<?php 
/**
* @version		$Id$
* @package		Elxis
* @subpackage	Elxis Defender
* @copyright	Copyright (c) 2006-2012 Elxis CMS (http://www.elxis.org). All rights reserved.
* @license		Elxis Public License ( http://www.elxis.org/elxis-public-license.html )
* @author		Elxis Team ( http://www.elxis.org )
* @description 	Elxis CMS is free software. Read the license for copyright notices and details
*/

defined('_ELXIS_') or die ('Direct access to this location is not allowed.');


/* USER AGENTS (Last update: 2011-06-21 20:50:10) */
$signatures = array(
	array('inmatch', 'useragentsws', '<?', 'PHP Script Execution Attempt.'),
	array('inmatch', 'useragentsws', '?>', 'PHP Script Break Attempt.'),
	array('inmatch', 'useragentsws', 'droptable', 'SQL injection attempt.'),
	array('inmatch', 'useragent', ' href','http url injection.'),
	array('inmatch', 'useragent', 'iframe','iframe injection.'),
	array('inmatch', 'useragentsws', '<script','http javascript (wedge end/script start) injection.'),
	array('inmatch', 'useragentsws', '/script>','http javascript (wedge start/script end) injection.'),
	array('inmatch', 'useragentsws', '<a','Anchor hack.'),
	array('inmatch', 'useragentsws', '/a>','Anchor hack.'),
	array('inmatch', 'useragent', '[url=','Anchor hack.'),
	array('inmatch', 'useragent', 'libwww-perl', 'No known valid perl clients or spiders. Infected machine.'),
	array('inmatch', 'useragent', 'curl', 'Robot Probe (modsecurity.org).'),
	array('lmatch', 'useragent', 'java/', 'No known valid Java clients or spiders. Infected machine.'),
	array('inmatch', 'useragent', 'tencenttraveler', 'Your computer is infected with Trojan Downloader tencenttraveler.'),
	array('inmatch', 'useragent', 'qqdownload', 'Your computer is infected with Trojan Downloader QQDownload.'),
	array('inmatch', 'useragent', 'ds_juicyaccess', 'Your computer is infected with Trojan Downloader ds_juicyaccess.'),
	array('inmatch', 'useragent', 'qqpinyinsetup', 'Your computer is infected with Trojan Keylogger QQPinyinSetup.'),
	array('inmatch', 'useragent', 'cncdialer', 'Your computer is infected with Trojan Dialer CNCDialer.'),
	array('inmatch', 'useragent', 'foxy/1', 'Your computer is infected with Trojan Cloaker Foxy.'),
	array('inmatch', 'useragent', 'desktopsmiley', 'Your computer is infected with Trojan Hijacker desktopsmiley.'),
	array('inmatch', 'useragent', 'theworld)', 'Your computer is infected with Trojan Dropper TheWorld.'),
	array('inmatch', 'useragent', '360se)', 'Your computer is infected with Trojan Dropper 360SE.'),
	array('inmatch', 'useragent', 'sicent', 'Your computer is infected with Trojan Remote Sicent.'),
	array('inmatch', 'useragent', 'icafe', 'Your computer is infected with Trojan Remote icafe.'),
	array('inmatch', 'useragent', 'msie 999.1', 'Invalid User Agent.'),
	array('inmatch', 'useragent', 'asia', '"asia" User agent. Invariably a bot.'),
	array('inmatch', 'useragent', 'morfeus', 'hacktool morfeus f**king scanner.'),
	array('inmatch', 'useragent', 'fuck', 'hacktool word. INSTA-BAN.'),
	array('inmatch', 'useragent', 'casino', 'Invariably a bot. INSTA-BAN.'),
	array('inmatch', 'useragent', 'mrsputnik', 'Nogoodnik nekulturny mail.ru forum spamming bot.'),
	array('inmatch', 'useragent', ' obot', 'exploit scanning bot.'), 
	array('inmatch', 'useragent', 'america online browser', 'Forum spamming bot, real announces as AOL.'),
	array('inmatch', 'useragent', 'toata dragostea mea pentru diavola', 'Oddball bot.'), 
	array('inmatch', 'useragent', 'mj12bot', 'www.majestic12.co.uk, fake, masked IP, dont use robots.txt, stealing your data.'), 
	array('inmatch', 'useragent', 'python-urllib', 'No known valid python clients or spiders. Infected machine.'),
	array('inmatch', 'useragent', 'indy library', 'Robot Probe (modsecurity.org).'),
	array('inmatch', 'useragent', 'snoopy', 'Robot Probe (modsecurity.org).'),
	array('inmatch', 'useragent', 'microsoft url control', 'Robot Probe (modsecurity.org).'),
	array('inmatch', 'useragent', 'download demon', 'Robot Probe (modsecurity.org).'),
	array('inmatch', 'useragent', 'libwww-pavuk', 'Robot Probe (modsecurity.org).'),
	array('inmatch', 'useragent', 'big brother', 'Robot Probe (modsecurity.org).'),
	array('inmatch', 'useragent', 'netants', 'Robot Probe (modsecurity.org).'),
	array('inmatch', 'useragent', 'autohttp', 'Robot Probe (modsecurity.org).'),
