*[^0-9]+ 2 0 0 1
|
|
2125 2125 ^\s?([\x3b\x0a\x26\x60\x7c\x24]|%(3b|0a|26|60|7c|24)) 2 0 0 1
|
|
2126 2126 ^\s*=\s*[\x22\x27]\s*ms-msdt\x3a 2 0 0 1
|
|
2127 2127 (\x2e|%2e)(\x2e|%2e)(\x2f|%2f) 2 0 0 1
|
|
2128 2128 myname=[^&]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
|
|
2129 2129 ^\x2fdefault\x2fen_US\x2fframe(\x2eA100)?\x2ehtml\?(content|sidebar)=.*\x2e\x2e\x2f 2 0 0 1
|
|
2130 2130 ^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
|
|
2131 2131 ^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1
|
|
2132 2132 [^a-zA-Z0-9_\-\.][a-zA-Z]{8}\.jar 2 0 0 1
|
|
2133 2133 ^\s?(file|https?)\x3a 2 0 0 1
|
|
2134 2134 ^(\/?\.\.?\/){2} 2 0 0 1
|
|
2135 2135 \b(<xps>[a-zA-Z]{7})\.classPK.+?\b(=xps)\[a-zA-Z]{12}\.classPK.+?\b(=xps)\$[a-zA-Z]{12}\.classPK 2 0 0 1
|
|
2136 2136 ^[\r\n\s\+]*.+?\}[\r\n\s]*?catch 2 0 0 1
|
|
2137 2137 ^(application\/(x-)?|text\/)xml 2 0 0 1
|
|
2138 2138 ^(application\/(x-)?|text\/)xml 2 0 0 1
|
|
2139 2139 \/((index|toc)\.html?)?\?\/\/ 2 0 0 1
|
|
2140 2140 ^.{0,10}[\x3b\x0a\x26\x60\x7c\x24] 2 0 0 1
|
|
2141 2141 [?&]ap= 2 0 0 1
|
|
2142 2142 ^\d+\s*[^\r\n]{50,} 2 0 0 1
|
|
2143 2143 (web|decorators|seraph-config)\x2exml$ 2 0 0 1
|
|
2144 2144 com.atlassian.jira\x2f(jira\x2dwebapp\x2ddist|atlassian\x2djira\x2dwebapp)\x2fpom\x2e(properties|xml)$ 2 0 0 1
|
|
2145 2145 ^[^\x3c]{,100}\x27 2 0 0 1
|
|
2146 2146 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
2147 2147 ^(Begin|End)\=/P 2 0 0 1
|
|
2148 2148 \/\?[a-f0-9]{64}\;\d\;\d 2 0 0 1
|
|
2149 2149 \x7b?(visibility\x3ahidden|display\x3anone)\x3b?\x7d?\x22><div>\d{16} 2 0 0 1
|
|
2150 2150 \/[a-z]\/[0-9a-f]{32}$ 2 0 0 1
|
|
2151 2151 \/dl\/\w{1,4}\.php\?[0-9]$ 2 0 0 1
|
|
2152 2152 \/[a-f0-9]{60,}_js\? 2 0 0 1
|
|
2153 2153 \/[a-f0-9]{60,}_jar$ 2 0 0 1
|
|
2154 2154 \/[a-f0-9]{60,}_exe$ 2 0 0 1
|
|
2155 2155 ,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+, 2 0 0 1
|
|
2156 2156 ^\/showthread\.php\?t=\d+$ 2 0 0 1
|
|
2157 2157 function\x20booom[1-3]{1}\x28\x29 2 0 0 1
|
|
2158 2158 var\x20Cute(Money|Power|Shine) 2 0 0 1
|
|
2159 2159 iframe[^\r\n]*\x2FCUTE-IE\x2Ehtml 2 0 0 1
|
|
2160 2160 ^\/[a-z][0-9a-z_+=-]{10,30}\?\w=[0-9.]+\&\w=1.6.0_\d\d$ 2 0 0 1
|
|
2161 2161 \.php\?(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+$ 2 0 0 1
|
|
2162 2162 \/[a-z0-9]+\.[a-z0-9]{2,4}\/eH[a-z0-9]{60,}$ 2 0 0 1
|
|
2163 2163 \/[a-z0-9]+\.[a-z0-9]{2,4}\/oH[a-z0-9]{60,}$ 2 0 0 1
|
|
2164 2164 \/indigo\?\d+ 2 0 0 1
|
|
2165 2165 ^\/\?[a-f0-9]{32}$ 2 0 0 1
|
|
2166 2166 =[.\"]\w{8}\.jar/Hi 2 0 0 1
|
|
2167 2167 \.php\?showtopic=[0-9]{6}$ 2 0 0 1
|
|
2168 2168 \/[0-9]\.html$ 2 0 0 1
|
|
2169 2169 ^\?[a-f0-9]{32}\" 2 0 0 1
|
|
2170 2170 ^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$ 2 0 0 1
|
|
2171 2171 ^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$ 2 0 0 1
|
|
2172 2172 ^\/t\/[a-f0-9]{32} 2 0 0 1
|
|
2173 2173 \/[A-Z]{20,}\?[A-Z]=\d$ 2 0 0 1
|
|
2174 2174 ^\/q[a-zA-Z0-9+-]{3,14}\/[a-zA-Z0-9+-]{3,16}\?[a-z]{1,6}=[a-zA-Z0-9+-\._]{7,18}$ 2 0 0 1
|
|
2175 2175 ^\/Applet\.jar$ 2 0 0 1
|
|
2176 2176 \/beacon\/[a-f0-9]{8}\.htm$ 2 0 0 1
|
|
2177 2177 \/t\/[a-f0-9]{32}$ 2 0 0 1
|
|
2178 2178 ^\/[0-9]{3}\.jar$ 2 0 0 1
|
|
2179 2179 ^[\r\n\s]*[\d\x5b] 2 0 0 1
|
|
2180 2180 ^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.jar$ 2 0 0 1
|
|
2181 2181 ^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.pdf$ 2 0 0 1
|
|
2182 2182 \/[0-9]{3}\.pdf 2 0 0 1
|
|
2183 2183 \(\x22[0-9\x3a\x3b\x3c\x3d\x3e\x3fa-k]{50,100}\x22\).{0,200}\)\x3b<\/script><\/body> 2 0 0 1
|
|
2184 2184 ^[a-f0-9]{32} 2 0 0 1
|
|
2185 2185 ^((<\/applet>).)+?\/.{1,12}\/.{1,12}\x3a.{1,12}p.{1,12}t.{1,12}t.{1,12}h 2 0 0 1
|
|
2186 2186 ^(\s*=\s*|[\x22\x27]\s*,\s*)[\x22\x27] 2 0 0 1
|
|
2187 2187 ^[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])(((=q)).)+?\.(gif|jpe?g|p(ng|sd))(=q) 2 0 0 1
|
|
2188 2188 ^((<\/applet>).)+[\r\n\s]value[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])[a-f0-9]{32}(=q1) 2 0 0 1
|
|
2189 2189 ^\/[a-z0-9A-Z]{25,35}\/(([tZFBeDauxR]+q){3}[tZFBeDauxR]+(_[tZFBeDauxR]+)?|O7dd)k(([tZFBeDauxR]+q){3}[tZFBeDauxR]+|O7dd)\/ 2 0 0 1
|
|
2190 2190 EGYPACK_CRYPT\d 2 0 0 1
|
|
2191 2191 \/\?[0-9a-f]{60,66}\x3b(1(0[0-3]|1\d)|90)\d{1,3}\x3b\d{1,3}$ 2 0 0 1
|
|
2192 2192 ^(ckwm)*?(Exp|cc)\.class 2 0 0 1
|
|
2193 2193 ^\/command\/[a-zA-Z]{6}$ 2 0 0 1
|
|
2194 2194 &b=[a-f0-9]{7}&k=[a-f0-9]{32} 2 0 0 1
|
|
2195 2195 ^(a(ttack|dEx[xp])|([a-z]))\.class 2 0 0 1
|
|
2196 2196 ^(a(ttack|dEx[xp])|([a-z]))\.class 2 0 0 1
|
|
2197 2197 ^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27]((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){10}|(=ascii){10}) 2 0 0 1
|
|
2198 2198 ^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27][^\x22\x27]+?[\x22\x27][^>]*((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){9,20}|(=ascii){9,20})%3C 2 0 0 1
|
|
2199 2199 ^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$ 2 0 0 1
|
|
2200 2200 ^\/[0-9]{1,2}\/red[0-9]{1,4}\.php[0-9]{0,1}$ 2 0 0 1
|
|
2201 2201 \.php\?(b=[a-fA-F0-9]{6}&)?v=1\.((4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{1,2})$ 2 0 0 1
|
|
2202 2202 &k=\d{16}(&|$) 2 0 0 1
|
|
2203 2203 ^(((?i:<\/applet>)).)+?[\r\n\s]value[\r\n\s]*[\r\n\s]*?[\x22\x27]?(\d{2,3})?(<sep>([^a-zA-Z0-9]{1,100}|[a-zA-Z0-9]{1,100}))\d{2,3}((=sep)\d{2,3}){20} 2 0 0 1
|
|
2204 2204 ^(((?i:<\/applet>)).)+?[\r\n\s]archive[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27] 2 0 0 1
|
|
2205 2205 &b=[a-f0-9]{7}&k=[a-f0-9]{32} 2 0 0 1
|
|
2206 2206 if.{1,10}[<>]=?\s*(<quot>[\x22\x27])1(<sep>[^0-9a-zA-Z])7((=sep)\d+)?(=quot).{1,10}[<>]=?\s*(=quot)1(=sep)7((=sep)\d+)?(=quot) 2 0 0 1
|
|
2207 2207 ^[\r\n\s]*[\r\n\s]*?[\x22\x27]http\x3a\/\/[^\/]+?\/\?[A-Za-z0-9]+=[A-Za-z0-9%]{60,}[\x22\x27] 2 0 0 1
|
|
2208 2208 ^[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\x22\x27]\.replace\([\r\n\s]*?(<q1>[\x22\x27]?)\/.+?\/g[\r\n\s]*?,[\r\n\s]*?(<q2>[\x22\x27]?)%(=q2)[\r\n\s]*?\) 2 0 0 1
|
|
2209 2209 (<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{12,16}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a) 2 0 0 1
|
|
2210 2210 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27] 2 0 0 1
|
|
2211 2211 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(<dot>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<p>((=dot))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<h>(((=p)|(=dot)))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=p).+?value[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(=dot)([^a-f0-9]{2}){1,20}(<e>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<x>((=e))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=e)(([^a-f0-9]{2}){1,20})?[\x22\x27] 2 0 0 1
|
|
2212 2212 \/[a-f0-9]{32}\/[a-z]+?\-[a-z]+?\.php 2 0 0 1
|
|
2213 2213 \.php\?e=\d+(&|$) 2 0 0 1
|
|
2214 2214 ^[\r\n\s]*?[\x22\x27][a-f0-9]{2}(<sep>[^a-f0-9]{1,10})(<a>[a-f0-9]{2})(=sep)(<p>[a-f0-9]{2})(=sep)(=p)(=sep)(<l>[a-f0-9]{2})(=sep)(<e>[a-f0-9]{2})[^\x22\x27]+?(=sep)(=p)(=sep)(=a)(=sep)[a-f0-9]{2}(=sep)(=a)(=sep)[^\x22\x27]+?(=sep)(=a)(=sep)(=l)(=sep)[a-f0-9]{2}(=sep)(=e) 2 0 0 1
|
|
2215 2215 \/cod\/[^\x2f]+\.vbs$ 2 0 0 1
|
|
2216 2216 [a-f0-9]{32}\.jar 2 0 0 1
|
|
2217 2217 ^[^a-z0-9] 2 0 0 1
|
|
2218 2218 \.php\?dwl=[a-z]+$ 2 0 0 1
|
|
2219 2219 ^[\r\n\s]*[\r\n\s]*?[\x22\x27]h(<sep>\d{2})t(=sep)t(=sep)p(=sep)\x3a 2 0 0 1
|
|
2220 2220 ^[\r\n\s]*?[\x22\x27]<([\x27\x22]\s*?\+\s*?[\x22\x27])?a([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?l([\x27\x22]\s*?\+\s*?[\x22\x27])?e([\x27\x22]\s*?\+\s*?[\x27\x22])?t 2 0 0 1
|
|
2221 2221 ^\/ep\/cl\.php$ 2 0 0 1
|
|
2222 2222 ^[\r\n\s]*?[\x22\x27]<applet 2 0 0 1
|
|
2223 2223 =\d+&e=\d+$ 2 0 0 1
|
|
2224 2224 \/\d+\/\d\.zip$ 2 0 0 1
|
|
2225 2225 (<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{10,20}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a) 2 0 0 1
|
|
2226 2226 (<a>[0-9a-z]{2})(<s>((=a))[0-9a-z]{2})[0-9a-z]{2}(=s)[0-9a-z]{2}(<y>[0-9a-z]{2})[0-9a-z]{4}(<dot>[0-9a-z]{2})(=a)(<r>[0-9a-z]{2})(=r)(=a)(=y)(=dot) 2 0 0 1
|
|
2227 2227 ^[\r\n\s]*?\( 2 0 0 1
|
|
2228 2228 \/[a-z0-9]{32}\.jar$ 2 0 0 1
|
|
2229 2229 ^[^\s]*?\s*?\/[^\r\n\s]*?\?src= 2 0 0 1
|
|
2230 2230 ^\/([\/_]*?[a-f0-9][\/_]*?){32}\/\d+?$ 2 0 0 1
|
|
2231 2231 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?\/([\/_]*?[a-f0-9][\/_]*?){64}[\x22\x27] 2 0 0 1
|
|
2232 2232 ^\/([\/_]*?[a-f0-9][\/_]*?){32}$ 2 0 0 1
|
|
2233 2233 ^\/[a-zA-Z0-9_\x2f-]{300,}\.jar$ 2 0 0 1
|
|
2234 2234 ^\/[a-zA-Z0-9_\x2f-]{300,}\.eot$ 2 0 0 1
|
|
2235 2235 ^((<\/applet>).)+?[\x22\x27]687474703a2f2f 2 0 0 1
|
|
2236 2236 \.html\?sv=[1-5](\,\d+?){1,3}$ 2 0 0 1
|
|
2237 2237 \/(d|xie|fla)\.php\?[a-z]+687474703a2f2f 2 0 0 1
|
|
2238 2238 \.html\?jar$ 2 0 0 1
|
|
2239 2239 ^\/\d{4,5}\/\d{7}$ 2 0 0 1
|
|
2240 2240 \/\{0,2}[A-Za-z0-9\+\/]+?LvoDc0RHa8NnZ$ 2 0 0 1
|
|
2241 2241 ^[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*?\.charCodeAt[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*[\r\n\s]*?\)[\r\n\s]*?\^[\r\n\s]*?[a-zA-Z_$][^\r\n\s]*\.charCodeAt[\r\n\s]*?\( 2 0 0 1
|
|
2242 2242 ^(<sep>[^\x22\x27]{1,10})100(=sep)97(=sep)115(=sep)104(=sep)115(=sep)116(=sep)121(=sep)108(=sep)101(=sep)46(=sep)97(=sep)114(=sep)114(=sep)97(=sep)121(=sep) 2 0 0 1
|
|
2243 2243 ^[a-z0-9]{1,500}?(<s>[a-z0-9]{2})(<t>((=s))[a-z0-9]{2})(<r>(((=s)|(=t)))[a-z0-9]{2})(=t)(<o>(((=s)|(=t)|(=r)))[a-z0-9]{2})(<b>(((=s)|(=t)|(=r)|(=o)))[a-z0-9]{2})(<y>(((=s)|(=t)|(=r)|(=o)|(=b)))[a-z0-9]{2})(=t)((((=s)|(=t)|(=r)))[a-z0-9]{4})(=s)(=t)(=r) 2 0 0 1
|
|
2244 2244 ^\/[a-z0-9]+?\?thread=\d+?&x?key=[A-F0-9]{32}$ 2 0 0 1
|
|
2245 2245 ^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x) 2 0 0 1
|
|
2246 2246 ^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x) 2 0 0 1
|
|
2247 2247 ^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x) 2 0 0 1
|
|
2248 2248 \/[A-Z]\.xml$ 2 0 0 1
|
|
2249 2249 ^(<sep>((100).){1,20})100(=sep)101(=sep)102(=sep)97(=sep)117(=sep)108(=sep)116(=sep)35(=sep)86(=sep)77(=sep)76(=sep) 2 0 0 1
|
|
2250 2250 \.php\?a=[^&]+&f=[a-f0-9]{32}&u=[^&]+$ 2 0 0 1
|
|
2251 2251 \.php\?a=(dw[a-z0-9]|[hr][2-7])$ 2 0 0 1
|
|
2252 2252 (PK\x01\x02.{24}\x0a\x00.{16}[a-z]{4}.class){4} 2 0 0 1
|
|
2253 2253 ^(((?i:<\/applet>)).)+?(?i:value)[\r\n\s]*=[\r\n\s]*\x5c?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]+(=slash) 2 0 0 1
|
|
2254 2254 ^\d+u\d+s\d+h\d 2 0 0 1
|
|
2255 2255 ^((<\/applet>).)+?&#(0*?(1([0-1]\d|2[0-2])|[78][0-9]|9[07-9]|4[8-9]|5[0-7]|6[5-9])|x0*?([46][1-9A-F]|[57][0-9A]|3[0-9]))(\x3b|&#) 2 0 0 1
|
|
2256 2256 ^\s*?\d 2 0 0 1
|
|
2257 2257 ^\s*\s*?[\x22\x27][^\x22\x27\x3d]{1,20}=[a-f0-9]{20} 2 0 0 1
|
|
2258 2258 ^[^\d]{1,20}100[^\d]{1,20}101[^\d]{1,20}102[^\d]{1,20}97[^\d]{1,20}117[^\d]{1,20}108[^\d]{1,20}116[^\d]{1,20}35[^\d]{1,20}86[^\d]{1,20}77[^\d]{1,20}76 2 0 0 1
|
|
2259 2259 ^\s*?<<\s*?\/[A-Z0-9a-z]+\([A-Z0-9a-z]+\)\s*? 2 0 0 1
|
|
2260 2260 ^\/[a-f0-9]{32}\.php\?q=[a-f0-9]{32}$ 2 0 0 1
|
|
2261 2261 \.php\?req=(swf(IE)?|x(ap|ml)|jar|mp3)& 2 0 0 1
|
|
2262 2262 (\0[a-z]{3}\.classPK.{43}){4} 2 0 0 1
|
|
2263 2263 ^[\x22\x27] 2 0 0 1
|
|
2264 2264 ^\s*\s*?window\.document\.createElement 2 0 0 1
|
|
2265 2265 ^(<sep>[^\x22\x27]{0,10})6f(=sep)6c(=sep)6c(=sep)65(=sep)63(=sep)74(=sep)47(=sep)61(=sep)72(=sep)62(=sep)61(=sep)67(=sep)65(=sep) 2 0 0 1
|
|
2266 2266 \/3\/[a-f0-9]{32}\/http\x3a\x2f 2 0 0 1
|
|
2267 2267 \/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+)?$ 2 0 0 1
|
|
2268 2268 ^\x2Fload\x5Fmodule\x2Ephp\x3Fuser\x3D(n1|11?|2)$ 2 0 0 1
|
|
2269 2269 ^\x2Fmodules\x2F(n[u3]|1|2)\x2Eswf$ 2 0 0 1
|
|
2270 2270 ^\x2Fmodules\x2F(1|2)\x2Ejar$ 2 0 0 1
|
|
2271 2271 ^\s*?\(\s*?[\x22\x27]Flash[\x22\x27] 2 0 0 1
|
|
2272 2272 ^\s*?[\x22\x27][A-Za-z0-9\s]{500} 2 0 0 1
|
|
2273 2273 ^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}<script>var 2 0 0 1
|
|
2274 2274 ^[\r\n\s]*?<script>[\r\n\s]*?[A-Za-z]+[\r\n\s]*[\r\n\s]*?[\x22\x27][A-Za-z]{9}\x20[A-Za-z\x20]{300} 2 0 0 1
|
|
2275 2275 ^\/[a-z]\?[a-z]=[0-9]{5,}$ 2 0 0 1
|
|
2276 2276 [^0-9a-f]{1,3}68[^0-9a-f]{1,3}74[^0-9a-f]{1,3}74[^0-9a-f]{1,3}70[0-9a-f]{1,3}3a 2 0 0 1
|
|
2277 2277 ^[\x22\x27] 2 0 0 1
|
|
2278 2278 ^(e(vtmgr|ext)|actmon|nciesc|EBC32|comm|tdi)\.sys[\x22\x27] 2 0 0 1
|
|
2279 2279 ^([\x22\x27]\s*?\])?\(\s*?(\[[\x22\x27])?rc4([\x22\x27]\s*?\])?\(\s*?[\x22\x27][^\x22\x27]+?[\x22\x27]\s*?,\s*?(\[[\x22\x27])?hex2bin([\x22\x27]\s*?\])?\( 2 0 0 1
|
|
2280 2280 ^[\x22\x27] 2 0 0 1
|
|
2281 2281 ^[\x22\x27] 2 0 0 1
|
|
2282 2282 ^[\x22\x27] 2 0 0 1
|
|
2283 2283 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\?\&]e=\d+[\x22\x27] 2 0 0 1
|
|
2284 2284 ^[\r\n\s]*?\,[\r\n\s]*?[\x22\x27][\%\\]u" 2 0 0 1
|
|
2285 2285 ^(((<\/object>).)+?codebase\s*\s*?[\x22\x27]spl[\x22\x27])(((<\/object>).)+?\/x-java-applet) 2 0 0 1
|
|
2286 2286 ^[\w.]*?\.class 2 0 0 1
|
|
2287 2287 ^\s*\s*?[\x22\x27]\- 2 0 0 1
|
|
2288 2288 ^\s*\s*?[\x22\x27]\- 2 0 0 1
|
|
2289 2289 \/Fqxzdh\.jar$ 2 0 0 1
|
|
2290 2290 ^\s*?\(\s*?[\x22\x27](AgControl\.AgControl)[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?\.[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?[\x22\x27]\s*?\.\s*?replace\s*?\( 2 0 0 1
|
|
2291 2291 ^id=[^&]+&dom=687474703a2f2f[a-f0-9]+2e706870\s*?$/Ps 2 0 0 1
|
|
2292 2292 [^=]+(([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+?2e)+([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+\s*?/P 2 0 0 1
|
|
2293 2293 \.php\?spl=[\w_]+$ 2 0 0 1
|
|
2294 2294 ^Content-Disposition\x3a[^\r\n]+\.swf/Hm 2 0 0 1
|
|
2295 2295 Referer\x3a[^\r\n]+\.php\/\[\[DYNAMIC\]\]\/\d/Hm 2 0 0 1
|
|
2296 2296 ^\s*?[\x3a\x3d]\s*?[\x22\x27]?\- 2 0 0 1
|
|
2297 2297 ^\/f(\/[^\x2f]+)?\/14\d{8}(\/\d{9,10})?(\/\d)+(\/x[a-f0-9]+(\x3b\d)+?)?$ 2 0 0 1
|
|
2298 2298 ^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{14,}\.html(\x3a\d{1,5})?\r$/Hm 2 0 0 1
|
|
2299 2299 ^(<sep>.{1,50})u(=sep)n(=sep)c(=sep)t(=sep)i(=sep)o(=sep)n(=sep)\s 2 0 0 1
|
|
2300 2300 ^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}(\r\n)*?<script>[^\r\n]+?\We[\x22\x27\+]*?v[\x22\x27\+]*?a[\x22\x27\+]*?l\W 2 0 0 1
|
|
2301 2301 ^(<sep>.{1,20})\.___\+(=sep)\._\\\+(=sep)\._\\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+(=sep)\.\\\_\+(=sep)\.\\__\+(=sep)\.__\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.___\+(=sep)\.\\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\\_\+(=sep)\._\_\+(=sep)\.\_\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\__\+(=sep)\.\\\\+(=sep)\.\\\$_\+ 2 0 0 1
|
|
2302 2302 ^\/(pruncd)?flashhigh\.swf$ 2 0 0 1
|
|
2303 2303 ^\/(pruncd)?flashlow\.swf$ 2 0 0 1
|
|
2304 2304 ^\/(pruncd)?silverapp1\.xap$ 2 0 0 1
|
|
2305 2305 \?action=lnd$ 2 0 0 1
|
|
2306 2306 \?action=(pld|exp)&exp= 2 0 0 1
|
|
2307 2307 ^Referer\x3a[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+\d/Hm 2 0 0 1
|
|
2308 2308 \/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Z-a-z]{18}\.jnlp$ 2 0 0 1
|
|
2309 2309 \/k\?t[a-z]*=\d{5,}$ 2 0 0 1
|
|
2310 2310 ^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f 2 0 0 1
|
|
2311 2311 ^\/[^\x2f]*?flashhigh\.swf$ 2 0 0 1
|
|
2312 2312 ^\/[^\x2f]*?flashlow\.swf$ 2 0 0 1
|
|
2313 2313 ^\/[^\x2f]*?iebasic\.html$ 2 0 0 1
|
|
2314 2314 ^\/[^\x2f]*?silverapp1\.xap$ 2 0 0 1
|
|
2315 2315 \/[a-z]{3,7}\.php$ 2 0 0 1
|
|
2316 2316 \/([a-z0-9]{1,7}\.php)?\?zho= 2 0 0 1
|
|
2317 2317 ^\/[a-f0-9]{32}\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Za-z]+\.(html|jar|swf)$ 2 0 0 1
|
|
2318 2318 ^\/Drop2(-\d+)\.swf$ 2 0 0 1
|
|
2319 2319 ^[^\r\n]*?(<name>\/[^\.\/]+\.html)\?[a-z]+?\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(\d{1,5})?\r\n 2 0 0 1
|
|
2320 2320 ^Content-Disposition\x3a[^\r\n]+\.swf/Hm 2 0 0 1
|
|
2321 2321 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi 2 0 0 1
|
|
2322 2322 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi 2 0 0 1
|
|
2323 2323 ^\s*?\x28\s*?[a-z0-9]{4,6}\s*?\x28\s*?[a-z0-9]{1,3}\s*?,\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x29\s*?\x3b\s*?(<var>[a-z0-9]{1,3})\s*?\x3d\s*?\x28\s*?(=var)\s*?\x2b\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x25\s*?[a-z0-9]{1,3}\.length\x3b 2 0 0 1
|
|
2324 2324 ^[A-Za-z0-9]+\x27\s*?src=\x27http\x3a[^\x27]+[\x27]\s*width=1\d\s+height=1\d\s+ 2 0 0 1
|
|
2325 2325 ^Last-Modified\x3a\x20[^A-Za-z]{2}/Hm 2 0 0 1
|
|
2326 2326 ^\/ABs[A-Za-z0-9_]+(\/x?[a-f0-9]+(\x3b\d+)+)?$ 2 0 0 1
|
|
2327 2327 ^\/AwoVG[A-Za-z0-9_]+$ 2 0 0 1
|
|
2328 2328 ^[a-z0-9]+\x2A\x2F\x22\x6F\x66\x74\x2E 2 0 0 1
|
|
2329 2329 ^Referer\x3a[^\r\n]+?rowedmedia\.com\/search\.php\r?$/Hmi 2 0 0 1
|
|
2330 2330 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r\n)/Hmi 2 0 0 1
|
|
2331 2331 ^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f 2 0 0 1
|
|
2332 2332 ^[a-zA-Z0-9]{9}<\/[^>]+>\s+?<[^\s]+\sid=\x22[a-zA-Z]{3,5}\x22\sstyle=\x22display\x3anone\x22>[A-Za-z0-9]{500} 2 0 0 1
|
|
2333 2333 ^[a-z]{7}(\s*?[a-z]+\s*?)*?[a-z]{7,}\x2a\x2f 2 0 0 1
|
|
2334 2334 nb[\d+]=Yes 2 0 0 1
|
|
2335 2335 ^(<vname>[A-Za-z0-9]+)\s*\s*?navigator.userAgent.toLowerCase\x28\x29\x3b.+?if\(document.cookie[^\r\n]+\([^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]b[\x22\x27+\s]*o[\x22\x27+\s]*t[\x22\x27+\s]*[\x22\x27][^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]s[\x22\x27+\s]*p[\x22\x27+\s]*i[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*r[\x22\x27+\s]*[\x22\x27] 2 0 0 1
|
|
2336 2336 ^Referer\x3a[^\r\n]+?\x3a\d+[^\r\n]*?\/[a-z0-9]+\.php\?[a-z0-9]+=\d+(\r\n|&)/Hm 2 0 0 1
|
|
2337 2337 ^GET \/(<name>a[a-z]{9,})\/.+?\r\nHost\x3a\x20(=name)\. 2 0 0 1
|
|
2338 2338 ^\s*?[\x22\x27][^\x22\x27]+\.php\?id=\d+[\x22\x27] 2 0 0 1
|
|
2339 2339 ^\W 2 0 0 1
|
|
2340 2340 ^[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(<arg>[a-z0-9]{3,})(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28[^\x29]+\x29\x3b\x2f\x2a[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(=arg)(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28 2 0 0 1
|
|
2341 2341 ^\s*?\d+,\s*?\d 2 0 0 1
|
|
2342 2342 ^\s*?\d+,\s*?\d 2 0 0 1
|
|
2343 2343 \/14\d{8}(\.jar)?$ 2 0 0 1
|
|
2344 2344 ^[a-z0-9]*\r\n/H 2 0 0 1
|
|
2345 2345 ^[a-z0-9]*\r\n/H 2 0 0 1
|
|
2346 2346 filename=[a-z0-9]*\r\n/H 2 0 0 1
|
|
2347 2347 \/\??4c2H($|[&?]utm_source=) 2 0 0 1
|
|
2348 2348 (Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P 2 0 0 1
|
|
2349 2349 (Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P 2 0 0 1
|
|
2350 2350 (Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P 2 0 0 1
|
|
2351 2351 \/([A-Za-z]{0,3}\d)(\d{0,3}[A-Za-z])[A-Za-z0-9]{4,5}\.swf$ 2 0 0 1
|
|
2352 2352 ^\s*[^>]*?[a-zA-Z]+\s*\s*?[\x22\x27]([a-z]{0,20}[A-Z])([A-Z]{0,20}[a-z])[A-Za-z]{15,21}[\x22\x27][^>]*([A-Za-z_]{0,200}[0-9])([0-9a-z_]{0,200}[A-Z])([0-9A-Z_]{0,200}[a-z])[A-Za-z0-9_]{200} 2 0 0 1
|
|
2353 2353 \/5\/[a-f0-9]{32}\/\x20*http\x3a\x2f 2 0 0 1
|
|
2354 2354 ^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f 2 0 0 1
|
|
2355 2355 ^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/Hm 2 0 0 1
|
|
2356 2356 ^\s*?[\x22\x27][^\x22\x27a-f0-9]68[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]70[^\x22\x27a-f0-9]3a[^\x22\x27a-f0-9]2f[^\x22\x27a-f0-9]2f[^\x22\x27]+?[^\x22\x27a-f0-9]00[\x22\x27] 2 0 0 1
|
|
2357 2357 ^\/[a-f0-9]{32}\/e\.html$ 2 0 0 1
|
|
2358 2358 Host\x3a\x20a[a-z]{10}\.[a-z]{5}\./H 2 0 0 1
|
|
2359 2359 \.js\?ver=[0-9]\.[0-9]{2}\.[0-9]{4}$ 2 0 0 1
|
|
2360 2360 \/\d\/?[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.html&[a-z]+=[^&]+&[a-z]+=\d{3}\.\d{3}\.\d{3,}(\.\d{3,})?$ 2 0 0 1
|
|
2361 2361 \/\d\/?[A-Z]+\/[a-f0-9]{40}\/$ 2 0 0 1
|
|
2362 2362 \/([a-z0-9]{0,10}[A-Z])([A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,20}\.jar$ 2 0 0 1
|
|
2363 2363 \?([a-z\d\x3d&\x2e]*?[A-Z])([A-Z\d=&\x2e]*?[a-z])([A-Za-z=&\x2e]*?\d)[A-Za-z\d=&\x2e]{50,}$ 2 0 0 1
|
|
2364 2364 ^\/([a-z0-9]+\/)?[^\x2f]+\?[a-z]{1,40}_id=\d{2,5}?&[a-z]{1,40}_id=\d{2,5}&[^&\x3d]+(_id)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$ 2 0 0 1
|
|
2365 2365 &cat_no=\d{2,5}?&no=\d{2,5}&[^&\x3d]+(_no)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$ 2 0 0 1
|
|
2366 2366 \x3capplet[^\x3e]+visibility[^\x3e]+hidden[^\x3e] 2 0 0 1
|
|
2367 2367 ^\s*?[a-z]+\s*\s*?\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b] 2 0 0 1
|
|
2368 2368 ^\s*? 2 0 0 1
|
|
2369 2369 ^\/[0-9a-f]{32}\.html$ 2 0 0 1
|
|
2370 2370 ^\/[a-z\_\-]{4,20}\.php\?([a-z\_\-]{4,20}=\d+?&){3,}[a-z\_\-]{4,20}=-?\d+$ 2 0 0 1
|
|
2371 2371 ^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{4,10}=\d{1,3}&){7,}[a-z\_\-]{4,10}=-?\d+$ 2 0 0 1
|
|
2372 2372 ^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d{1,3}&){3,}[a-z\_\-]{4,10}=-?\d+$ 2 0 0 1
|
|
2373 2373 \.jpg$ 2 0 0 1
|
|
2374 2374 ^\s+\d+\x3b\s*\} 2 0 0 1
|
|
2375 2375 ^\/([a-z][a-z\x2f]*\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d)[a-z0-9\x2f]+\/$ 2 0 0 1
|
|
2376 2376 ^\/([a-z][a-z\x2f]*-[a-z\x2f]+-)[a-z\x2f-]+\/$ 2 0 0 1
|
|
2377 2377 ^http\x3a\/\/[^\x2f]+\/[A-Z]([a-z0-9]+[A-Z])([A-Z0-9]+[a-z])[A-Za-z0-9]{9,}\.html?\r?$/Hmi 2 0 0 1
|
|
2378 2378 \.js\?chebstr=0\.\d+$ 2 0 0 1
|
|
2379 2379 \.js\?chbstr=0\.\d+$ 2 0 0 1
|
|
2380 2380 ^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*script\s*\)\x3b 2 0 0 1
|
|
2381 2381 ^\/([a-z\d]+[+-][a-z\d]+[+-][a-z\d]+[+-])[a-z\d+-]*\/$ 2 0 0 1
|
|
2382 2382 ^\s*\(\s*[\x22\x27][\x00-\x09\x80-\xff][\x22\x27]\s*\)\s*\x3b\s*[A-Za-z0-9]+\s*=\s*[\x22\x27] 2 0 0 1
|
|
2383 2383 ^\s*\x27[^\x27]+\x27width=\x27250\x27\sheight=\x27250\x27>\s*<\/iframe>\s*<\/div> 2 0 0 1
|
|
2384 2384 ^[\x3b\x2c]postRequest\x28cfg\.urlSoftDetectorCallback 2 0 0 1
|
|
2385 2385 ^[\r\n\s]*?Base64\.decode[\r\n\s]*?\x28[\r\n\s]*?[\x22\x27] 2 0 0 1
|
|
2386 2386 Referer\x3a\x20http\x3a\x2f\x2f[^\r\n\x2f]+\/index\.php\?[^\x3d&]+=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=)?\r\n/H 2 0 0 1
|
|
2387 2387 ^[^\n]*\x29\x3b$ 2 0 0 1
|
|
2388 2388 ^\s*(<var>[^\r\n\s\x3d\x2c\x3b]+)\s*=[^\n]*<iframe([^\n>]*top\x3a-\d+px\x3b)[^\n>]+src\s*=\s*\x5c?[\x22\x27]http[^\n>]+>\s*<\/iframe>\x22\x3bdocument\.write\((=var)\)\x3b\s*$ 2 0 0 1
|
|
2389 2389 ^[^\x2f\x22\x27]+\/\?[^=&\x22\x27]+=l3S 2 0 0 1
|
|
2390 2390 ^.{16}[a-z]{3}\.dll 2 0 0 1
|
|
2391 2391 ^.{16}[a-z]{4}\.dll 2 0 0 1
|
|
2392 2392 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{7,8}\d{2,3}\.pdf\r\n/Hm 2 0 0 1
|
|
2393 2393 \.php\?setup=d&s=\d+&r=\d+$ 2 0 0 1
|
|
2394 2394 \/\?[a-z0-9]{65,}\x3b \d\x3b \d 2 0 0 1
|
|
2395 2395 ^\/wordpress\/\?[A-Za-z0-9]{4}(&utm_source=le)?$ 2 0 0 1
|
|
2396 2396 (NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp) 2 0 0 1
|
|
2397 2397 (NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp) 2 0 0 1
|
|
2398 2398 \/\?nbVykj$ 2 0 0 1
|
|
2399 2399 ^s?\x3a\x2f\x2f[^\x22\x27]+\/\?[A-Za-z0-9]{5,6}(=[^&\x22\x27]+)?[\x22\x27]\x29\x3bsetCookie\(\x22popundr\x22,1,864e5\)\} 2 0 0 1
|
|
2400 2400 ^(<var>[A-Z0-9a-z]{1,20})\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29 2 0 0 1
|
|
2401 2401 ^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.[a-z]+\?time=[^&]+&stamp=[a-z]*\d+(\.[a-z]*\d+)+$ 2 0 0 1
|
|
2402 2402 ^[^\r\n]+\/%(3A|20)http%3A%2F%2F/Hmi 2 0 0 1
|
|
2403 2403 ^\/\?3b[A-Z0-9a-z]{2}(&subid=[^&]*)?$ 2 0 0 1
|
|
2404 2404 ^\/[a-z]+\/$ 2 0 0 1
|
|
2405 2405 ^\s*\([\x22\x27][A-F0-9a-f]{32}[\x22\x27]\s*\)\s*\x3b\s*}\s*catch\s*\(e\)\s*\{\s*\}\s*\}\s*<\/script>\s*<\/body> 2 0 0 1
|
|
2406 2406 ^([^>]*? name\s*=\s*[\x22\x27]flashvars)[^>]*? value\s*=\s*[\x22\x27]url=https?\x3a[^\x22\x27]*?\.wasm 2 0 0 1
|
|
2407 2407 ^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22(\!(\x22\s*?\+\s*?\x22)?)?Q(\x22\s*?\+\s*?\x22)?Q\x22 2 0 0 1
|
|
2408 2408 ^(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{2}(<J>[0-9a-z]{2})[0-9a-z]{4}(=v)[0-9a-z]{6}(=space)[0-9a-z]{2}(=space)[0-9a-z]{64}(=J)(=a)(=v)(=a) 2 0 0 1
|
|
2409 2409 ^\d{3}px\x3b\swidth\x3a3\d{2}px\x3b\sheight\x3a3\d{2}px\x3b\x22>[^<>]*?<iframe src=[\x22\x27][^\x22\x27]+[\x22\x27]\swidth=[\x22\x27]2\d{2}[\x22\x27]\sheight=[\x22\x27]2\d{2}[\x22\x27]><\/iframe>[^<>]*?\n[^<>]*?<\/span> 2 0 0 1
|
|
2410 2410 \/[a-z]{4,20}-a\.[a-z]{4,20}\.jar$ 2 0 0 1
|
|
2411 2411 \/view.php\?i=\d&key=[0-9a-f]{32}$ 2 0 0 1
|
|
2412 2412 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.jar$ 2 0 0 1
