Skip to content

Commit 41a295e

Browse files
MaikuolanMaikuolan
committed
Modules update.
1 parent 50c397a commit 41a295e

File tree

3 files changed

+24
-99
lines changed

3 files changed

+24
-99
lines changed

‎modules/module_badhosts.php‎

Lines changed: 9 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Bad hosts blocker module (last modified: 2025.02.13).
11+
* This file: Bad hosts blocker module (last modified: 2025.07.27).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -63,15 +63,9 @@
6363
$UA = str_replace('\\', '/', strtolower(urldecode($CIDRAM['BlockInfo']['UA'])));
6464
$UANoSpace = preg_replace('/\s/', '', $UA);
6565

66-
$Trigger(preg_match(
67-
'/\$(?:globals|_(?:cookie|env|files|get|post|request|server|session))/',
68-
$HN
69-
), 'Banned hostname'); // 2017.01.21 mod 2022.11.23
66+
$Trigger(preg_match('/\$(?:globals|_(?:cookie|env|files|get|post|request|server|session))/', $HN), 'Banned hostname'); // 2017.01.21 mod 2022.11.23
7067

71-
$Trigger(preg_match(
72-
'/(?:<(\?|body|i?frame|object|script)|(body|i?frame|object|script)>)/',
73-
$HN
74-
), 'Hostname script injection'); // 2017.01.21
68+
$Trigger(preg_match('/(?:<(\?|body|i?frame|object|script)|(body|i?frame|object|script)>)/', $HN), 'Hostname script injection'); // 2017.01.21
7569

7670
$Trigger(preg_match('~captch|dbcapi\.me~', $HN), 'CAPTCHA cracker host'); // 2017.01.21
7771

@@ -97,71 +91,18 @@
9791
$Trigger(preg_match('~exatt\.net$|unpef\.org$~', $HN), 'Pornobot/Pornhost'); // 2017.02.16
9892

9993
$Trigger(preg_match(
100-
'~^(?:damage|moon|test)\.|anahaqq|core\.youtu\.me|hosted-(?:by|in)|n' .
101-
'o-(?:data|(?:reverse-)?r?dns)|qeas|spletnahisa|therewill\.be|unassi' .
102-
'gned|work\.from|yhost\.name~',
94+
'~^(?:damage|moon|test)\.|anahaqq|core\.youtu\.me|fuc' . 'kyou|hoste' .
95+
'd-(?:by|in)|no-(?:data|(?:reverse-)?r?dns)|qeas|spletnahisa|therewi' .
96+
'll\.be|unassigned|work\.from|yhost\.name~',
10397
$HN
104-
), 'Questionable Host'); // 2017.01.30 mod 2020.11.09
98+
), 'Questionable Host'); // 2017.01.30 mod 2025.07.27
10599

106100
$Trigger(preg_match('~anchorfree|hotspotsheild|esonicspider\.com$~', $HN), 'Hostile/esonicspider'); // 2018.09.15
107101

108-
$Trigger(preg_match(
109-
'~megacom\.biz$|ideastack\.com$|dotnetdotcom\.org$|controlyourself\.online~',
110-
$HN
111-
), 'Hostile/Unauthorised'); // 2017.02.14 mod 2021.06.28
112-
113102
$Trigger(preg_match('~brandaffinity~', $HN), 'Hostile/SLAPP'); // 2018.09.15
114103