	array('inmatch', 'useragent', 'ecatch', 'Robot Probe (modsecurity.org).'),
	array('inmatch', 'useragent', 'deepnet', 'Robot Probe. INSTA-BAN.'),
	array('inmatch', 'useragent', 'worio', 'Robot Probe. INSTA-BAN.'),
	array('inmatch', 'useragent', 'mozillaxyz', 'Robot Probe.'),
	array('inmatch', 'useragent', 'casper bot', 'Robot Probe. INSTA-BAN.'),
	array('inmatch', 'useragent', 'dex bot', 'Robot Probe.'),
	array('inmatch', 'useragent', 'kangen', 'Robot Probe.'),
	array('inmatch', 'useragent', 'kmccrew', 'Robot Probe.'),
	array('inmatch', 'useragent', 'sasqia', 'Robot Probe.'),
	array('inmatch', 'useragent', 'sledink', 'Robot Probe.'),
	array('inmatch', 'useragent', 'mama casper', 'Robot Probe. INSTA-BAN.'),
	array('inmatch', 'useragent', 'planetwork', 'Robot Probe. INSTA-BAN.'),
	array('inmatch', 'useragent', 'mama cyber', 'Robot Probe. INSTA-BAN.'),
	array('inmatch', 'useragent', 'xirio', 'Robot Probe.'),
	array('inmatch', 'useragent', 'whitehat', 'Robot Probe. INSTA-BAN.'),
	array('inmatch', 'useragent', 'aihitbot/', 'Robot Probe. INSTA-BAN.'),
	array('inmatch', 'useragent', 'zmeu', 'Robot Probe. INSTA-BAN.'),
	array('inmatch', 'useragent', 'moget', 'Japanese Robot Probe.'),
	array('inmatch', 'useragent', 'ichiro', 'Japanese Robot Probe.'),
	array('inmatch', 'useragent', 'yeti', 'Korean Robot Probe.'),
	array('inmatch', 'useragent', 'naver', 'Korean Robot Probe.'),
	array('inmatch', 'useragent', 'sogou', 'Chinese Robot Probe.'),
	array('inmatch', 'useragent', 'youdao', 'Chinese Robot Probe.'),
	array('inmatch', 'useragent', 'yodao', 'Chinese Robot Probe.'),
	array('inmatch', 'useragent', 'MSIECrawler', 'Faked user agent. INSTA-BAN.'),
	array('inmatch', 'useragent', 'mozilla/0.91 beta', 'Robot Probe. INSTA-BAN.'),
	array('inmatch', 'useragent', 'exabot', 'Very aggressive user agent'),
	array('inmatch', 'useragent', 'soso', 'Chinese Robot Probe.'),
	array('inmatch', 'useragent', 'magpie', 'Marketing bot'),
	array('inmatch', 'useragent', 'psbot', 'Image scraper.'),
	array('inmatch', 'useragent', 'twisted pagegetter', 'Feed scraper.'),
	array('inmatch', 'useragent', 'socialsearcher', 'Bad bot.'),
	array('inmatch', 'useragent', 'lexxebot', 'Unknown bot.'),
	array('inmatch', 'useragent', 'xrumer', 'INSTA-BAN'),
	array('inmatch', 'useragent', 'xpymep', 'INSTA-BAN'),
	array('inmatch', 'useragent', 'shell_exec', 'Hack UA string.'),
	array('inmatch', 'useragent', 'if (', 'Hack UA string.'),
	array('inmatch', 'useragent', 'adwords', 'Refer Spammer UA.'),
	array('inmatch', 'useragent', 'allsubmitter', 'Spamtool UA.'),
	array('inmatch', 'useragent', 'anonymouse', 'Proxy UA.'),
	array('inmatch', 'useragent', 'autoemailspider', 'Email Havester UA.'),
	array('inmatch', 'useragent', 'bsalsa.com', 'Spamtool UA.'),
	array('inmatch', 'useragent', 'ecollector', 'Email Havester UA.'),
	array('inmatch', 'useragent', 'email extractor', 'Email Havester UA.'),
	array('inmatch', 'useragent', 'email siphon', 'Email Havester UA.'),
	array('inmatch', 'useragent', 'emailcollector', 'Email Havester UA.'),
	array('inmatch', 'useragent', 'emailsiphon', 'Email Havester UA.'),
	array('inmatch', 'useragent', 'internet explorer/', 'Hack Tool UA.'),
	array('inmatch', 'useragent', 'microsoft url', 'Email Havester UA.'),
	array('inmatch', 'useragent', 'webbot', 'Obvious bot UA.'),
	array('inmatch', 'useragent', 'webcapture', 'Scraper UA.'),
	array('inmatch', 'useragent', 'wordpress ha', 'Hack Tool UA.'),
	array('lmatch', 'useragent', 'acme.spider', 'Bot UA.'),
	array('lmatch', 'useragent', 'autoemailspider', 'Email harvester UA.'),
	array('lmatch', 'useragent', 'bad-neighborhood', 'Link dropper UA.'),
	array('lmatch', 'useragent', 'blogbot', 'Bot UA.'),
	array('lmatch', 'useragent', 'cyberpatrol', 'Bot UA.'),
	array('lmatch', 'useragent', 'da', 'Abusive downloader UA.'),
	array('lmatch', 'useragent', 'datacha', 'Bot UA.'),
	array('lmatch', 'useragent', 'dex bot search', 'Bot UA.'),
	array('lmatch', 'useragent', 'digger', 'Email havester UA.'),
	array('lmatch', 'useragent', 'emailsearch', 'Email havester UA.'),
	array('lmatch', 'useragent', 'evaal', 'Scraper UA.'),
	array('lmatch', 'useragent', 'findlinks', 'Botnet UA.'),
	array('lmatch', 'useragent', 'http://www.mozilla/', 'Abusive UA.'),
	array('lmatch', 'useragent', 'isc systems', 'Email havester UA.'),
	array('lmatch', 'useragent', 'lwp', 'Bot UA.'),