|
|
2413 2413 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$ 2 0 0 1
|
|
2414 2414 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$ 2 0 0 1
|
|
2415 2415 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$ 2 0 0 1
|
|
2416 2416 ^\/[a-z]\/f\.php\?k=\d(&e=\d&f=\d)?$ 2 0 0 1
|
|
2417 2417 ^\/[a-z]+\/$ 2 0 0 1
|
|
2418 2418 \.php\?j=1&k=[0-9](i=[0-9])?$ 2 0 0 1
|
|
2419 2419 ^\/[a-zA-Z]{7}\.jar$ 2 0 0 1
|
|
2420 2420 \/lpdf\.php\?i=[a-zA-Z0-9]+&?$ 2 0 0 1
|
|
2421 2421 [a-z0-9]{32}\.jar 2 0 0 1
|
|
2422 2422 \/inf\.php\?id=[a-f0-9]{32}$ 2 0 0 1
|
|
2423 2423 ^\s*=\s*[\x22\x27] 2 0 0 1
|
|
2424 2424 \/vd\/\d+\x3b[a-f0-9]{32} 2 0 0 1
|
|
2425 2425 \.php\?pprec$ 2 0 0 1
|
|
2426 2426 \.php\?c002$ 2 0 0 1
|
|
2427 2427 [a-f0-9]{32}\.jar 2 0 0 1
|
|
2428 2428 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1) 2 0 0 1
|
|
2429 2429 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1) 2 0 0 1
|
|
2430 2430 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1) 2 0 0 1
|
|
2431 2431 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1) 2 0 0 1
|
|
2432 2432 [a-f0-9]{32,64}\/[a-f0-9]{32,64}/\w$ 2 0 0 1
|
|
2433 2433 \?(s|page|id)=\d+$ 2 0 0 1
|
|
2434 2434 ^[\r\n\s\+]*[\r\n\s\+]*?(<func>[_a-zA-Z][a-zA-Z0-9_-]+)\([\r\n\s]*?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]*?[\x22\x27][\r\n\s]*?,[\r\n\s]*?[\x22\x27][^\x22\x27]+[\x22\x27][\r\n\s]*?\)\+(=func) 2 0 0 1
|
|
2435 2435 \/FlashPlayer\.cpl$ 2 0 0 1
|
|
2436 2436 ^((<\/applet>).)+?[\x22\x27]1337\.exe 2 0 0 1
|
|
2437 2437 filename=[a-z]{4}\.txt\x0D\x0A/H 2 0 0 1
|
|
2438 2438 &p=\d+\.\d+\.\d+\.\d+&j=\d+\.\d+\.\d+\.\d+&f=\d+\.\d+\.\d+\.\d+$ 2 0 0 1
|
|
2439 2439 ^[\r\n\s]*[\r\n\s]*?(<q>[\x22\x27])[a-f0-9]{9,16}\.(jar|zip)(=q) 2 0 0 1
|
|
2440 2440 ^\x2Fclicker\x2Ephp$ 2 0 0 1
|
|
2441 2441 ^(<var>.{1,10})\.\\_\\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\(\!\[\]\+\x22\x22\)\[(=var)\.\_\\_\]\+(=var)\.\\\$\_\+(=var)\.\_\_\+ 2 0 0 1
|
|
2442 2442 \?(s|page|id)=\d+&text=\d+$ 2 0 0 1
|
|
2443 2443 ^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)j51[a-f0-9]{21}\.jar(=q)\r?$/Hm 2 0 0 1
|
|
2444 2444 ^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)e51[a-f0-9]{21}\.exe(=q)\r?$/Hm 2 0 0 1
|
|
2445 2445 \/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$ 2 0 0 1
|
|
2446 2446 \/\{0,2}[A-Za-z0-9\+\/]+?voDc0RHa8NnZ$ 2 0 0 1
|
|
2447 2447 ^[^\x3b\r\n\x22\x27]+?[A-Za-z0-9\/\_\-]{60,}\.exe\? 2 0 0 1
|
|
2448 2448 ^[^\x3b\r\n\x22\x27]+?\.txt\?e=\d+(&[fh]=\d)? 2 0 0 1
|
|
2449 2449 ^[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?) 2 0 0 1
|
|
2450 2450 [a-z] 2 0 0 1
|
|
2451 2451 \.exe\?(e=)?\d+$ 2 0 0 1
|
|
2452 2452 \/j\d{2}\.php\?i= 2 0 0 1
|
|
2453 2453 \/\?whole=\d+$ 2 0 0 1
|
|
2454 2454 ^\/search\/[0-9]{64} 2 0 0 1
|
|
2455 2455 \/m1[1-6]\.jar$ 2 0 0 1
|
|
2456 2456 \/[0-9]{4}\.html$ 2 0 0 1
|
|
2457 2457 \/\d+\.pkg$ 2 0 0 1
|
|
2458 2458 \/j_[a-z0-9]+_(0422|1723|3544|5076)\.jar$ 2 0 0 1
|
|
2459 2459 \/[a-z0-9]{3}\.php\?[a-z]=[a-zA-Z0-9]{10}$ 2 0 0 1
|
|
2460 2460 amor\d{0,2}\.jar 2 0 0 1
|
|
2461 2461 [a-f] 2 0 0 1
|
|
2462 2462 =(3[0-9a]|2e)+3a313[3-9](3[0-9]){8}$ 2 0 0 1
|
|
2463 2463 (<m>[0-9a-f]{2})(<sep>[^0-9a-f])(<e>((=m))[0-9a-f]{2})(=sep)([0-9a-f]{2}(=sep)){7}(=e)(=sep)(=m)(=sep)[0-9a-f]{2}(=sep)(=e)(=sep)(<d>((=e))[0-9a-f]{2})(=sep)(=d)(=sep)(=e)(=sep)(=d) 2 0 0 1
|
|
2464 2464 ^[\r\n\s]*?\([\r\n\s]*?(<q>[\x22\x27])(<m>(((=q)).)+)(=q).+?<(=m)?a(=m)?p(=m)?p(=m)l(=m)?e(=m)?t 2 0 0 1
|
|
2465 2465 \/[a-f0-9]{32}\/[a-f0-9]{32}\.jar$ 2 0 0 1
|
|
2466 2466 ^\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$ 2 0 0 1
|
|
2467 2467 \.jar\?java=\d+$ 2 0 0 1
|
|
2468 2468 ^((<\/applet>).)+?\.jar\?java=\d+ 2 0 0 1
|
|
2469 2469 ^((<\/applet>).)+?[\x22\x27]aHR0cDov 2 0 0 1
|
|
2470 2470 ^[a-f0-9]{32}=\d{1,10}\r\n/H 2 0 0 1
|
|
2471 2471 \/1[34]\d{8}\.tpl$ 2 0 0 1
|
|
2472 2472 ^[\r\n\s]*?\([\r\n\s]*?[\x22\x27]f([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?m([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?C([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?h([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?a([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?c([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?d([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?e[\x22\x27] 2 0 0 1
|
|
2473 2473 ^\/\d{1,2}(<l>[A-Z])\d{1,2}(=l)\d{1,2}(=l)\d{1,2}\.pdf$ 2 0 0 1
|
|
2474 2474 \/java\.php\?eid=[a-f0-9]{32}& 2 0 0 1
|
|
2475 2475 \/pdf\.php\?pdf=[a-f0-9]{32}& 2 0 0 1
|
|
2476 2476 [&?]type=\d+($|&) 2 0 0 1
|
|
2477 2477 ^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{32,}\.html(\x3a\d{1,5})?\r$/Hm 2 0 0 1
|
|
2478 2478 ^\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?m\d+([\x22\x27]\s*?,\s*[\x22\x27])?C\d+([\x22\x27]\s*?,\s*[\x22\x27])?h\d+([\x22\x27]\s*?,\s*[\x22\x27])?a\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?c\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?d\d+([\x22\x27]\s*?,\s*[\x22\x27])?e\d+[\x22\x27] 2 0 0 1
|
|
2479 2479 \/13[89]\d{7}.swf$ 2 0 0 1
|
|
2480 2480 \/[a-z]+\.php\?[a-z]+\d{7}&[a-z]+\d{7,8}$ 2 0 0 1
|
|
2481 2481 ^(<sep>[^\x22\x27]{0,10})75(=sep)6e(=sep)63(=sep)74(=sep)69(=sep)6f(=sep)6e(=sep)20 2 0 0 1
|
|
2482 2482 ^\d+?\*\/\s*?(<vname>[^\s\(\x3b]{1,20})\s*?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)\s*?(\/\*\d+?\*\/\s*?)?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname) 2 0 0 1
|
|
2483 2483 [&?]v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)= 2 0 0 1
|
|
2484 2484 \/1(3[89]\d{7}|4\d{8})\.xap$ 2 0 0 1
|
|
2485 2485 &dr=\d+$ 2 0 0 1
|
|
2486 2486 &nrk=\d+$ 2 0 0 1
|
|
2487 2487 ^Content-Disposition\x3a[^\r\n]+(\W14\d{8})\.pdf\r?$/Hm 2 0 0 1
|
|
2488 2488 ^(((<\/iframe>).)+?src\s*\s*?\x22http\x3a[^\x22]+16\.html\x22)(((<\/iframe>).)+?left\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)(((<\/iframe>).)+?top\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)((<\/iframe>).)+?<\/iframe>\x27\x29 2 0 0 1
|
|
2489 2489 ^\s*?[A-Z0-9a-z\+]+?\s*?\x7d 2 0 0 1
|
|
2490 2490 ^((\/[a-z]+?)*?\/\d+\/)((\/\d+?)*?\/[a-z]+?\/)(\/([a-z]+|\d+)){4,}\/[a-z]+\.pack\.gz$ 2 0 0 1
|
|
2491 2491 ^\s*?\x28\s*?(<q>[\x22\x27])(((=q)).)+?(=q)\s*?\,\s*?[\x22\x27]container[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27],\s*?[\x22\x27]9\.0\.0[\x22\x27]\s*?,\s*?false\s*?,\s*?flashvars,\s*?params\s*?,\s*?attributes\s*?\x29\s*?\x3b\s*?<\/script>\s*?<\/head> 2 0 0 1
|
|
2492 2492 \/14\d{8}(\.swf)?$ 2 0 0 1
|
|
2493 2493 \/14\d{8}(\.pdf)?$ 2 0 0 1
|
|
2494 2494 ^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.exe/Hm 2 0 0 1
|
|
2495 2495 ^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.dll/Hm 2 0 0 1
|
|
2496 2496 \/14\d{8}(\/\d+)*?(\/x[a-f0-9]+[\x3b0-9]*)?$ 2 0 0 1
|
|
2497 2497 ^\s[^\r\n]*?[\x28\x5b]\s*?[\x22\x27][^\x22\x27]?s[^\x22\x27]?u[^\x22\x27]?b[^\x22\x27]?s[^\x22\x27]?t[^\x22\x27]?r[^\x22\x27]?[\x22\x27]\s*?[\x29\x5d]\s*?(\x5d\s*?)?\x28 2 0 0 1
|
|
2498 2498 \/video.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1
|
|
2499 2499 \/player.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1
|
|
2500 2500 \/search.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1
|
|
2501 2501 ^\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28(=var1)\s*\!\s*=\s*[\x27\x22][\x22\x27]\s*?\x29\s*?\{\s*?(<var2>[^\s\x3d]+)\s*\s*?(=var1)\s*?\[ 2 0 0 1
|
|
2502 2502 \/1\.php\?r$ 2 0 0 1
|
|
2503 2503 ^[^a-z]?\x65[^a-z]?\x6e[^a-z]?\x67[^a-z]?\x74[^a-z]?\x68 2 0 0 1
|
|
2504 2504 ^\s*?[\x22\x27](<char>[^\x22\x27]+)[\x22\x27]\.replace\x28\s*?[\x22\x27](=char)[\x22\x27]\s*?, 2 0 0 1
|
|
2505 2505 \/banner.php\?sid=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1
|
|
2506 2506 \/blog.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1
|
|
2507 2507 \/main\.html$ 2 0 0 1
|
|
2508 2508 \.php\?id=[0-9A-F]{44,54}&rnd=[0-9]{3,7}$ 2 0 0 1
|
|
2509 2509 ^\/tdstest\/[a-f0-9]{32,}\/?$ 2 0 0 1
|
|
2510 2510 \/content\/dl\.php\?sl=vbs[a-z0-9]{32}$ 2 0 0 1
|
|
2511 2511 \/content\/getvbslink\.php\?d=[a-z0-9]{32}$ 2 0 0 1
|
|
2512 2512 Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H 2 0 0 1
|
|
2513 2513 ^[a-z0-9]*\r\n/H 2 0 0 1
|
|
2514 2514 ^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22 2 0 0 1
|
|
2515 2515 ^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22 2 0 0 1
|
|
2516 2516 \/street[1-5]\.php$ 2 0 0 1
|
|
2517 2517 \/XV-\d+\.exe$ 2 0 0 1
|
|
2518 2518 \/bad\/[A-Z0-9]+\.swf$ 2 0 0 1
|
|
2519 2519 \/\d\/[A-Z]+\/[a-f0-9]{32}\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?$ 2 0 0 1
|
|
2520 2520 ^\s*?[^\x28\s]*?\x28\s*?(<a1>[^\s,\x29]+)\s*?,\s*?(<a2>[^\s,\x29]+)\s*?\x29\{[^\r\n]*?[\+=]String.fromCharCode\((=a2)\)[^\r\n]*?\} 2 0 0 1
|
|
2521 2521 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.jar\r\n/Hm 2 0 0 1
|
|
2522 2522 ^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D)) 2 0 0 1
|
|
2523 2523 \b[a-z]{2}\d+\s*\s*?Yes 2 0 0 1
|
|
2524 2524 ^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x20http\x3a\x2f 2 0 0 1
|
|
2525 2525 ^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?(\.[a-z]+)?$ 2 0 0 1
|
|
2526 2526 ^[^\r\n]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?/H 2 0 0 1
|
|
2527 2527 ^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x3ahttp\x3a\x2f 2 0 0 1
|
|
2528 2528 ^Referer\x3a[^\r\n]+\/4\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?$/Hm 2 0 0 1
|
|
2529 2529 ^\s*\s*?[\x22\x27]8\.8\.8\.8[\x22\x27] 2 0 0 1
|
|
2530 2530 ^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D)) 2 0 0 1
|
|
2531 2531 Host\x3a\x20([\x2eg-z]*[a-f0-9][\x2eg-z]*){32}\./H 2 0 0 1
|
|
2532 2532 \/e\.html$ 2 0 0 1
|
|
2533 2533 ^(<var>[a-f0-9]{6})-->\s*?<script\s*?type=[\x22\x27]text\/javascript[\x22\x27]\s*?src=[\x22\x27]http\x3a\x2f[^\x22\x27]*?\/[a-z\d]{8}\.php\?id=\d+[\x22\x27]\s*<\/script><!--\/(=var)--> 2 0 0 1
|
|
2534 2534 [&?]t=[a-f0-9]{32}(&|$) 2 0 0 1
|
|
2535 2535 \/5\/[A-Z]{3,}\/[a-f0-9]{32}(\.[^\x2f]+|\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?|\/\d+\/?)?$ 2 0 0 1
|
|
2536 2536 ^\s*?[_$]+\x28\x29 2 0 0 1
|
|
2537 2537 ^\s*?[_$]+\x28\x29 2 0 0 1
|
|
2538 2538 Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)[^\r\n]*?\/search\?q=([A-Z&=\d]*?[a-z])([a-zA-Z\d&=]*?[A-Za-z=&]\d[A-Za-z])([a-zA-Z\d&=]*?[a-z\d][A-Z][A-Za-z\d])[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+[&=A-Za-z0-9]*?\r\n.*?Host\x3a\x20(=refhost)/Hsi 2 0 0 1
|
|
2539 2539 ^\s*?\w+\s*?\.\s*?charCodeAt 2 0 0 1
|
|
2540 2540 ^\/\?[a-f0-9]{32,64}$ 2 0 0 1
|
|
2541 2541 ^[^>]*?id\s*[\x22\x27][a-z0-9]+[\x22\x27][^>]*\s*?[\x2a\d]{100} 2 0 0 1
|
|
2542 2542 Referer\x3a\x20http\x3a\x2f+(<dl1>[^\x2e\r\n]+)\x2e[^\x2f\r\n]*?(<dl2>\x2e[^\x2e\r\n\x2f]+\x2e[^\x2e\x2f\r\n]+)\x2f(\??[a-f0-9]{32,64}\/?)?\r\n.*?Host\x3a\x20((=dl1))[^\r\n]*?(=dl2)\r\n/Hsm 2 0 0 1
|
|
2543 2543 Referer\x3a\x20[^\r\n]*?\/[a-f0-9]{32,64}\.swf/H 2 0 0 1
|
|
2544 2544 \.php\?id=[0-9A-F]{32,}&rnd=\d+$ 2 0 0 1
|
|
2545 2545 ^((<\/div).)+?top\x3a\s*?\x2d[0-9]+px\x3b.+left\x3a\s*?\x2d[0-9]+px\x3b.+<iframe\x20.+?stack=\d+ 2 0 0 1
|
|
2546 2546 ^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)str2long(=sep)).+?(=sep)long2str(=sep) 2 0 0 1
|
|
2547 2547 ^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)str2long(=sep) 2 0 0 1
|
|
2548 2548 ^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)long2str(=sep) 2 0 0 1
|
|
2549 2549 ^([^>]*?\sname\s*?\x3d\s*?[\x22\x27]?movie[\x22\x27]?)[^>]*?\svalue\s*?\x3d\s*?[\x22\x27][^\x22\x27]+\/(\??[a-f0-9]+)?[\x22\x27] 2 0 0 1
|
|
2550 2550 ^Host\x3a[^\r\n]*?\.pw\r$/Hmi 2 0 0 1
|
|
2551 2551 ^Host\x3a\x20[a-z0-9]+\.(g[aq]|cf|ml|tk|xyz|info|space)(\x3a\d{1,5})?\r$/Hm 2 0 0 1
|
|
2552 2552 ^\s*[a-z]+\s*\s*?(<q1>[\x22\x27])(((=q1)).)+?(=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*\s*?(<q2>[\x22\x27])(((=q2)).)+?(=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr 2 0 0 1
|
|
2553 2553 ^(<ccode>[a-f0-9]{6})-->.*?<script.+?<\/script>.*--/(=ccode)--> 2 0 0 1
|
|
2554 2554 ^\/[a-z]{2,20}\/[a-z]{2,20}\/(((featur|quot)e|ip)s|d(ropdown|etect)|co(mpiled|re)|header|jquery|lang|min|ga)\.js$ 2 0 0 1
|
|
2555 2555 ^\s*?<script>\s*?([A-Za-z][A-Za-z\d+]+\s*?\+\s*([A-Za-z][A-Za-z\d]+|[\x22\x27]\\x[2-7][0-9a-fA-F](\\x[2-7][0-9a-fA-F]){0,4}[\x22\x27])\s*?\x3b){20} 2 0 0 1
|
|
2556 2556 ^\/js\/analytic\.php\?id=\d+&tz=\-?\d+&rs=\d+x\d+$ 2 0 0 1
|
|
2557 2557 ^[\x22\x27](<script)[\x22\x27+\s]*<[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[^\r\n]+\.php\?id=\d+&tz=\x27\+tzSignature\x28\x29\+\x27&rs= 2 0 0 1
|
|
2558 2558 ^\/promo\d+(x\d+)?\/promo\.swf\?t=\d+$ 2 0 0 1
|
|
2559 2559 Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H 2 0 0 1
|
|
2560 2560 ^\s*\x28\s*[\x22\x27]<div\s*style\s*=\s*[\x22\x27]([^\x22\x27\r\n]*position\x3aabsolute\x3b)([^\x22\x27\r\n]*top\x3a\s\-\d+px\x3b)([^\x22\x27\r\n]*left\x3a\s0px\x3b)[^\r\n]*?<iframe[^\r\n>]*\s><\/i[\x22\x27]\+[\x22\x27]frame>[^\r\n]*<\/div>[\x22\x27]\s*\x29\x3b$ 2 0 0 1
|
|
2561 2561 ^#?\d+ 2 0 0 1
|
|
2562 2562 ^#?\d+ 2 0 0 1
|
|
2563 2563 ^\s*var\s*(<var>[^\s=]+)\s*=\s*document.createElement\(\s*[\x22\x27]iframe[\x22\x27](.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b 2 0 0 1
|
|
2564 2564 ^\s*\([^\x29]*(\%2F|\/)(\%5B|\[)(\%5E|)([^\x29]*(%3C|\<))([^\x29]*(%3E|\>))([^\x29]*(\%5C|\\)(\%6E|n)) 2 0 0 1
|
|
2565 2565 ^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27] 2 0 0 1
|
|
2566 2566 ^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Chrome_Font\.exe/Hmi 2 0 0 1
|
|
2567 2567 ^[^\x2f\x22\x27]+\/([^\x22\x27]*?[?&]oq=[A-Za-z0-9+\x2f_-]+([\x22\x27]|&))([^\x22\x27]*?[&?][a-z]+_[a-z]+=\d+)([^\x22\x27]*?[&?]q=) 2 0 0 1
|
|
2568 2568 ^\s*=\s*[\x27\x22](sh(ell(32)?)?|exec)=6wLrBej5\x2f\x2f 2 0 0 1
|
|
2569 2569 (value=[\x22\x27](sh(ell(32)?)?|exec)=|unescape\(EscapeHexString\(.)EB02EB05E8F9FFFFFF 2 0 0 1
|
|
2570 2570 ^\s*=\s*[\x22\x27][Hh][Tt][Tt][Pp][Ss]?\x3a\x2f\x2f[^\x2f]+\x2f([^\x2f\x22\x27]+=[^\x2f\x22\x27&]{0,5}QMvXcJ)[^\x2f\x22\x27]{90} 2 0 0 1
|
|
2571 2571 ^(rocket|java)script\x22>\s*var\s*(<ifr>[^\s=]+)\s*=\s*[\x22\x27]iframe[\x22\x27].*?\s*var\s*(<var>[^\s=]+)\s*=\s*document\.createElement\(\s*(=ifr)(.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b 2 0 0 1
|
|
2572 2572 ^[a-z]\d{3}\(new Array\( 2 0 0 1
|
|
2573 2573 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27]iddqd?\s*= 2 0 0 1
|
|
2574 2574 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=]*\s*=EB02EB05E8F9FFFFFF 2 0 0 1
|
|
2575 2575 ^[a-zA-Z0-9]{4}NzgzNDI[a-zA-Z0-9]{8}=\x22 2 0 0 1
|
|
2576 2576 ^\d{1,2}\.php$ 2 0 0 1
|
|
2577 2577 &b=[a-f0-9]{7}&k=[a-f0-9]{32} 2 0 0 1
|
|
2578 2578 ^\/[a-z]+\/$ 2 0 0 1
|
|
2579 2579 ^\/[a-z]+\/$ 2 0 0 1
|
|
2580 2580 ^GET\s*?\/stat\/load((?-i)[a-z0-9]*?[A-Z])((?-i)[A-Z0-9]*?[a-z])(<hname>[a-z0-9]+)\.php\s.+?Host\x3a\x20(=hname)\. 2 0 0 1
|
|
2581 2581 ^[0-9a-fA-F]{25}$ 2 0 0 1
|
|
2582 2582 ^[-_\w]+$ 2 0 0 1
|
|
2583 2583 \/[a-z]{2}[0-9]{3}[a-z]{2}\/LoginFacebook\.php$ 2 0 0 1
|
|
2584 2584 ^\d+$ 2 0 0 1
|
|
2585 2585 \x2Fgetfile\x2Ephp\x3Fi\x3D[0-9]\x26key\x3D[a-f0-9]{32}$ 2 0 0 1
|
|
2586 2586 ^\/[a-z]{15}[0-9]\.php$ 2 0 0 1
|
|
2587 2587 ^\d$ 2 0 0 1
|
|
2588 2588 \/\?[a-f0-9]{32}=[^&]+&[a-f0-9]{32}=[^&]+$ 2 0 0 1
|
|
2589 2589 ^\/\d{5}$ 2 0 0 1
|
|
2590 2590 \/[0-9]{2}\.html$ 2 0 0 1
|
|
2591 2591 \.php\?[a-z]=.{2}KAhFXlx9.{2}Oj[^&]+$ 2 0 0 1
|
|
2592 2592 \x2F[0-9]{3}\.pdf$ 2 0 0 1
|
|
2593 2593 ^\d{1,2}=[a-zA-Z0-9+=]{100} 2 0 0 1
|
|
2594 2594 ^\/[a-z]\.jar$ 2 0 0 1
|
|
2595 2595 \/[a-f0-9]+\.zip$ 2 0 0 1
|
|
2596 2596 ^\/\d{2,}\.[a-z0-9]+$ 2 0 0 1
|
|
2597 2597 ^\/\?[a-f0-9]{32}$ 2 0 0 1
|
|
2598 2598 \/(java(db|im|rh)|silver|flash|msie)\.php\?id= 2 0 0 1
|
|
2599 2599 ^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}\r\n<script>(var [a-zA-Z0-9]{1,20}\x3b){1,20}[a-zA-Z0-9]{1,20}\s* 2 0 0 1
|
|
2600 2600 ^Host\x3a\x20[^\.\r\n]+?\.[a-z]{2,4}\r\n 2 0 0 1
|
|
2601 2601 \/\??[a-f0-9]{60,}\x3b1\d{5}\x3b\d{1,3}$ 2 0 0 1
|
|
2602 2602 \/\??[a-f0-9]{60,}\x3b5[0-1]\d{5}$ 2 0 0 1
|
|
2603 2603 ^\/[^\x2f]+?\/\??[a-f0-9]{60,66}(\x3b\d+){1,4}$ 2 0 0 1
|
|
2604 2604 (\/[A-Z][a-z][A-Z][a-z][A-Z][a-z]|(b(m(nw|wn)|n(mw|wm)|w(mn|nm))|m(b(nw|wn)|n(bw|wb)|w(bn|nb))|n(b(mw|wm)|m(bw|wb)|w(bm|mb))|w(b(mn|nm)|m(bn|nb)|n(bm|mb))))\.jar$ 2 0 0 1
|
|
2605 2605 ^\/index\.php\?[A-Za-z0-9_-]{15}=l3S 2 0 0 1
|
|
2606 2606 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.swf\r\n 2 0 0 1
|
|
2607 2607 ^\/\?[A-Za-z0-9_-]{15}=l3S 2 0 0 1
|
|
2608 2608 \x20filename=\r\n(\r\n)?$ 2 0 0 1
|
|
2609 2609 PK\x01\x02.{42}(<dir>[a-z]{7,}\/)([a-z]+\.class)?(\xfe\xca\x00\x00)?(PK\x01\x02.{42}(=dir)[a-z]+\.class){6,}(PK\x01\x02.{42}[0-9a-z]{5,}(\.[a-z]{3})?)K\x05\x06.{18}$ 2 0 0 1
|
|
2610 2610 ^\/index\.php\?[A-Za-z0-9_-]{15}=l3S 2 0 0 1
|
|
2611 2611 \w_\.jar\?[a-f0-9]{8}$ 2 0 0 1
|
|
2612 2612 ^\d+[\r\n\x2f] 2 0 0 1
|
|
2613 2613 ^\d+[\r\n\x2f] 2 0 0 1
|
|
2614 2614 ^\d+[\r\n\x2f] 2 0 0 1
|
|
2615 2615 ^\d+[\r\n\x2f] 2 0 0 1
|
|
2616 2616 ^\d+[\r\n\x2f] 2 0 0 1
|
|
2617 2617 ^\d+[\r\n\x2f] 2 0 0 1
|
|
2618 2618 ^\d+[\r\n\x2f] 2 0 0 1
|
|
2619 2619 ^\d+[\r\n\x2f] 2 0 0 1
|
|
2620 2620 ^\d+[\r\n\x2f] 2 0 0 1
|
|
2621 2621 ^\d+[\r\n\x2f] 2 0 0 1
|
|
2622 2622 Content-Disposition\x3a[^\r\n]+\.exe-rc4\.exe\r\n 2 0 0 1
|
|
2623 2623 ^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/[a-zA-Z0-9]{12}\.php(\?[^&=]+=([a-zA-Z0-9]{8}|0(189|037)|flash|2(551|419)|6332))?$ 2 0 0 1
|
|
2624 2624 ^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/test\.mp3$ 2 0 0 1
|
|
2625 2625 ^\/\d{9,10}\/\d{4,5}$ 2 0 0 1
|
|
2626 2626 \/index\.html\?p=\d+$ 2 0 0 1
|
|
2627 2627 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?[a-f0-9] 2 0 0 1
|
|
2628 2628 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a/Hmi 2 0 0 1
|
|
2629 2629 ^(<split>.{1,10})2f(=split)64(=split)69(=split)76(=split)3e(=split)?[^\x22\x27]*[\x22\x27]\.replace\s*\(\s*[\x22\x27]?\/(=split)\/g[\x22\x27]?\s*,\s*[\x22\x27]\x25[\x22\x27]\s*\x29\s*\x3b 2 0 0 1
|
|
2630 2630 ^\s*=\s*[\x22\x27]?(10|127|172\.(1[6-9]|2[0-9]|3[01])|192\.168)\. 2 0 0 1
|
|
2631 2631 \.php\?hash=I3QxW[A-Za-z0-9\+\/]+={0,2}$ 2 0 0 1
|
|
2632 2632 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\/[a-zA-Z0-9\/\-\_]{60,}\/[a-zA-Z0-9]+\.exe\?[a-zA-Z0-9]+=[a-zA-Z0-9]+(&h=\d+)?[\x22\x27] 2 0 0 1
|
|
2633 2633 ^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27] 2 0 0 1
|
|
2634 2634 ^\s*type\s*=\s*[\x22\x27]\s*text\/javascript\s*[\x22\x27]\s*>\s+var\s*(<timestamp>[A-Za-z0-9]{1,25})\s*=\s*\(new\sDate\(\)\)\.getTime\(\)\;\s+(<url>[A-Za-z0-9]{1,25})\s*=\s*[\x22\x27]\s*[^\r\n]+\.php\?JBOSSESSION=\s*[\x22\x27]\s+(<urlvar2>[A-Za-z0-9]{1,25})\s*=\s*(=url)\s*\+\s*(=timestamp)\s+window\.location\.href\s*=\s*(=urlvar2)\s+ 2 0 0 1
|
|
2635 2635 ^\s*[\x22\x27][^\r\n]+\/[a-z0-9]{20,40}\.js[\x22\x27]\s*>\s*<\/script>\s*<\/body> 2 0 0 1
|
|
2636 2636 ^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html 2 0 0 1
|
|
2637 2637 ^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html 2 0 0 1
|
|
2638 2638 ^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html 2 0 0 1
|
|
2639 2639 ^http\:\/\/[^\r\n\x2f]+\/\?s=[a-f0-9]{32}[a-z]{2}$ 2 0 0 1
|
|
2640 2640 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
2641 2641 ^(<vars>[a-z0-9]{1,20})\s*=\s*new\s*Array\x3b\r\n((=vars)\[\d{1,3}\]\s*=\s*\d{4,12}\x3b\r\n){5,40} 2 0 0 1
|
|
2642 2642 ^\/([\/_]*?[a-f0-9][\/_]*?){64}$ 2 0 0 1
|
|
2643 2643 src\s*=\s*https?\x3A\x2f+[^\x2f]*?((((static)?flick|blogge)r|p(hotobucket|icasa)|wordpress|tinypic)\.com|im(g(\.youtube|ur)\.com|ageshack\.us)|upload\.wikimedia\.org)[^\x2f] 2 0 0 1
|
|
2644 2644 ^[a-f0-9]{32}$ 2 0 0 1
|
|
2645 2645 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/ 2 0 0 1
|
|
2646 2646 [=\"]\w{8}\.jar 2 0 0 1
|
|
2647 2647 ^[a-z]{2}\. 2 0 0 1
|
|
2648 2648 \/jdb\/[^\/]+\.class$ 2 0 0 1
|
|
2649 2649 \/lib\/adobe\.php\?id=[a-f0-9]{32}$ 2 0 0 1
|
|
2650 2650 \/i.php?token=[a-z0-9]+$ 2 0 0 1
|
|
2651 2651 \x2Fjerk\x2Ecgi\x3F[0-9]$ 2 0 0 1
|
|
2652 2652 ^(\?[^=]{1,10}=[^&\r\n]{100,})?$ 2 0 0 1
|
|
2653 2653 \.php\?e=[^&]+?$ 2 0 0 1
|
|
2654 2654 \.txt\?e=\d+(&[fh]=\d+)?$ 2 0 0 1
|
|
2655 2655 ^\x2F\x3Fwps\x3D[0-9]$ 2 0 0 1
|
|
2656 2656 ^[^\r\n]+\/[A-Fa-f0-9]+\.js\?cp= 2 0 0 1
|
|
2657 2657 ^\/[a-z0-9]{1,4}\.jnlp$ 2 0 0 1
|
|
2658 2658 \.php\?id=[a-f0-9]{32}$ 2 0 0 1
|
|
2659 2659 ^\/[a-f0-9]{32}\/[a-f0-9]{32}\.swf$ 2 0 0 1
|
|
2660 2660 \.php\?[^=]+=([^&]?[a-z0-9]{2}){5}&[^=]+=([^&]?[a-z0-9]{2}){10}& 2 0 0 1
|
|
2661 2661 \/[A-F0-9]{8}\.js\?cp= 2 0 0 1
|
|
2662 2662 ^\/[a-z0-9]+[0-9][a-z0-9]+\/\?\d$ 2 0 0 1
|
|
2663 2663 \.exe(\?[a-zA-Z0-9]+=[a-zA-Z0-9]+)?&h=\d+$ 2 0 0 1
|
|
2664 2664 ^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$ 2 0 0 1
|
|
2665 2665 ^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$ 2 0 0 1
|
|
2666 2666 \/\d{6}\.mp3$ 2 0 0 1
|
|
2667 2667 \/14\d{8}(\.xap)?$ 2 0 0 1
|
|
2668 2668 \.swf\?myid=[a-zA-Z0-9]+$ 2 0 0 1
|
|
2669 2669 \.php\?rnd=[0-9]{3,7}&id=[0-9A-F]{44,54}$ 2 0 0 1
|
|
2670 2670 \/(Flash[23]?|Ink|New|One|HQ).exe$ 2 0 0 1
|
|
2671 2671 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.xap\r\n 2 0 0 1
|
|
2672 2672 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?[^\r\n]*?\/(index.html)?\r\n.*?\r\nHost\x3a\x20(=refhost)[\x3a\r] 2 0 0 1
|
|
2673 2673 \/\d{2,}\.xap$ 2 0 0 1
|
|
2674 2674 \.php\?rnd=\d+&id=[0-9A-F]{32,}$ 2 0 0 1
|
|
2675 2675 \/\?keyword=(([a-f]{0,31}[0-9])([0-9]{0,31}[a-f])[a-f0-9]{32}|\d{5})$ 2 0 0 1
|
|
2676 2676 ^\/(.*?[&?][a-z]{2}_[a-z]{2}=\d+(&))(.*?[&?]q=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&))(.*?[&?]oq=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&)).*?[&?][a-z]{3}=[A-Za-z_]{3,20}([a-z\d]*\x2e)([a-z\x2e]*\d)[a-z\d\x2e]+(&|$) 2 0 0 1
|
|
2677 2677 ^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Font_Update\.exe 2 0 0 1
|
|
2678 2678 ^\s*[\x22\x27]\s*http[^\x22\x27]+\.php\s*[\x22\x27]\s*\x2c\s*[\x22\x27]\s*uylzJB3mWrFjellI9iDFGQjO 2 0 0 1
|
|
2679 2679 =[a-f0-9]{32,}(&|$) 2 0 0 1
|
|
2680 2680 \&e=(cve|flash) 2 0 0 1
|
|
2681 2681 ^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.htm$ 2 0 0 1
|
|
2682 2682 ^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.swf$ 2 0 0 1
|
|
2683 2683 ^(0x[a-f0-9]{1,2}, ){500} 2 0 0 1
|
|
2684 2684 ^[0-9_,{AbZwP&-]{2000} 2 0 0 1
|
|
2685 2685 ^[A-F0-9]+ 2 0 0 1
|
|
2686 2686 ^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_ 2 0 0 1
|
|
2687 2687 ^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_ 2 0 0 1
|
|
2688 2688 ^[a-z0-9]{13}\.[a-z]{3}$ 2 0 0 1
|
|
2689 2689 ^\d+$ 2 0 0 1
|
|
2690 2690 Host\x3a\x20(<refhost>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f(=refhost)(\x3a\d{1,5})?\/? 2 0 0 1
|
|
2691 2691 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\r$|\x3a) 2 0 0 1
|
|
2692 2692 ^\/[a-z]{3,20}\.php\?sid=[A-F0-9]{40,200}$ 2 0 0 1
|
|
2693 2693 ^\/[a-z]{3,20}\.php\?id=4[A-F0-9]{39,200}$ 2 0 0 1
|
|
2694 2694 ^\/\?o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+$ 2 0 0 1
|
|
2695 2695 (.*?[?&]oq=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&)).*?[?&]q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$) 2 0 0 1
|
|
2696 2696 (.*[^&]{3,4}QMvXcJ).*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&.*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$) 2 0 0 1
|
|
2697 2697 ^[HX3][^&]Q[cdM][^&]{3}[ab]R 2 0 0 1
|
|
2698 2698 ^\/\?[a-f0-9]{114}$ 2 0 0 1
|
|
2699 2699 Date\x3a\x20(<dstring>[^\r\n]+)\r\n.*?Last-Modified\x3a\x20(=dstring)\r\n 2 0 0 1
|
|
2700 2700 ^\/[a-f0-9]{16}$ 2 0 0 1
|
|
2701 2701 ^GET (<uri>(\/[A-Za-z0-9]+)?\/\d+\/\d+)\sHTTP\/1\.1\r\nUser-Agent\x3a\x20http\x3a\/\/(<host>[^\r\n]+)(=uri)\r\nHost\x3a\x20(=host)\r\n(\r\n)?$ 2 0 0 1
|
|
2702 2702 ^Referer\x3a[^\r\n]+?\/[a-z0-9A-Z\_\-]{26,}\.html(\x3a\d{1,5})?\r$ 2 0 0 1
|
|
2703 2703 \/3\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+|\/\d+\.\d+\.\d+\.\d+\/?)?$ 2 0 0 1
|
|
2704 2704 ^\/([A-Za-z_-]*?\d)([a-z0-9_-]*?[A-Z])([A-Za-z0-9_-]{4}){15,}([[A-Za-z0-9_-]{2}\x2e?\x2e|[A-Za-z0-9_-]{3}\x2e)$ 2 0 0 1
|
|
2705 2705 ^\d$ 2 0 0 1
|
|
2706 2706 ^[A-F0-9]{16}\x22> 2 0 0 1
|
|
2707 2707 ^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-zA-Z0-9]{16}\/[a-f0-9]{40}\/[a-zA-Z0-9]+\.jpg$ 2 0 0 1
|
|