115104
if (
116-
// Caught attempting to brute-force WordPress logins (2020.11.09).
117-
$Trigger(preg_match('~\.domainserver\.ne\.jp$~', $HN), 'Cloud/Webhosting') ||
118-
119-
// 2022.12.19 mod 2025.02.13
120-
$Trigger(preg_match(
121-
'~i(?:g|nsite)\.com\.br$|terra\.cl$|acetrophies\.co\.uk$|adsinmedia\.co\.' .
122-
'in$|(?:webfusion|xcalibre)\.co\.uk$|(?:\.(?:appian|cloud|ctera|dyn|emc|f' .
123-
'orce|fsfreeware|gnip|gridlayer|hosting|icims|panorama|parallels|quest|si' .
124-
'teprotect|thegridlayer|voda|vultr|webzilla|workday)|10gen|12designer|3le' .
125-
'afsystems|3tera|a(?:cademicedge|ccentrainc|conex|dvologix|gathon|ltornet' .
126-
'works|mericanforeclosures|mitive|pp(?:irio|istry|jet|nexus|renda|spot|ze' .
127-
'ro)|ptana|ramenet|riasystems|rjuna|rtofdefence|sterdata|syanka|uthenticn' .
128-
'etworks|zati)|b(?:alticservers|eam4d|hivesoft|irtondemand|linklogic|lue(' .
129-
'?:host|lock|wolf)|oomi|ucketexplorer|ungeeconnect)|c(?:a(?:dinor|msoluti' .
130-
'onsinc|spio|ssatt|stiron)|l(?:arioanalytics|ickability|oud(?:42|9analyti' .
131-
'cs|computingchina|control|era|foundry|kick|scale|status|switch|works)|us' .
132-
'terseven)|o(?:ghead|hesiveft|ldlightsolutions|ncur|ntroltier)|tinets|ybe' .
133-
'r-freaks)|d(?:ata(?:line|sisar|synaps)|ailyrazor|edicatedpanel|inaserver' .
134-
'|irectlaw|ns-safe|oclanding|ropbox|ynamsoft)|e(?:last(?:ichosts|ra)|n(?:' .
135-
'gineyard|omalism|stratus)|telos|ucalyptus|vapt|vionet)|fathomdb|flexisca' .
136-
'le|followmeoffice|g(?:emstone|enerositycool|igaspaces|ogrid|othamdating|' .
137-
'roupcross)|h(?:eroku|exagrid|olhost|ost(?:acy|cats|ing24)|ubspan|yperic)' .
138-
'|i(?:buzytravel|modrive|nfo(?:bright|rmatica)|tricityhosting)|j(?:oyent|' .
139-
'umpbox|unglebox|usthost)|k(?:2analytics|aavo|eynote|nowledgetree)|l(?:ay' .
140-
'eredtech|inkneo|iveops|oadstorm|ogixml|ongjump|tdomains)|m(?:o(?:derro|j' .
141-
'site|rphexchange|sso|zy)|idphase|idnight-monkey|turk|ulesoft)|n(?:asstar' .
142-
'|e(?:ointeractiva|t(?:app|documents|suite|topia)|wrelic|wservers)|ionex|' .
143-
'irvanix|ovatium|scaled)|o(?:co-inc|nelogin|npathtech|penqrm|psource)|p(?' .
144-
':ara(?:scal|tur)e|hatservers|hishmongers|iemontetv|inqidentity|ivotlink|' .
145-
'luraprocessing)|q(?:layer|rimp|uanti(?:vo|x-uk))|r(?:ackspace(?:cloud)?|' .
146-
'e(?:di2|ductivelabs|lia(?:blehosting|cloud)|sponsys)|ight(?:now|scale)|o' .
147-
'llbase|omania-webhosting|path)|s(?:alesforce|avvis|ertifi|erver306|huili' .
148-
'nchi|kytap|martservercontrol|naplogic|oasta|pringcm|tax|treetsmarts|tret' .
149-
'choid|uccessmetrics|wifttrim|ymplified|yncplicity)|t(?:aleo|err[ae]mark|' .
150-
'h(?:eprocessfactory|inkgos|oughtexpress)|rustsaas)|utilitystatus|v(?:aul' .
151-
'tscape|ertica|mware|ordel)|web(?:faction|hosting\.uk|hostinghub|scalesol' .
152-
'utions|sitewelcome)|xactlycorp|xlhost|xythos|z(?:embly|imory|manda|oho|u' .
153-
'ora))\.com$|server4u\.cz$|(?:(?:\.|kunden)server|clanmoi|fastwebserver|o' .
154-
'ptimal|server4you|your-server)\.de$|candycloud\.eu$|cyberresilience\.io$' .
155-
'|server\.lu$|starnet\.md$|(?:\.(?:above|akpackaging|bhsrv|box|propagatio' .
156-
'n|voxel)|1978th|collab|enkiconsulting|incrediserve|jkserv|recyber|reliab' .
157-
'lesite|shared-server|techajans)\.net$|hitech-hosting\.nl$|(?:\.terracott' .
158-
'a|beowulf|iboss|opennebula|xen)\.org$|mor\.ph$|(?:ogicom|vampire)\.pl$|(' .
159-
'?:serverhub|rivreg|tkvprok|vpsnow|vympelstroy)\.ru$|g\.ho\.st$~',
160-
$HN
161-
), 'Cloud/Webhosting') ||
162-
163-
// 2022.06.22
164-
$Trigger(preg_match('~\.google(?:domains|usercontent)\.com$~', $HN), 'Google user content not permitted here')
105+
$Trigger(preg_match('~\.google(?:domains|usercontent)\.com$~', $HN), 'Google user content not permitted here') // 2022.06.22
165106
) {
166107
$CIDRAM['AddProfileEntry']('Webhosting');
167108
}
@@ -170,37 +111,13 @@
170111
$CIDRAM['AddProfileEntry']('VPNs here');
171112
} // 2023.08.12
172113