	array('lmatch', 'useragent', 'mail.ru', 'Bot UA.'),
	array('lmatch', 'useragent', 'microsoft-webdav', 'Bot UA.'),
	array('lmatch', 'useragent', 'movable Type', 'Bot UA.'),
	array('lmatch', 'useragent', 'movabletype/3.3', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla ', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla/0.', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla/1.', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla 4.0', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla/2.0 (compatible; ask/teoma)', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla/3.0 (compatible;)', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla/4.0 (compatible; ics 1.2.105)', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla/4.0+(compatible;+', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla/4.76 [ru] (x11; U; sunos 5.7 sun4u)', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla/4.7 (compatible; offbyone; windows 2000) webster pro v3.4', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla/5.0 (000000000;', 'Bot UA.'),
	array('lmatch', 'useragent', 'mozilla/picgrabber', 'Scraper UA.'),
	array('lmatch', 'useragent', 'msie', 'Bot UA.'),
	array('lmatch', 'useragent', 'nicebot', 'Bot UA.'),
	array('lmatch', 'useragent', 'obot', 'Bot UA.'),
	array('lmatch', 'useragent', 'offline navigator', 'Abusive downloader UA.'),
	array('lmatch', 'useragent', 'psbot', 'Scraper UA.'),
	array('lmatch', 'useragent', 'psycheclone', 'Email harvester UA.'),
	array('lmatch', 'useragent', 'smileseotools', 'Bot UA.'),
	array('lmatch', 'useragent', 'smile seo tools', 'Bot UA.'),
	array('lmatch', 'useragent', 'test', 'Fake UA.'),
	array('lmatch', 'useragent', 'user-agent', 'Fake UA.'),
	array('lmatch', 'useragent', 'webripper', 'Scraper UA.'),
	array('lmatch', 'useragent', 'email extractor', 'Email Harvester.'),
	array('lmatch', 'useragent', 'email', 'General email harvester detection.'),
	array('lmatch', 'useragent', 'ichiro', 'Dubious spider UA.'),
	array('lmatch', 'useragent', 'fast enterprise crawler', 'Dubious spider UA.'),
	array('lmatch', 'useragent', 'k2spider', 'Dubious spider UA.'),
	array('lmatch', 'useragent', 'scspider', 'Dubious spider UA.'),
	array('lmatch', 'useragent', 'seznambot', 'Dubious spider UA.'),
	array('lmatch', 'useragent', 'sogou spider', 'Dubious spider UA.'),
	array('lmatch', 'useragent', 'sohu agent', 'Dubious spider UA.'),
	array('lmatch', 'useragent', 'voilabot', 'Dubious spider UA.'),
	array('inmatch', 'useragent', 'dotbot', 'Dotbot - Paid Service SEO Service (Keyword Spamming Aides).'),
	array('inmatch', 'useragent', 'omgilibot', 'Israel Server-Farm.'),
	array('inmatch', 'useragent', 'collect', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'harvest', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'magnet', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'extractor', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'reaper', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'siphon', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'wolf', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'irgrabber', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'xtractorpro', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'attache', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'athens', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'emailspider', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'dsarobot', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'emailex', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', '3mir', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'fastlwspider', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'floodgate', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'pcbrowser', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'packrat', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'psurf', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'digout4uagent', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'takeout', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'cha0s', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'chinaclaw', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'rsync', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'shai', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'zeus', 'Rogue Site Crawler (modsecurity.org).'),