2708 2708 ^[A-F0-9]{16}(&|&\x3b)id=\d+(&|&\x3b)gid=[A-F0-9\-]+\x22> 2 0 0 1
|
|
2709 2709 ^[^>]*?\> 2 0 0 1
|
|
2710 2710 ^-?\d+=([a-zA-Z0-9]|%[A-F0-9]{2}){2}(<var1>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){6}(<var2>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){2}(=var2)([a-zA-Z0-9]|%[A-F0-9]{2}){4}(=var1)/P 2 0 0 1
|
|
2711 2711 ^\s*?[\x22\x27]([A-Z]{0,19}[a-z]{1,19}[A-Z])[a-zA-Z]{14,20}[\x22\x27][^<>]*([A-Za-z]{0,99}\d)[A-Za-z0-9\x20]{100} 2 0 0 1
|
|
2712 2712 ^\s*?(<var1>[^\x29]+)\x29[^\n]*\s*?(=var1)\s*?\x7c{2}\s*?\d+?\s*?\x2c 2 0 0 1
|
|
2713 2713 ^\s+\d{1,2}\x3b\s+else\s+(<var>[a-z]+)\s+\-=\s+\d{1,2}\x3b\s+return\s+[a-z]+\.charAt\x28(=var)\/\d{1,2}\x29\x7d 2 0 0 1
|
|
2714 2714 ^[a-z0-9_-]+\.([0-9_-]*[A-Z])[A-Z0-9_-]+\.[^\x22]+\x22\s 2 0 0 1
|
|
2715 2715 ^[a-z]{10}\.[a-z]{3}\r?$/Hm 2 0 0 1
|
|
2716 2716 Last-Modified\x3a Mon, ((0[29]|16|23|30))\d{2} Jul 2001/H 2 0 0 1
|
|
2717 2717 ^\d+\x3b 2 0 0 1
|
|
2718 2718 ^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500} 2 0 0 1
|
|
2719 2719 ^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f 2 0 0 1
|
|
2720 2720 ^[^\x27]+[\x27]\s* 2 0 0 1
|
|
2721 2721 ^\d+\x3b 2 0 0 1
|
|
2722 2722 ^([A-Z0-9]*?[a-z])([a-z0-9]*?[A-Z])[A-Za-z0-9]+\x2a\x2f[^\n]*?Function\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28\s*?(=var1)\s*[=!]{2}\s*?[\x27\x22][\x22\x27]\s*?\x29\s*?\{ 2 0 0 1
|
|
2723 2723 ^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500} 2 0 0 1
|
|
2724 2724 ^\s*\x27[^\x27\x3b\r\n]+\x27width=\x27250\x27\sheight=\x27250\x27\> 2 0 0 1
|
|
2725 2725 ^[^A-Za-z0-9] 2 0 0 1
|
|
2726 2726 ^http\x3a\x2f[^\x27]+[\x27](\swidth=\d{1,2}\sheight=\d{1,2}\s|\sheight=\d{1,2}\swidth=\d{1,2}\s) 2 0 0 1
|
|
2727 2727 ^\s*\(\s*[\x22\x27]id[\x22\x27]\s*,\s*?(<var>[^,\x29\s\x3b]+)\s*\x29.*?\.appendChild\s*\(\s*(=var) 2 0 0 1
|
|
2728 2728 ^[^<]+\x0d\x0a<\/script> 2 0 0 1
|
|
2729 2729 \?src=[a-z]+snet$ 2 0 0 1
|
|
2730 2730 ^[0-9a-f]{6} 2 0 0 1
|
|
2731 2731 ^(\x20id=\x22\d+\x22)?\x20style=\x22([^\x22\r\n]*top\x3a\x20-\d{3}px\x3b)([^\x22\r\n]*left\x3a-\d{3}px\x3b)([^\x22\r\n]*position\x3a\x20absolute\x3b)[^\x22\r\n]*\x22>\x20<iframe[^\r\n>]*><\x2f 2 0 0 1
|
|
2732 2732 ^(\s+style=\x27hidden\x27)?\s+src=\x27https?\x3a[^>\x22\x27]+[\x22\x27]\s*width=\x270\x27\s+ 2 0 0 1
|
|
2733 2733 (NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp) 2 0 0 1
|
|
2734 2734 ^[^\d](.{0,20}[^\d])?100[^\d](.{0,20}[^\d])?101[^\d](.{0,20}[^\d])?102[^\d](.{0,20}[^\d])?97[^\d](.{0,20}[^\d])?117[^\d](.{1,20}[^\d])?108[^\d](.{0,20}[^\d])?116[^\d](.{0,20}[^\d])?35[^\d]([^\d].{0,20}[^\d])?86[^\d](.{0,20}[^\d])?77[^\d](.{0,20}[^\d])?76[^\d] 2 0 0 1
|
|
2735 2735 ^(<sep>((\.\\_\\+).){1,10})\.\\_\\+(=sep)\.___\+(=sep)\.\\\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\_\\_\+(=sep)\.\_\\\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\\+(=sep)\.\_\_\$ 2 0 0 1
|
|
2736 2736 ^[\r\n\s]*[\r\n\s]*?(-[\r\n\s]*?\d|0[\r\n\s]*?-) 2 0 0 1
|
|
2737 2737 SELECT.+FROM 2 0 0 1
|
|
2738 2738 DELETE.+FROM 2 0 0 1
|
|
2739 2739 INSERT.+INTO 2 0 0 1
|
|
2740 2740 UPDATE.+SET 2 0 0 1
|
|
2741 2741 UNION.+SELECT 2 0 0 1
|
|
2742 2742 INTO.+OUTFILE 2 0 0 1
|
|
2743 2743 ^SITE\s+EXEC\s[^\n]*?%[^\n]*?% 2 0 0 1
|
|
2744 2744 ^PASS\s[^\n]{100} 2 0 0 1
|
|
2745 2745 ^MKD\s[^\n]{100} 2 0 0 1
|
|
2746 2746 ^REST\s[^\n]{100} 2 0 0 1
|
|
2747 2747 ^DELE\s[^\n]{100} 2 0 0 1
|
|
2748 2748 ^RMD\s[^\n]{100} 2 0 0 1
|
|
2749 2749 ^RMDIR\s[^\n]{100} 2 0 0 1
|
|
2750 2750 ^SITE\s+NEWER\s[^\n]{100} 2 0 0 1
|
|
2751 2751 ^SITE\s+ZIPCHK\s[^\n]{100} 2 0 0 1
|
|
2752 2752 ^USER\s+w0rm 2 0 0 1
|
|
2753 2753 ^ALLO\s[^\n]{100} 2 0 0 1
|
|
2754 2754 ^CEL\s[^\n]{100} 2 0 0 1
|
|
2755 2755 ^CMD\s[^\n]{100} 2 0 0 1
|
|
2756 2756 ^CWD\s[^\n]{100} 2 0 0 1
|
|
2757 2757 ^SITE\s+CPWD\s[^\n]{100} 2 0 0 1
|
|
2758 2758 ^SITE\s+NEWER 2 0 0 1
|
|
2759 2759 ^STAT\s+[^\n]*\x3f 2 0 0 1
|
|
2760 2760 ^APPE\s[^\n]{100} 2 0 0 1
|
|
2761 2761 ^CWD\s+~ 2 0 0 1
|
|
2762 2762 ^MODE\s+[^ABSC]{1} 2 0 0 1
|
|
2763 2763 ^SITE\s[^\n]{100} 2 0 0 1
|
|
2764 2764 ^SITE\s+CHOWN\s[^\n]{100} 2 0 0 1
|
|
2765 2765 ^SITE\s+EXEC 2 0 0 1
|
|
2766 2766 ^XCWD\s[^\n]{100} 2 0 0 1
|
|
2767 2767 ^STOR\s[^\n]{100} 2 0 0 1
|
|
2768 2768 ^SITE\s+CHMOD\s[^\n]{100} 2 0 0 1
|
|
2769 2769 ^LIST\s[^\n]{100,} 2 0 0 1
|
|
2770 2770 ^RENAME\s[^\n]*?%[^\n]*?% 2 0 0 1
|
|
2771 2771 ^MKDIR\s[^\n]*?%[^\n]*?% 2 0 0 1
|
|
2772 2772 ^PASS\s[^\n]*?%[^\n]*?% 2 0 0 1
|
|
2773 2773 ^USER\s[^\n]*?%[^\n]*?% 2 0 0 1
|
|
2774 2774 ^MDTM\s[^\n]{100} 2 0 0 1
|
|
2775 2775 ^RETR\s[^\n]*?%[^\n]*?% 2 0 0 1
|
|
2776 2776 ^CWD\s[^\n]*?\.\.\. 2 0 0 1
|
|
2777 2777 ^CWD\s+~root 2 0 0 1
|
|
2778 2778 ^NLST\s[^\n]{100} 2 0 0 1
|
|
2779 2779 ^PORT 2 0 0 1
|
|
2780 2780 REST\s+[0-9]+\n 2 0 0 1
|
|
2781 2781 ^RETR\s[^\n]{100} 2 0 0 1
|
|
2782 2782 ^RNFR\s[^\n]{100} 2 0 0 1
|
|
2783 2783 ^RNTO\s[^\n]{100} 2 0 0 1
|
|
2784 2784 ^STAT\s[^\n]{100} 2 0 0 1
|
|
2785 2785 ^STOU\s[^\n]{100} 2 0 0 1
|
|
2786 2786 ^XMKD\s[^\n]{100} 2 0 0 1
|
|
2787 2787 \s+.*?%.*?% 2 0 0 1
|
|
2788 2788 ^530\s+(Login|User) 2 0 0 1
|
|
2789 2789 ^PASS\s*\n 2 0 0 1
|
|
2790 2790 ^LIST\s+\x22-W\s+\d 2 0 0 1
|
|
2791 2791 ^USER\x20[^\x00\x20\x0a\x0d]{100} 2 0 0 1
|
|
2792 2792 ^STAT\s+[^\n]*\x2a 2 0 0 1
|
|
2793 2793 ^MDTM \d+[-+]\D 2 0 0 1
|
|
2794 2794 ^[^\r\n]+\.jar 2 0 0 1
|
|
2795 2795 ^\d\.\d(_\d+)?\@\r\n 2 0 0 1
|
|
2796 2796 \x5csecure\x5c[^\x00]{50} 2 0 0 1
|
|
2797 2797 \x5C[^\x5C\x00]{257} 2 0 0 1
|
|
2798 2798 ^\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[x])|c(rt|[ho]m|li|pl|md|pp)|d(iz|ll)|e(m[fl]|xe|bs)|h(lp|sq|ta)|jse?|m(d[abzew]|s[tcgip]|htm|ht)|p(cd|if|l[xsc]|[lm]|ot)|r(eg|ar)|s(cr|ct|[hy]s|wf)|v(b[es]?|xd)|w(m[dfsz]|p[msz]|s[cfh])|xl[tw]|folder|fol|ba[st]|i(sp|n[sif])|lnk|nws|ocx|zip|url)[\x27\x22\n\r\s] 2 0 0 1
|
|
2799 2799 (a|#61)(p|#70)(p|#70)(l|#6C)(i|#69)(c|#63)(a|#61)(t|#74)(i|#69)(o|#6F)(n|#6E)(\x2F|#2F)x-shockwave-flash 2 0 0 1
|
|
2800 2800 ^[^\r\n]*[\[\|\{][A-Z]{3}[\]\|\}] 2 0 0 1
|
|
2801 2801 ^[^\r\n]*win 2 0 0 1
|
|
2802 2802 ^[^\r\n]*-PC 2 0 0 1
|
|
2803 2803 ^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl) 2 0 0 1
|
|
2804 2804 ^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl) 2 0 0 1
|
|
2805 2805 ^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb) 2 0 0 1
|
|
2806 2806 ^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb) 2 0 0 1
|
|
2807 2807 ^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3) 2 0 0 1
|
|
2808 2808 ^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3) 2 0 0 1
|
|
2809 2809 User-Agent\x3a.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi 2 0 0 1
|
|
2810 2810 User-Agent\:.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi 2 0 0 1
|
|
2811 2811 ^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}B[\x0d\x0a]{0,2}0[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}t[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}u[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}3[\x0d\x0a]{0,2}M[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}x[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}T[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}q[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}N[\x0d\x0a]{0,2}0 2 0 0 1
|
|
2812 2812 ^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}Q[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}1[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}5[\x0d\x0a]{0,2}n[\x0d\x0a]{0,2}c[\x0d\x0a]{0,2}y[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}P[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}3 2 0 0 1
|
|
2813 2813 ^[A-Za-z0-9\/\+\x0D\x0A]+?B[\x0d\x0a]{0,2}w[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}C[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}z[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}s[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}U[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}j[\x0d\x0a]{0,2}d 2 0 0 1
|
|
2814 2814 \d*?\.bin 2 0 0 1
|
|
2815 2815 ^[^\r\n]*(W(in(dows)?)?[^a-z0-9]?(XP|[7-8])|Vista) 2 0 0 1
|
|
2816 2816 ^\d+/V 2 0 0 1
|
|
2817 2817 ^\s*,\s*[a-zA-Z]\x3a[\x2f\x5c] 2 0 0 1
|
|
2818 2818 ^((PK).)*?\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00 2 0 0 1
|
|
2819 2819 (UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH) 2 0 0 1
|
|
2820 2820 U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud 2 0 0 1
|
|
2821 2821 U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud 2 0 0 1
|
|
2822 2822 U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud 2 0 0 1
|
|
2823 2823 (UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH) 2 0 0 1
|
|
2824 2824 (UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH) 2 0 0 1
|
|
2825 2825 \bshell\b 2 0 0 1
|
|
2826 2826 \benable\b 2 0 0 1
|
|
2827 2827 ^[^\r\n]+\.(t(ar|gz)|exe|zip) 2 0 0 1
|
|
2828 2828 ^([\x7f-\xff]){100}/Hi 2 0 0 1
|
|
2829 2829 ^((<\/script>).)*?src\s*=\s*\x5c?[\x22\x27]https?\x3a\/\/(www\.)?pastebin\.com\/raw(\/|\.php\?i=)[A-Z-a-z0-9]{8}[\x22\x27] 2 0 0 1
|
|
2830 2830 ^.{42}[\x20-\x7f]{1,500}\.jsPK\x05\x06.{4}\x01\x00\x01\x00 2 0 0 1
|
|
2831 2831 \/[0-9]{1,2}\.dat$ 2 0 0 1
|
|
2832 2832 \.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$ 2 0 0 1
|
|
2833 2833 \.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$ 2 0 0 1
|
|
2834 2834 \.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or 2 0 0 1
|
|
2835 2835 ))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$ 2 0 0 1
|
|
2836 2836 \.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or 2 0 0 1
|
|
2837 2837 ))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$ 2 0 0 1
|
|
2838 2838 \.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils 2 0 0 1
|
|
2839 2839 .in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$ 2 0 0 1
|
|
2840 2840 \.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils 2 0 0 1
|
|
2841 2841 .in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$ 2 0 0 1
|
|
2842 2842 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1
|
|
2843 2843 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1
|
|
2844 2844 Content-Disposition\x3a[^\r\n]*?\.xla[\s\x22\x27] 2 0 0 1
|
|
2845 2845 \.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)(\x3a\d{1,5})?$ 2 0 0 1
|
|
2846 2846 ^[\d\s] 2 0 0 1
|
|
2847 2847 ^USER [^\r\n]*?\x22 2 0 0 1
|
|
2848 2848 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
2849 2849 ^(\x3a\d{1,5})?$ 2 0 0 1
|
|
2850 2850 \.(gif|jpe?g|png)$ 2 0 0 1
|
|
2851 2851 ^((jp|pn)g|bmp) 2 0 0 1
|
|
2852 2852 ^(logins|c(cdata|ookie)) 2 0 0 1
|
|
2853 2853 ^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1
|
|
2854 2854 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
2855 2855 \/winhost(32|64)\.(exe|pack)$ 2 0 0 1
|
|
2856 2856 \/pony\.(exe|pack)$ 2 0 0 1
|
|
2857 2857 ^[^>]+url=sms\x3a 2 0 0 1
|
|
2858 2858 \/[^\x2f]+\.[^\x2f]+\.wsf$ 2 0 0 1
|
|
2859 2859 ^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4}) 2 0 0 1
|
|
2860 2860 ^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4}) 2 0 0 1
|
|
2861 2861 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
|
|
2862 2862 ^[^\r\n]+\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz) 2 0 0 1
|
|
2863 2863 ^((jp|pn)g|bmp) 2 0 0 1
|
|
2864 2864 ^(logins|c(cdata|ookie)) 2 0 0 1
|
|
2865 2865 ^(m(ultipart|essage|odel)|a(pplication|udio|ccept)|(exampl|imag)e|video|text|\*) 2 0 0 1
|
|
2866 2866 ^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$ 2 0 0 1
|
|
2867 2867 ^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$ 2 0 0 1
|
|
2868 2868 ^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$ 2 0 0 1
|
|
2869 2869 ^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$ 2 0 0 1
|
|
2870 2870 ^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$ 2 0 0 1
|
|
2871 2871 ^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$ 2 0 0 1
|
|
2872 2872 ^[a-f0-9]{8,}\.duckdns\.org$ 2 0 0 1
|
|
2873 2873 ^[^\x3b\x2f\x28]+$ 2 0 0 1
|
|
2874 2874 ^[^\r\n]{100,} 2 0 0 1
|
|
2875 2875 ^[^\r\n]{100,} 2 0 0 1
|
|
2876 2876 ^[^\r\n]{100,} 2 0 0 1
|
|
2877 2877 ^[^\r\n]{100,} 2 0 0 1
|
|
2878 2878 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
2879 2879 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
|
|
2880 2880 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
|
|
2881 2881 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
|
|
2882 2882 [a-z]{8}.[a-z]{3} 2 0 0 1
|
|
2883 2883 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.zip$ 2 0 0 1
|
|
2884 2884 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.vbs$ 2 0 0 1
|
|
2885 2885 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.pif$ 2 0 0 1
|
|
2886 2886 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.exe$ 2 0 0 1
|
|
2887 2887 CN=ssl\d{1,2}.ovh.net($|,) 2 0 0 1
|
|
2888 2888 (\.[a-z]{2}|$) 2 0 0 1
|
|
2889 2889 [a-f0-9]{32}$ 2 0 0 1
|
|
2890 2890 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P 2 0 0 1
|
|
2891 2891 ^(\x3b|\r\n) 2 0 0 1
|
|
2892 2892 CN=([^\r\n]+?\.)?\.gov\.procurement\.(\.) 2 0 0 1
|
|
2893 2893 ^[a-f0-9]+ 2 0 0 1
|
|
2894 2894 ^[a-f0-9]+ 2 0 0 1
|
|
2895 2895 ^[a-f0-9]+ 2 0 0 1
|
|
2896 2896 ^Agent\d{5,6}$ 2 0 0 1
|
|
2897 2897 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
|
|
2898 2898 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
|
|
2899 2899 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1
|
|
2900 2900 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2901 2901 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2902 2902 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2903 2903 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2904 2904 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2905 2905 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2906 2906 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2907 2907 wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2908 2908 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2909 2909 wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2910 2910 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2911 2911 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2912 2912 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2913 2913 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2914 2914 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2915 2915 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1
|
|
2916 2916 Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dU 2 0 0 1
|
|
2917 2917 RMjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0 2 0 0 1
|
|
2918 2918 .*[^A-Za-z0-9]edu\.rf\.gd$ 2 0 0 1
|
|
2919 2919 \x2edoc[xm]?$ 2 0 0 1
|
|
2920 2920 \x2exls[xm]?$ 2 0 0 1
|
|
2921 2921 \/\d+$ 2 0 0 1
|
|
2922 2922 function(\s_0x[0-9a-f]{4})?\(_0x[0-9a-f]{6},_0x[0-9a-f]{6}\){var _0x[0-9a-f]{6}=/Qi 2 0 0 1
|
|
2923 2923 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
2924 2924 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
2925 2925 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
2926 2926 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
2927 2927 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
2928 2928 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
2929 2929 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
2930 2930 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
2931 2931 \sLOGIN\s[^\n]*?\s\{ 2 0 0 1
|
|
2932 2932 \sLSUB\s[^\n]*?\s\{ 2 0 0 1
|
|
2933 2933 \sRENAME\s[^\n]{100} 2 0 0 1
|
|
2934 2934 \sFIND\s[^\n]{100} 2 0 0 1
|
|
2935 2935 \sFETCH\s[^\n]{500} 2 0 0 1
|
|
2936 2936 \sLOGIN\s[^\n]{100} 2 0 0 1
|
|
2937 2937 \sAUTHENTICATE\s[^\n]{100} 2 0 0 1
|
|
2938 2938 \sLIST\s[^\n]*?\s\{ 2 0 0 1
|
|
2939 2939 \sPARTIAL.*BODY\[[^\]]{1024} 2 0 0 1
|
|
2940 2940 AUTH\s[^\n]{100} 2 0 0 1
|
|
2941 2941 \sCREATE\s*\{ 2 0 0 1
|
|
2942 2942 \sRENAME\s[^\n]*?\s\{ 2 0 0 1
|
|
2943 2943 \sLIST\s[^\n]{100} 2 0 0 1
|
|
2944 2944 \sCREATE\s[^\n]{1024} 2 0 0 1
|
|
2945 2945 \sLSUB\s[^\n]{100} 2 0 0 1
|
|
2946 2946 \sAUTHENTICATE\s[^\n]*?\{ 2 0 0 1
|
|
2947 2947 \sPARTIAL.*BODY\.PEEK\[[^\]]{1024} 2 0 0 1
|
|
2948 2948 \sUNSUBSCRIBE\s[^\n]{100} 2 0 0 1
|
|
2949 2949 \sUNSUBSCRIBE\s[^\n]*?\s\{ 2 0 0 1
|
|
2950 2950 \sSUBSCRIBE\s[^\n]{100} 2 0 0 1
|
|
2951 2951 \sSUBSCRIBE\s[^\n]*?\s\{ 2 0 0 1
|
|
2952 2952 \sSTATUS\s[^\n]{100} 2 0 0 1
|
|
2953 2953 \sSTATUS\s[^\n]*?\s\{ 2 0 0 1
|
|
2954 2954 \sFETCH\s[^\n]*?\s\{ 2 0 0 1
|
|
2955 2955 \sEXAMINE\s[^\n]{100} 2 0 0 1
|
|
2956 2956 \sEXAMINE\s[^\n]*?\s\{ 2 0 0 1
|
|
2957 2957 \sAPPEND\s[^\n]{256} 2 0 0 1
|
|
2958 2958 \sCOPY\s[^\n]*?\{ 2 0 0 1
|
|
2959 2959 \sDELETE\s[^\n]*?\{ 2 0 0 1
|
|
2960 2960 \sDELETE\s[^\n]{100} 2 0 0 1
|
|
2961 2961 \sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?% 2 0 0 1
|
|
2962 2962 (FREE XXX|dildo|masturbat|oral sex|ejaculat|up skirt|tits|bondage|lolita|clitoris|cock suck|hardcore (teen|anal|sex|porn)|raw sex|((fuck|sex|porn|xxx) (movies|dvd))|((naked|nude) (celeb|lesbian)))\b 2 0 0 1
|
|
2963 2963 ^RETR\s+[^\r\n]+?\x2eexe\r?$ 2 0 0 1
|
|
2964 2964 \<xdp\x3axdp(\s+[^\>]*)?\>((\<\/xdp[^\>]*\>).)*?\<pdf 2 0 0 1
|
|
2965 2965 SELECT @@version_compile_os\s*?\x3b 2 0 0 1
|
|
2966 2966 ^Server\x3a[^\r\n]*Portable SDK for UPnP devices(\/?\s*$|\/1\.([0-5]\..|8\.0.|(6\.[0-9]|6\.1[0-7]))) 2 0 0 1
|
|
2967 2967 ^Server\x3a[^\r\n]*Intel SDK for UPnP devices 2 0 0 1
|
|
2968 2968 ^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27] 2 0 0 1
|
|
2969 2969 ^[8-9]\.0 2 0 0 1
|
|
2970 2970 ^(<global_var>(((\]\,__\\x3a\+\+)).)+)]\,__\$\x3a\+\+(=global_var) 2 0 0 1
|
|
2971 2971 ^Host\x3a\x20[^\r\n]+\.((b(bsindex|0ne)|chatnook|gotgeeks|3d-game|4irc)\.com|s((cieron|uroot)\.com|lyip\.(com|net))|d(arktech\.org|eaftone\.com|tdns\.net)|e(towns\.(net|org)|ffers\.com)|flnet\.org)(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
|
|
2972 2972 ^Host\x3a\x20[^\r\n]+\.cd\.am(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
|
|
2973 2973 ^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}[^\r\n]*\x3C\x2Fiframe\x3E 2 0 0 1
|
|
2974 2974 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1
|
|
2975 2975 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1
|
|
2976 2976 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1
|
|
2977 2977 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1
|
|
2978 2978 ^(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?m(\x22\s*?\+\s*?\x22)?C(\x22\s*?\+\s*?\x22)?h(\x22\s*?\+\s*?\x22)?a(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?c(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?d(\x22\s*?\+\s*?\x22)?e 2 0 0 1
|
|
2979 2979 ^(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?m(\x27\s*?\+\s*?\x27)?C(\x27\s*?\+\s*?\x27)?h(\x27\s*?\+\s*?\x27)?a(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?c(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?d(\x27\s*?\+\s*?\x27)?e 2 0 0 1
|
|
2980 2980 for\x28[^\x3D\r\n]*[0-9]{1,6}\x2D[0-9]{1,5}\x3B[^\x3D\r\n]\x3E\x3D0\x3B[^\x29\r\n]\x2D\x2D\x29 2 0 0 1
|
|
2981 2981 ^User-Agent\x3a[^\r\n]*?Googlebot/Hmi 2 0 0 1
|
|
2982 2982 ^\s*?\([^\)]*?(<var>[^\.]+)\s*?\.\s*?length\s*<\s*(0?[0-9]{5,}|0x[a-z0-9]{3,})[^)]+\)\s*?\{\s*?(=var)\s*\s*?(=var)\s*?\+\s*?(=var)\s*?\} 2 0 0 1
|
|
2983 2983 ^(nc)?\s*([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=) 2 0 0 1
|
|
2984 2984 \x00[0-9]{4,7}\x02in\x00 2 0 0 1
|
|
2985 2985 ^Server\x3a[^\r\n]*miniupnpd\/1\.[0-3] 2 0 0 1
|
|
2986 2986 ^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27] 2 0 0 1
|
|
2987 2987 ^\s+?(<vname>[^\s\x3d]+)\s*\s*?(0x((6[4-9a-f]|[7-9a-f])|\d{3,})|\d{3,}).+?[\s\x3b]for\s*?\([^\x3b\)]*?\x3b[^\x3b\)]+?\s*?(=vname)[^\)]+?\)\s*?(\{[^}]*?|[^\r\n]*?)document\s*\.\s*createElement 2 0 0 1
|
|
2988 2988 ^((<\/title).)*\x26\x23x1F512 2 0 0 1
|
|
2989 2989 ^\/tmp\/.+\.exe$ 2 0 0 1
|
|
2990 2990 ^(&). 2 0 0 1
|
|
2991 2991 ((\?|&))pasa=(&). 2 0 0 1
|
|
2992 2992 se(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp)\.com 2 0 0 1
|
|
2993 2993 \.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03) 2 0 0 1
|
|
2994 2994 ))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net 2 0 0 1
|
|
2995 2995 \.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.rupacetechnology\.ne 2 0 0 1
|
|
2996 2996 .in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$ 2 0 0 1
|
|
2997 2997 ^(\d{1,3}\.){3}\d{1,3}(\x3a\d+)?$ 2 0 0 1
|
|
2998 2998 \.jpg(\?\d+)?$ 2 0 0 1
|
|
2999 2999 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3000 3000 ^[^0-9] 2 0 0 1
|
|
3001 3001 ^(\x3a\d{1,5})?$ 2 0 0 1
|
|
3002 3002 \.(arm(5n|7)?|m(ips|psl))$ 2 0 0 1
|
|
3003 3003 \.dyndns\.(biz|info|org|tv)$ 2 0 0 1
|
|
3004 3004 (at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work)\.com 2 0 0 1
|
|
3005 3005 ^[^&=?]*\/wp-content\/themes\/ 2 0 0 1
|
|
3006 3006 ^(\x3a\d{1,5})?$ 2 0 0 1
|
|
3007 3007 ^\x22(v(mware|irtual|irtualbox|m\x20ware|box)) 2 0 0 1
|
|
3008 3008 ^\x22(v(mware|irtual|irtualbox|m\x20ware|box)) 2 0 0 1
|
|
3009 3009 ^\x22(v(mware|irtual|irtualbox|m\x20ware|box)) 2 0 0 1
|
|
3010 3010 ^[a-z0-9.]+\.kali\.org 2 0 0 1
|
|
3011 3011 dynamic\.(com|net)|\.(info|me)|api\.info|get\.org|53\.biz|dns01\.com 2 0 0 1
|
|
3012 3012 (h(ard-work|unt)e|financialadviso)r|de(mocrat|signer) 2 0 0 1
|
|
3013 3013 \.com|y\.net)|a([klr]\.com|z\.net)|c([at]\.com|o\.net)|la\.net)|or 2 0 0 1
|
|
3014 3014 \.com|ndof(internet\.(net|org)|theinternet\.org))|le(btimnetz|itungsen) 2 0 0 1
|
|
3015 3015 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
3016 3016 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3017 3017 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3018 3018 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3019 3019 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3020 3020 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3021 3021 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3022 3022 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3023 3023 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3024 3024 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3025 3025 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3026 3026 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3027 3027 ^1\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3028 3028 ^2\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3029 3029 ^3\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3030 3030 ^4\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3031 3031 ^5\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3032 3032 ^6\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3033 3033 ^7\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3034 3034 ^8\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3035 3035 ^9\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3036 3036 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3037 3037 ^\d 2 0 0 1
|
|
3038 3038 ^User-Agent\x3a\x20iTunes\/10\.6\.[0-1] 2 0 0 1
|
|
3039 3039 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3040 3040 (/d{6}) 2 0 0 1
|
|
3041 3041 CN=([^\r\n]+?\.)?hizliresim\.com(\.) 2 0 0 1
|
|
3042 3042 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3043 3043 ^ip[23]?\.bablosoft\.com$ 2 0 0 1
|
|
3044 3044 ^[A-Z]=[A-Za-z/+0-9=]{200,400}$ 2 0 0 1
|
|
3045 3045 CN=([^\r\n]+?\.)?sharepointin\.com(\.) 2 0 0 1
|
|
3046 3046 CN=([^\r\n]+?\.)?templatern\.com(\.) 2 0 0 1
|
|
3047 3047 CN=([^\r\n]+?\.)?prizegives\.com(\.) 2 0 0 1
|
|
3048 3048 CN=([^\r\n]+?\.)?shareholds\.com(\.) 2 0 0 1
|
|
3049 3049 CN=([^\r\n]+?\.)?mesharepoint\.com(\.) 2 0 0 1
|
|
3050 3050 CN=([^\r\n]+?\.)?prizewings\.com(\.) 2 0 0 1
|
|
3051 3051 CN=([^\r\n]+?\.)?doctricant\.com(\.) 2 0 0 1
|
|
3052 3052 CN=([^\r\n]+?\.)?sharession\.com(\.) 2 0 0 1
|
|
3053 3053 CN=([^\r\n]+?\.)?sharepointle\.com(\.) 2 0 0 1
|
|
3054 3054 CN=([^\r\n]+?\.)?mcsharepoint\.com(\.) 2 0 0 1
|
|
3055 3055 CN=([^\r\n]+?\.)?officenced\.com(\.) 2 0 0 1
|
|
3056 3056 CN=([^\r\n]+?\.)?templatent\.com(\.) 2 0 0 1
|
|
3057 3057 CN=([^\r\n]+?\.)?sharepointen\.com(\.) 2 0 0 1
|
|
3058 3058 CN=([^\r\n]+?\.)?officence\.com(\.) 2 0 0 1
|
|
3059 3059 CN=([^\r\n]+?\.)?templateau\.com(\.) 2 0 0 1
|
|
3060 3060 CN=([^\r\n]+?\.)?sharesbyte\.com(\.) 2 0 0 1
|