173-
$Trigger(preg_match(
174-
'~(?:(?:criminalip|dimenoc|dumpyourbitch|hostenko|internetserviceteam|ipr' .
175-
'edator|krypt|webandnetworksolutions|xcelmg)\.com|mbox\.kz|doctore\.sk|ho' .
176-
'stnoc\.net|\.(?:host|spheral)\.ru)$|45ru\.net\.au|p(?:rohibitivestuff|wn)~',
177-
$HN
178-
), 'Dangerous Host'); // 2022.06.24 mod 2022.12.19
179-
180114
$Trigger(preg_match('~shadowserver\.org$~', $HN), 'Regular unauthorised proxy tunnel attempts'); // 2023.09.15
181115

182116
$Trigger(preg_match(
183117
'~(?:iweb|privatedns)\.com$|iweb\.ca$|^(?:www\.)?iweb~',
184118
$HN
185119
), 'Domain Snipers'); // 2017.02.15 mod 2021.06.28
186120

187-
$Trigger(preg_match('~(?<!ssg-corp\.)zetta\.net$|(?<!\.user\.)veloxzone\.com\.br$|12bot\.com$~', $HN), 'Server farm'); // 2022.12.19
188-
189-
$Trigger(preg_match(
190-
'~(?:starlogic|temka)\.biz$|ethymos\.com\.br$|(?:amplilogic|astranig' .
191-
'ht|borderfreehosting|creatoor|dl-hosting|hosting-ie|idknet|ipilum|k' .
192-
'uzbass|prommorpg|uxxicom|vdswin|x-svr)\.com$|(?:ahost01|efdns|em-zw' .
193-
'o|haebdler-treff|key(account|mars64)|mail\.adc|rootbash|securewebse' .
194-
'rver|tagdance|traders-briefing|vilitas|w-4)\.de$|(?:hostrov|kemhost' .
195-
'|netorn|power-web34|profithost|volia)\.net$|cssgroup\.lv|(?:nasza-k' .
196-
'lasa|softel\.com)\.pl$|(?:corbina|cpms|datapoint|elsv-v|hc|itns|lim' .
197-
't|majordomo|mtu-net|netorn|nigma|relan|spb|totalstat)\.ru|(?:(?:cos' .
198-
'monova|sovam|utel)\.net|odessa|poltava|rbn\.com|volia)\.ua$|aceleo|' .
199-
'dedibox|filmefashion|infobox|key(?:machine|server|web)|kyklo|laycat' .
200-
'|oliro~',
201-
$HN
202-
), 'RBN'); // 2017.02.06 mod 2021.06.28
203-
204121
$Trigger(preg_match('~amazonaws\.com$~', $HN) && (
205122
!preg_match(
206123
'~alexa|postrank|twitt(?:urly|erfeed)|bitlybot|unwindfetchor|met' .
@@ -275,7 +192,7 @@
275192
); // 2018.06.24
276193

277194
/** Conjunctive reporting. */
278-
if (preg_match('~Spoofed/Fake Hostname|Dangerous Host|Questionable Host|DNS error~i', $CIDRAM['BlockInfo']['WhyReason'])) {
195+
if (preg_match('~Spoofed/Fake Hostname|Questionable Host|DNS error~i', $CIDRAM['BlockInfo']['WhyReason'])) {
279196
$CIDRAM['Reporter']->report([20], [], $CIDRAM['BlockInfo']['IPAddr']);
280197
}
281198
if (preg_match('~(?:VPN|Proxy) Host~i', $CIDRAM['BlockInfo']['WhyReason'])) {