	array('inmatch', 'useragent', 'nutch', 'Rogue Site Crawler.'),
	array('inmatch', 'useragent', 'webster pro', 'Rogue Site Crawler.'),
	array('inmatch', 'useragent', 'dkimrepbot', 'Bad spider.'),
	array('inmatch', 'useragent', '_sitemapper', 'Bad spider.'),
	array('inmatch', 'useragent', 'tasapspider', 'Bad spider.'),
	array('inmatch', 'useragent', 'jadynavebot', 'Bad spider.'),
	array('inmatch', 'useragent', 'emailsearch', 'Bad spider.'),
	array('inmatch', 'useragent', 'rulinki', 'Bad spider.'),
	array('inmatch', 'useragent', 'irc search', 'Bad spider.'),
	array('inmatch', 'useragent', 'mentormate', 'Bad spider.'),
	array('inmatch', 'useragent', 'larbin', 'Scrapebot.'),
	array('inmatch', 'useragent', 'harvest', 'Scrapebot.'),
	array('inmatch', 'useragent', 'jakarta', 'Scrapebot.'),
	array('inmatch', 'useragent', 'accelobot', 'Content scraper for paid service.'),
	array('inmatch', 'useragent', 'oozbot', 'Email harvester from India.'),
	array('inmatch', 'useragent', 'artviper', 'Scrapebot.'),
	array('inmatch', 'useragent', 'vbseo', 'Scrapebot, SEO scum.'),
	array('inmatch', 'useragent', 'dotnetdotcom', 'SEOMOZ keyword scraper.'),
	array('inmatch', 'useragent', 'dotcomdotnet', 'SEOMOZ keyword scraper.'),
	array('inmatch', 'useragent', 'ccbot', 'Vague, nutch like scraper.'),
	array('inmatch', 'useragent', '3d-ftp', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'boitho', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'bpimagewalker', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'cr4nk', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'enabot', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'envolk', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'eurobot', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'geturl11', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'grub', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'gurujibot', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'heritrix', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'holmes', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'httpunit', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'keywenbot', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'linkwalker', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'mahiti', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'mot-v980', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'multicrawler', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'page_verifier', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'path 2', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'poe-component-client-http', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'rankivabot', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'rebi-shoveler', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'sbider', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'sosoimagespider', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'tagsdir', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'turnitinbot', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'visbot', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'wauuu', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'webalta', 'Possibly hostile scraper/harvester.'),
	//array('inmatch', 'useragent', 'wget', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'winhttp', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'yeti', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'yoofind', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'indocom', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', '80legs', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'purity', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'purebot', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'httrack', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'sniper', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'affinity', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'discobot', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'web downloader', 'Possibly hostile scraper/harvester.'),
	array('inmatch', 'useragent', 'appengine-google', 'Google Cloud Services.'),
	array('lmatch', 'useragent', 'spider', 'Generic scrapebot.'),
	array('inmatch', 'useragent', 'ezoom', 'Possibly hostile scraper/harvester.')
);

?>