|
3061 3061 CN=([^\r\n]+?\.)?officences\.com(\.) 2 0 0 1
|
|
3062 3062 CN=([^\r\n]+?\.)?officentry\.com(\.) 2 0 0 1
|
|
3063 3063 CN=([^\r\n]+?\.)?officested\.com(\.) 2 0 0 1
|
|
3064 3064 CN=([^\r\n]+?\.)?prizemons\.com(\.) 2 0 0 1
|
|
3065 3065 CN=([^\r\n]+?\.)?prizewel\.com(\.) 2 0 0 1
|
|
3066 3066 CN=([^\r\n]+?\.)?sharestion\.com(\.) 2 0 0 1
|
|
3067 3067 CN=([^\r\n]+?\.)?attemplate\.com(\.) 2 0 0 1
|
|
3068 3068 CN=([^\r\n]+?\.)?windocyte\.com(\.) 2 0 0 1
|
|
3069 3069 CN=([^\r\n]+?\.)?logodownload\.org(\.) 2 0 0 1
|
|
3070 3070 ^[0-9a-f]{32} 2 0 0 1
|
|
3071 3071 # \d+d \d+dh \d+m # 2 0 0 1
|
|
3072 3072 \x0D\x0A\x0D\x0ASLP\x3A\d+\x3BMOD\x3A[\S\x3B]+\x3BURL\x3Ahttp\x3A\x2F{2}[^\x3B]+\x3BSRV\x3Aupd\x3B 2 0 0 1
|
|
3073 3073 ^\x23\d\d\d\x2f\x21 2 0 0 1
|
|
3074 3074 \x06\x00?$ 2 0 0 1
|
|
3075 3075 \.php\?i=\w+_[0-9A-F]{8}&k=\d+$ 2 0 0 1
|
|
3076 3076 .asp\?username=.+&serverMac=([0-9A-F]{2}-){5}[0-9A-F]{2}&edition= 2 0 0 1
|
|
3077 3077 \/smain\?scout=acxc[a-z]{3}$ 2 0 0 1
|
|
3078 3078 \?sid=[0-9A-F]{180} 2 0 0 1
|
|
3079 3079 .asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2}) 2 0 0 1
|
|
3080 3080 \/chr\/\d+\/e\/t\d+\?lid= 2 0 0 1
|
|
3081 3081 mac=([0-9A-F]{2}:){5}([0-9A-F]{2}) 2 0 0 1
|
|
3082 3082 mac=([0-9A-F]{2}:){5}([0-9A-F]{2}) 2 0 0 1
|
|
3083 3083 cmd=give&pcname=.+&status=\d+$ 2 0 0 1
|
|
3084 3084 \?uid=[0-9a-f]{40}&action=\w+&v=[\w.]+&b=\d+$ 2 0 0 1
|
|
3085 3085 Host\x3a [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} 2 0 0 1
|
|
3086 3086 \/[0-9A-Z]+\/[0-9A-Z]+\.bin$ 2 0 0 1
|
|
3087 3087 \x2fpeca\d+\x2eexe 2 0 0 1
|
|
3088 3088 \.php\?v=[A-Za-z0-9.]+&id=-?\d+&wv=[0-9.]{1,14}$ 2 0 0 1
|
|
3089 3089 si\x5F[a-z]{5}[0-9]{5}\x2Ecb 2 0 0 1
|
|
3090 3090 seclog\x5F[a-z]{5}[0-9]{5}\x5F.+\x2Ekcb 2 0 0 1
|
|
3091 3091 &si=\d+&si=\d+&rd=20\d{11} 2 0 0 1
|
|
3092 3092 \x2f\x3fdata\x3d[a-fA-F0-9]{60} 2 0 0 1
|
|
3093 3093 \S{20,40}\'\> 2 0 0 1
|
|
3094 3094 \.php\?e=\d+&o=\w+&b=\w+&id=[0-9a-f]{32}$ 2 0 0 1
|
|
3095 3095 c\x3d[0-9a-f]{100} 2 0 0 1
|
|
3096 3096 ^\x23BOT\x23(VisitUrl|OpenUrl|Ping|RunPrompt|CloseServer|SvrUninstall|URLUpate|URLDownload) 2 0 0 1
|
|
3097 3097 ^\x23botCommand\x25(close\x20command|Error|Finish|Http\x20Flood|Mass\x20Download|Respond\x20\x5bOK|Syn\x20Flood|UDP\x20Flood|uninstall|Update|) 2 0 0 1
|
|
3098 3098 hash=\{[a-f0-9]+- 2 0 0 1
|
|
3099 3099 \/server_privileges\.php\?[0-9a-f]{32}=\d+(&\w+)?$ 2 0 0 1
|
|
3100 3100 \.php\?w=\d+&fail=\d+&i=[0-9a-f]{32}$ 2 0 0 1
|
|
3101 3101 (\.php|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$ 2 0 0 1
|
|
3102 3102 ddos\.(phat(icmp|syn|wonk)|stop|(syn|udp|http)flood|targa3|(syn|ack|random) ([0-9]{1,3}\.){3}[0-9]{1,3}) 2 0 0 1
|
|
3103 3103 floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3} 2 0 0 1
|
|
3104 3104 \.(upda|getfile|dl\dx|dl|download|execute)\w*\s+http\x3a\x2f\x2f 2 0 0 1
|
|
3105 3105 (ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12])) 2 0 0 1
|
|
3106 3106 \x3A\x02\x034\x5B(BackConnect|help|HTTP.*|SCAN|TCP.*|UDP.*|VERSION)\x5D\x03\x02 2 0 0 1
|
|
3107 3107 ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3}) 2 0 0 1
|
|
3108 3108 ((\.aim\w*|ascanall|\x3agetshit200)\s+\w+)|((@kill|@get_os_version|@get_computer_name|@get_bot_version|@update|@restart|@reboot|@shutdown)\s) 2 0 0 1
|
|
3109 3109 (testdlls|threads|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|currentip)\s*[\r\n] 2 0 0 1
|
|
3110 3110 ((cvar\.set)|(http\.(execute|update))|((aol)spam\.(setlist|settemplate|start|stop|setuser|setpass))|sniffer\.(addstring|delstring)|pingstop|udpstop|scan(all|stats|del|stop)|clone(stop|start)|c_(raw|mode|nick|join|part|privmsg|action)) 2 0 0 1
|
|
3111 3111 ((T?FTP)\x3a File transfer|(random|sequential) Port Scan|Random (Spreading|Scanner)|Exploiting IP|Exploiting\.\.|flooding\x3a|flood stopped|sending packets)|Random Method started|FINDFILE|Scan stopped|No scan thread found|thread\(s\) stopped|\x3aExec 2 0 0 1
|
|
3112 3112 PRIVMSG\s+\S+\s+\x3a\s*(\.user |\.logout|\.die|\.restart|\.mail |\.dns |\.download |\.exec |\.find |\.cmd |\.php |\.tcpflood |\.udpflood |\.raw |\.rndnick|\.pscan |\.ud\.server ) 2 0 0 1
|
|
3113 3113 \x7Cddos\x7C(syn|http)\x7C 2 0 0 1
|
|
3114 3114 \?rnd=\d{5,7}\x20HTTP1\/1\.[01]\x0d\x0aHost\x3a\x20 2 0 0 1
|
|
3115 3115 \?aid=\d{9}&url=[\w\.\-]{23}$ 2 0 0 1
|
|
3116 3116 \?subid=\d{9}&u=[\w\.\-]{23}$ 2 0 0 1
|
|
3117 3117 FileName\x3D[^\r\n]*\x2E(dll|exe) 2 0 0 1
|
|
3118 3118 Subject\x3A\x20[^\r\n]*C\x3A\x5C[^\r\n]*\x2Eexe 2 0 0 1
|
|
3119 3119 download\x2FAntivirus_\d+\x2Eexe 2 0 0 1
|
|
3120 3120 \/installer\.\d+\.exe 2 0 0 1
|
|
3121 3121 \/installer_\d+\.exe 2 0 0 1
|
|
3122 3122 \x0d\x0aHost\: [a-z\x2e]+(security|virus|pro|anti|scan|mypc|total|protect|check|guard|defend) 2 0 0 1
|
|
3123 3123 Setup_20\d+\x2Eexe 2 0 0 1
|
|
3124 3124 \/dl\/AcroIEHelpe(r)?(\d)?\.dll 2 0 0 1
|
|
3125 3125 mac=[0-9A-Fa-f]{12}& 2 0 0 1
|
|
3126 3126 \?type=slg&id=[0-9A-Z]{18} 2 0 0 1
|
|
3127 3127 phid=[A-F0-9]{64} 2 0 0 1
|
|
3128 3128 mode=\d+D[0-9A-F]{150} 2 0 0 1
|
|
3129 3129 ^x=[0-9a-zA-Z]{50}/P 2 0 0 1
|
|
3130 3130 \/x\/\?0\w{35}$ 2 0 0 1
|
|
3131 3131 \/down\d+\/down\/\?s=[A-F0-9]+\&t=\d+\/\d+\/20 2 0 0 1
|
|
3132 3132 \?spl=\d+&br=[A-Za-z]+&vers=\d\.\d&s=[a-z0-9]+[^&]$ 2 0 0 1
|
|
3133 3133 \?spl=MS[0-9]{2}-[0-9]{3}$ 2 0 0 1
|
|
3134 3134 \.php\?(land=\d+|affid=\d{5})&(land=\d+|affid=\d{5})$ 2 0 0 1
|
|
3135 3135 [1-3]\x2Finstaller\x2FInstaller\x2Eexe 2 0 0 1
|
|
3136 3136 \x2FLayouts\x2FLandings\x2FCentralLandings\x2F\d+\x2Fimages\x2F 2 0 0 1
|
|
3137 3137 MyValue=[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\: 2 0 0 1
|
|
3138 3138 \/(ucleaner|udefender|ufixer)\.com\/demo\.php\? 2 0 0 1
|
|
3139 3139 \.php\?1=[a-z0-9]+_[a-z0-9_]+&i= 2 0 0 1
|
|
3140 3140 ^User-Agent\:[^\n]+PassSickle/Hmi 2 0 0 1
|
|
3141 3141 \/cd\/un\.php.id=[A-F0-9\-]+&ver= 2 0 0 1
|
|
3142 3142 &os=[a-f0-9]{50} 2 0 0 1
|
|
3143 3143 ^GET\x20[^\x0D\x0A]+\x3Fmod\x3Dcmd\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+ 2 0 0 1
|
|
3144 3144 ^POST\x20[^\x0D\x0A]+\x3Fmod\x3Dlog\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+.*\x0D\x0A\x0D\x0Acurr\x3D.*\x26next\x3D 2 0 0 1
|
|
3145 3145 Content-Length\x3a [1-9] 2 0 0 1
|
|
3146 3146 Host\x3a\s[a-z]{15,19}\.ru(\x3a8080)?/Hm 2 0 0 1
|
|
3147 3147 gameover(\d+)?\.php 2 0 0 1
|
|
3148 3148 \x2F[a-z]{5}\x2Ephp\x3Fid\x3D 2 0 0 1
|
|
3149 3149 \.php\?m=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&[vs]= 2 0 0 1
|
|
3150 3150 \.php\?s=\d&m=[A-F0-9]{16}$ 2 0 0 1
|
|
3151 3151 \?id=[A-Za-z]+_[A-Za-z0-9]+& 2 0 0 1
|
|
3152 3152 \/index.dat\?\d{5,9}$ 2 0 0 1
|
|
3153 3153 \x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+[a-f0-9]{12}&ext\x3D 2 0 0 1
|
|
3154 3154 ^User-Agent\x3a [a-z0-9]{92}/Hmi 2 0 0 1
|
|
3155 3155 \/crack\.\d+\.exe$ 2 0 0 1
|
|
3156 3156 ^\d+\x7cddos\x7c([^\x7c]+\x7c){5}[^\x7c]+$ 2 0 0 1
|
|
3157 3157 ^\d+\x7cdlexec\x7c([^\x7c]+\x7c){3}[^\x7c]+$ 2 0 0 1
|
|
3158 3158 \.txt$ 2 0 0 1
|
|
3159 3159 ^\d+\x3a\d\x7c\d+\x7c[0-9a-z]+\x7c\d 2 0 0 1
|
|
3160 3160 \.php\?cmd=getFile&counter=\d 2 0 0 1
|
|
3161 3161 codec=\d+D\d+D\d 2 0 0 1
|
|
3162 3162 (\.aim\w*|ascanall)\s+\w 2 0 0 1
|
|
3163 3163 report=\d+&pid=\d+&wv=[A-Za-z0-9]/P 2 0 0 1
|
|
3164 3164 User\x2DAgent\x3A\x20[a-f0-9]{5,14}\x0D\x0A/H 2 0 0 1
|
|
3165 3165 .php\?gd=\d+_\d+_\d+$ 2 0 0 1
|
|
3166 3166 \x2f\d+?\x2erar$ 2 0 0 1
|
|
3167 3167 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$ 2 0 0 1
|
|
3168 3168 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/ 2 0 0 1
|
|
3169 3169 ^KEEPALIVE\x7c?\d 2 0 0 1
|
|
3170 3170 kill\-\d+.\d+.\d+.\d+\:\d+%\d 2 0 0 1
|
|
3171 3171 \x0d\x0aMagic-Number\x3a\s+\d+\|\d 2 0 0 1
|
|
3172 3172 \/ping\/[0-9a-fA-F]{64}\/[0-9a-fA-F]+\/[0-9a-fA-F] 2 0 0 1
|
|
3173 3173 \x3Fmod\x3D\w*?\x26id\x3D[^\x26\s]+?\x5F\w+?\x26up\x3D[^\x26]+?\x26mid\x3D[^\x26\s] 2 0 0 1
|
|
3174 3174 Host\: \d+\.\d+\.\d+\.\d 2 0 0 1
|
|
3175 3175 \?n=\d+&id=.+&t=.+&i=\d 2 0 0 1
|
|
3176 3176 id=[a-f0-9-]+& 2 0 0 1
|
|
3177 3177 ID=.{40}&.{6} 2 0 0 1
|
|
3178 3178 (web(\.(velocitycache\.com|autoflash\.info)|update\.(dyndns\.info|hopto\.org)|app\.serveftp\.com)|flash(center\.info|rider\.org)|cache\.dyndns\.info)\r?$/Hmi 2 0 0 1
|
|
3179 3179 ((nvidia(s(tream|oft)|drivers)|(rendercode|videosyn)c|flashupdates|syncstream)\.info|194\.192\.14\.125|202\.75\.58\.179)\r?$/Hmi 2 0 0 1
|
|
3180 3180 \/search\?q\=\d+&aq=\d 2 0 0 1
|
|
3181 3181 \x7C(NEW|Awaiting commands) 2 0 0 1
|
|
3182 3182 \x7C(NEW|Awaiting commands) 2 0 0 1
|
|
3183 3183 \x7C(NEW|Awaiting commands) 2 0 0 1
|
|
3184 3184 ^\x3c\x21\x2d\x2d\x0d\x0a\x3cimg\x20border=\d+\x20src=\x22\S+\x2f\x23KX8\x2e 2 0 0 1
|
|
3185 3185 ^\d+\s*--> 2 0 0 1
|
|
3186 3186 ^[0-4]\s*src=\x22[^\x22]+\x22\swidth=\d+\sheight=\d+>\r\n--> 2 0 0 1
|
|
3187 3187 \&p=[0-9A-Za-z]{5}\-[0-9A-Za-z]{5}\- 2 0 0 1
|
|
3188 3188 ^Accept-Encoding\x3a\s+([a-z]){3}/Hmi 2 0 0 1
|
|
3189 3189 user=[a-f0-9]{32}& 2 0 0 1
|
|
3190 3190 \/tlog\.php\?logn=[^\s]+&pss=[^\s] 2 0 0 1
|
|
3191 3191 ntarg\.php\?[^\s]*(notdoing|howme|uname)= 2 0 0 1
|
|
3192 3192 \/tnewu\.php\?nlogin=[^\s]+&npss=[^\s]+&invitedby=[^\s] 2 0 0 1
|
|
3193 3193 updatea\.php\?p=\d 2 0 0 1
|
|
3194 3194 &d=.{44}$ 2 0 0 1
|
|
3195 3195 filename=j[a-f0-9]{23}\.jar/H 2 0 0 1
|
|
3196 3196 ^hello\/[0-9]\.[0-9]\/[0-9]{3} 2 0 0 1
|
|
3197 3197 ^[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1
|
|
3198 3198 ^[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1
|
|
3199 3199 NICK {[a-z]{2,3}\x2D.+?x86[a-z]}[a-z] 2 0 0 1
|
|
3200 3200 ^\d+\w+\/\d+\w+ free \(\d+% used\) 2 0 0 1
|
|
3201 3201 ^[A-Z]\x3a\x5f 2 0 0 1
|
|
3202 3202 filename=e[a-f0-9]{23}\.exe/H 2 0 0 1
|
|
3203 3203 ^Host\x3a\x20[a-z0-9]+\.[a-z0-9]+\.[a-z0-9]+\.pl\x3a\d{2,5}\r$/Hm 2 0 0 1
|
|
3204 3204 ^[A-Z]{3}\|[UA]\|[DL]\|W([78]|_XP|VIS)\|x(86|64)\| 2 0 0 1
|
|
3205 3205 ^([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4}) 2 0 0 1
|
|
3206 3206 ^[a-z0-9\+\/]+={0,2}$ 2 0 0 1
|
|
3207 3207 ^(\r\n|$) 2 0 0 1
|
|
3208 3208 ^\d+?\x5d 2 0 0 1
|
|
3209 3209 ^[\r\n\s]*?<<((>>).)+?\/[a-zA-Z\d]*?#([46][1-9a-fA-F]|[57][\daA])([a-zA-Z\d])*?#([46][1-9a-fA-F]|[57][\daA]) 2 0 0 1
|
|
3210 3210 ^(4\x00[1-9a-f]|5\x00[\da]) 2 0 0 1
|
|
3211 3211 ^Referer\x3a[^\r\n]+\/[a-f0-9]{8}\/1(0\/[0-2]|1\/\d)\/\r$/Hm 2 0 0 1
|
|
3212 3212 data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt 2 0 0 1
|
|
3213 3213 ^\d+?\x7cOnConnect\x7c 2 0 0 1
|
|
3214 3214 ^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01 2 0 0 1
|
|
3215 3215 ^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01 2 0 0 1
|
|
3216 3216 ^[0-9a-f]{22,46} 2 0 0 1
|
|
3217 3217 ^((PCACTIV|ONLIN)ETIME|WEBSITE[DS]|CHATROOM|KEYLOGS) 2 0 0 1
|
|
3218 3218 ^\S{2,3}\x7c\S+?[au]\x7D\w{2,11}\x0d?\x0a 2 0 0 1
|
|
3219 3219 ^\/[A-Z]{1}[0-9]{1,3}\/[A-X]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/[A-Z]{1}[0-9]{4,5}[A-M]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/$ 2 0 0 1
|
|
3220 3220 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1
|
|
3221 3221 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1
|
|
3222 3222 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1
|
|
3223 3223 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1
|
|
3224 3224 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1
|
|
3225 3225 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1
|
|
3226 3226 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1
|
|
3227 3227 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1
|
|
3228 3228 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1
|
|
3229 3229 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1
|
|
3230 3230 ^(x(86|64)@)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
|
|
3231 3231 ^[^\x00]+?\x00 2 0 0 1
|
|
3232 3232 Host\x3a\x20([^\r\n]+\.)?bitcrypt\.cc(\x3a\d{1,5})?\r\n/Hmi 2 0 0 1
|
|
3233 3233 ID=\d{24}($|&) 2 0 0 1
|
|
3234 3234 ^[a-z0-9_-]*?\.class 2 0 0 1
|
|
3235 3235 name=\x22[a-z0-9\-_\.\s]{0,25}\.gadget\x22 2 0 0 1
|
|
3236 3236 ^..[\x0d-\x20](\d{0,27}[a-z])([a-z]{0,27}\d)[a-z0-9]{21,28}(\x03(biz|com|net|org))\x00\x00\x01\x00\x01 2 0 0 1
|
|
3237 3237 ^\d\.\d\.\d{4}\]\r\n\(C\)\x20Copyright\x20\d{4}(\x2d\d{4})?\x20Microsoft Corp(:?\.|oration) 2 0 0 1
|
|
3238 3238 ^\d+?\.\d+?\sstarted 2 0 0 1
|
|
3239 3239 ^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$ 2 0 0 1
|
|
3240 3240 MyValue=[a-f0-9]{32} 2 0 0 1
|
|
3241 3241 ^([a-zA-Z0-9\x2d\x5f]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]*?9\.9\.9\.9\s+?([a-zA-Z0-9\_\-]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n] 2 0 0 1
|
|
3242 3242 ^PRIVMSG.*@(portscan|back|(tcp|udp|http)flood|tsunami|(de)?voice|reset|die|say|join|part|(de)?op) 2 0 0 1
|
|
3243 3243 name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22 2 0 0 1
|
|
3244 3244 \/.+(www\.)?[a-z0-9]+\.[a-z]{2,3}\.exe$ 2 0 0 1
|
|
3245 3245 adobe-flash\.v\.\d{5}\.exe 2 0 0 1
|
|
3246 3246 \x2Finvoice\x2Escr$ 2 0 0 1
|
|
3247 3247 forum\/\?[0-9a-f]{8}$ 2 0 0 1
|
|
3248 3248 ups(_parcel_delivery-tracking-notice-|-Delivery-Notification-Message_)\S*\.zip 2 0 0 1
|
|
3249 3249 Host\x3A\x20[^a-z]*[0-9]{4,30}\x2Ecn\x0D\x0A/Hi 2 0 0 1
|
|
3250 3250 User-Agent\x3a\x20[a-z]{3,4}\x0d\x0a/H 2 0 0 1
|
|
3251 3251 \/xxxx_\d+\/ 2 0 0 1
|
|
3252 3252 ^Host\x3a\s[^\r\n]+?\.[abedgfihkmlonqpsruwvyxz]{16}\.waw\.pl\r$/Hmi 2 0 0 1
|
|
3253 3253 \x10[abedgfihkmlonqpsruwvyxz]{16}\x03waw\x02pl\x00 2 0 0 1
|
|
3254 3254 ^[^\x3b]+\\x([57][0-9a]|4[0-9a-f]|6[1-9a-f]|3[0-9]) 2 0 0 1
|
|
3255 3255 ^(<q>[\x22\x27])(((=q))[^\r\n\x2c])+?(=q)\s*?\+\s*?[\x22\x27][^\r\n\x2c]*?[cg][\x22\x27\+\s]*?[o][\x22\x27\+\s]*?[vm][\x22\x27\+\s]*?\.[\x22\x27\+\s]*?b[\x22\x27\+\s]*?r[\x22\x27\+\s]*?\x2c 2 0 0 1
|
|
3256 3256 ^..[\x0d-\x20][a-z]{13,32}(\x03(biz|com|net|org)|\x04info|\x02ru)\x00\x00\x01\x00\x01 2 0 0 1
|
|
3257 3257 ^\d 2 0 0 1
|
|
3258 3258 [^\x33][^\x6f\x19\x18\x0e\x4f\x09\x08\x11\x0c\x0f\x0d\x1f\x10\x39][\x00-\x07\x0b\x0a\x1e\x1d\x12\x13\x15\x10\x1b\x1a\x54-\x5f\x50-\x52\x40-\x4b\x4d\x4e\x70-\x7f\x60-\x67\x69-\x6d]{1,14}\x33 2 0 0 1
|
|
3259 3259 ^\x2d?\d 2 0 0 1
|
|
3260 3260 My\x20IP\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x0A 2 0 0 1
|
|
3261 3261 ^[^\r\n]{0,7}\b(M[ACDEFGHKLMNOPQRSTUVWXYZ]|B[ABDEFGHIJLMNOQRSTVWYZ]|S[ABCDEGHIJKLMNORSTVXYZ]) 2 0 0 1
|
|
3262 3262 ^[^\r\n]{0,7}\b(M(A[CFR]|D[AGV]|N[EGP]|L[IT]|Y[ST]|[MS]) 2 0 0 1
|
|
3263 3263 ^[a-z0-9_-]*?\.class 2 0 0 1
|
|
3264 3264 ^.\x00\x00\x00[a-z0-9]+?\x00 2 0 0 1
|
|
3265 3265 ^\d+[\r\n]*?$ 2 0 0 1
|
|
3266 3266 ^[^\r\n]*?\x3a[^\r\n]*?(port(scan)?|udp[1-3]|tcp|http|download)[^\r\n]+?(\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}|https?\x3A\x2F\x2F) 2 0 0 1
|
|
3267 3267 ^[^\r\n]*?(p[ao]rt|udp|c?tcp|http|d(ie|ownload)|mail|c?back|(msg|notice)?flood) 2 0 0 1
|
|
3268 3268 ^[a-z]{12} 2 0 0 1
|
|
3269 3269 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x40\x24\x40$ 2 0 0 1
|
|
3270 3270 ^[a-z]{16} 2 0 0 1
|
|
3271 3271 \/get\/get\.php$ 2 0 0 1
|
|
3272 3272 ^[A-Za-z0-9\s/+]{100} 2 0 0 1
|
|
3273 3273 ^Host\x3a\x20ns1\.help(update(d\.(com?|net?|org?)|k\.(at?|eu?|tw)|r\.net|s\.com)|checks\.net) 2 0 0 1
|
|
3274 3274 ^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)> 2 0 0 1
|
|
3275 3275 ^[^\r\n]+?\n$ 2 0 0 1
|
|
3276 3276 \x21\x20UDP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1
|
|
3277 3277 \x21\x20TCP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1
|
|
3278 3278 \x21\x20HOLD\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1
|
|
3279 3279 \x21\x20SCANNER\x20(ON|OFF)\x0A 2 0 0 1
|
|
3280 3280 \x21\x20JUNK\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1
|
|
3281 3281 ^[a-z][a-f0-9]{33} 2 0 0 1
|
|
3282 3282 ^[a-z][a-f0-9]{33} 2 0 0 1
|
|
3283 3283 ^[a-z][a-f0-9]{33} 2 0 0 1
|
|
3284 3284 ^[a-z][a-f0-9]{33} 2 0 0 1
|
|
3285 3285 ^[a-z][a-f0-9]{33} 2 0 0 1
|
|
3286 3286 ^[a-z][a-f0-9]{33} 2 0 0 1
|
|
3287 3287 ^[a-z][a-f0-9]{33} 2 0 0 1
|
|
3288 3288 ^[a-z][a-f0-9]{33} 2 0 0 1
|
|
3289 3289 ^Host\x3A[^\r\n]+?\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r?$/Hmi 2 0 0 1
|
|
3290 3290 ^[a-f0-9]+$ 2 0 0 1
|
|
3291 3291 ^[0-9A-F]{12}$ 2 0 0 1
|
|
3292 3292 ^\S{2,3}\x2d(XP|2K3|VIS|2K8|W7|ERR)\w?\x2d\w+?\x7D\w+?\r\n? 2 0 0 1
|
|
3293 3293 ^(MIPS(EL)?|POWERPC|ARM|X86)\x0a$ 2 0 0 1
|
|
3294 3294 ^(ON|OFF) 2 0 0 1
|
|
3295 3295 ^\d+MHz\x00 2 0 0 1
|
|
3296 3296 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})system$ 2 0 0 1
|
|
3297 3297 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}D\x3a\x00+?$ 2 0 0 1
|
|
3298 3298 ^.{2}(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x08.{2}(=var) 2 0 0 1
|
|
3299 3299 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3300 3300 ^[\x53\x54] 2 0 0 1
|
|
3301 3301 ^[a-z0-9]{50} 2 0 0 1
|
|
3302 3302 ^[a-z0-9]{50} 2 0 0 1
|
|
3303 3303 ^\x3c\x2a\x60[\x20-\x7e]+\x60\x2a\x3e$ 2 0 0 1
|
|
3304 3304 ^\d+\]\r\n$ 2 0 0 1
|
|
3305 3305 ^((menelao|ho[mr]u)s|adair|johan|kweku)\r\n 2 0 0 1
|
|
3306 3306 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d 2 0 0 1
|
|
3307 3307 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d 2 0 0 1
|
|
3308 3308 ^[A-F0-9]{8,12} 2 0 0 1
|
|
3309 3309 ^(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$ 2 0 0 1
|
|
3310 3310 ^[\x01\x03\x08\x09\x0b]\x00 2 0 0 1
|
|
3311 3311 ^\d{1,3}[0-2] 2 0 0 1
|
|
3312 3312 \.tar$ 2 0 0 1
|
|
3313 3313 ^[a-zA-Z0-9]{8} 2 0 0 1
|
|
3314 3314 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
|
|
3315 3315 \x7c[a-f0-9]{16}\x7c\d+\x7c$ 2 0 0 1
|
|
3316 3316 [^\x28][^\x76\x74\x02\x03\x15\x54\x12\x13\x0a\x17\x14\x16\x04\x0b\x22][\x05\x09\x0b\x0e\x08\x06\x1a-\x1f\x10\x11\x18\x19\x40-\x47\x48-\x4f\x50-\x53\x55\x56\x58-\x5e\x60-\x68\x6a-\x6f\x70\x72\x76-\x7e]{1,14}\x28 2 0 0 1
|
|
3317 3317 \x00\x05value$ 2 0 0 1
|
|
3318 3318 ^[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1
|
|
3319 3319 ^\d{1,5} 2 0 0 1
|
|
3320 3320 ^.{2}[a-z]{5,}\.[a-z]{2}\x30 2 0 0 1
|
|
3321 3321 ^(#+[A-Z]+)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\${10} 2 0 0 1
|
|
3322 3322 ^(in|out) 2 0 0 1
|
|
3323 3323 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1
|
|
3324 3324 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1
|
|
3325 3325 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1
|
|
3326 3326 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1
|
|
3327 3327 ^[0-9A-F]{12} 2 0 0 1
|
|
3328 3328 ^\d{1,6}\x00pl\x7c 2 0 0 1
|
|
3329 3329 ^\d{1,6}\x00sc\x7e\x7c 2 0 0 1
|
|
3330 3330 ^\d{1,6}\x00scPK\x7c 2 0 0 1
|
|
3331 3331 ^\d{1,6}\x00rn\x7c 2 0 0 1
|
|
3332 3332 ^\d{1,6}\x00ret\x7c 2 0 0 1
|
|
3333 3333 ^\d{1,6}\x00cap\x7c 2 0 0 1
|
|
3334 3334 ^\d{1,6}\x00kl\x7c 2 0 0 1
|
|
3335 3335 ^\d{1,6}\x00fm\x7c 2 0 0 1
|
|
3336 3336 ^\d{1,6}\x00proc\x7c 2 0 0 1
|
|
3337 3337 ^\d{1,6}\x00rg\x7c 2 0 0 1
|
|
3338 3338 ^\d{1,6}\x00srv\x7c 2 0 0 1
|
|
3339 3339 ^\d{1,6}\x00rs\x7c 2 0 0 1
|
|
3340 3340 ^\d{1,6}\x00mic\x7c 2 0 0 1
|
|
3341 3341 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
|
|
3342 3342 ^NOTICE [^\r\n]+? \x3aREWRITING\x0a[^\r\n]+?\x0ato\x0a[^\r\n]+?\x0a 2 0 0 1
|
|
3343 3343 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1
|
|
3344 3344 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1
|
|
3345 3345 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1
|
|
3346 3346 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1
|
|
3347 3347 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1
|
|
3348 3348 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1
|
|
3349 3349 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1
|
|
3350 3350 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1
|
|
3351 3351 ^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$ 2 0 0 1
|
|
3352 3352 ^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$ 2 0 0 1
|
|
3353 3353 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1
|
|
3354 3354 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1
|
|
3355 3355 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1
|
|
3356 3356 ^\d+ 2 0 0 1
|
|
3357 3357 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1
|
|
3358 3358 ^.{2}[a-z]{5,}\.[a-z]{2}[01] 2 0 0 1
|
|
3359 3359 ^.{2}[a-z]{5,}\.[a-z]{2}[01] 2 0 0 1
|
|
3360 3360 ^.{2}[a-z]{5,}\.[a-z]{2}[01] 2 0 0 1
|
|
3361 3361 ^.{2}[a-z]{5,}\.[a-z]{2}[01] 2 0 0 1
|
|
3362 3362 ^.{2}[a-z]{25}\.[a-z]{2,3}[01] 2 0 0 1
|
|
3363 3363 ^(([0-9]{1,3}\.){3}[0-9]{1,3})(={2}) 2 0 0 1
|
|
3364 3364 \/\?[A-Z]{10,}$ 2 0 0 1
|
|
3365 3365 ^User-Agent\x3a[^\r\n]+?(MSIE|rv\x3a11)/Hm 2 0 0 1
|
|
3366 3366 \/\d{10}\?w=\d{3}&i=\d{6,10}&v=\d\.\d$ 2 0 0 1
|
|
3367 3367 \.php$ 2 0 0 1
|
|
3368 3368 ^KEEPALIVE\d+$ 2 0 0 1
|
|
3369 3369 \x24RECYCLE\.BIN\.\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\x5C\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\.(scr|pif|cmd) 2 0 0 1
|
|
3370 3370 ^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9] 2 0 0 1
|
|
3371 3371 ^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9] 2 0 0 1
|
|
3372 3372 \.php\?e=\d{4}\-\d{4}&h=[a-f0-9]{32}$ 2 0 0 1
|
|
3373 3373 ^[a-f0-9]{7,}$ 2 0 0 1
|
|
3374 3374 ^.{2}(www)\d?[A-Z]?([a-z]{3,20}\.)?[a-z]{5,}(\d[a-z]{5,})?\.[a-z]{2,5}[01] 2 0 0 1
|
|
3375 3375 ^[^\x00]+(\xff\xd9)?$ 2 0 0 1
|
|
3376 3376 ^0103F\x00[^\x00]+(\xff\xd9)?$ 2 0 0 1
|
|
3377 3377 ^0103F\x00[^\x00]+(\xff\xd9)?$ 2 0 0 1
|
|
3378 3378 ^.{2}((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((com|net|org)[01])[a-z]{2,}[01] 2 0 0 1
|
|
3379 3379 ^(<v1>\S{1,100})\s+(<v2>\S{1,100})\s+=\s+\x22\x22\x3b\s+(=v2)\s+\+\=\s+\x27(=v1).+?(=v1)\x27\x3b.+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27] 2 0 0 1
|
|
3380 3380 ^[a-z]{12} 2 0 0 1
|
|
3381 3381 ^[a-f0-9]{14}$ 2 0 0 1
|
|
3382 3382 ^\d 2 0 0 1
|
|
3383 3383 \.php\?id=\d+&magic=(-)?\d+$ 2 0 0 1
|
|
3384 3384 ^.{2}(<CN>((\d?[A-Z]?|[A-Z]?\d?)([a-z]{3,20}|[a-z]{3,6}[0-9_][a-z]{3,6})\.){0,2}?(\d?[A-Z]?|[A-Z]?\d?)[a-z]{3,}([0-9_-][a-z]{3,})?\.(com|org|net|tv)[a-z]{2,9})[01].*?(=CN)[01] 2 0 0 1
|
|
3385 3385 ^.[\x0e\x0f]((www|ns))[a-z0-9]{2,3} 2 0 0 1
|
|
3386 3386 ^.[\x0a\x0b]((www|ns))[a-z0-9]{1,2} 2 0 0 1
|
|
3387 3387 ^KEEPALIVE\x7c?\d 2 0 0 1
|
|
3388 3388 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3389 3389 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3390 3390 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3391 3391 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3392 3392 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3393 3393 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3394 3394 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3395 3395 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3396 3396 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3397 3397 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3398 3398 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3399 3399 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3400 3400 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3401 3401 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3402 3402 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3403 3403 ^[a-f0-9]{13,30}$ 2 0 0 1
|
|
3404 3404 ^[A-F0-9]+\x00 2 0 0 1
|
|
3405 3405 Cookie\x3a mstshash=[a-zA-Z]\r\n 2 0 0 1
|
|
3406 3406 ^[^A-Za-z0-9] 2 0 0 1
|
|
3407 3407 ^(FM|SM|CP|CM|MC|NF|CH|PS|PT) 2 0 0 1
|
|
3408 3408 ^(Lg|Execute|FLD|Sc)\x7c\x2d\x7c 2 0 0 1
|
|
3409 3409 ^(\x40|\x21|\x23|\x7e|\x24) 2 0 0 1
|
|
3410 3410 \bnethelper\b/Vi 2 0 0 1
|
|
3411 3411 ^\d 2 0 0 1
|
|
3412 3412 [\x04\x06]\x88\x4d\x76$ 2 0 0 1
|
|
3413 3413 [\xb0\xb2]\x63\x70\x7b$ 2 0 0 1
|
|
3414 3414 ^(.{0,56}\x00.{0,55}\x00.{0,54}\x00.{0,53}\x00)(.{0,54}\x00{2}) 2 0 0 1
|
|
3415 3415 \r\nHost\x3a[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\n(Connection\x3a Keep-Alive\r\n)?(\r\n)?$/H 2 0 0 1
|
|
3416 3416 ^Accept\x3a\x20\*\/\*\r\nConnection\x3a\x20close\r\nHost\x3a\x20[^\r\n\x2e]+\x2e[^\r\n\x2e]+(\x3a\d{1,5})?\r\n(\r\n)?$/H 2 0 0 1
|
|
3417 3417 name\x3d\x22(message|letter|.*lebanon\x2donline\x2ecom\x2elb)?\x2ezip\x22\x0d\x0a 2 0 0 1
|
|
3418 3418 ^[A-Za-z0-9+/=]+\x24\x3a\d+\x3a\x24$ 2 0 0 1
|
|
3419 3419 ^[acdefghijlmopqrtwz]{16}\.mynumber\.org$ 2 0 0 1
|
|
3420 3420 ^Host\x3a (\d+\.){3}\d+$ 2 0 0 1