‎modules/module_extras.php‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Optional security extras module (last modified: 2025.07.27).
11+
* This file: Optional security extras module (last modified: 2025.07.28).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -145,9 +145,9 @@
145145
), 'Probing for webshells/backdoors')) { // 2023.08.18 mod 2025.07.10
146146
$CIDRAM['Reporter']->report([15, 20, 21], ['Caught probing for webshells/backdoors. Host might be compromised.'], $CIDRAM['BlockInfo']['IPAddr']);
147147
} elseif ($Trigger(preg_match(
148-
'~(?:^|[/?])(?:css/dmtixucz/golden-access|fierzashell\.html?|perl.alfa|search/label/php-shells)(?:$|[/?])~',
148+
'~(?:^|[/?])(?:brutalshell|css/dmtixucz/golden-access|fierzashell\.html?|perl.alfa|search/label/php-shells)(?:$|[/?])~',
149149
$LCNrURI
150-
), 'Probing for webshells/backdoors')) { // 2025.05.12 mod 2025.05.20
150+
), 'Probing for webshells/backdoors')) { // 2025.05.12 mod 2025.07.28
151151
$CIDRAM['Reporter']->report([15, 20, 21], ['Caught probing for webshells/backdoors. Host might be compromised.'], $CIDRAM['BlockInfo']['IPAddr']);
152152
} elseif ($Trigger(preg_match(
153153
'~(?:^|[/?])(?:\.well-known(?:new\d*|old\d*)|[1-9cefimnptuwx]{27}\.jsp|alfa_data/alfacgiapi|alfa-?rexhp\d\.p|(?:send-)?ses\.sh)(?:$|[/?])~',
@@ -195,6 +195,14 @@
195195
$CIDRAM['Reporter']->report([15, 16, 21], ['Caught probing for ' . $Exploit . ' vulnerability.'], $CIDRAM['BlockInfo']['IPAddr']);
196196
}
197197

198+
/** Probing for compromised WordPress installations. */
199+
if ($Trigger(preg_match(
200+
'~/wp-content/plugins/(?:aryabot|cakil|cekidot|dummyyummy|helloapx|ioptimization|masterx|owfsmac|prenota|pwnd|ubh|upspy|uwogh-segs|vwcleanerplugin|wp(?:-d(?:[ao]ftx?|b-ajax-made|iambar)|-freeform|-hps|eazvp)|xichang|xt|yyobang|zaen)/~',
201+
$LCNrURI
202+
), 'Probing for compromised WordPress installations')) {
203+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for compromised WordPress installations.'], $CIDRAM['BlockInfo']['IPAddr']);
204+
} // 2025.07.28
205+
198206
/** Probing for exposed Git data. */
199207
if ($Trigger(preg_match('~\.git(?:config)?(?:$|\W)~', $LCNrURI), 'Probing for exposed Git data')) {
200208
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Git data.'], $CIDRAM['BlockInfo']['IPAddr']);

‎modules/modules.dat‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ module_abuseipdb.php:
144144
module_badhosts.php:
145145
Name: "Bad hosts blocker module"
146146
False Positive Risk: "Medium"
147-
Version: "2025.43.0"
147+
Version: "2025.208.0"
148148
Dependencies:
149149
PHP: "^5.4|^7|^8"
150150
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -156,7 +156,7 @@ module_badhosts.php:
156156
To:
157157
- "module_badhosts.php"
158158
Checksum:
159-
- "fc1c3be5f179f6feb7320d3de00d58cfb2b1e06c3d86208edf9b4028ee5d2c10:14662"
159+
- "cba13c69d7f2b58e617bb85ab0c6d4295481e62081e0eac6457f8a443510bf3d:9295"
160160
Used with: "modules"
161161
Reannotate: "modules.dat"
162162
module_badtlds.php:
@@ -239,7 +239,7 @@ module_cookies.php:
239239
module_extras.php:
240240
Name: "Optional security extras module"
241241
False Positive Risk: "Medium"
242-
Version: "2025.207.0"
242+
Version: "2025.208.0"
243243
Dependencies:
244244
PHP: "^5.4|^7|^8"
245245
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -254,7 +254,7 @@ module_extras.php:
254254
- "module_extras.php"
255255
- "module_extras.yaml"
256256
Checksum:
257-
- "3a90191df4328cc170636f18f08cbdc1db936a175f95e1015ed89fa241b6b1a2:38266"
257+
- "f8d420e63f58f5d261e6daf95634abd600c64222127f2d33f37806428bf5990d:38879"
258258
- "7b891d1fa4b1c52c410220bc758e8cb7064bd6040430fb149a5b60e9ae2e0838:890"
259259
Used with: "modules"
260260
Reannotate: "modules.dat"

0 commit comments

Comments
 (0)