|
|
3421 3421 ^[0-9A-Z]{8}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9]{12}-0[0-9]{1} 2 0 0 1
|
|
3422 3422 ^(_|Keylogger) 2 0 0 1
|
|
3423 3423 [^\x12][^\x4e\x38\x39\x2f\x6e\x28\x29\x30\x2d\x2e\x2c\x3e\x31\x18][\x40-\x48\x4a-\x4d\x31-\x34\x3a-\x3c\x3f\x50-\x5f\x60-\x6c\x6f\x73-\x7f\x70\x71\x20-\x27\x2a\x2b]{1,14}\x12 2 0 0 1
|
|
3424 3424 ^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(=var)[^\r\n]+(=var)$ 2 0 0 1
|
|
3425 3425 ^(GET|POST)\/(watch|search|find|results|open|search|close)\/\?(text=|from=|aq=|ai=|ags=|oe=|btnG=|oprnd=|utm=|channel=|itwm=) 2 0 0 1
|
|
3426 3426 itwm=[A-Za-z0-9\-\_]{29,35} 2 0 0 1
|
|
3427 3427 &itwm=[A-Za-z0-9\-\_]{29,35} 2 0 0 1
|
|
3428 3428 [A-Z0-9\-]{16}-FILE-[^\r\n]+.tmp 2 0 0 1
|
|
3429 3429 Mozilla\/[0-9]{1,2}.[0-9]{1,2}\(compatible\; MSIE [0-9]{1,2}.[0-9]{1,2}\;\)\x0d\x0a 2 0 0 1
|
|
3430 3430 ^.{2}[A-Za-z][a-z]*?@[a-z]+\.com0 2 0 0 1
|
|
3431 3431 ^User-Agent\x3a\x20[^\r\n]+?(MSIE|rv\x3a11\.0)/Hmi 2 0 0 1
|
|
3432 3432 ^\x00+?[\x20-\x7f]+?\x00+?$ 2 0 0 1
|
|
3433 3433 ^\x00+?[\x20-\x7f]+?\x00+?$ 2 0 0 1
|
|
3434 3434 ^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi 2 0 0 1
|
|
3435 3435 ^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi 2 0 0 1
|
|
3436 3436 ^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi 2 0 0 1
|
|
3437 3437 ^[\x22\x27][a-z][\x27\x22] 2 0 0 1
|
|
3438 3438 ^.(.[a-z]{4,12}\.(us|org|net|biz|info|mobi|com)[01]).*?\x55\x04\x03. 2 0 0 1
|
|
3439 3439 ^[0-9]{3}\x7cx 2 0 0 1
|
|
3440 3440 ^[0-9]{2}\x7cx 2 0 0 1
|
|
3441 3441 ^[a-f0-9]{40,}$ 2 0 0 1
|
|
3442 3442 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3443 3443 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps 2 0 0 1
|
|
3444 3444 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps 2 0 0 1
|
|
3445 3445 ([0-9A-F]{8}\-){5}\-SH 2 0 0 1
|
|
3446 3446 ^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8}) 2 0 0 1
|
|
3447 3447 ^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8}) 2 0 0 1
|
|
3448 3448 ^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8}) 2 0 0 1
|
|
3449 3449 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
3450 3450 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
3451 3451 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3452 3452 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3453 3453 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3454 3454 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3455 3455 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3456 3456 ^d([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?e([\x22\x27][\r\n\s]) 2 0 0 1
|
|
3457 3457 ^.{4}[\x0a-\x7f]{0,100}[\x00-x09\x80-\xff] 2 0 0 1
|
|
3458 3458 ^\/([a-z]*[0-9][a-z-0-9]*)([0-9]*[a-z][a-z-0-9]*)[a-z0-9]{5,8}$ 2 0 0 1
|
|
3459 3459 Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r\n/H 2 0 0 1
|
|
3460 3460 \/js\/bin\.exe\\d+$ 2 0 0 1
|
|
3461 3461 ^.{1}([\x20-\x7e]{0,8}?[^\x20-\x7e])(<var>.{10,120}?[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1
|
|
3462 3462 ^.{2}[a-z]+@[a-z]+\.com[01] 2 0 0 1
|
|
3463 3463 ^.{2}[a-z]+@[a-z]+\.com[01] 2 0 0 1
|
|
3464 3464 ^.{2}[A-Za-z][a-z]*?@[a-z]+\.com[01] 2 0 0 1
|
|
3465 3465 \x00[0-9]{4,7}\x02in\x00 2 0 0 1
|
|
3466 3466 ^[\x0e-\x1e]([a-f0-9]{2}){1,3}(dc([a-f0-9]{2}){1,3}){3}.[a-f0-9]{2} 2 0 0 1
|
|
3467 3467 ^[\x08-\xFF]([a-f0-9]{2})*?dc978a97 2 0 0 1
|
|
3468 3468 ^(gdqg|hdqh|idqi|jdqj|kdqk|ldql|mdqm|ndqn|odqo|pdqp|qdqq|rdqr|sdqs|tdqt|udqu|vdqv|wdqw|xdqx|ydqy|zdqz)[a-j](\x02ch|\x03biz) 2 0 0 1
|
|
3469 3469 ^(adra|bdrb|cdrc|ddrd|edre|fdrf|gdrg|hdrh|idri|jdrj|kdrk|ldrl|mdrm|ndrn|odro|pdrp|qdrq|rdrr|sdrs|tdrt|udru|vdrv|wdrw|xdrx|ydry|zdrz)[a-j](\x02ch|\x03biz) 2 0 0 1
|
|
3470 3470 ^(0+30)[0-9A-Z]+30[^0-9] 2 0 0 1
|
|
3471 3471 [a-z]{4,10}\.velodrivve\.biz$ 2 0 0 1
|
|
3472 3472 [a-z]{4,10}\.bedrifg\.org$ 2 0 0 1
|
|
3473 3473 [a-z]{4,10}\.fedbook\.org$ 2 0 0 1
|
|
3474 3474 [a-z]{4,10}\.goodbird\.biz$ 2 0 0 1
|
|
3475 3475 [a-z]{4,10}\.verekt\.biz$ 2 0 0 1
|
|
3476 3476 [a-z]{4,10}\.barrout\.org$ 2 0 0 1
|
|
3477 3477 [a-z]{4,10}\.biojart\.biz$ 2 0 0 1
|
|
3478 3478 [a-z]{4,10}\.benefin\.org$ 2 0 0 1
|
|
3479 3479 \.(upda|getfile|dl\dx|dl|download|execute)\w*\s+ftp\x3a\x2f\x2f 2 0 0 1
|
|
3480 3480 \/operator\/login\.php$ 2 0 0 1
|
|
3481 3481 ^.{8}[\x20-\x7e]+?\x7b\x9e 2 0 0 1
|
|
3482 3482 ^Subject\x3a [^\r\n]+?Foi Instalado 2 0 0 1
|
|
3483 3483 ^\/[56]\d{4}\x2c.*?\x2c[A-Z]\x3a[\x2f\x5c].+?\.exe 2 0 0 1
|
|
3484 3484 \x00\x07[a-z0-9]{7}\x02eu\x00 2 0 0 1
|
|
3485 3485 [^a-z0-9\-\.][a-z]{32,48}\x02ru\x00\x00 2 0 0 1
|
|
3486 3486 ^ETag\x3a\x20\x22\d+75BCD15\d+\x3a[a-f0-9]{1,6} 2 0 0 1
|
|
3487 3487 ^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)>$ 2 0 0 1
|
|
3488 3488 ^Host\x3a[^\r\n]+?cvredirect.no-ip.net/Hmi 2 0 0 1
|
|
3489 3489 ^Host\x3a[^\r\n]+?cvredirect.ddns.net/Hmi 2 0 0 1
|
|
3490 3490 ^Keylogger\r$ 2 0 0 1
|
|
3491 3491 ^[\x22\x27]NEGOCIO_ONLINE(\.(zip|exe))[\x27\x22]\x0d\x0a 2 0 0 1
|
|
3492 3492 ^[A-F0-9]{48}\.bin\r\n 2 0 0 1
|
|
3493 3493 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/stat\x03\x08\x0c$ 2 0 0 1
|
|
3494 3494 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/control\x03\x08\x0c$ 2 0 0 1
|
|
3495 3495 ^Host\x3a[^\r\n]+?\r\n(\r\n)?$/Hi 2 0 0 1
|
|
3496 3496 ^Host\x3a[^\r\n]+\.asia\r\n/Hmi 2 0 0 1
|
|
3497 3497 ^Host\x3a[^\r\n]+\.ru\r\n/Hmi 2 0 0 1
|
|
3498 3498 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title><\/html>$ 2 0 0 1
|
|
3499 3499 ^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3a)(l|&#(x[64]c|108|76)\x3b) 2 0 0 1
|
|
3500 3500 ^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b) 2 0 0 1
|
|
3501 3501 ^[a-z0-9]{1,10}[A-F0-9]+\.bin\r\n$ 2 0 0 1
|
|
3502 3502 ^\s*\s*?[\x22\x27]javax.naming.InitialContext 2 0 0 1
|
|
3503 3503 \x7c([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$ 2 0 0 1
|
|
3504 3504 ^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/n\d+\.png$ 2 0 0 1
|
|
3505 3505 (JUNK|HOLD) Flooding (\d{1,3}\.){3}\d{1,3} for \d+ seconds.\r?\n 2 0 0 1
|
|
3506 3506 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})Wrod--\\\$ 2 0 0 1
|
|
3507 3507 ^(:?[78]|XP) 2 0 0 1
|
|
3508 3508 \.php\?\d{1,4}$ 2 0 0 1
|
|
3509 3509 \.php\?\d{1,4}$ 2 0 0 1
|
|
3510 3510 \/config\.php\?id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+ 2 0 0 1
|
|
3511 3511 ^AuthToken=[A-Za-z0-9+/]{43}=$ 2 0 0 1
|
|
3512 3512 \.[^\x3F]+\?id=\d+&act=\d+$ 2 0 0 1
|
|
3513 3513 ^.{2}[A-Z]?[a-z]+\.[A-Z]?[a-z]+@gmail\.com[01] 2 0 0 1
|
|
3514 3514 ^[0-9A-Z]+232A 2 0 0 1
|
|
3515 3515 ^\d{1,3}$ 2 0 0 1
|
|
3516 3516 ^(Cek\x20This|miss\x20[A-Za-z0-9]{2,20}|[A-Za-z0-9]{2,20}Porn)\r\n 2 0 0 1
|
|
3517 3517 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
3518 3518 ^(likes|check|login_status)\.json\? 2 0 0 1
|
|
3519 3519 ^[0-9A-F]{16}$ 2 0 0 1
|
|
3520 3520 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
3521 3521 ^[A-F0-9]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\/ 2 0 0 1
|
|
3522 3522 ^[a-z0-9/%=]{100,}$ 2 0 0 1
|
|
3523 3523 ^(-[0-9]+|[A-F0-9]{32})=1$ 2 0 0 1
|
|
3524 3524 ^(-[0-9]+|[A-F0-9]{32})=1&type=zip$ 2 0 0 1
|
|
3525 3525 ^(-[0-9]+|[A-F0-9]{32})=1&type=filter$ 2 0 0 1
|
|
3526 3526 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&u= 2 0 0 1
|
|
3527 3527 ^[A-Za-z0-9\/\.=]{250,}$ 2 0 0 1
|
|
3528 3528 ^\d+\x0a$ 2 0 0 1
|
|
3529 3529 ^[A-Za-z0-9]{25,}$ 2 0 0 1
|
|
3530 3530 ^\d{2,4}$ 2 0 0 1
|
|
3531 3531 ^[a-z0-9]{6}$ 2 0 0 1
|
|
3532 3532 ^=?[a-z0-9]{6}$ 2 0 0 1
|
|
3533 3533 ^(pe|pp|s)$ 2 0 0 1
|
|
3534 3534 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3535 3535 ^(mfa\.[\w-]{84}|[\w-]{24}\.[\w-]{6}\.[\w-]{27})\x0d\x0a 2 0 0 1
|
|
3536 3536 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})\d(\r\n)?$/Hmi 2 0 0 1
|
|
3537 3537 &p=[a-z0-9]{12}(&v=[a-z0-9\.-]{1,24})?$ 2 0 0 1
|
|
3538 3538 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3539 3539 ^[A-F0-9]{8}$ 2 0 0 1
|
|
3540 3540 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x00$ 2 0 0 1
|
|
3541 3541 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3542 3542 ^[a-zA-Z0-9\/+]{171}=$ 2 0 0 1
|
|
3543 3543 ^[a-z]{200,}$ 2 0 0 1
|
|
3544 3544 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3545 3545 ^(The White House|And increasing numbers|Drivers for a parcel|The Italian region worst hit|Although Interpol issued|President Donald Trump|Restaurants are still allowed|A paper released on Friday) 2 0 0 1
|
|
3546 3546 ^[a-f0-9]{32}$ 2 0 0 1
|
|
3547 3547 ^[A-Za-z0-9\-_\.]{20,80}\.[a-z]{2}\d{2}\.com$ 2 0 0 1
|
|
3548 3548 ^[a-fA-F0-9]{61}\.[a-fA-F0-9]{63}\.[a-fA-F0-9]{63}\. 2 0 0 1
|
|
3549 3549 ^88[a-fA-F0-9]{38}b9\. 2 0 0 1
|
|
3550 3550 ^8b[a-fA-F0-9]{46}b9\. 2 0 0 1
|
|
3551 3551 &uuid=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1
|
|
3552 3552 ^[a-z]{256}$ 2 0 0 1
|
|
3553 3553 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3554 3554 \x2Fu\x2Fupd\x5F(cb|.+\x2Ecb) 2 0 0 1
|
|
3555 3555 ^(\d+|(\w+)?grabbers?|uploader)(&luck=\d)?$ 2 0 0 1
|
|
3556 3556 \x2F(data|main|patch)\x2Ecfg 2 0 0 1
|
|
3557 3557 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
3558 3558 c\x3d[0-9a-f]{100} 2 0 0 1
|
|
3559 3559 \.php\?U=\d+@\d+@\d+@\d+@\d+@[a-f0-9]+$ 2 0 0 1
|
|
3560 3560 ^(0-9]{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
3561 3561 ^[^?#]+?\.php\?f=\w+&e=\d+$ 2 0 0 1
|
|
3562 3562 id=[A-F0-9]{20} 2 0 0 1
|
|
3563 3563 ^(x\d{1,2}){5,} 2 0 0 1
|
|
3564 3564 \?ca[sc]hingDeny=[0-9A-Za-z]{16}& 2 0 0 1
|
|
3565 3565 ^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1
|
|
3566 3566 ^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1
|
|
3567 3567 ^\d+$ 2 0 0 1
|
|
3568 3568 ^\d+$ 2 0 0 1
|
|
3569 3569 ^\d+$ 2 0 0 1
|
|
3570 3570 ^[a-z0-9]{60} 2 0 0 1
|
|
3571 3571 ^[A-F0-9\-]+&ver= 2 0 0 1
|
|
3572 3572 ^[A-F0-9\-]+&ver= 2 0 0 1
|
|
3573 3573 \/task.php\?id=[^&]{32,64}&task=\d 2 0 0 1
|
|
3574 3574 ^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}&a= 2 0 0 1
|
|
3575 3575 c\x3d[0-9A-F]{100} 2 0 0 1
|
|
3576 3576 ^[a-f0-9]{100,200}\/[a-f0-9]{6,9}\/[A-Z0-9_]{4,200}\.com 2 0 0 1
|
|
3577 3577 \.php\?m=\w&n=\w+_\w+(@|@.c|@.t)$ 2 0 0 1
|
|
3578 3578 ^\d{5,9}$ 2 0 0 1
|
|
3579 3579 \x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+121212121212 2 0 0 1
|
|
3580 3580 ^[a-z]{3,6}\x3d[A-F0-9]{50} 2 0 0 1
|
|
3581 3581 ^([0-9A-F][0-9A-F]-){5}([0-9A-F][0-9A-F]) 2 0 0 1
|
|
3582 3582 verint=\d+&uid=\d+&wv=[A-Za-z0-9]+&report=\d+&abbr=[A-Za-z0-9]+&pid=\d 2 0 0 1
|
|
3583 3583 ^\d+$ 2 0 0 1
|
|
3584 3584 ^(\d+|x.+) 2 0 0 1
|
|
3585 3585 ^[a-z0-9]{12,14}(&p2=([a-z0-9]([\._-])?){1,24}(_DROPPER)?)$ 2 0 0 1
|
|
3586 3586 id=x.+_[0-9A-F]{8}&build_id=. 2 0 0 1
|
|
3587 3587 ^[A-Za-z0-9+\/=]+?$ 2 0 0 1
|
|
3588 3588 v=\d+&rnd=\d 2 0 0 1
|
|
3589 3589 \?mac=[0-9]*?&os=[a-z]*?&ver=[0-9]{8}&id= 2 0 0 1
|
|
3590 3590 p4=\d+&p5=\d+&hs=\d 2 0 0 1
|
|
3591 3591 ^[a-f0-9] 2 0 0 1
|
|
3592 3592 ^\d 2 0 0 1
|
|
3593 3593 \x2Ephp\x3Fid\x3D\d*\x26v\x3D\d*\x26tm\x3D\d*\x26b\x3D 2 0 0 1
|
|
3594 3594 \.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})+&ver=\d 2 0 0 1
|
|
3595 3595 id=\d+&bid=[^&]+&query=\w+&data=\w 2 0 0 1
|
|
3596 3596 ^[a-z]{1,4}\x3d[a-z0-9]+?$ 2 0 0 1
|
|
3597 3597 ^\d{5}\x2eddns[a-z0-9]\x2eeu$ 2 0 0 1
|
|
3598 3598 ^\/[A-Z]+\.php\?php=receipt$ 2 0 0 1
|
|
3599 3599 ^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x3A[0-9]{1,5} 2 0 0 1
|
|
3600 3600 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
3601 3601 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
3602 3602 ^[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}$ 2 0 0 1
|
|
3603 3603 ^(id|key)= 2 0 0 1
|
|
3604 3604 User-Agent\x3a[^\r\n]+[^\x20]\x3bTrident\/4\.0\x29\s\d{2}\x3a\d{2}\s\r$ 2 0 0 1
|
|
3605 3605 &userid=\d{4}&other=[MF] 2 0 0 1
|
|
3606 3606 ^[A-Z]{10}$ 2 0 0 1
|
|
3607 3607 ^\x2F[a-f0-9]{40,60}$ 2 0 0 1
|
|
3608 3608 \/[a-z0-9]+$ 2 0 0 1
|
|
3609 3609 ^[a-z0-9]{196} 2 0 0 1
|
|
3610 3610 ^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1
|
|
3611 3611 ^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1
|
|
3612 3612 ^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1
|
|
3613 3613 \/[a-z]\/$ 2 0 0 1
|
|
3614 3614 ^\/ad[^\x2f]*?\/\?[a-z]{1,5}\x3d\x2e?[a-z0-9]+?$ 2 0 0 1
|
|
3615 3615 ^[a-z]{15}$ 2 0 0 1
|
|
3616 3616 ^[a-z]{3,4}\/\d{1,4}$ 2 0 0 1
|
|
3617 3617 ^subject=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})_((list|que)_done|ini(_done)?)&data 2 0 0 1
|
|
3618 3618 ^\d+?\x22 2 0 0 1
|
|
3619 3619 ^\/[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{5}\/\d+\/\d{2}[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{3}\/$ 2 0 0 1
|
|
3620 3620 ^[^\r\n]+?\$ 2 0 0 1
|
|
3621 3621 ^[A-Za-z0-9]{15}([A-Za-z0-9]{19})?$ 2 0 0 1
|
|
3622 3622 =[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1
|
|
3623 3623 ^[a-f0-9]{32}\/[0-9]$ 2 0 0 1
|
|
3624 3624 \/get\d*\.php\?c=[A-Z]{8}&d=[0-9A-F]{250,}$ 2 0 0 1
|
|
3625 3625 \/crypt_[^\/]*?sell[^\/]*?\d\.exe$ 2 0 0 1
|
|
3626 3626 \/[A-F0-9]+$ 2 0 0 1
|
|
3627 3627 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1
|
|
3628 3628 ^[^\x22\x2f\r\n]+?\x22\r\n 2 0 0 1
|
|
3629 3629 ^[^&]+?&\d+$ 2 0 0 1
|
|
3630 3630 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3631 3631 ^id=[A-Z0-9]+?&info=[A-Z0-9]+?$ 2 0 0 1
|
|
3632 3632 ^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3} 2 0 0 1
|
|
3633 3633 ^\x2F(policy|cache)$ 2 0 0 1
|
|
3634 3634 ^(ode)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&h(wid) 2 0 0 1
|
|
3635 3635 (\?|&)guid=[^!&]+?\! 2 0 0 1
|
|
3636 3636 ^\d+\d+?(&ver=\d+?)?&req=\d+?(&r=)?$ 2 0 0 1
|
|
3637 3637 ^mac=([A-F0-9]{2}-){5}[A-F0-9]{2}&t1= 2 0 0 1
|
|
3638 3638 \.((jp|pn)g|cgi|gif)\?tq= 2 0 0 1
|
|
3639 3639 ^\/[b-u][A-Za-z0-9]{6,25}\.php$ 2 0 0 1
|
|
3640 3640 ^Last-Modified\x3a(\s[^\r\n]{2}|[^\r\n\s]{3}), 2 0 0 1
|
|
3641 3641 ^\d{5,}$ 2 0 0 1
|
|
3642 3642 \?[0-9a-f]{6}$ 2 0 0 1
|
|
3643 3643 \?ID=[A-Z]{10}$ 2 0 0 1
|
|
3644 3644 ^[0-9A-F]{12,24} 2 0 0 1
|
|
3645 3645 ^\x2F[a-f0-9]{40,60}$ 2 0 0 1
|
|
3646 3646 \.cgi\?s(id)\d{1,12}&r= 2 0 0 1
|
|
3647 3647 \/([^\x2f]+?\/)?[a-z-_]+?\.(php|html)$ 2 0 0 1
|
|
3648 3648 ^\x2fimage\x2f[A-Za-z0-9\+_-]+\.jpg$ 2 0 0 1
|
|
3649 3649 \/\/?$ 2 0 0 1
|
|
3650 3650 ^(\x3a\d{1,5})?$ 2 0 0 1
|
|
3651 3651 ^(\x3a\d{1,5})?$ 2 0 0 1
|
|
3652 3652 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$ 2 0 0 1
|
|
3653 3653 ^[A-Za-z0-9]{48}\x3a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$ 2 0 0 1
|
|
3654 3654 \/0\/$ 2 0 0 1
|
|
3655 3655 ^[^\x2f]+\/[a-z0-9]+$ 2 0 0 1
|
|
3656 3656 \/([a-z]{4,9}\/[a-z]{3,10}\?[a-z_]{2,9}=[0-9]{2,8}|[a-z]{10})&[a-z]{5,9}=[a-zA-Z0-9_*]{30,}$ 2 0 0 1
|
|
3657 3657 ^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}_ 2 0 0 1
|
|
3658 3658 ^\/lolo\/[0-9]+\/[0-9]+\/[0-9]+\/[0-9]+\.html$ 2 0 0 1
|
|
3659 3659 ^\/log\/[0-9]+\/[0-9]+\/\?id=[0-9]+$ 2 0 0 1
|
|
3660 3660 ^\/[\/a-z0-9]+$ 2 0 0 1
|
|
3661 3661 ^\/\?\d([A-Za-z0-9~_]{4})*([A-Za-z0-9~_]{2}--|[A-Za-z0-9~_]{3}-|[A-Za-z0-9~_]{4})$ 2 0 0 1
|
|
3662 3662 ^\/UID\d+\.jsp\? 2 0 0 1
|
|
3663 3663 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$ 2 0 0 1
|
|
3664 3664 \.php\?id=[a-zA-Z]{15,}&?x=\d+&?os=[0-9.]+&?n=\d 2 0 0 1
|
|
3665 3665 ^[0-9A-F]{550,}\.html 2 0 0 1
|
|
3666 3666 \/Setup_\d+\.exe$ 2 0 0 1
|
|
3667 3667 \?0=.*\&1=.*\&2=.*\&3=.*\&4=.*\&5=.*\&6=.*\&7=.*\&8= 2 0 0 1
|
|
3668 3668 &ver=\d\.\d$ 2 0 0 1
|
|
3669 3669 ^\/([A-Fa-f0-9]+|index\.php)$ 2 0 0 1
|
|
3670 3670 ^(c(omment|_id)|m(jdu)?)= 2 0 0 1
|
|
3671 3671 ^\/1+$ 2 0 0 1
|
|
3672 3672 (MSIE|rv\x3a11) 2 0 0 1
|
|
3673 3673 \/\d+\.png\?uid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$ 2 0 0 1
|
|
3674 3674 &data=([a-z]\d){7,}$ 2 0 0 1
|
|
3675 3675 ^([a-z]\d){7,}\.zip\x22 2 0 0 1
|
|
3676 3676 (MSIE|rv\x3a11\.0) 2 0 0 1
|
|
3677 3677 ^\x2f[a-zA-Z]{4,}\x2ephp\x3f[a-zA-Z]{2,10}\x3d([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+ 2 0 0 1
|
|
3678 3678 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1
|
|
3679 3679 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$ 2 0 0 1
|
|
3680 3680 =0[0-2](&\w+=[a-fA-F0-9]{8}){2}&\w+=[a-fA-F0-9]+$ 2 0 0 1
|
|
3681 3681 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
3682 3682 0[0-2]0000[a-fA-F0-9]{16,}$ 2 0 0 1
|
|
3683 3683 ^\d+$ 2 0 0 1
|
|
3684 3684 ^([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})+ 2 0 0 1
|
|
3685 3685 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+?$ 2 0 0 1
|
|
3686 3686 ^\x5b[^\r\n]+\(64\s=\s\d\)\sEXE\s= 2 0 0 1
|
|
3687 3687 ^[a-zA-Z0-9+/]{43} 2 0 0 1
|
|
3688 3688 ^winver=\d+&ver=\d+$ 2 0 0 1
|
|
3689 3689 ^\/\?0=([^&]+?&\d+)+?[^=&]+?$ 2 0 0 1
|
|
3690 3690 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1
|
|
3691 3691 ^[a-z]{2,}=(%[A-F0-9]{2})+& 2 0 0 1
|
|
3692 3692 ^[a-z]{2,}=(%[A-F0-9]{2})+& 2 0 0 1
|
|
3693 3693 ^\/[^\x2f]+\/0000[A-F0-9]{4}\/0[0-2]\/[A-F0-9]{8}$ 2 0 0 1
|
|
3694 3694 ^\/0[0-2]\/[^\x2f]+\/0000[A-F0-9]{4}\/[^\x2f]+\/[A-F0-9]{8}$ 2 0 0 1
|
|
3695 3695 ^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]svchost\.exe[\x22\x27]\r\n 2 0 0 1
|
|
3696 3696 ^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]explorer\.exe[\x22\x27]\r\n 2 0 0 1
|
|
3697 3697 ^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]hkcmd\.exe[\x22\x27]\r\n 2 0 0 1
|
|
3698 3698 ^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]server\.exe[\x22\x27]\r\n 2 0 0 1
|
|
3699 3699 ^\d+?\/(\d+?\/-?\d+?\.(php|jsp))?$ 2 0 0 1
|
|
3700 3700 \?uid=\d+&context=\w+&mode=text&data=\w+$ 2 0 0 1
|
|
3701 3701 ^\/\d+$ 2 0 0 1
|
|
3702 3702 ^\/sys\/(who|genid|data|upload|update) 2 0 0 1
|
|
3703 3703 ^a=(%[0-9A-Fa-f]{2})+\x26b=[0-9A-Za-z]+(%3[dD]){0,2}\x26c=(%[0-9A-Fa-f]{2})+$ 2 0 0 1
|
|
3704 3704 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3705 3705 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3706 3706 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3707 3707 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3708 3708 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1
|
|
3709 3709 ^\/[a-z]+\/[a-z]+\.exe$ 2 0 0 1
|
|
3710 3710 \.php\?uid=\d{5,6}&ver=[^&]+(&traff=\d+)?$ 2 0 0 1
|
|
3711 3711 ^Host\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1
|
|
3712 3712 ^[a-z]{4,12}=([A-Za-z0-9+/]{4})*[A-Za-z0-9+/]{3}=&[a-z]{4,12}=[A-Za-z0-9+/]{4} 2 0 0 1
|
|
3713 3713 \/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$ 2 0 0 1
|
|
3714 3714 ^http\x3a\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/[a-z_-]+\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r?$ 2 0 0 1
|
|
3715 3715 ^[C-J]\r\n 2 0 0 1
|
|
3716 3716 ^[A-Z]+$ 2 0 0 1
|
|
3717 3717 ^(32|64)$ 2 0 0 1
|
|
3718 3718 \/$ 2 0 0 1
|
|
3719 3719 ^[a-f0-9]+(\x20[a-f0-9]+)+$ 2 0 0 1
|
|
3720 3720 ^\/-?[a-f0-9]{8,9}\/-?\d+(\.php|\/)$ 2 0 0 1
|
|
3721 3721 &_=\d+$ 2 0 0 1
|
|
3722 3722 &_=\d+$ 2 0 0 1
|
|
3723 3723 &_=\d+$ 2 0 0 1
|
|
3724 3724 ^User-Agent\x3a[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x30442e9d036a40c8cbd41f8f4c9afab1ba\x20no-cache\r\n(\r\n)?$ 2 0 0 1
|
|
3725 3725 ^\d+$ 2 0 0 1
|
|
3726 3726 ^[a-z]=[a-f0-9]{80,}$ 2 0 0 1
|
|
3727 3727 \/[a-f0-9]{32}\.png$ 2 0 0 1
|
|
3728 3728 &(un)?key=[A-Z]+$ 2 0 0 1
|
|
3729 3729 \.php\?pn=[^&]+&s=[0-9]+&x=0\.[0-9]{7}$ 2 0 0 1
|
|
3730 3730 ^\/([a-z]{4,9}\/[a-z]{4,12}\?[a-z]{4,7}\=[0-9]{5,7})$ 2 0 0 1
|
|
3731 3731 ^\/p\?\d+(\x3b\d+){4}$ 2 0 0 1
|
|
3732 3732 ^\/s\?\d+\x3b\d+\x3b\d{1,2}\.\d_(32|64)_\d+(\x3b\d+){4}$ 2 0 0 1
|
|
3733 3733 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
3734 3734 \/[a-f0-9]{8}\/archive\/\d{8,10}\.html$ 2 0 0 1
|
|
3735 3735 \?[0-9a-f]{5,}=\d+&id=\d+&v=\d+$ 2 0 0 1
|
|
3736 3736 iid=[a-fA-F0-9]{32}&kernel= 2 0 0 1
|
|
3737 3737 iid=[a-fA-F0-9]{32}&username= 2 0 0 1
|
|
3738 3738 ^[a-z]{2}\x3d[a-z0-9]+?[A-F0-9]+?$ 2 0 0 1
|
|
3739 3739 ^\x2F[a-z]\x2Ephp\x3Fp\x3D[a-z0-9]{30,}$ 2 0 0 1
|
|
3740 3740 ^\x2Ftrack\x2F\x3Fip\x3D\d&data\x3D 2 0 0 1
|
|
3741 3741 \/\d{5}\/(<s1>[a-z]{3})[a-z]\.php\?(=s1)_id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3742 3742 ^filename=[a-z]+?\.[a-z]+?&data= 2 0 0 1
|
|
3743 3743 ^Host\x3a[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)? 2 0 0 1
|
|
3744 3744 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1
|
|
3745 3745 ^\x0a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})\x0a 2 0 0 1
|
|
3746 3746 _W\d+\.[A-F0-9]+\/\d+\/[^\x2f]+\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/$ 2 0 0 1
|
|
3747 3747 x20InfoPath\x2e\d[^\x29]+$ 2 0 0 1
|
|
3748 3748 \/\d{4,}\.txt$ 2 0 0 1
|
|
3749 3749 \/([a-z]+|\d+)\.jpg 2 0 0 1
|
|
3750 3750 \?[a-z0-9]{32}$ 2 0 0 1
|
|
3751 3751 [a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1
|
|
3752 3752 \.[a-z]{3,4}$ 2 0 0 1
|
|
3753 3753 \/[A-Za-z]{4,9}\.dot$ 2 0 0 1
|
|
3754 3754 \/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}$ 2 0 0 1
|
|
3755 3755 \/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}&pdf=[a-zA-Z]{4,}$ 2 0 0 1
|
|
3756 3756 ^\/document\.php\?rnd=[0-9]{4}&id=[A-F0-9]{100,}$ 2 0 0 1
|
|
3757 3757 \/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$ 2 0 0 1
|
|
3758 3758 ^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}$ 2 0 0 1
|
|
3759 3759 ^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}&ncm=[a-zA-Z]{4,}$ 2 0 0 1
|
|
3760 3760 ^\/[a-f0-9]+000[a-f0-9]{37}$ 2 0 0 1
|
|
3761 3761 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3762 3762 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P 2 0 0 1
|
|
3763 3763 \.php\?check=\d$ 2 0 0 1
|
|
3764 3764 ^tekst=\w+$ 2 0 0 1
|
|
3765 3765 ^User-Agent\x3a MSIE \d+\.\d+\r\n 2 0 0 1
|
|
3766 3766 \/libso\d{1,4}\.php\?id=[a-zA-Z0-9]+$ 2 0 0 1
|
|
3767 3767 \/[0-9]{2}\.exe\?[0-9]$ 2 0 0 1
|
|
3768 3768 ^\/0[a-f0-9]{48}$ 2 0 0 1
|
|
3769 3769 path=[A-Z]\x3a\x5c[A-F0-9]+\r\nlog= 2 0 0 1
|
|
3770 3770 ^(Connection\x0d\x0a)?\x0d\x0a$ 2 0 0 1
|
|
3771 3771 ^[a-z0-9]{10,}$ 2 0 0 1
|
|
3772 3772 \?sid=[a-f0-9]{40}&cid=[0-9]$ 2 0 0 1
|
|
3773 3773 [A-F0-9]{8}(-[A-F0-9]{4}){2}-[A-F0-9]{8} 2 0 0 1
|
|
3774 3774 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3775 3775 \/[A-Za-z]+\.php\?(id|token1|token2|C)=[A-Za-z0-9] 2 0 0 1
|
|
3776 3776 ^([a-zA-Z]*?\d)([a-z0-9]*?[A-Z])[a-zA-Z0-9+/]{30} 2 0 0 1
|
|
3777 3777 ^[a-z]{256}$ 2 0 0 1
|
|
3778 3778 ^[abcdefghiklmnopqrstvxyz123456789]{62}\.aaaaaaaaaaaa 2 0 0 1
|
|
3779 3779 ^(Connection\x3a[^\r\n]+\r\n)?Accept\x3a[^\r\n]+\r\n(Accept-Encoding\x3a[^\r\n]+\r\n) 2 0 0 1
|
|
3780 3780 \.php\?lid=[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$ 2 0 0 1
|
|
3781 3781 ^[A-F0-9]{2}F4[A-F0-9]{2}0(1|2|3)[A-F0-9]{8} 2 0 0 1
|
|
3782 3782 &m=\d$ 2 0 0 1
|
|
3783 3783 ^[a-f0-9]{31}\x3B([a-zA-Z0-9+/=]+)?\r?$ 2 0 0 1
|
|
3784 3784 \?q=[a-f0-9]{32}$ 2 0 0 1
|
|
3785 3785 ^(<id>[a-z])\x22\sname=\x22(=id)\x22>TVqQAA 2 0 0 1
|
|
3786 3786 ^version=\d{4}-\d{1,2}-\d{1,2}$ 2 0 0 1
|
|
3787 3787 [\x80-\xff] 2 0 0 1
|
|
3788 3788 (xyz|pw)$ 2 0 0 1
|
|
3789 3789 ^[A-Z0-9_-]+\.analytics-akadns\.com$ 2 0 0 1
|
|
3790 3790 ^[A-Z0-9_-]+\.akamai-analytics\.com$ 2 0 0 1
|
|
3791 3791 ^[A-Z0-9_-]+\.akamai-information\.com$ 2 0 0 1
|
|
3792 3792 ^[A-Z0-9_-]+\.akamai-technologies\.com$ 2 0 0 1
|
|
3793 3793 ^[A-Z0-9_-]+\.sync-akamai\.com$ 2 0 0 1
|
|
3794 3794 ^\/[^\r\n]+\.php\?[a-f0-9]{32}+$ 2 0 0 1
|
|
3795 3795 ^.{0,15}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3796 3796 \?---[A-Z]$ 2 0 0 1
|
|
3797 3797 ^\/help(me)?\.bmp$ 2 0 0 1
|
|
3798 3798 \/[a-z0-9]{16}\.php\?ufw=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3799 3799 (BrowsingHistoryView|WebBrowserPassView)\.exe$ 2 0 0 1
|
|
3800 3800 [\x80-\xff] 2 0 0 1
|
|
3801 3801 \.php\?a=\d{5,10}.+\x3a\d\x3a\d\x3a\d\.\d\x3a\d$ 2 0 0 1
|
|
3802 3802 =8ACEFC[0-9A-F]{150,}$ 2 0 0 1
|
|
3803 3803 \?[a-f0-9]{32}$ 2 0 0 1
|
|
3804 3804 ^ps0=[A-F0-9]+\&ps1=[A-F0-9]+($|\&[a-z]s\d=) 2 0 0 1
|
|
3805 3805 \.php\?computerid=[a-fA-F0-9]{32}&(public|private)=\d$ 2 0 0 1
|
|
3806 3806 ^[^_]+_[^\_]+_[A-F0-9]{10}_[0-9]{2}-[0-9]{2}-20[0-9]{2}\s[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{1,2}\. 2 0 0 1
|
|
3807 3807 \/(tr(_w)?|ft)\.so$ 2 0 0 1
|
|
3808 3808 ^([a-zA-Z0-9+/\x20]{4})*([a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{3}=|[a-zA-Z0-9+/\x20]{4})$ 2 0 0 1
|
|
3809 3809 ^\/v\d+\/lady_[ix] 2 0 0 1
|
|
3810 3810 \/(IUpdate|fbclient|IETask|Mixeds|Ubuntu10)\.dll$ 2 0 0 1
|
|
3811 3811 \?action=\d(&botId=[A-F0-9]{32})?$ 2 0 0 1
|
|
3812 3812 ^[^&]+?\.html\?s=[^&]+?&d=$ 2 0 0 1
|
|
3813 3813 \/victim\.php\?info=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&ip=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3814 3814 \/savekey\.php\?file=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3815 3815 \/images\/.*_2[FB].*\.(avi|gif|bmp|jpeg|png)$ 2 0 0 1
|
|
3816 3816 ^[A-F0-9]{8}$ 2 0 0 1
|
|
3817 3817 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a)? 2 0 0 1
|
|
3818 3818 [A-Za-z]{1,10}=[A-Za-z0-9_+\x2d\x2e] 2 0 0 1
|
|
3819 3819 ^\/kb\/\d{4,8}$ 2 0 0 1
|
|
3820 3820 \.[a-z]{3}\?[a-z]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3821 3821 ^[a-zA-Z]{7}=([A-Za-z0-9+/]|%2[FB]){2}AAAA[a-z]A[^\s=]+=?$ 2 0 0 1
|
|
3822 3822 END\x20CERTIFICATE-----$ 2 0 0 1
|
|
3823 3823 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$ 2 0 0 1
|
|
3824 3824 ^get=\d+($|&) 2 0 0 1
|
|
3825 3825 ^(Mozilla\/|Shockwave) 2 0 0 1
|
|
3826 3826 =11&[^&]{1,7}2[^&]{6,12}&[^&]{1,7}410&[^&]{1,7}650&[^&]{1,7}51$ 2 0 0 1
|
|
3827 3827 (\x20MSIE\x20|rv\x3a11) 2 0 0 1
|
|
3828 3828 ^id=[0-9A-Z]+&count= 2 0 0 1
|
|
3829 3829 ^guid=[^&]+?&ver=[^&]+?(&fc=[^\r\n]+)?$ 2 0 0 1
|
|
3830 3830 \.php\?rid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3831 3831 ^machine=[^&]+$/Pi 2 0 0 1
|
|
3832 3832 \.(arm(5n|7)?|m(ips|psl))$ 2 0 0 1
|
|
3833 3833 [a-z]+\.php\?aid=\d+&sid=[a-z0-9]+$ 2 0 0 1
|
|
3834 3834 ^\/oscp\/[a-z]+$ 2 0 0 1
|
|
3835 3835 \/(countdown|check)\/[a-f0-9]{30,45}\/([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})?$ 2 0 0 1
|
|
3836 3836 \.php\?key=[^\r\n]+&string=[^\r\n]+?(\x3a\x3a[^\x3a]+?){5,}$ 2 0 0 1
|
|
3837 3837 \.php\?key=[^\r\n]+&string=[^\r\n]+?((\x3a\x3a|3A3A)[^\x3a]+?){5,}$ 2 0 0 1
|
|
3838 3838 ^((Passwords|PCinformation)\.txt|(Data|GrabbedTxtFiles)\.zip)\x22\r\n 2 0 0 1
|
|
3839 3839 \/[a-z]+2\.php\?jpg=[^&]+$ 2 0 0 1
|
|
3840 3840 ^[a-f0-9]{8}\.(s(pac|it)e|net|top)$ 2 0 0 1
|
|
3841 3841 ^[a-f0-9]{8}\.(s(pac|it)e|net|top)$ 2 0 0 1
|
|
3842 3842 \.php\?Hwid=[^&]+[0-9](&(Pc|Etat)=[^&]+)?(&user=[^&]+&Ip=[^&]+&Ping=[^&]+&v=[^&]+&Ville=[^&]+&Pays=[^&]+&Region=[^&]+)?$ 2 0 0 1
|
|
3843 3843 \.php\?[a-z]{3,8}=[a-f0-9]{16}[01][a-z]+$ 2 0 0 1
|
|
3844 3844 ^((a((lbu|d)m|ccount|uthor)|c(ont(ac|en)|lien)t|p(artners|hoto)|(memb|us)er|session|video|hash|key|id)=[a-z0-9]{6,12}&){4} 2 0 0 1
|
|
3845 3845 \.(aspx|txt)\?[a-z0-9]{3}=[a-f0-9]{32}&[a-z0-9]{3}=[^&]+&[a-z0-9]{3}=[a-f0-9]{32}$ 2 0 0 1
|
|
3846 3846 \.php\?string=[a-zA-Z0-9+=]+$ 2 0 0 1
|
|
3847 3847 ^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$ 2 0 0 1
|
|
3848 3848 ^c=[A-F0-9]{10,}&v=[^&]+&h=[^&]+&t=[0-9]$ 2 0 0 1
|
|
3849 3849 ^([a-f0-9]{30,60})$ 2 0 0 1
|
|
3850 3850 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3851 3851 \x26affid\x3D[0-9]{4,7}$ 2 0 0 1
|
|
3852 3852 [\x80-\xff]{16} 2 0 0 1
|
|
3853 3853 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3} 2 0 0 1
|
|
3854 3854 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3} 2 0 0 1
|
|
3855 3855 ^[0-9a-f]{4,8}\x3d\x2d?\d+(&id\x3d\d+)?$ 2 0 0 1
|
|
3856 3856 ^[A-Z0-9]{18}$ 2 0 0 1
|
|
3857 3857 ^[a-z]{3,4}\x2F[a-f0-9]{24}$ 2 0 0 1
|
|
3858 3858 ^\/[a-z0-9]{1,10}\/?\?.+?$ 2 0 0 1
|
|
3859 3859 \/[a-z0-9A-Z]\.exe$ 2 0 0 1
|
|
3860 3860 ^\d+$ 2 0 0 1
|
|
3861 3861 ^\d+$ 2 0 0 1
|
|
3862 3862 ^\/[a-z0-9+\/=]{16,400}$ 2 0 0 1
|
|
3863 3863 &s=\{?[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}\}?(&|$) 2 0 0 1
|
|
3864 3864 ^(cache|logs)\/[^\x2f]+\.(exe|dll|doc|bin)$ 2 0 0 1
|
|
3865 3865 ^\/[a-z0-9.&-]+([a-z0-9]{4}-){3}[a-z0-9.&+-]+$ 2 0 0 1
|
|
3866 3866 =\d+$ 2 0 0 1
|
|
3867 3867 \/[A-Z0-9]+\.[aj]sp\?[a-zA-Z0-9+/\x20=]+$ 2 0 0 1
|
|
3868 3868 \.php\?w=\d+&i=[0-9a-f]{32}&a=\d+$ 2 0 0 1
|
|
3869 3869 \?action=\w+gen&v=\d 2 0 0 1
|
|
3870 3870 \/counter(\?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}[0-9][A-Za-z_-]{0,200}[0-9])([A-Z0-9_-]{0,200}[a-z][A-Z0-9_-]{0,200}[a-z])([a-z0-9_-]{0,200}[A-Z][a-z0-9_-]{0,200}[A-Z])[A-Za-z0-9_-]{50,}(&|$) 2 0 0 1
|
|
3871 3871 ^[^\r\n]+\.(jpe?g|gif|png)\r\n 2 0 0 1
|
|
3872 3872 ^\/report[0-9]?_(v[0-9])?[A-Z]?[A-F0-9_-]+_[0-9]{1,3}_(st(arted|ep)|already|mark|p(rocess|a(ge|yload))|watch2|http|image|gdiplus|crc|DIRRR|finished|(ex(cept|ecuted))) 2 0 0 1
|
|
3873 3873 \/[a-z]+\.php\?[A-F0-9]{250,}$ 2 0 0 1
|
|
3874 3874 ^Accept\x3a\x20text\/\*,\x20application\/\*\r\nUser-Agent\x3a\x20[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\nConnection\x3a Keep-Alive\r\nHost\x3a[^\r\n]+?\r\n(\r\n)?$ 2 0 0 1
|
|
3875 3875 ^[A-F0-9]{250,}$ 2 0 0 1
|
|
3876 3876 ^\d+?$ 2 0 0 1
|
|
3877 3877 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3878 3878 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3} 2 0 0 1
|
|
3879 3879 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
3880 3880 ^\/debug\/trace\/(Fw(Downloaded|Check)|N(oFw|sis))$ 2 0 0 1
|
|
3881 3881 ^\/[a-z]+\.php\?num=\d+&rev= 2 0 0 1
|
|
3882 3882 ^[A-Za-z0-9]{14,15}$ 2 0 0 1
|
|
3883 3883 ^\d{2}$ 2 0 0 1
|
|
3884 3884 \.php\?v\x3d\d+?\x26rs\x3d((\d+?\x2d){3})?\d+?\x26n\x3d\d 2 0 0 1
|
|
3885 3885 ^(<vname>[^\r\n\x3a]+)(<n1>[0-4])\x3a\x20\d+\r\n(=vname)(<n2>(((=n1))[0-4]))\x3a\x20\d+\r\n(=vname)(<n3>((((=n1)|(=n2)))[0-4]))\x3a\x20\d+\r\n(=vname)((((=n1)|(=n2)))[0-4])\x3a\x20\d+\r\n 2 0 0 1
|
|
3886 3886 \/counter\/\?id=[A-Z0-9_-]{60,}&rnd=\d{1,}$ 2 0 0 1
|
|
3887 3887 ^[0-9a-f]{32}\.php 2 0 0 1
|
|
3888 3888 ^[A-F0-9]{30} 2 0 0 1
|
|
3889 3889 ^[a-f0-9]{24}$ 2 0 0 1
|
|
3890 3890 ^\x00\x00\x00[\x72-\x74] 2 0 0 1
|
|
3891 3891 (\d{1,3}\.){3}\d{1,3} (\d{1,3}\.){3}\d{1,3} \x3a(Linux|FreeBSD|SunOS) 2 0 0 1
|
|
3892 3892 ^\d+[\x22\x27] 2 0 0 1
|
|
3893 3893 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3894 3894 ^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e]) 2 0 0 1
|
|
3895 3895 ^(-[0-9]+|[A-F0-9]{32})=1&type=txt$ 2 0 0 1
|
|
3896 3896 ^([a-f0-9]{2}-){5}[a-f0-9]{2} 2 0 0 1
|
|
3897 3897 ^[a-f0-9]{18}\x22 2 0 0 1
|
|
3898 3898 ^(<id>[a-z])\x22\sname=\x22(=id)\x22>[a-zA-Z0-9+/=]{28} 2 0 0 1
|
|
3899 3899 ^[A-Za-z0-9]{10,}[\-\)\(]{1,2} 2 0 0 1
|
|
3900 3900 data=[a-zA-Z0-9\+\/]{64}/P 2 0 0 1
|
|
3901 3901 <root><clnt>\d{8}-\d{4}-\d{4}-\d{4}-[0-9A-F]{12}</clnt><code>CheckUpdate</code>/P 2 0 0 1
|
|
3902 3902 \d{2}\x7C\d{1,3}\x7C\d{1,3}http\x3A\x2F\x2F 2 0 0 1
|
|
3903 3903 ^X-ID\x3a\x20\d+\r?$/Hm 2 0 0 1
|
|
3904 3904 \/ff\.ie\?rnd=\x2d?\d 2 0 0 1
|
|
3905 3905 c=[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2} 2 0 0 1
|
|
3906 3906 ^.{2}(<fake_org>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]).+?\x06\x03\x55\x04\x0a.{2}(=fake_org) 2 0 0 1
|
|
3907 3907 ^\d{1,6}\x00msg\x7c 2 0 0 1
|
|
3908 3908 ^\/counter\/\?([a-z]=(0\.\d{8}|1[A-Z0-9a-z]+))+&r=\d+$ 2 0 0 1
|
|
3909 3909 [^A-Za-z0-9+/]TVqQA 2 0 0 1
|
|
3910 3910 \/im(age|g)\.php\?id=\d+$ 2 0 0 1
|
|
3911 3911 ^.{1,1000}p([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?o([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27]) 2 0 0 1
|
|
3912 3912 ^(-[0-9]+|[A-F0-9]{32})=1$ 2 0 0 1
|
|
3913 3913 ^([a-z0-9]{0,19}[A-Z])(([A-Z0-9]{0,19}[a-z])|([A-Za-z]{0,19}\d)|([A-Z]+\.))[a-zA-Z0-9]{3,20}[\x2e\x20][a-z]{2,3}$ 2 0 0 1
|
|
3914 3914 ^.{0,15}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3915 3915 ^\d{30}\w{6}-\d{2}-\d{3}-\d{9}$ 2 0 0 1
|
|
3916 3916 (\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
3917 3917 ^[a-zA-Z0-9/+]{171}= 2 0 0 1
|
|
3918 3918 ms-?office 2 0 0 1
|
|
3919 3919 ^(Connection\r\n)?\r\n$ 2 0 0 1
|
|
3920 3920 ^(Connection\r\n)?\r\n$ 2 0 0 1
|
|
3921 3921 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3922 3922 ^[0-9]+lu[0-9]+d[0-9]+$ 2 0 0 1
|
|
3923 3923 ^[a-f0-9]{16}$ 2 0 0 1
|
|
3924 3924 ^[a-z0-9_\/+-]{1000} 2 0 0 1
|
|
3925 3925 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3926 3926 ^\d{4,8}$ 2 0 0 1
|
|
3927 3927 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3928 3928 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1
|
|
3929 3929 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1
|
|
3930 3930 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1
|
|
3931 3931 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1
|
|
3932 3932 ^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3} 2 0 0 1
|
|
3933 3933 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1
|
|
3934 3934 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1
|
|
3935 3935 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1
|
|
3936 3936 ^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3} 2 0 0 1
|
|
3937 3937 ^Host\x3a\x20[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)?$ 2 0 0 1
|
|
3938 3938 ^(WOW64\x3b\s)?Trident\/[457]\.0\x3b\s*SLCC2\x3b\s\.NET\sCLR\s2\.0\.50727\x3b\s\.NET\sCLR\s3\.5\.30729\x3b\s(\x20\.NET\x20CLR\x203\.5\.30729\x3b\s)?\.NET\sCLR\s3\.0\.30729\x3b\sMedia\sCenter\sPC\s6\.0\x3b\s\.NET4\.0C\x3b\s\.NET4\.0E(\.NET4\.0E(\x3b\s)?)?(\x3b\sInfoPath\.3)?\)$ 2 0 0 1
|
|
3939 3939 ^[a-z0-9]+\.(biz|com|net|org) 2 0 0 1
|
|
3940 3940 \/wp-(content|admin|includes)\/ 2 0 0 1
|
|
3941 3941 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
3942 3942 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3943 3943 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3944 3944 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3945 3945 ^[A-Za-z0-9\/\-\+]{40,}\.=auth\. 2 0 0 1
|
|
3946 3946 ^[A-Za-z0-9\/\-\+]{10,}\.=connect\. 2 0 0 1
|
|
3947 3947 ^[A-Za-z0-9\/\-\+]{10,}AAAA--\. 2 0 0 1
|
|
3948 3948 ^[A-Z]{2}-[0-9]{1,5}\x3aEnd(\x3a[0-9]{1,5})?$ 2 0 0 1
|
|
3949 3949 ^[a-z0-9]{8} 2 0 0 1
|
|
3950 3950 ^(\d{1,3}\.)\d{1,3}$ 2 0 0 1
|
|
3951 3951 ^\/[a-z]\.php\?query=[a-f0-9]{32}$ 2 0 0 1
|
|
3952 3952 ^[A-F0-9]{50,}$ 2 0 0 1
|
|
3953 3953 ^([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=|[A-Z0-9+\/]{4})$ 2 0 0 1
|
|
3954 3954 ^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$ 2 0 0 1
|
|
3955 3955 ^data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
3956 3956 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1
|
|
3957 3957 ^(<js>\$[a-z0-9]{1,15})\s*=\s*\[System\.Text\.Encoding\]::ASCII\.GetString\(\[System\.Convert\]::FromBase64String\((=js)\)\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.[a-z0-9]{2,4}\s*|-Value\s*(=js)\s*|-Encoding\s*ASCII){3} 2 0 0 1
|
|
3958 3958 ^(<content>\[a-z0-9]{1,15})\s*=\s*\[System\.Convert\]::FromBase64String\(\$[a-z0-9]{1,15}\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.vbe\s*|-Value\s*(=content)\s*|-Encoding\s*Byte){3} 2 0 0 1
|
|
3959 3959 ^[a-zA-Z0-9\x21\x2a\x2f\x2e\x3b\x3a\x5b\x5d\x7b\x7d]+$ 2 0 0 1
|
|
3960 3960 ^[0-9]{3,5}\s*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$ 2 0 0 1
|
|
3961 3961 ^[a-z0-9]{3,10}$ 2 0 0 1
|
|
3962 3962 ^[a-z0-9]{5,30}$ 2 0 0 1
|
|
3963 3963 ^\d{3,15}$ 2 0 0 1
|
|
3964 3964 ^\/([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
3965 3965 ^[a-z]{3,10}=[a-z0-9]+$ 2 0 0 1
|
|
3966 3966 ^[a-z]{3,10}=[a-z0-9]+$ 2 0 0 1
|
|
3967 3967 ^[a-z]{3,10}=[a-z0-9]+$ 2 0 0 1
|
|
3968 3968 ^\.(space|press|website)$ 2 0 0 1
|
|
3969 3969 ^\/hyllkjit\/[a-f0-9]{8}\/\?n=\d{4,10}$ 2 0 0 1
|
|
3970 3970 ^9([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
3971 3971 ^(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?<pushvar>\.push\x28\x22)(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar) 2 0 0 1
|
|
3972 3972 ^lessie(\/[0-9]\.0)?$ 2 0 0 1
|
|
3973 3973 ^Cakle(\/[0-9]\.0)?$ 2 0 0 1
|
|
3974 3974 ^Damien(\/[0-9]\.0)?$ 2 0 0 1
|
|
3975 3975 ^Solar(\/[0-9]\.0)?$ 2 0 0 1
|
|
3976 3976 ^muhstik(-scan)?(\/[0-9]\.0)?$ 2 0 0 1
|
|
3977 3977 ^Shaolin(\/[0-9]\.0)?$ 2 0 0 1
|
|
3978 3978 ^Rift(\/[0-9]\.0)?$ 2 0 0 1
|
|
3979 3979 ^Tsunami(\/[0-9]\.0)?$ 2 0 0 1
|
|
3980 3980 ^Yowai(\/[0-9]\.0)?$ 2 0 0 1
|
|
3981 3981 ^Yakuza(\/[0-9]\.0)?$ 2 0 0 1
|
|
3982 3982 ^Hentai(\/[0-9]\.0)?$ 2 0 0 1
|
|
3983 3983 \/[A-Za-z0-9]{2,8}[-_][a-zA-Z0-9-_]+\/\?InvoiceType=Regular&date=[0-9-_]+$ 2 0 0 1
|
|
3984 3984 ^[A-F0-9]+\x2d\x2d\x3e(\r\n)?$ 2 0 0 1
|
|
3985 3985 ^CN=(help|g(ui(de|ld)|round))\.domainoutlet\.site$ 2 0 0 1
|
|
3986 3986 ^CN=((jasper|qwe|alter|car|param|bike|genwar)\.)?drivethrough\.top$ 2 0 0 1
|
|
3987 3987 ^CN=((justin|digest)\.)?drinkeatgood\.space$ 2 0 0 1
|
|
3988 3988 ^\d 2 0 0 1
|
|
3989 3989 ^\/[a-zA-Z0-9]{1,19}\/?\?[abdefijhgv\x22](\x7C\x2d?\d+?[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\%^&\(\)\x20_{}\.~]{1,14})?$ 2 0 0 1
|
|
3990 3990 ^\/(<n>\d)(=n){1,2}$ 2 0 0 1
|
|
3991 3991 \/\d+$ 2 0 0 1
|
|
3992 3992 ^\/[a-f0-9]{7,8}\/[a-f0-9]{7,8}\/$ 2 0 0 1
|
|
3993 3993 ^GET\x20\/[A-F0-9]{32}\x20HTTP\/1\.1\r\nHost\x3a\x20[^\r\n]+\r\n\r\n$ 2 0 0 1
|
|
3994 3994 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
3995 3995 _[A-F0-9]{12}\.jpg$ 2 0 0 1
|
|
3996 3996 _[A-F0-9]{12}&filename=\w{1,20}\.jpg$ 2 0 0 1
|
|
3997 3997 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1
|
|
3998 3998 ^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1
|
|
3999 3999 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
4000 4000 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4001 4001 ^[0-9]{3}$ 2 0 0 1
|
|
4002 4002 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4003 4003 ^.+(IlR5cGUiO|JUeXBlIj|iVHlwZSI6) 2 0 0 1
|
|
4004 4004 \.jpg\?v=\d+&d=(\d{8}T\d{6}Z)([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1
|
|
4005 4005 ^\/[^\x2f]+\/pops[a-z]?\.php$ 2 0 0 1
|
|
4006 4006 \.php\?s=\d+&cn= 2 0 0 1
|
|
4007 4007 ^[a-z]{4,10}\.freemooon\.org$ 2 0 0 1
|
|
4008 4008 [a-z]{4,10}\.olimpian\.org$ 2 0 0 1
|
|
4009 4009 [a-z]{4,10}\.sunsay\.biz$ 2 0 0 1
|
|
4010 4010 [a-z]{4,11}\.feellgood\.org$ 2 0 0 1
|
|
4011 4011 [a-z]{4,11}\.kinomix\.org$ 2 0 0 1
|
|
4012 4012 [a-z]{4,10}\.beneton\.biz$ 2 0 0 1
|
|
4013 4013 [a-z]{4,10}\.bigdoggi\.biz$ 2 0 0 1
|
|
4014 4014 [a-z]{4,10}\.bjksfohseaguu\.org$ 2 0 0 1
|
|
4015 4015 [a-z]{4,10}\.closedoors\.net$ 2 0 0 1
|
|
4016 4016 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4017 4017 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4018 4018 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4019 4019 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4020 4020 ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ 2 0 0 1
|
|
4021 4021 ^(www|bbs|cms|down|up|file|ftp) 2 0 0 1
|
|
4022 4022 \/log\/proc\.php.key=[a-z0-9]{11} 2 0 0 1
|
|
4023 4023 code=[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2} 2 0 0 1
|
|
4024 4024 x=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1
|
|
4025 4025 mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1
|
|
4026 4026 ^RAV\d\.\d\d 2 0 0 1
|
|
4027 4027 ^([a-z0-9:.,]{3,10}\s){50,}[a-z0-9:.,]{3,10}\s*$ 2 0 0 1
|
|
4028 4028 ^[a-zA-Z0-9]{20} 2 0 0 1
|
|
4029 4029 \x2E(p(hp|ng)|jpe?g|cgi|gif)\x3F(v\d{1,2}|pr)\x3D 2 0 0 1
|
|
4030 4030 \/\?rnd=\d+&id=\d+$ 2 0 0 1
|
|
4031 4031 port=[1-9]{1,5} 2 0 0 1
|
|
4032 4032 \/getfile\.php\?r=-?\d+&p= 2 0 0 1
|
|
4033 4033 \/manda\.php\?id=(-)?\d{8,10}&v=\w 2 0 0 1
|
|
4034 4034 \/\?id(\d+)?&rnd=\d+$ 2 0 0 1
|
|
4035 4035 \.php\?hdr_ctx=[0-9]{1,5}_[0-9]{1,5}$ 2 0 0 1
|
|
4036 4036 ^\/\d+\.functions$ 2 0 0 1
|
|
4037 4037 \/\d{10}$ 2 0 0 1
|
|
4038 4038 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
4039 4039 ^[A-F0-9]{100,}$ 2 0 0 1
|
|
4040 4040 ^\d 2 0 0 1
|
|
4041 4041 ^\/[a-z-_]+?\.(php|html)$ 2 0 0 1
|
|
4042 4042 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4043 4043 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
|
|
4044 4044 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4045 4045 ^data=[a-zA-Z0-9+\/]{64} 2 0 0 1
|
|
4046 4046 ^\d{4}$ 2 0 0 1
|
|
4047 4047 \.(jpg|png|gif)\?v[0-9]{1,2}=[0-9]+&tq= 2 0 0 1
|
|
4048 4048 ^\/[mp]od[12]\/[^\/]+?\.exe$ 2 0 0 1
|
|
4049 4049 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1
|
|
4050 4050 \/[0-9]{2}\.exe$ 2 0 0 1
|
|
4051 4051 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1
|
|
4052 4052 [\x80-\xff] 2 0 0 1
|
|
4053 4053 \.(me|net)$/W 2 0 0 1
|
|
4054 4054 \/[A-Z]?[a-z]{1,3}[0-9]?\.exe$ 2 0 0 1
|
|
4055 4055 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4056 4056 ^[a-z]\. 2 0 0 1
|
|
4057 4057 ^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$ 2 0 0 1
|
|
4058 4058 ^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$ 2 0 0 1
|
|
4059 4059 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4060 4060 ^m=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1
|
|
4061 4061 ^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$ 2 0 0 1
|
|
4062 4062 \/[0-9]{10}.php1$ 2 0 0 1
|
|
4063 4063 ^[A-F0-9]{10,}(BBZ|BBY)[A-F0-9]{,1000}$ 2 0 0 1
|
|
4064 4064 ^[A-F0-9]{10,}$ 2 0 0 1
|
|
4065 4065 ^[A-F0-9]{10,}$ 2 0 0 1
|
|
4066 4066 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
4067 4067 ^\/d[0-9]?\.php\?check$ 2 0 0 1
|
|
4068 4068 ^\/d[0-9]?\.php\?servers$ 2 0 0 1
|
|
4069 4069 ^\/[a-z]\.php\?check=[a-f0-9]{32}$ 2 0 0 1
|
|
4070 4070 ^[a-f0-9]{8}$ 2 0 0 1
|
|
4071 4071 \.aspx\?m=[A-F0-9]{3,40}&i=[A-F0-9]{3,40}&p=[A-F0-9]{3,40}$ 2 0 0 1
|
|
4072 4072 ^([\x3a\x2c\x2e]?[A-Za-z0-9]{1,8}[\x3a\x2c\x2e]?[\x3a\x2c\x2e]?\s*){50,}$ 2 0 0 1
|
|
4073 4073 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4074 4074 ^[a-z]{1,10}=[A-Z]+(&[a-z]{1,10}=[A-Z]+){2,}$ 2 0 0 1
|
|
4075 4075 ^[A-F0-9]{16}$ 2 0 0 1
|
|
4076 4076 \/rpt\d 2 0 0 1
|
|
4077 4077 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4078 4078 ^\/fbot\.arm\d{1}\.u$ 2 0 0 1
|
|
4079 4079 ^\/[A-F0-9]{30,60}\/1\/0\/0$ 2 0 0 1
|
|
4080 4080 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4081 4081 ^[A-F0-9]+$ 2 0 0 1
|
|
4082 4082 ^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n 2 0 0 1
|
|
4083 4083 ^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n 2 0 0 1
|
|
4084 4084 ^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n 2 0 0 1
|
|
4085 4085 ^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n 2 0 0 1
|
|
4086 4086 ^[a-z0-9\-\.]{1,60}\.ssmailer\.com$ 2 0 0 1
|
|
4087 4087 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4088 4088 ^[a-z]=[a-f0-9]{80,}$ 2 0 0 1
|
|
4089 4089 ^Mozilla\/\d+\.\d+\x20\x28compatible\x3b\x20MSIE\x20\d+\.\d+\x3b\x20Windows\x20NT\x20\d+\.\d+\x3b\x20SV1\x29$ 2 0 0 1
|
|
4090 4090 ^php.{0,500}[\x80-\xff] 2 0 0 1
|
|
4091 4091 ^[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+(\x3b\x20[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+){1,6}={0,2}?$ 2 0 0 1
|
|
4092 4092 ^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$ 2 0 0 1
|
|
4093 4093 ^[A-F0-9]{8}_[A-F0-9]{8}\.sql 2 0 0 1
|
|
4094 4094 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1
|
|
4095 4095 \/[a-z-_]{75,}\.php$ 2 0 0 1
|
|
4096 4096 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4097 4097 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4098 4098 ^[^\x20-\x7e\r\n]{2}$ 2 0 0 1
|
|
4099 4099 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
4100 4100 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4101 4101 ^\/\?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4102 4102 ^[a-zA-Z0-9=/&?\x2e-]+$ 2 0 0 1
|
|
4103 4103 ^\d{5,10}$ 2 0 0 1
|
|
4104 4104 ^[a-z0-9/%=]{100,}$ 2 0 0 1
|
|
4105 4105 \/[a-z0-9]+\/[a-z0-9]+\.exe$ 2 0 0 1
|
|
4106 4106 ^[a-zA-Z0-9]+$ 2 0 0 1
|
|
4107 4107 ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[A-Za-z]+? 2 0 0 1
|
|
4108 4108 ^.([a-z0-9+/]*?[A-Z])([A-Z0-9+/]*?[a-z])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.29a\.de$ 2 0 0 1
|
|
4109 4109 (^|\.)en-content\.com$ 2 0 0 1
|
|
4110 4110 ch=1$ 2 0 0 1
|
|
4111 4111 ^\/\?ptrxcz_[a-z0-9A-Z]{30}$ 2 0 0 1
|
|
4112 4112 [a-z]{2}\.CAB.bin 2 0 0 1
|
|
4113 4113 \.php\?(print_)?receipt=(s00|\d{3})_\d+$ 2 0 0 1
|
|
4114 4114 ^sleep \d+[\r\x2c] 2 0 0 1
|
|
4115 4115 \.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&os=\d\.\d[^&]*&bot_id= 2 0 0 1
|
|
4116 4116 \.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}-(\d{1,3}\.){3}\d{1,3}&gr 2 0 0 1
|
|
4117 4117 \(b\x3a\d+?\x3bc\x3aAMD- 2 0 0 1
|
|
4118 4118 \(b\x3a\d+?\x3bc\x3aINT- 2 0 0 1
|
|
4119 4119 ^\/uploading\/id=\d{2,20}&u=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4120 4120 user=[a-f0-9]{31,32}& 2 0 0 1
|
|
4121 4121 ^$ 2 0 0 1
|
|
4122 4122 \/gate\.php\?reg=([a-z]{10}|[A-Za-z]{15})$ 2 0 0 1
|
|
4123 4123 \(b\x3a\d+?\x3bc\x3a[^\x3b]+AuthenticAMD\x3b 2 0 0 1
|
|
4124 4124 \(b\x3a\d+?\x3bc\x3a[^\x3b]+GenuineIntel\x3b 2 0 0 1
|
|
4125 4125 \?hostid=[0-9A-F]+?& 2 0 0 1
|
|
4126 4126 ^\/[a-z0-9]{3,}\/upload\/img\.jpg$ 2 0 0 1
|
|
4127 4127 \.php\?[a-zA-Z0-9]+[a-zA-Z0-9]+?&[a-zA-Z0-9]+([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})(&[a-zA-Z0-9]+[a-f0-9]{32}){2}$ 2 0 0 1
|
|
4128 4128 \.php\?ver=\d\&cver=\d\&id=\d{5}$ 2 0 0 1
|
|
4129 4129 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4130 4130 ^\x2Flts\x2Etxt$ 2 0 0 1
|
|
4131 4131 \/\d\d[A-F0-9]{4}0000\/log$ 2 0 0 1
|
|
4132 4132 \/[a-z]{2,3}\/(\d{3,4}x\d{3,4}|default)\.bmp\.gz$ 2 0 0 1
|
|
4133 4133 \/cp\/\?(logo\.jpg|adm) 2 0 0 1
|
|
4134 4134 \x2Fping\x2Ehtml\x3Fr\x3D[0-9]{5,14}$ 2 0 0 1
|
|
4135 4135 ^g=[A-Z0-9]+&cmd= 2 0 0 1
|
|
4136 4136 &arg2=(([a-f0-9]{32})|([A-Za-z0-9\x2b\x2f]{4})*([A-Za-z0-9\x2b\x2f]{2}==|[A-Za-z0-9\x2b\x2f]{3}=|[A-Za-z0-9\x2b\x2f]{4}))(&|$) 2 0 0 1
|
|
4137 4137 filename=[a-f0-9]{13}\.file\r\n 2 0 0 1
|
|
4138 4138 \/monitor\.php\?resp=ID\x3a[A-Za-z]{15} 2 0 0 1
|
|
4139 4139 \/gate\.php\?cmd=(get(installconfig|exe)|urls)$ 2 0 0 1
|
|
4140 4140 \.php\?(q|name)= 2 0 0 1
|
|
4141 4141 ^\x2F(acheb|bajree|cyacrin|dauber|eaves)\x2Easpx\x3FRandom\x3D[a-z]{16}$ 2 0 0 1
|
|
4142 4142 ^\/201\d{5,8}\/\d{6,11}\/\d{5,10}\.jsp$ 2 0 0 1
|
|
4143 4143 \.php\?a1=\d+&a2=([0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}|([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4}))(&a\d+=[^&]+)+$ 2 0 0 1
|
|
4144 4144 &HD=[A-F0-9]{32}& 2 0 0 1
|
|
4145 4145 &id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&os= 2 0 0 1
|
|
4146 4146 \.asp\?MAC=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&VER=[^&]+$ 2 0 0 1
|
|
4147 4147 \/log\?(start|install)\x7caid= 2 0 0 1
|
|
4148 4148 \.php\?user=[a-f0-9]{32}&id=\d+&type=\d+($|&) 2 0 0 1
|
|
4149 4149 ^\/post\.aspx\?[^&]+=[0-9]{9,10}$ 2 0 0 1
|
|
4150 4150 ^\/j\/[a-f0-9]{8}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{12}\/0001\/?$ 2 0 0 1
|
|
4151 4151 ^\x2Fel\x2Fsregister\x2Ephp\x3Fname\x3D[a-f0-9]{32}$ 2 0 0 1
|
|
4152 4152 ^\x2Fel\x2Fslogin\x2Ephp\x3Fuid\x3D[a-f0-9]{32}$ 2 0 0 1
|
|
4153 4153 \.php\?m=[A-F0-9]{12} 2 0 0 1
|
|
4154 4154 &rvz1=\d+&rvz2=\d+?$ 2 0 0 1
|
|
4155 4155 ^\/getc(loud|onf)\/\?c= 2 0 0 1
|
|
4156 4156 ^\/home\/index\.asp\?typeid=(1[13]?|[3579])$ 2 0 0 1
|
|
4157 4157 \/tasksz\.php\?(dc|load) 2 0 0 1
|
|
4158 4158 ^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Ffile(index\x3D[A-Z]|n\x3Dnoexist|wh\x3Dfalse) 2 0 0 1
|
|
4159 4159 ^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3FRe\x3D 2 0 0 1
|
|
4160 4160 ^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Fverify\x3D 2 0 0 1
|
|
4161 4161 \.asp\?IDPC=[^\x26]*?\x26(Status=|Msg=)[^\x26]*?$ 2 0 0 1
|
|
4162 4162 ^OPC=\d 2 0 0 1
|
|
4163 4163 ^\/[^\x2f]+?\.hlp$ 2 0 0 1
|
|
4164 4164 ^\/(components|wp-content|tmp)/api/[a-zA-Z0-9\/\x20]{43}=\/(toll|inv|notice|get_label)$ 2 0 0 1
|
|
4165 4165 &build_id=[A-F0-9]+$ 2 0 0 1
|
|
4166 4166 ^&op=\d{1,2}&id=\w+?&ui=.+?&bv=\d{1,2}\.\d{1,2}($|&) 2 0 0 1
|
|
4167 4167 \/vtris\d?\.php\?srs=\d{1,10}$ 2 0 0 1
|
|
4168 4168 \/soft(32|64)\.dll$ 2 0 0 1
|
|
4169 4169 \/ord\/[^\x2f]+?\.exe$ 2 0 0 1
|
|
4170 4170 \/zConfig\/\d+$ 2 0 0 1
|
|
4171 4171 \/zImprimer\/\d+- 2 0 0 1
|
|
4172 4172 \/enc\/1$ 2 0 0 1
|
|
4173 4173 ^\/p\/(p(hphphphphphphp|thon)|(dropytho|admmmom)n|u(pdata-server|dom)|eyewheye|joompler|rubbay|tempzz) 2 0 0 1
|
|
4174 4174 [a-z]\d{2}$ 2 0 0 1
|
|
4175 4175 \/images2\/[0-9a-fA-F]{500} 2 0 0 1
|
|
4176 4176 uwf(ekfyj|ubpeb)|d(xowub|zycaf)|h(duxic|zubvo)|x(fokur|osgik) 2 0 0 1
|
|
4177 4177 z(u(pivzed|qijcel)|aefofin|idamuk|ylhomu) 2 0 0 1
|
|
4178 4178 \/[a-z]\.htm\?[A-Za-z0-9]+$ 2 0 0 1
|
|
4179 4179 Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1
|
|
4180 4180 Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1
|
|
4181 4181 \/p?2p\/[a-z]{3}$ 2 0 0 1
|
|
4182 4182 \/\d\.php\?sid=[0-9A-F]{32}$ 2 0 0 1
|
|
4183 4183 ^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\r?$ 2 0 0 1
|
|
4184 4184 ^\/mod_jshoppi(-|ng|\/) 2 0 0 1
|
|
4185 4185 ( MSIE |rv\x3a11) 2 0 0 1
|
|
4186 4186 ( MSIE |rv\x3a11) 2 0 0 1
|
|
4187 4187 ( MSIE |rv\x3a11) 2 0 0 1
|
|
4188 4188 ( MSIE |rv\x3a11) 2 0 0 1
|
|
4189 4189 \/[a-z]+\.k(ey)?btc$ 2 0 0 1
|
|
4190 4190 &id=[A-F0-9]+$ 2 0 0 1
|
|
4191 4191 \/images\/view\.php$ 2 0 0 1
|
|
4192 4192 \/txt\/read\.php$ 2 0 0 1
|
|
4193 4193 ^hwid=[A-F0-9]{4}(-[A-F0-9]{4}){7}&func= 2 0 0 1
|
|
4194 4194 \/[A-Za-z0-9-_]{75,}\.html$ 2 0 0 1
|
|
4195 4195 filename=\x22[A-Z]\x3a\\.+?\\[a-f0-9]{32}\.zip\x22\r\n 2 0 0 1
|
|
4196 4196 ^\/me\/(get(ref|ua)\.php|videos\.txt)$ 2 0 0 1
|
|
4197 4197 \/infect(-\d)?\.php$ 2 0 0 1
|
|
4198 4198 &hash=[^&]+$ 2 0 0 1
|
|
4199 4199 ^Host\x3a[^\r\n]+?webdav\.cloudme\.com[^\r\n]*?\r?$ 2 0 0 1
|
|
4200 4200 \.exe\?dummy=\d+$ 2 0 0 1
|
|
4201 4201 ^(<v1>.).{33}(=v1).{9}(<v2>.)(.{4}(=v2)){3} 2 0 0 1
|
|
4202 4202 \.png$ 2 0 0 1
|
|
4203 4203 \x26enckey\x3D[A-F0-9]+$ 2 0 0 1
|
|
4204 4204 ^\/action\.php\?action=get_(mails|red)$ 2 0 0 1
|
|
4205 4205 ^Host\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1
|
|
4206 4206 \/data\.cfg$ 2 0 0 1
|
|
4207 4207 \/bn_versions\/\d+?\.exe$ 2 0 0 1
|
|
4208 4208 ^(Accept\x3a\x20text\/\*, application\/\*\r\n)?User-Agent\x3a[^\r\n\x3b\x28\x29]+\r\nHost\x3a[^\r\n]+checkip\.dyndns\.org\r\nCache-Control\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1
|
|
4209 4209 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
4210 4210 &user=\d+$ 2 0 0 1
|
|
4211 4211 ^Host\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1
|
|
4212 4212 \/web_[0-9A-F]{12}\.jpg$ 2 0 0 1
|
|
4213 4213 ^Mozilla(\/4\.0)?$ 2 0 0 1
|
|
4214 4214 Host\x3a\x20[a-z0-9]{16}\.[^\r\n]*?(tor|onion) 2 0 0 1
|
|
4215 4215 ^\/([^\x2f]+\/)?rp\?[a-z]= 2 0 0 1
|
|
4216 4216 ^User-Agent\x3a\x20(\d*[a-z])[a-z0-9]+\r\nHost\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1
|
|
4217 4217 ^Host\x3a[^\r\n]+bagacaoutra\.ru\r\n 2 0 0 1
|
|
4218 4218 ^Host\x3a[^\r\n]+bagacavoltou\.ru 2 0 0 1
|
|
4219 4219 ^Host\x3a[^\r\n]+bagacaveia\.ru 2 0 0 1
|
|
4220 4220 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4221 4221 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4222 4222 \/state[^\x2f]*\.php\?[A-Za-z0-9+/]*={0,2}$ 2 0 0 1
|
|
4223 4223 ^Accept\x3a\x20\*\/\*,[^\r\n]+, MZ 2 0 0 1
|
|
4224 4224 ^\/[^\x2f]+?\.exe$ 2 0 0 1
|
|
4225 4225 ^[A-F0-9]+$ 2 0 0 1
|
|
4226 4226 \/redirect\.php\?loc=mail$ 2 0 0 1
|
|
4227 4227 &(uid|name|file)=[a-f0-9]+$ 2 0 0 1
|
|
4228 4228 \?HostID=([A-F0-9]{2}(-|<>)){5}[A-F0-9]{2}$ 2 0 0 1
|
|
4229 4229 \/\?bit=(32|64)&version=\d{4}-\d{1,2}-\d{1,2}$ 2 0 0 1
|
|
4230 4230 \/\?check$ 2 0 0 1
|
|
4231 4231 ^Host\x3a[^\r\n]+\r\nAccept-Language\x3a[^\r\n]+\r\nAccept\x3a[^\r\n]+\r\nAccept-Encoding\x3a[^\r\n]+\r\nConnection\x3a\x20close\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1
|
|
4232 4232 [A-Z]{100}(&\w+=[a-zA-Z0-9/+=]+){0,2}$ 2 0 0 1
|
|
4233 4233 ^\w+=([a-zA-Z0-9/+=]{1,30}&\w+=)?[a-zA-Z0-9+/]{0,13}[A-Z]{200} 2 0 0 1
|
|
4234 4234 boardid|bbsNo|strBoardID|userid|bbs|filename|code|pid|seqNo|ReportID 2 0 0 1
|
|
4235 4235 \/setup\/[a-zA-Z0-9!-]{100,}$ 2 0 0 1
|
|
4236 4236 \/app\.exe$ 2 0 0 1
|
|
4237 4237 ^Host\x3a[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$ 2 0 0 1
|
|
4238 4238 =c3NoOi8v[A-Za-z0-9+/]+={0,2}$ 2 0 0 1
|
|
4239 4239 \.asp\?([A-Za-z0-9+*]{4})*([A-Za-z0-9+*]{2}==|[A-Za-z0-9+*]{3}=|[A-Za-z0-9+*]{4})$ 2 0 0 1
|
|
4240 4240 \?wd=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})$ 2 0 0 1
|
|
4241 4241 &version=\d+$ 2 0 0 1
|
|
4242 4242 ^[A-Za-z0-9/_]+={0,2}$ 2 0 0 1
|
|
4243 4243 \/[a-z]\/infects\/[a-z]\?[a-z]=[^\\\*\+\=\|\:\;\x22\?\<\>\,\#] 2 0 0 1
|
|
4244 4244 ^\d{4} 2 0 0 1
|
|
4245 4245 ^\d{4} 2 0 0 1
|
|
4246 4246 ^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$ 2 0 0 1
|
|
4247 4247 \/lns.txt$ 2 0 0 1
|
|
4248 4248 ^\/[a-z]+?\.*?ini\?\d+$ 2 0 0 1
|
|
4249 4249 \/[a-f0-9]{8}\/page_\d{8,10}\.html$ 2 0 0 1
|
|
4250 4250 ^[a-z]{1,7}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4251 4251 SSID=[0-9]{5}[0-8][01][a-f0-9]{36} 2 0 0 1
|
|
4252 4252 SSID=[0-9]{5}[0-8][01][a-f0-9]{36} 2 0 0 1
|
|
4253 4253 ^[\x20-\x7e\s]{0,20}[^\x20-\x7e\s] 2 0 0 1
|
|
4254 4254 ^s?\x3a\x2f+[^\r\n\s]+\.exe 2 0 0 1
|
|
4255 4255 \.jpg\?vid=\d+$ 2 0 0 1
|
|
4256 4256 ^[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\nUser-Agent\x3a 2 0 0 1
|
|
4257 4257 \.php\?[a-z]+=0000[a-fA-F0-9]{4}&[a-z]+=\?[A-F0-9]+&[a-z]=\d{4}&[a-z]=\d{4}$ 2 0 0 1
|
|
4258 4258 ^[0-9a-f]+$ 2 0 0 1
|
|
4259 4259 \/r\.php\?[A-F0-9]+=?$ 2 0 0 1
|
|
4260 4260 ^m=([A-Za-z0-9+/]{4}){11}(([A-Za-z0-9+/]{4}){6})?AA== 2 0 0 1
|
|
4261 4261 \/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$ 2 0 0 1
|
|
4262 4262 ^\d+\x20 2 0 0 1
|
|
4263 4263 ^\d+\x20 2 0 0 1
|
|
4264 4264 ^\d+\x20 2 0 0 1
|
|
4265 4265 ^\d+\x20 2 0 0 1
|
|
4266 4266 ^\d+\x20 2 0 0 1
|
|
4267 4267 ^\d+\x20 2 0 0 1
|
|
4268 4268 ^\d+\x20 2 0 0 1
|
|
4269 4269 ^\d+\x20 2 0 0 1
|
|
4270 4270 \.php\?a1=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/] 2 0 0 1
|
|
4271 4271 \/(im(age|g)|pict)\.(jpg|php)\?id=\d+&act=[12]$ 2 0 0 1
|
|
4272 4272 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4273 4273 \.php\?hwid=[A-F0-9]{16}$ 2 0 0 1
|
|
4274 4274 ^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/general\.png$ 2 0 0 1
|
|
4275 4275 ^\/\d+$ 2 0 0 1
|
|
4276 4276 ^[\x2fa-z\d]+\.exe$ 2 0 0 1
|
|
4277 4277 \.php\?command=(g(hl|et(ip|id|backconnect))|update2?|dl|log)($|&) 2 0 0 1
|
|
4278 4278 \.(gif|jpe?g)\.zip$ 2 0 0 1
|
|
4279 4279 ^(zh-CN|en-US)\x3b rv\x3a1\.7\.6\)\r\n 2 0 0 1
|
|
4280 4280 (,0x[0-9a-f]{2}){10}$ 2 0 0 1
|
|
4281 4281 \/default\.aspx?\?tmp=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4282 4282 ^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$ 2 0 0 1
|
|
4283 4283 \/\d{8,10}\.html$ 2 0 0 1
|
|
4284 4284 ^\x40\x24[^\x20-\x7e\r\n]+$ 2 0 0 1
|
|
4285 4285 ^\/[A-F0-9]+$ 2 0 0 1
|
|
4286 4286 ^\/[a-z0-9]+\.jpg\?([a-z0-9]*[A-Z]+[a-z0-9])[A-Za-z0-9]+=\d{1,4}$ 2 0 0 1
|
|
4287 4287 \.png\x3f[0-9a-f]{4,8}\x3d\d+?$ 2 0 0 1
|
|
4288 4288 ^Host\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$ 2 0 0 1
|
|
4289 4289 [a-z0-9]anel_includes 2 0 0 1
|
|
4290 4290 \.pdf\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4291 4291 \.zip\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4292 4292 \.htm\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4293 4293 \.xml\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4294 4294 ^\/[a-z0-9_-]+\.jpg\?[A-Za-z0-9]{2,10}=\d{1,4}$ 2 0 0 1
|
|
4295 4295 ^(www\.)?google(\.[a-z]{2,3})+$ 2 0 0 1
|
|
4296 4296 \.log$ 2 0 0 1
|
|
4297 4297 \/([a-z0-9]+_){4,}[a-z0-9]+(\/[a-f0-9]+)*?\/[a-f0-9]+\.([Ee][Xx][Ee])[a-z0-9]+$ 2 0 0 1
|
|
4298 4298 ^\/pm\.sh\?\d+$ 2 0 0 1
|
|
4299 4299 \.asp\?m=(INS|UAC)(&p=&a=)?&i=201\d{11}& 2 0 0 1
|
|
4300 4300 \?ver=\d+$ 2 0 0 1
|
|
4301 4301 ^\/(i686|arm|mips(el)?)\?ver=\d+$ 2 0 0 1
|
|
4302 4302 &u=[a-f0-9]{16}&p= 2 0 0 1
|
|
4303 4303 \/[a-f0-9]{16}\.down$ 2 0 0 1
|
|
4304 4304 \.php\/data$ 2 0 0 1
|
|
4305 4305 \/catalog\/\d{3,}$ 2 0 0 1
|
|
4306 4306 \.php\?cookie=1$ 2 0 0 1
|
|
4307 4307 ^\/[A-Za-z0-9]+?\/file\.php$ 2 0 0 1
|
|
4308 4308 \/tor\/[^\x2f\x2e]+(32|64)\.dll$ 2 0 0 1
|
|
4309 4309 \.php\?shinu=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4310 4310 [A-Za-z0-9]+\x2d\x2e 2 0 0 1
|
|
4311 4311 ^\/link\.txt\?[0-9]{1,2}\x3a[0-9]{1,2}\x3a[0-9]{1,2} 2 0 0 1
|
|
4312 4312 \.php\?uuid=[a-z0-9]{32}$ 2 0 0 1
|
|
4313 4313 ^(Referer\x3a[^\r\n]+\r\n)?Host\x3a[^\r\n]+[\r\n]+$ 2 0 0 1
|
|
4314 4314 \.exe\?$ 2 0 0 1
|
|
4315 4315 ^\/\w+\.php\?f=[a-z]?\d{1,3}(\.(dat|gif))?$ 2 0 0 1
|
|
4316 4316 \/\?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4317 4317 \.php\?cn(ame) 2 0 0 1
|
|
4318 4318 ^(Host\x3a [^\r\n]+?\r\nConnection\x3a Keep-Alive|Connection\x3a Keep-Alive\r\nHost\x3a [^\r\n]+?)\r\n(\r\n)?$ 2 0 0 1
|
|
4319 4319 \.php\?file=(64|86)$ 2 0 0 1
|
|
4320 4320 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4321 4321 meta=(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?(&?id=[a-z]+)?$ 2 0 0 1
|
|
4322 4322 ^\/[a-z]+?\/\?([a-z]+[A-Za-z0-9\x5f\x2d]+&){1,}ai=[^&]{5}([A-Za-z0-9\x5f\x2d]{4})*([A-Za-z0-9\x5f\x2d]{2}==|[A-Za-z0-9\x5f\x2d]{3}=|[A-Za-z0-9\x5f\x2d]{4})(&|$) 2 0 0 1
|
|
4323 4323 (^|=)[A-F0-9]{70,}($|&) 2 0 0 1
|
|
4324 4324 ^[A-Za-z0-9+/]{64}\x0a 2 0 0 1
|
|
4325 4325 \/viewforum\.php\?f=\d+&sid=[A-F0-9]{32}$ 2 0 0 1
|
|
4326 4326 \?uid=\d{8}&ver=\d\.\d{2}&mk=[0-9a-zA-Z]{6}&os=[A-Za-z0-9]+&rs=[a-z]+&c=\d+&rq=\d 2 0 0 1
|
|
4327 4327 ^Content-Disposition\x3a[^\r\n]*\.sct[\x22\x27\s\r\n] 2 0 0 1
|
|
4328 4328 \.php\?cmd=p&id=\w+.*?&rnd=[\x2e\d]+$ 2 0 0 1
|
|
4329 4329 myguy\.(xls(\.hta)?|exe)$ 2 0 0 1
|
|
4330 4330 \/invoice[^a-z\/]*?\.(exe|zip|7z|rar|com|vbs|ps1)$ 2 0 0 1
|
|
4331 4331 \/[\x2f\x2bA-Za-z0-9]{59}AAA==$ 2 0 0 1
|
|
4332 4332 ^\/[^\x2f]+?\/create\.php\?[a-z0-9]+\x3d[a-z0-9\x5f\x2d]+?$ 2 0 0 1
|
|
4333 4333 \.php\?id=\d+&stat=[a-z0-9]{32}(&cidl=\d+|&sidl=[\d%:\x20-]+)?$ 2 0 0 1
|
|
4334 4334 \/[A-Z0-9]{4,8}\/[A-Z0-9]{8}\.DAT$ 2 0 0 1
|
|
4335 4335 \.exe\?\.\d+$ 2 0 0 1
|
|
4336 4336 ^Host\x3a[^\r\n]+\r\n((Cache-Control|Pragma)\x3a[^\r\n]+\r\n)?(\r\n)?$ 2 0 0 1
|
|
4337 4337 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4338 4338 ^\/Search\/en-US\?query=[a-z]{200,400}&pgArea=header$ 2 0 0 1
|
|
4339 4339 \/stat\d+\.php 2 0 0 1
|
|
4340 4340 \?url=[0-9]&affid=[0-9]{5} 2 0 0 1
|
|
4341 4341 \.php\?id=[0-9a-f]{8}$ 2 0 0 1
|
|
4342 4342 ^6\.[0-2]\x20\d\d\x3a\d\d\x20 2 0 0 1
|
|
4343 4343 ^IPHONE\d+\x2e\d+\x28(host\x3a|[^\r\n\x2c]+\x2c(\d{1,3}\.){3}\d{1,3}) 2 0 0 1
|
|
4344 4344 (1|2)\.(p(hp|ng)|jpe?g|cgi|gif)\?sv=\d{2,3}&tq= 2 0 0 1
|
|
4345 4345 [\?&]p=\d&t=\d(&|$) 2 0 0 1
|
|
4346 4346 ^\x2fhistory\x2f[A-Za-z0-9+_-]+\x2easp$ 2 0 0 1
|
|
4347 4347 ^\x2fdocs\x2fname\x3d\x2f[A-Za-z0-9+_-]+$ 2 0 0 1
|
|
4348 4348 ^\x2ftech\x2fs\x2easp\x3fm\x3d[A-Za-z0-9+_-]+$ 2 0 0 1
|
|
4349 4349 ^\x2fmanage\x2fasp\x2fitem\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26mux\x3d[A-Za-z0-9+_-]+$ 2 0 0 1
|
|
4350 4350 ^\x2farticle\x2f30441\x2fReview\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26data\x3d[A-Za-z0-9+_-]+$ 2 0 0 1
|
|
4351 4351 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4352 4352 ^\/[A-Za-z0-9-_]{30,}\/$ 2 0 0 1
|
|
4353 4353 ^build\d 2 0 0 1
|
|
4354 4354 ^[a-zA-Z0-9]{5}6164(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){5,}\. 2 0 0 1
|
|
4355 4355 ^[a-zA-Z0-9]{5}6364(3[0-9]){4}\d{1,3}\. 2 0 0 1
|
|
4356 4356 ^[a-zA-Z0-9]{5}6464(3[0-9]){4}\. 2 0 0 1
|
|
4357 4357 ^[a-zA-Z0-9]{5}6664(3[0-9]){4}\. 2 0 0 1
|
|
4358 4358 ^[a-zA-Z0-9]{5}6864(3[0-9]){4}31303[0-9]\. 2 0 0 1
|
|
4359 4359 ^[a-zA-Z0-9]{5}7264(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){10,}\. 2 0 0 1
|
|
4360 4360 ^[a-zA-Z0-9]{5}7164(3[0-9]){4}\. 2 0 0 1
|
|
4361 4361 ^[a-f0-9]{8}$ 2 0 0 1
|
|
4362 4362 ^\d{1,3}$ 2 0 0 1
|
|
4363 4363 ^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1
|
|
4364 4364 ^[A-Za-z0-9\/\+\=]{100,}$ 2 0 0 1
|
|
4365 4365 \.(txt|gif|exe|bmp)$ 2 0 0 1
|
|
4366 4366 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
4367 4367 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
4368 4368 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4369 4369 ^[A-F0-9]{128}$ 2 0 0 1
|
|
4370 4370 ^DEMONS((\/|\s)[0-9]\.0)?$ 2 0 0 1
|
|
4371 4371 ^Hakai((\/|\s)[0-9]\.0)?$ 2 0 0 1
|
|
4372 4372 ^Messiah((\/|\s)[0-9]\.0)?$ 2 0 0 1
|
|
4373 4373 ^Liquor((\/|\s)[0-9]\.0)?$ 2 0 0 1
|
|
4374 4374 ^Nija((\/|\s)[0-9]\.0)?$ 2 0 0 1
|
|
4375 4375 ^Gemini((\/|\s)[0-9]\.0)?$ 2 0 0 1
|
|
4376 4376 ^Kayla((\/|\s)[0-9]\.0)?$ 2 0 0 1
|
|
4377 4377 ^Sector((\/|\s)[0-9]\.0)?$ 2 0 0 1
|
|
4378 4378 ^OSIRIS((\/|\s)[0-9]\.0)?$ 2 0 0 1
|
|
4379 4379 ^lessie(\/[0-9]\.0)?$ 2 0 0 1
|
|
4380 4380 ^Cakle(\/[0-9]\.0)?$ 2 0 0 1
|
|
4381 4381 ^Damien(\/[0-9]\.0)?$ 2 0 0 1
|
|
4382 4382 ^Solar(\/[0-9]\.0)?$ 2 0 0 1
|
|
4383 4383 ^muhstik(-scan)?(\/[0-9]\.0)?$ 2 0 0 1
|
|
4384 4384 ^Shaolin(\/[0-9]\.0)?$ 2 0 0 1
|
|
4385 4385 ^Rift(\/[0-9]\.0)?$ 2 0 0 1
|
|
4386 4386 ^Tsunami(\/[0-9]\.0)?$ 2 0 0 1
|
|
4387 4387 ^Yowai(\/[0-9]\.0)?$ 2 0 0 1
|
|
4388 4388 ^Yakuza(\/[0-9]\.0)?$ 2 0 0 1
|
|
4389 4389 ^Hentai(\/[0-9]\.0)?$ 2 0 0 1
|
|
4390 4390 ^[a-zA-Z/+=]$ 2 0 0 1
|
|
4391 4391 \?uid=[A-F0-9]{15,}&pid=\d+$ 2 0 0 1
|
|
4392 4392 \.php\?[A-F0-9]{15,25}$ 2 0 0 1
|
|
4393 4393 ^(Sucessful|Failed|Missing\x20CBA8|Missing\x20LANDesk\x20Agent)$ 2 0 0 1
|
|
4394 4394 ^POST\shttp\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5}) 2 0 0 1
|
|
4395 4395 ^name=v[0-9]{1,2}_kt[0-9]{1,2}p[0-9]{1}_[0-9]{8,10}$ 2 0 0 1
|
|
4396 4396 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
4397 4397 ^\/[a-z]\.php 2 0 0 1
|
|
4398 4398 ^\d{1,6}$ 2 0 0 1
|
|
4399 4399 ^[A-Z0-9]{8} 2 0 0 1
|
|
4400 4400 ^\d{15} 2 0 0 1
|
|
4401 4401 ^(winload(32)?|cmms)\x0d\x0a 2 0 0 1
|
|
4402 4402 ^\d$ 2 0 0 1
|
|
4403 4403 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4404 4404 ^\/[a-z]+\/\?ip= 2 0 0 1
|
|
4405 4405 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1
|
|
4406 4406 ^\d{1,5}\.[2-5]0[0-5]\.\d+? Firefox\/7\.0\.1 2 0 0 1
|
|
4407 4407 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4408 4408 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4409 4409 ^(update_hash|js|key|arsiv_(hash|link))$ 2 0 0 1
|
|
4410 4410 \/([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})\.jpg$ 2 0 0 1
|
|
4411 4411 ^[a-z0-9]{11}=\d{16}$ 2 0 0 1
|
|
4412 4412 ^[A-Za-z0-9]{3,25}=[a-f0-9]{28,}$ 2 0 0 1
|
|
4413 4413 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4414 4414 ^Hello, World((\/|\s)[0-9]\.0)?$ 2 0 0 1
|
|
4415 4415 \/cgi\/[a-z0-9]{1,31}\.bin$ 2 0 0 1
|
|
4416 4416 ^[0-9a-zA-Z=%-]{0,48}(%[A-F0-9]{2}){4} 2 0 0 1
|
|
4417 4417 \?id=\d+&act=[12]$ 2 0 0 1
|
|
4418 4418 \?id=\d+&act=\d$ 2 0 0 1
|
|
4419 4419 ^([A-F0-9]{2}%3A){5}[A-F0-9]{2}& 2 0 0 1
|
|
4420 4420 \/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}\/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}$ 2 0 0 1
|
|
4421 4421 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&isAdvpp=(true|false)$ 2 0 0 1
|
|
4422 4422 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3} 2 0 0 1
|
|
4423 4423 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3} 2 0 0 1
|
|
4424 4424 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3} 2 0 0 1
|
|
4425 4425 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3} 2 0 0 1
|
|
4426 4426 ^\d\.\d_(64|32)_\d\x3a 2 0 0 1
|
|
4427 4427 (^|\.)15438\.xyz$ 2 0 0 1
|
|
4428 4428 (^|\.)12724\.xyz$ 2 0 0 1
|
|
4429 4429 (^|\.)21736\.xyz$ 2 0 0 1
|
|
4430 4430 ^[a-f0-9]+\x08\x00$ 2 0 0 1
|
|
4431 4431 ^[A-Za-z0-9] 2 0 0 1
|
|
4432 4432 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1
|
|
4433 4433 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1
|
|
4434 4434 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1
|
|
4435 4435 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1
|
|
4436 4436 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1
|
|
4437 4437 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1
|
|
4438 4438 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1
|
|
4439 4439 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1
|
|
4440 4440 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1
|
|
4441 4441 ^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nConnection\x3a\x20close(\r\n)+$ 2 0 0 1
|
|
4442 4442 ^[A-Z]+$ 2 0 0 1
|
|
4443 4443 ^\d+$ 2 0 0 1
|
|
4444 4444 ^(64|86)$ 2 0 0 1
|
|
4445 4445 \/counter\/?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}) 2 0 0 1
|
|
4446 4446 ^\/(\w+\/){1,5}\?[a-z]{1,6}=[a-z0-9]{2,40}(&[a-z]{1,6}=([a-z0-9]){1,40}) 2 0 0 1
|
|
4447 4447 ^\d{5,10}\x7d 2 0 0 1
|
|
4448 4448 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
|
|
4449 4449 \/\d{8,10}\.html$ 2 0 0 1
|
|
4450 4450 ^\d{1,3}= 2 0 0 1
|
|
4451 4451 (Proxy-)?Connection\x3a[^\r\n]+?\r\n(Pragma|Cache-Control)\x3a[^\r\n]+?\r\n(\r\n)?$ 2 0 0 1
|
|
4452 4452 \/?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4453 4453 ^\d+$ 2 0 0 1
|
|
4454 4454 ^\/\?m=[abcde]&p1=[a-f0-9]{8,12}(&p2=[^&]+)?(&p3=[^&]+)?$ 2 0 0 1
|
|
4455 4455 [&?]a=([a-zA-Z0-9_-]{25,}|(0\.)?\d+)(&|$) 2 0 0 1
|
|
4456 4456 ^[A-Za-z]{1,10} 2 0 0 1
|
|
4457 4457 \.(aspx?|php)\?q=(KT)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$ 2 0 0 1
|
|
4458 4458 ^[A-Za-z]{1,10}=[^&]+(&[A-Za-z]{1,10}=[^&]+){10,}$ 2 0 0 1
|
|
4459 4459 ^[a-f0-9]{32}\x3b$ 2 0 0 1
|
|
4460 4460 ^\/(kas|ser|mac)[0-9]+\.png$ 2 0 0 1
|
|
4461 4461 ^\/s\.php\?id=[a-z0-9]{2,6}$ 2 0 0 1
|
|
4462 4462 \.php\?d=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4463 4463 ^[a-z0-9]!\x22# 2 0 0 1
|
|
4464 4464 ^[a-f0-9]{16}$ 2 0 0 1
|
|
4465 4465 ^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4}) 2 0 0 1
|
|
4466 4466 ^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1
|
|
4467 4467 [a-z0-9]{3,4}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$ 2 0 0 1
|
|
4468 4468 ^Mozilla\/4\.0\x20\(compatible\x3b\x20MSIE\x20\d{1,2}\.0\.\d+\.\d+\.0\x3b\x20Windows\x20NT\x20 2 0 0 1
|
|
4469 4469 ^[\x20-\x7e\r\n]{0,28}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4470 4470 ^\/([a-z]{0,9}?\d)(\d{0,9}?[a-z])[a-z0-9]{4,10}$ 2 0 0 1
|
|
4471 4471 (^|&)id=\d+($|&) 2 0 0 1
|
|
4472 4472 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1
|
|
4473 4473 ^\d?\.dll$ 2 0 0 1
|
|
4474 4474 ^(32|64)$ 2 0 0 1
|
|
4475 4475 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)$ 2 0 0 1
|
|
4476 4476 \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d{1,5}$ 2 0 0 1
|
|
4477 4477 ^env=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1
|
|
4478 4478 \/pict\.(jpg|php|xsp)\?id=\d+((&data=|&bid=)[^&]*?)?$ 2 0 0 1
|
|
4479 4479 ^SESSIONID=[A-Z0-9]{16} 2 0 0 1
|
|
4480 4480 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1
|
|
4481 4481 ^(\/\w{3,12}){2,4}\?[a-z]{3,12}=([A-Za-z0-9+/\x20]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$ 2 0 0 1
|
|
4482 4482 ^\d+$ 2 0 0 1
|
|
4483 4483 ^POST \/(<filep>[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(=filep)[a-z]+?\.net\r\n 2 0 0 1
|
|
4484 4484 [=\"]\w{8}\.jar 2 0 0 1
|
|
4485 4485 ^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4486 4486 filename\x3D\x22[^\r\n]*security[^\n]+\.exe 2 0 0 1
|
|
4487 4487 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4488 4488 ^[A-F0-9]{30}$ 2 0 0 1
|
|
4489 4489 \.php\?cx=[A-F0-9]+&b=[A-F0-9]+>=[A-F0-9]+&tx=[A-F0-9]+$ 2 0 0 1
|
|
4490 4490 ^\/ucD[A-Za-z0-9_\/\-+]{171}$ 2 0 0 1
|
|
4491 4491 ^[a-zA-Z0-9\/+]{171}=$ 2 0 0 1
|
|
4492 4492 ^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK>$ 2 0 0 1
|
|
4493 4493 ^[a-zA-Z0-9\/+_-]{171}$ 2 0 0 1
|
|
4494 4494 \/\d+\/\d+\.exe$ 2 0 0 1
|
|
4495 4495 ^[A-Za-z0-9]{20,22}&usg=[A-Za-z0-9_]{34}&bvm=bv\.81[1-7]{6}\,d\.[A-Za-z0-9_]{3}\r\n 2 0 0 1
|
|
4496 4496 ^fn=[^&]*\.gif&code=\d+$ 2 0 0 1
|
|
4497 4497 ^[A-F0-9]+$ 2 0 0 1
|
|
4498 4498 ^log=save&session_id=[^&]+&value=[^&]+$ 2 0 0 1
|
|
4499 4499 (\\x70)|[Pp]\^?((\\x4f)|(\\x5f)|[Oo]) 2 0 0 1
|
|
4500 4500 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4501 4501 ^([a-f0-9]{2}){23,60}$ 2 0 0 1
|
|
4502 4502 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4503 4503 ^[0-9]*?[a-z]/P 2 0 0 1
|
|
4504 4504 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a8080$ 2 0 0 1
|
|
4505 4505 ^\/[a-z]{4}(\d{1,3}\.){3}\d{1,3}[a-z]{6}\.txt 2 0 0 1
|
|
4506 4506 ^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n 2 0 0 1
|
|
4507 4507 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+ 2 0 0 1
|
|
4508 4508 ^[a-zA-Z0-9=/&?\x2e-]+$ 2 0 0 1
|
|
4509 4509 ^[a-f0-9]{8}\.grp[0-9]*\.ping\.adm\.([a-f0-9]+\.){2,} 2 0 0 1
|
|
4510 4510 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1
|
|
4511 4511 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1
|
|
4512 4512 ^[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}$ 2 0 0 1
|
|
4513 4513 ^[\x20-\x25\x27-\x3c\x3e-\x7e]{25,}$ 2 0 0 1
|
|
4514 4514 ^(i686|x86_64|arm|mipsel)\-(static-linux|w64|iamsatan)\-(mingw32|uclibc(gnueabi)?) 2 0 0 1
|
|
4515 4515 ^[^\\\*\+\=\|\:\;\x22\?\>\>\,\#][a-zA-Z0-9-!@#] 2 0 0 1
|
|
4516 4516 ^([A-Za-z0-9]) 2 0 0 1
|
|
4517 4517 ^\/[^\x2f]+?\.htm$ 2 0 0 1
|
|
4518 4518 ^\d{2,7}$ 2 0 0 1
|
|
4519 4519 ^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.bin$ 2 0 0 1
|
|
4520 4520 ^Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x3A\d{1,5}\r?$ 2 0 0 1
|
|
4521 4521 ^Host\x3a[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(\r\n)?$ 2 0 0 1
|
|
4522 4522 plugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|osts?\ 2 0 0 1
|
|
4523 4523 ^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n 2 0 0 1
|
|
4524 4524 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1
|
|
4525 4525 ^[a-zA-Z0-9\/+_-]{171}$ 2 0 0 1
|
|
4526 4526 ^cnc\.[a-fA-F0-9]{14}.xyz$ 2 0 0 1
|
|
4527 4527 ^[^&]+&[a-z]=[^&]+&[a-z]=[A-F0-9]+$ 2 0 0 1
|
|
4528 4528 ^[A-Za-z0-9]{3,20}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4529 4529 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4530 4530 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4531 4531 _aWQ9[a-zA-Z0-9\/]{43,46}(JmdpZD|Z2lkP|ZnaWQ9) 2 0 0 1
|
|
4532 4532 ^\/[a-f0-9]+$ 2 0 0 1
|
|
4533 4533 ^[A-Z]{4} 2 0 0 1
|
|
4534 4534 \.php\?host=[^&]+&password=[a-f0-9]{32}$ 2 0 0 1
|
|
4535 4535 ^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1
|
|
4536 4536 ^\x2F[a-f0-9]{40,60}$ 2 0 0 1
|
|
4537 4537 ^[^\r\n]+\.exe(\x3b)?$ 2 0 0 1
|
|
4538 4538 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4539 4539 \r\nHost\x3a[^\r\n]+\r\n(Content-Length\x3a\x20\d+\r\n)?Connection\x3a\x20Keep-Alive\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$ 2 0 0 1
|
|
4540 4540 Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n 2 0 0 1
|
|
4541 4541 Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n 2 0 0 1
|
|
4542 4542 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4543 4543 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4544 4544 [A-Za-z]{1,10}=A-Za-z0-9_+\x2d\x2e 2 0 0 1
|
|
4545 4545 ^Host\x3a\x20[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$ 2 0 0 1
|
|
4546 4546 ^[a-z0-9]+\.appsync-api\.(eu|us)-(ea|we)st-[12]\.avsvmcloud\.com$ 2 0 0 1
|
|
4547 4547 ^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})) 2 0 0 1
|
|
4548 4548 a-z0-9\(_~\-\.\x00]{300,}\x00$ 2 0 0 1
|
|
4549 4549 ^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm 2 0 0 1
|
|
4550 4550 ^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm 2 0 0 1
|
|
4551 4551 ^[A-Z0-9\-]{30,42}$ 2 0 0 1
|
|
4552 4552 ^\d+?\r\n 2 0 0 1
|
|
4553 4553 ^__io_r=[0-9]{10}_[01]_[0-9]{4,5}_[0-9]{7,8}_[0-9]{1,2}\x3b\x20 2 0 0 1
|
|
4554 4554 \.php\?c=[a-f0-9]{160}$ 2 0 0 1
|
|
4555 4555 Cache-Control\r\n(\r\n|Cookie\r\n\r\n)$ 2 0 0 1
|
|
4556 4556 ^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})) 2 0 0 1
|
|
4557 4557 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
4558 4558 ^dkv=[a-f0-9]{32}\x3bYSC=\d+$ 2 0 0 1
|
|
4559 4559 ^(resp|onl|pr)= 2 0 0 1
|
|
4560 4560 ^id=\d+&cred=[a-z]+\x7c 2 0 0 1
|
|
4561 4561 [\x80-\xff] 2 0 0 1
|
|
4562 4562 (retdl|fb|step) HTTP\/1\.1$ 2 0 0 1
|
|
4563 4563 ^\/[0-9]{6,16}-(pro|xl2|us1)$ 2 0 0 1
|
|
4564 4564 ^(81|freq|domains|over|rate|npcap\.exe)\/?\s*[^\/]*$ 2 0 0 1
|
|
4565 4565 ^\/[0-9a-f]{16}$ 2 0 0 1
|
|
4566 4566 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4567 4567 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4568 4568 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4569 4569 ^[A-F0-9]{24} 2 0 0 1
|
|
4570 4570 ^[a-z0-9]{32}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4571 4571 ^\/[a-z0-9]{32}\/\d\/$ 2 0 0 1
|
|
4572 4572 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4573 4573 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4574 4574 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4575 4575 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/Psi 2 0 0 1
|
|
4576 4576 ^transfer=[A-Za-z0-9/+=]+$ 2 0 0 1
|
|
4577 4577 ^__gads=\d{9,10}:[01]:\d+:\d+(:\d{2,4})?\x3b\s_gat=(10|6)\.[0-3]\.\d{4,6}\.(32|64) 2 0 0 1
|
|
4578 4578 ^[A-Z]{256}$ 2 0 0 1
|
|
4579 4579 ^[0-9]{90,180}\r\n 2 0 0 1
|
|
4580 4580 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r\n 2 0 0 1
|
|
4581 4581 ^\/vpn-service\/[a-z]{15}\/crunchyroll-vpn$ 2 0 0 1
|
|
4582 4582 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4583 4583 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4584 4584 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4585 4585 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4586 4586 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4587 4587 ^SSID=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4588 4588 ^(id|tfzT)= 2 0 0 1
|
|
4589 4589 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4590 4590 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1
|
|
4591 4591 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1
|
|
4592 4592 ^[a-zA-Z0-9]{32}\.dot$ 2 0 0 1
|
|
4593 4593 ^[0-9A-F]{21,22}\x20HTTP\/1\.1$ 2 0 0 1
|
|
4594 4594 ^[0-9A-F]+$ 2 0 0 1
|
|
4595 4595 ^C=(M[ACDEGHKLMNOPQRSTUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|B[ABDEFGHIJMNORSTVWZ]|A[DEFGILMNOQRSTUWXZ]) 2 0 0 1
|
|
4596 4596 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4597 4597 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4598 4598 \x1c([a-z0-9]{28})[^\r\n]+(\x03(net|com)|\x02in) 2 0 0 1
|
|
4599 4599 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4600 4600 ^[a-zA-Z0-9/+]{171}=$ 2 0 0 1
|
|
4601 4601 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4602 4602 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4603 4603 ^OSID=[a-zA-Z0-9\/+]{171}=$ 2 0 0 1
|
|
4604 4604 \=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4605 4605 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4606 4606 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4607 4607 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4608 4608 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4609 4609 ^[a-z0-9_]{6}[^a-z0-9_] 2 0 0 1
|
|
4610 4610 ^[a-z0-9]{5}\.com$ 2 0 0 1
|
|
4611 4611 ^[a-z]{3,15}\x3a\x20 2 0 0 1
|
|
4612 4612 ^[a-zA-z]{5,10}_[A-F0-9]{12}$ 2 0 0 1
|
|
4613 4613 ^[a-zA-z]{5,10}_[A-F0-9]{12}$ 2 0 0 1
|
|
4614 4614 ^[^\"]+\x7c\x22\x2c\x22 2 0 0 1
|
|
4615 4615 ^[a-z0-9]{32} 2 0 0 1
|
|
4616 4616 ^[a-z0-9]{32} 2 0 0 1
|
|
4617 4617 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4618 4618 ^(curl|wget)_?(c(ve_20(1((7_1161|8_760)0|9_10758)|20_16846)|url_xxljobUnauth)|tp5)$ 2 0 0 1
|
|
4619 4619 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4620 4620 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4621 4621 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4622 4622 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
4623 4623 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4624 4624 ^_?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4625 4625 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4626 4626 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4627 4627 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4628 4628 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4629 4629 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4630 4630 ^[a-f0-9]{5,12}&a= 2 0 0 1
|
|
4631 4631 CN=([^\r\n]+?\.)?hotjar\.info(\.) 2 0 0 1
|
|
4632 4632 ^\/\?d=[a-f0-9]{16}$ 2 0 0 1
|
|
4633 4633 ^[a-z]{1} 2 0 0 1
|
|
4634 4634 ^Date\x3a\x20[^\r\n]+[0-9]{2}::[0-9]{2}\x20 2 0 0 1
|
|
4635 4635 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
|
|
4636 4636 ^[A-P]{256}$ 2 0 0 1
|
|
4637 4637 ^[a-f0-9]{32}\r\n\r\nPK 2 0 0 1
|
|
4638 4638 ^pk=[A-Za-z0-9]{8,50}&value=[a-f0-9]{50,500}$ 2 0 0 1
|
|
4639 4639 ^[A-Z]{2}-[A-Z0-9]{10,20}-[A-Z0-9]{6,10}-[A-Z0-9]{2,8}-[A-Z0-9]{2,8}-[0-9]{2,5}$ 2 0 0 1
|
|
4640 4640 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$ 2 0 0 1
|
|
4641 4641 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$ 2 0 0 1
|
|
4642 4642 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$ 2 0 0 1
|
|
4643 4643 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1
|
|
4644 4644 ^\.(93joshua|purrple|black)$ 2 0 0 1
|
|
4645 4645 Content-Disposition\x3a\x20form-data\x3b\s*name=\x22(source|formdata|billinfo|cardinfo)\x22 2 0 0 1
|
|
4646 4646 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1
|
|
4647 4647 ^[A-Za-z0-9_-]+$ 2 0 0 1
|
|
4648 4648 plugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes) 2 0 0 1
|
|
4649 4649 ^CN=www\.[0-9a-z]{8,20}\.net$ 2 0 0 1
|
|
4650 4650 ^[A-F0-9]+$ 2 0 0 1
|
|
4651 4651 \.[dghbcijklmnfqrwxyz23stuopaev4569]{26}\.[a-z0-9_-]{1,50}\.[a-z]{2,8}$ 2 0 0 1
|
|
4652 4652 ^[a-zA-z]{8}\. 2 0 0 1
|
|
4653 4653 ^[a-zA-z]{8}\. 2 0 0 1
|
|
4654 4654 [^\x18][^\x44\x32\x33\x25\x64\x22\x23\x3a\x27\x24\x26\x34\x3b\x12] 2 0 0 1
|
|
4655 4655 ^[A-F0-9]{32} 2 0 0 1
|
|
4656 4656 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4657 4657 ^tt[cf]$ 2 0 0 1
|
|
4658 4658 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4659 4659 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4660 4660 ^([1-3]?)\/download\.php\?filename=ccom 2 0 0 1
|
|
4661 4661 ^[a-z]$ 2 0 0 1
|
|
4662 4662 \/([0-9]*?[a-z]*?[a-z0-9)([a-z0-9]*[0-9][a-z]*[0-9][a-z0-9]*\.exe)(setup\d+\.exe)[a-z0-9]{5,15}\.exe 2 0 0 1
|
|
4663 4663 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1
|
|
4664 4664 ^User-Agent\x3a\x20(Mozilla\/|Shockwave) 2 0 0 1
|
|
4665 4665 id\x3d[a-z0-9]{8}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{12}\x26key\x3d[a-z0-9]{512} 2 0 0 1
|
|
4666 4666 ^[a-zA-Z0-9\/+]{171}=$ 2 0 0 1
|
|
4667 4667 ^([a-f0-9]{32})=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4668 4668 ^[a-z0-9]{32} 2 0 0 1
|
|
4669 4669 ^[\x20-\x7e]+?.{8}\x7d\x9f 2 0 0 1
|
|
4670 4670 ^[\x20-\x7e]+?.{8}\x7a\x9f 2 0 0 1
|
|
4671 4671 ^[\x20-\x7e]+?.{8}\x78\x9a 2 0 0 1
|
|
4672 4672 ^[\x20-\x7e]+?.{8}\x7f\x9f 2 0 0 1
|
|
4673 4673 ^[\x20-\x7e]+?.{8}\xc3\x70 2 0 0 1
|
|
4674 4674 ^[\x20-\x7e]+?.{8}\x7c\x9e 2 0 0 1
|
|
4675 4675 ^.{4}[\x20-\x7e]+?.{4}\x78\x9c 2 0 0 1
|
|
4676 4676 ^[\x20-\x7e]+?.{8}\x7c\x99 2 0 0 1
|
|
4677 4677 ^[\x20-\x7e]+?.{8}\x7f\x9b 2 0 0 1
|
|
4678 4678 ^[\x20-\x7e]+?.{8}\x31\xd9 2 0 0 1
|
|
4679 4679 ^[\x20-\x7e]+?.{8}\x70\x9b 2 0 0 1
|
|
4680 4680 ^[\x20-\x7e]+?.{8}\xda\x41 2 0 0 1
|
|
4681 4681 ^[\x20-\x7e]+?.{8}\x7a\x9a 2 0 0 1
|
|
4682 4682 ^[\x20-\x7e]+?.{8}\x3f\xa6 2 0 0 1
|
|
4683 4683 ^[\x20-\x7e]+?.{8}\x70\x9b 2 0 0 1
|
|
4684 4684 ^[\x20-\x7e]+?.{8}\x39\xdd 2 0 0 1
|
|
4685 4685 ^.{4}[\x20-\x7e]+?.{4}\x78\x9c 2 0 0 1
|
|
4686 4686 ^[\x20-\x7e]+?.{8}\x3b\xd8 2 0 0 1
|
|
4687 4687 ^[\x20-\x7e]+?.{8}\x79\x9b 2 0 0 1
|
|
4688 4688 ^[\x20-\x7e]+?.{8}\x7c\x9c 2 0 0 1
|
|
4689 4689 ^[\x20-\x7e]+?.{8}\x79\x95 2 0 0 1
|
|
4690 4690 ^[\x20-\x7e]+?.{8}\x71\x95 2 0 0 1
|
|
4691 4691 ^[\x20-\x7e]{5,}.{8}\x78\x9c 2 0 0 1
|
|
4692 4692 ^[\x20-\x7e]+?.{8}\x7b\x95 2 0 0 1
|
|
4693 4693 ^[\x20-\x7e]+?.{8}\x79\x9f 2 0 0 1
|
|
4694 4694 ^[A-Z]{14}$ 2 0 0 1
|
|
4695 4695 ^.{4}[\x20-\x7e]+?.{4}\x71\x94 2 0 0 1
|
|
4696 4696 ^[\x20-\x7e]*?.{8}\x79\x9e 2 0 0 1
|
|
4697 4697 ^.{4}[\x20-\x7e]+?.{4}\x7c\x9c 2 0 0 1
|
|
4698 4698 ^[\x20-\x7e]+?.{8}\x7f\x9d 2 0 0 1
|
|
4699 4699 ^[\x20-\x7e]+?.{8}\x49\xa5 2 0 0 1
|
|
4700 4700 ^[\x20-\x7e]+?.{8}\x79\x94 2 0 0 1
|
|
4701 4701 ^.{8}[\x20-\x7e]+?.{5}\x7b\x9e 2 0 0 1
|
|
4702 4702 ^.{4}[\x20-\x7e]+?.{4}\x7d\x94 2 0 0 1
|
|
4703 4703 ^[\x20-\x7e]+?.{8}\x7d\x94 2 0 0 1
|
|
4704 4704 ^multipart/form-data\x3b\x20boundary=[a-f0-9]{60}$ 2 0 0 1
|
|
4705 4705 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1
|
|
4706 4706 ^[\x20-\x7e]+?.{8}\x7b\x98 2 0 0 1
|
|
4707 4707 ^[\x20-\x7e]+?.{8}\x31\xad 2 0 0 1
|
|
4708 4708 ^[\x20-\x7e]+?.{8}\x40\xa3 2 0 0 1
|
|
4709 4709 ^[\x20-\x7e]+?.{8}\x7d\x98 2 0 0 1
|
|
4710 4710 ^.{4}[\x20-\x7e]{5}.{4}\x7a\x9a 2 0 0 1
|
|
4711 4711 ^[\x20-\x7e]+?.{8}\x71\x9d 2 0 0 1
|
|
4712 4712 ^[\x20-\x7e]+?.{8}\x7a\x9b 2 0 0 1
|
|
4713 4713 ^.{8}\x70\x94[\x20-\x7e] 2 0 0 1
|
|
4714 4714 ^[\x20-\x7e]+?.{8}\x79\xda 2 0 0 1
|
|
4715 4715 ^[\x20-\x7e]+?.{8}\x30\xa5 2 0 0 1
|
|
4716 4716 ^[\x20-\x7e]+?.{8}\x70\x9a 2 0 0 1
|
|
4717 4717 ^[\x20-\x7e]+?.{8}\x79\x9b 2 0 0 1
|
|
4718 4718 ^[\x20-\x7e]+?.{8}\x31\xd9 2 0 0 1
|
|
4719 4719 ^[\x20-\x7e]+?.{8}\x79\x9c 2 0 0 1
|
|
4720 4720 ^[\x20-\x7e]+?.{8}\x7d\x99 2 0 0 1
|
|
4721 4721 ^[\x20-\x7e]+?.{8}\x7b\x9d 2 0 0 1
|
|
4722 4722 ^[\x20-\x7e]+?.{8}\x2e\x96 2 0 0 1
|
|
4723 4723 ^[\x20-\x7e]+?.{8}\x78\x9c 2 0 0 1
|
|
4724 4724 ^[\x20-\x7e]+?.{8}\x70\x98 2 0 0 1
|
|
4725 4725 ^[\x20-\x7e]+?.{8}\x4a\xae 2 0 0 1
|
|
4726 4726 ^[\x20-\x7e]+?.{8}\x71\x9e 2 0 0 1
|
|
4727 4727 ^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c 2 0 0 1
|
|
4728 4728 ^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c 2 0 0 1
|
|
4729 4729 ^.{8}[\x20-\x7e]+?\x79\x94 2 0 0 1
|
|
4730 4730 ^[\x20-\x7e]+?.{8}\x84\x60 2 0 0 1
|
|
4731 4731 ^[\x20-\x7e]+?.{8}\x40\xd8 2 0 0 1
|
|
4732 4732 ^[\x20-\x7e]+?.{8}\x7f\x94 2 0 0 1
|
|
4733 4733 ^[\x20-\x7e]+?.{8}\x79\x9c 2 0 0 1
|
|
4734 4734 ^[\x20-\x7e]+?.{8}\x7a\x9c 2 0 0 1
|
|
4735 4735 ^[\x20-\x7e]+?.{8}\x7e\x9c 2 0 0 1
|
|
4736 4736 ^[\x20-\x7e]+?.{8}\x39\x99 2 0 0 1
|
|
4737 4737 ^[\x20-\x7e]+?.{8}\x49\xa2 2 0 0 1
|
|
4738 4738 ^[\x20-\x7e]+?.{8}\x79\x9d 2 0 0 1
|
|
4739 4739 ^[\x20-\x7e]+?.{8}\x7b\x9f 2 0 0 1
|
|
4740 4740 ^[\x20-\x7e]+?.{8}\x79\x9a 2 0 0 1
|
|
4741 4741 ^[\x20-\x7e]+?.{8}\x70\x94 2 0 0 1
|
|
4742 4742 ^[\x20-\x7e]+?.{8}\x44\xdf 2 0 0 1
|
|
4743 4743 ^.{4}[\x20-\x7e]+?.{4}\x7b\x9e 2 0 0 1
|
|
4744 4744 ^[\x20-\x7e]+?.{8}\x7b\x9e 2 0 0 1
|
|
4745 4745 ^[\x20-\x7e]+?.{8}\x83\x7f 2 0 0 1
|
|
4746 4746 ^.{8}[\x20-\x7e]+?\x7c\x9f 2 0 0 1
|
|
4747 4747 ^[\x20-\x7e]+?.{8}\x7d\x9a 2 0 0 1
|
|
4748 4748 ^.{9,28}\x78\x9c 2 0 0 1
|
|
4749 4749 ^.{8}[\x20-\x7e]{5}\x78\x9c 2 0 0 1
|
|
4750 4750 ^[\x20-\x7e]+?.{8}\x4a\xd5 2 0 0 1
|
|
4751 4751 ^[\x20-\x7e]+?.{8}\x79\xdd 2 0 0 1
|
|
4752 4752 ^[\x20-\x7e]+?.{8}\x70\x9e 2 0 0 1
|
|
4753 4753 ^[\x20-\x7e]+?.{10}\x7a\x5d 2 0 0 1
|
|
4754 4754 ^.{8}[\x20-\x7e]+?.{5}\x7c\x9e 2 0 0 1
|
|
4755 4755 ^[\x20-\x7e]+?.{8}\x7d\x9e 2 0 0 1
|
|
4756 4756 ^[\x20-\x7e]+?.{8}\x70\x9c 2 0 0 1
|
|
4757 4757 ^[\x20-\x7e]+?.{8}\x3b\xdf 2 0 0 1
|
|
4758 4758 ^[\x20-\x7e]+?.{8}\x47\xd9 2 0 0 1
|
|
4759 4759 ^[\x20-\x7e]+?.{8}\x79\x99 2 0 0 1
|
|
4760 4760 ^.{8}[\x20-\x7e]+?.{2}\x78\x9c 2 0 0 1
|
|
4761 4761 ^.{4}[\x20-\x7e]{5}.{4}\x96\x71 2 0 0 1
|
|
4762 4762 ^[\x20-\x7e]+?.{8}\x7b\x9b 2 0 0 1
|
|
4763 4763 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4764 4764 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4765 4765 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4766 4766 ([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4767 4767 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4768 4768 ^[a-f0-9]{32} 2 0 0 1
|
|
4769 4769 >\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}> 2 0 0 1
|
|
4770 4770 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4771 4771 ^[A-Za-z0-9_]{20}\/[a-f0-9]{40}$ 2 0 0 1
|
|
4772 4772 \/[a-z0-9]{1,31}\.bin$ 2 0 0 1
|
|
4773 4773 ^[A-Za-z0-9\-_~]{75,}$ 2 0 0 1
|
|
4774 4774 (JmJ1aWxkP|YnVpbGQ9|ZidWlsZD) 2 0 0 1
|
|
4775 4775 ^[\x80|\x40]\x00[\x80|\x40]\x00\x00\x00 2 0 0 1
|
|
4776 4776 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4777 4777 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4778 4778 ^[A-Za-z0-9]{16,32}$ 2 0 0 1
|
|
4779 4779 ^[a-zA-Z0-9_-]{171}$ 2 0 0 1
|
|
4780 4780 (Q(k(MIdh|UMcR)|0IPdR)|(DQg91|FRghw)F|(NCD3U|VGCHA)X) 2 0 0 1
|
|
4781 4781 (fCxTeXN0ZW0gSWRsZS|wsU3lzdGVtIElkbGUg|8LFN5c3RlbSBJZGxlI) 2 0 0 1
|
|
4782 4782 (I(iwidmFsdWUiO|sInZhbHVlIjo)i|iLCJ2YWx1ZSI6I) 2 0 0 1
|
|
4783 4783 ^[0-9a-f]{64}$ 2 0 0 1
|
|
4784 4784 ^[0-9a-f]{64}$ 2 0 0 1
|
|
4785 4785 ^[\x01-\x4c]$ 2 0 0 1
|
|
4786 4786 CN=([^\r\n]+?\.)?OU=Delegated\ Licensor,KYP\ SDT\ LTD(\.) 2 0 0 1
|
|
4787 4787 ^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4788 4788 ^key=\w+\&data= 2 0 0 1
|
|
4789 4789 ^\d+$ 2 0 0 1
|
|
4790 4790 \.php\?zs=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&t=[0-9]{1,2}$ 2 0 0 1
|
|
4791 4791 ^[0-9D]+$ 2 0 0 1
|
|
4792 4792 \.(dll|exe|zip|json)$ 2 0 0 1
|
|
4793 4793 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4794 4794 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4795 4795 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4796 4796 ^\/[a-zA-Z0-9]{9,12}\/t\.html$ 2 0 0 1
|
|
4797 4797 ^\/[a-z]{3,10}\.php\?[a-z]{3,10}=([A-Za-z0-9+/]{4}) 2 0 0 1
|
|
4798 4798 ^[a-z]{256}$ 2 0 0 1
|
|
4799 4799 ^[0-9]&(index|pi|serv)= 2 0 0 1
|
|
4800 4800 ^[0-9]&(index|pi|serv)= 2 0 0 1
|
|
4801 4801 ^[0-9]&(index|pi|serv)= 2 0 0 1
|
|
4802 4802 ^\/[a-zA-Z0-9+=]{29,44}.{0,8}=$ 2 0 0 1
|
|
4803 4803 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1
|
|
4804 4804 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1
|
|
4805 4805 ^[A-Za-z0-9]{1,15}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1
|
|
4806 4806 (IiwiM2ZlMTEiOi|IsIjNmZTExIjoi|iLCIzZmUxMSI6I) 2 0 0 1
|
|
4807 4807 (IiwiYXU1byI6I|IsImF1NW8iOi|iLCJhdTVvIjoi) 2 0 0 1
|
|
4808 4808 (ifQ==|In0=|J9)$ 2 0 0 1
|
|
4809 4809 ^[a-z]{256}-\.jpg$ 2 0 0 1
|
|
4810 4810 ^[IJKL].*(PT0iLC|09Iiwi|9PSIsI)[a-zA-Z0-9+\/]+(PT0iLC|09Iiwi|9PSIsI) 2 0 0 1
|
|
4811 4811 ^[a-f0-9]{5,12}&a= 2 0 0 1
|
|
4812 4812 ^[a-zA-Z0-9]{12}\.onion 2 0 0 1
|
|
4813 4813 ^\x7b(\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22,){4}\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22\x7d$ 2 0 0 1
|
|
4814 4814 ^[a-z]{256}\.gif$ 2 0 0 1
|
|
4815 4815 (JTBEJTBBJTBEJTBBJTREJTY1JTZEJTZGJTcyJTc5JTNBJTIw|UwRCUwQSUwRCUwQ) 2 0 0 1
|
|
4816 4816 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d+)?$ 2 0 0 1
|
|
4817 4817 ^\/[a-zA-Z0-9]{9,12}\/x\.html$ 2 0 0 1
|
|
4818 4818 ^[0-9]+$ 2 0 0 1
|
|
4819 4819 ^([A-Za-z0-9%+\/]{4,6})*([A-Za-z0-9%+\/]{2}==|[A-Za-z0-9%+\/]{3}=|[A-Za-z0-9%+\/]{4})$ 2 0 0 1
|
|
4820 4820 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4821 4821 ^[\x01-\x04] 2 0 0 1
|
|
4822 4822 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4823 4823 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4824 4824 [a-z]{8}.(:?psd|dib) 2 0 0 1
|
|
4825 4825 [a-z]{8}.(:?dib|psd) 2 0 0 1
|
|
4826 4826 https:\/\/[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12} 2 0 0 1
|
|
4827 4827 ^[a-z0-9]{6}_[a-z0-9]{32} 2 0 0 1
|
|
4828 4828 \.php\?[a-z]{3}=(baby|child|adult) 2 0 0 1
|
|
4829 4829 ^[a-f0-9=]{5,12}&ap= 2 0 0 1
|
|
4830 4830 ^[0-9]{8}$ 2 0 0 1
|
|
4831 4831 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4832 4832 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4833 4833 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4834 4834 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4835 4835 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4836 4836 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4837 4837 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4838 4838 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4839 4839 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4840 4840 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4841 4841 ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ 2 0 0 1
|
|
4842 4842 ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ 2 0 0 1
|
|
4843 4843 ^(update|designs)$ 2 0 0 1
|
|
4844 4844 ^\d$ 2 0 0 1
|
|
4845 4845 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a80$ 2 0 0 1
|
|
4846 4846 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4847 4847 \*\*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\*\* 2 0 0 1
|
|
4848 4848 ^\/wp\x2dcontent\/[a-z]{3}\/[0-9]{16}\.exe$ 2 0 0 1
|
|
4849 4849 ^[A-Za-z0-9-_]{176}$ 2 0 0 1
|
|
4850 4850 ^\/\.x\/irq\d$ 2 0 0 1
|
|
4851 4851 ^\/\.x\/\dsh$ 2 0 0 1
|
|
4852 4852 ^(?<len>.{2})\xc0\xff(=len)\x00\x00.{2}\x00\x00\x01\x78\x9c 2 0 0 1
|
|
4853 4853 \x24url[0-9]{1}\s=\s'(http|https):\/\/[^']*\x27\x3b 2 0 0 1
|
|
4854 4854 ^\/[A-Za-z0-9]{10,11}\/ 2 0 0 1
|
|
4855 4855 \.php\?serial=[a-z0-9]{16} 2 0 0 1
|
|
4856 4856 ^[0-3]{2}_[0-2]{2}\.php$ 2 0 0 1
|
|
4857 4857 ^dBrowser\x20\d\x20CallGetResponse\x3a\d$ 2 0 0 1
|
|
4858 4858 ^\/\w$ 2 0 0 1
|
|
4859 4859 ^\/wrte\?maid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$ 2 0 0 1
|
|
4860 4860 ^\/[a-z0-9]{1,3}\/service\?uuid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$ 2 0 0 1
|
|
4861 4861 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20} 2 0 0 1
|
|
4862 4862 ^\/wp-includes\/[A-Za-z0-9]{10}\/$ 2 0 0 1
|
|
4863 4863 ^.\d{1,2}\.\d+\.\d+ 2 0 0 1
|
|
4864 4864 ^.\d{1,2}\.\d+\.\d+ 2 0 0 1
|
|
4865 4865 ^.\d{1,2}\.\d+\.\d+ 2 0 0 1
|
|
4866 4866 ^.\d{1,2}\.\d+\.\d+ 2 0 0 1
|
|
4867 4867 ^.\d{1,2}\.\d+\.\d+ 2 0 0 1
|
|
4868 4868 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4869 4869 ^[A-Za-z0-9]{16,32}$ 2 0 0 1
|
|
4870 4870 ^[A-Za-z0-9]{16,32}$ 2 0 0 1
|
|
4871 4871 ^\d+$ 2 0 0 1
|
|
4872 4872 ^\/[A-Za-z0-9]{30}\.php$ 2 0 0 1
|
|
4873 4873 ^[a-f0-9]{5}([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4}) 2 0 0 1
|
|
4874 4874 ^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$ 2 0 0 1
|
|
4875 4875 ^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$ 2 0 0 1
|
|
4876 4876 ^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$ 2 0 0 1
|
|
4877 4877 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4878 4878 ^[a-z0-9]{8}\r\n 2 0 0 1
|
|
4879 4879 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
4880 4880 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4881 4881 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4882 4882 ^[0-9]{6,10}\. 2 0 0 1
|
|
4883 4883 ^\/[a-zA-z]{14}\/ 2 0 0 1
|
|
4884 4884 ^\/[a-zA-z]{14}\/ 2 0 0 1
|
|
4885 4885 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4886 4886 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4887 4887 ^[A-Z]{16}$ 2 0 0 1
|
|
4888 4888 ^\/\x3fusername\x3d[a-z0-9]{2,3}_\d$ 2 0 0 1
|
|
4889 4889 ^[A-Z]{16}$ 2 0 0 1
|
|
4890 4890 ^[A-Z]{16}$ 2 0 0 1
|
|
4891 4891 ^([A-F0-9]\x00){12} 2 0 0 1
|
|
4892 4892 ^([A-F0-9]\x00){12} 2 0 0 1
|
|
4893 4893 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4894 4894 ^[A-F0-9]{12} 2 0 0 1
|
|
4895 4895 ^([A-F0-9]\x00){12} 2 0 0 1
|
|
4896 4896 ^[A-F0-9]{12} 2 0 0 1
|
|
4897 4897 ^(<letter>[a-z])(=letter)\, 2 0 0 1
|
|
4898 4898 O=(GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(NL|Pty|Inc|Corp|Ltd)\.?,.+CN=[a-z]{5,}\.[a-z]{2,3}($|,) 2 0 0 1
|
|
4899 4899 [eE]mail(Address)admin@ 2 0 0 1
|
|
4900 4900 ^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.) 2 0 0 1
|
|
4901 4901 ^([0-9]{1,3}\.){3}[0-9]{1,3}$/W 2 0 0 1
|
|
4902 4902 ^([0-9]{1,3}\.){3}[0-9]{1,3}$/W 2 0 0 1
|
|
4903 4903 ^[A-F0-9]{12} 2 0 0 1
|
|
4904 4904 ^\d 2 0 0 1
|
|
4905 4905 ^\x2F[a-z]{1}\x2Ehtm$ 2 0 0 1
|
|
4906 4906 \/index.dat\?\d{5,9}$ 2 0 0 1
|
|
4907 4907 ^\/[A-Za-z]{2,}\/\?[a-z]\sHTTP\/1\.[0-1]\r\nUser-Agent\x3a Mozilla\/4\.0 2 0 0 1
|
|
4908 4908 ^Host\x3a\x20([a-z0-9]{0,19}[A-Z])([A-Z0-9]{0,19}[a-z])[a-zA-Z0-9]{4,20}\.[a-z]{2,3}/H 2 0 0 1
|
|
4909 4909 ^[a-zA-Z0-9\+\/]+={0,2}$/P 2 0 0 1
|
|
4910 4910 filename=[a-f0-9]{32}v\.(docm|zip)\x0d\x0a/Hmi 2 0 0 1
|
|
4911 4911 ^((\x00\x00\x00).)*?_\x00((\x00\x00).)*?_\x00((\x00\x00).)*?_\x00 2 0 0 1
|
|
4912 4912 ^[a-z]\x29 2 0 0 1
|
|
4913 4913 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title 2 0 0 1
|
|
4914 4914 ^.{2}([a-z]{0,15}\d)(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x0a.{2}(=var) 2 0 0 1
|
|
4915 4915 ^\/[a-z]$ 2 0 0 1
|
|
4916 4916 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4917 4917 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4918 4918 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4919 4919 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4920 4920 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4921 4921 ^.{2}(<fake_loc>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]) 2 0 0 1
|
|
4922 4922 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4923 4923 ^[a-z0-9/=\+]$ 2 0 0 1
|
|
4924 4924 ^[a-z0-9/=\+]$ 2 0 0 1
|
|
4925 4925 ^\/d\/[a-z]+\d+\.jpg$ 2 0 0 1
|
|
4926 4926 \/p?2p\/[0-9]{1,2}\.exe$ 2 0 0 1
|
|
4927 4927 ^\/2p\/[a-z]{1,2}\.exe$ 2 0 0 1
|
|
4928 4928 \/[a-z0-9]{3,}\.gz$ 2 0 0 1
|
|
4929 4929 \/mss\d+\.exe$ 2 0 0 1
|
|
4930 4930 ^\/download\/ftp\/(grabftp|grabftp64)\.bin$ 2 0 0 1
|
|
4931 4931 ^\/image\/(data|flags)\/[^\x2f]+\.exe$ 2 0 0 1
|
|
4932 4932 (\x20MSIE\x20|rv\x3a11) 2 0 0 1
|
|
4933 4933 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1
|
|
4934 4934 ^\/[a-z]{3,6}\/[a-z]{3,6}\.[a-z]{3}$ 2 0 0 1
|
|
4935 4935 ^[A-Z]{2}-[0-9]{1,5}\x3aBegin$ 2 0 0 1
|
|
4936 4936 ^[A-Z]{2}-[0-9]{1,5}\x3aStartU$ 2 0 0 1
|
|
4937 4937 ^\/command\/[A-Fa-f0-9]{8}\-([A-Fa-f0-9]{4}\-){3}[A-Fa-f0-9]{12}\.cmd$ 2 0 0 1
|
|
4938 4938 ^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK> 2 0 0 1
|
|
4939 4939 ^\{\x22uid\x22\x3a\x22[a-f0-9]+\x22\}$ 2 0 0 1
|
|
4940 4940 ^[A-Za-z0-9_-]{171}$ 2 0 0 1
|
|
4941 4941 ^\/[a-f0-9]{8}\/\D+\d{8,10}\.html$ 2 0 0 1
|
|
4942 4942 ^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}\/){1,10})\sHTTP\/1\.1\r\n 2 0 0 1
|
|
4943 4943 ^\x2f\x00{3}[A-Z0-9]{6}_[a-f0-9]+\x00{16}$ 2 0 0 1
|
|
4944 4944 [A-Za-z0-9]{62} 2 0 0 1
|
|
4945 4945 ^(php)?Yuok\\\d\d 2 0 0 1
|
|
4946 4946 Data\\\d\d 2 0 0 1
|
|
4947 4947 ^[a-zA-Z0-9\/+]{171}=$ 2 0 0 1
|
|
4948 4948 ^\/\?id\=[A-Z]{12,28}[0-9]$ 2 0 0 1
|
|
4949 4949 ^\/\?id\=[A-Z]{12,28}[0-9]$ 2 0 0 1
|
|
4950 4950 \/\?p=p52dcW[A-Za-z]{4} 2 0 0 1
|
|
4951 4951 ^.{2}(<var>[a-zA-Z0-9]{24}[01]).+?\x06\x03\x55\x04\x07.{2}(=var) 2 0 0 1
|
|
4952 4952 ^(<var>[a-zA-Z0-9]{1,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1
|
|
4953 4953 ^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1
|
|
4954 4954 ^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1
|
|
4955 4955 ^.(<orgname>.[^01]+).*?\x55\x04\x0b.(=orgname) 2 0 0 1
|
|
4956 4956 [^\x15][^\x49\x3f\x3e\x28\x69\x2f\x2e\x37\x2a\x29\x2b\x39\x36] 2 0 0 1
|
|
4957 4957 ^[0-9]-[0-9]-[0-9]{5}-[0-9]\r\n 2 0 0 1
|
|
4958 4958 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4959 4959 ^[A-Za-z0-9\/_\-\+]{171}=$ 2 0 0 1
|
|
4960 4960 [a-zA-Z0-9]{8}\/ 2 0 0 1
|
|
4961 4961 ^[a-z]\.(tech|online)$ 2 0 0 1
|
|
4962 4962 ^([0-9]{1,3}\.){3}[0-9]{1,3}$/W 2 0 0 1
|
|
4963 4963 ^[a-zA-Z0-9-_]{171}$ 2 0 0 1
|
|
4964 4964 [a-z0-9]{8}\/.*\?[a-z0-9]{3,10}=[a-z0-9]{8,11}$ 2 0 0 1
|
|
4965 4965 updateb\.php\?p=\d 2 0 0 1
|
|
4966 4966 &os=[0-9a-z]{40} 2 0 0 1
|
|
4967 4967 &(<vname>[a-z]+)1=[A-F0-9]+&(=vname)2=[A-F0-9]+&(=vname)3=[A-F0-9]+&(=vname)4=[A-F0-9] 2 0 0 1
|
|
4968 4968 ^[1-z]{13}=[0-9]{16}$ 2 0 0 1
|
|
4969 4969 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4970 4970 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4971 4971 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
|
|
4972 4972 ^\/[A-F0-9]{33}$ 2 0 0 1
|
|
4973 4973 ^\d+?\x00 2 0 0 1
|
|
4974 4974 %(USERPROFILE|APPDATA)% 2 0 0 1
|
|
4975 4975 %(USERPROFILE|APPDATA)% 2 0 0 1
|
|
4976 4976 %(USERPROFILE|APPDATA)% 2 0 0 1
|
|
4977 4977 %(USERPROFILE|APPDATA)% 2 0 0 1
|
|
4978 4978 ^[0-9]{10}$ 2 0 0 1
|
|
4979 4979 ^key=[A-F0-9]{32}$ 2 0 0 1
|
|
4980 4980 ^[a-f0-9]{60}\x0d\x0a 2 0 0 1
|
|
4981 4981 ^(pro)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
|
|
4982 4982 [0-9]{1,2} 2 0 0 1
|
|
4983 4983 \d{1,2} 2 0 0 1
|
|
4984 4984 [0-9]{1,2} 2 0 0 1
|
|
4985 4985 [0-9]{1,2} 2 0 0 1
|
|
4986 4986 [0-9]{1,2} 2 0 0 1
|
|
4987 4987 [0-9]{1,2} 2 0 0 1
|
|
4988 4988 CN=([^\r\n]+?\.)?supportmicrohere\.com(\.) 2 0 0 1
|
|
4989 4989 CN=([^\r\n]+?\.)?jbdelmarket\.com(\.) 2 0 0 1
|
|
4990 4990 [0-9]{1,3} 2 0 0 1
|
|
4991 4991 [0-9]{1,3} 2 0 0 1
|
|
4992 4992 ^ETag\x3a\x20[0-9]{6}-[0-9]{3,5}-[0-9]{8}\r\n 2 0 0 1
|
|
4993 4993 ^([0-9]{1,3}\.){3}[0-9]{1,3}$/W 2 0 0 1
|
|
4994 4994 [a-f0-9]{60}$ 2 0 0 1
|
|
4995 4995 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
4996 4996 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1
|
|
4997 4997 ^[a-z0-9]{33} 2 0 0 1
|
|
4998 4998 ^[qbedm]{1}[a-zA-Z]{1,3}646[a-zA-Z0-9]{1,3}\. 2 0 0 1
|
|
4999 4999 ^[zjr9x]{1}[tmdhpz]{1}[0-9a-z]{1,6}266([a-zA-Z0-9]{1,6})?\. 2 0 0 1
|
|
5000 5000 ^5\.[0-2]\x20\d\d\x3a\d\d\x20 2 0 0 1 |