Skip to content

Commit d899dba

Browse files
MaikuolanMaikuolan
committed
Modules update.
1 parent 0422187 commit d899dba

File tree

6 files changed

+75
-54
lines changed

6 files changed

+75
-54
lines changed

‎modules/module_botua.php‎

Lines changed: 48 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Bot user agents module (last modified: 2025.07.19).
11+
* This file: Bot user agents module (last modified: 2025.07.24).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -151,7 +151,7 @@
151151
$Trigger(preg_match(
152152
'~^(?:wp-iphone$|\'?test|-|default|foo)|_sitemapper|3mir|' .
153153
'a(?:boundex|dmantx|dnormcrawler|dvbot|lphaserver|thens|ttache)|' .
154-
'blekko|blogsnowbot|bytespider|' .
154+
'blekko|blogsnowbot|' .
155155
'cmscrawler|co(?:ccoc|llect|modo-webinspector-crawler|mpspy)|crawler(?:4j|\.feedback)|' .
156156
'd(?:atacha|igout4uagent|ioscout|kimrepbot|sarobot)|' .
157157
'easou|exabot|' .
@@ -167,28 +167,28 @@
167167
'user-agent|visaduhoc|vonchimpenfurlr|webtarantula|wolf|' .
168168
'y(?:acy|isouspider|[ry]spider|unrang|unyun)|zoominfobot~',
169169
$UANoSpace
170-
) || strpos($UA, ' ') !== false, 'Banned UA'); // 2021.07.08 mod 2025.03.31
170+
) || strpos($UA, ' ') !== false, 'Banned UA'); // 2021.07.08 mod 2025.07.24
171171

172172
if (!$Trigger((
173173
preg_match('~^python-requests/2\.27~', $UANoSpace) &&
174174
preg_match('~admin|config\.php~', $CIDRAM['BlockInfo']['rURI'])
175175
), 'Hack attempt')) { // 2022.05.08
176176
$Trigger(preg_match(
177177
'~c(?:copyright|enturyb|9hilkat|olly)|fetch/|flipboard|googlealerts|grub|' .
178-
'indeedbot|quick-crawler|scrapinghub|ttd-content|zgrab|^(?:abot|python-re' .
179-
'quests/|spider)~',
178+
'indeedbot|quick-crawler|scrapinghub|ttd-content|^(?:abot|python-requests' .
179+
'/|spider)~',
180180
$UANoSpace
181-
), 'Scraper UA'); // 2022.05.11
181+
), 'Scraper UA'); // 2022.05.11 mod 2025.07.24
182182
}
183183

184184
$Trigger(preg_match('~^mozila/~', $UANoSpace), 'Hack attempt'); // 2022.05.31
185185

186186
$Trigger(preg_match(
187187
'~007ac9|200please|360spider|3d-ftp|' .
188188
'a(?:6-indexer|ccelo|ffinity|ghaven|href|ipbot|naly(?:ticsseo|zer)|pp3lewebkit|rtviper|wcheck)|' .
189-
'b(?:acklink|azqux|ender|inlar|itvo|ixo|lex|nf.fr|ogahn|oitho|pimagewalker)|' .
190-
'c(?:cbot|ent(?:iverse|ric)|ityreview|msworldmap|omment|ommoncrawl|overscout|r4nk|rawl(?:erbotalpha|fire)|razywebcrawler|uriousgeorge|ydral)|' .
191-
'd(?:ataprovider|atenbank|aylife|ebate|igext|(?:cp|isco|ot|ouban|ownload)bot|otcomdotnet|otnetdotcom|owjones|tsagent)|' .
189+
'b(?:abbar\.tech|acklink|arkrowler|azqux|ender|inlar|itvo|ixo|lex|nf.fr|ogahn|oitho|pimagewalker)|' .
190+
'c(?:ent(?:iverse|ric)|ityreview|msworldmap|omment|ommoncrawl|overscout|r4nk|rawl(?:erbotalpha|fire)|razywebcrawler|uriousgeorge|ydral)|' .
191+
'd(?:ataprovider|aylife|ebate|igext|(?:cp|isco|ot|ouban|ownload)bot|otcomdotnet|otnetdotcom|owjones|tsagent)|' .
192192
'e(?:(?:na|uro|xperi)bot|nvolk|stimatewebstats|vaal|zoom)|' .
193193
'f(?:dm|etch(?:er.0|or)|ibgen)|' .
194194
'g(?:alaxydownloads|et(?:download\.ws|ty|url11)|slfbot|umgum|urujibot)|' .
@@ -197,19 +197,18 @@
197197
'k(?:eywenbot|eywordsearchtool|imengi|kman)|' .
198198
'l(?:abjs\.pro|arbin|ink(?:dex|walker)|iperhey|(?:t|ush)bot)|' .
199199
'm(?:ahiti|ahonie|attters|egaindex|iabot|lbot|oreover|ormor|ot-v980|oz\.com|rchrome|ulticrawler)|' .
200-
'n(?:eofonie|etestate|ewsbot|extgensearchbot|ineconnections)|' .
200+
'n(?:eofonie|ewsbot|extgensearchbot|ineconnections)|' .
201201
'o(?:afcrawl|fflinenavigator|odlebot|ptimizer)|' .
202-
'p(?:age(?:fetch|gett|_verifi)er|agesinventory|anscient|ath2|ic(?:grabber|s|tsnapshot|turefinder)|i(?:pl|xmatch|xray)|oe-component-client-|owermarks|rofiler|roximic|(?:s|ure)bot|urity)|qqdownload|' .
202+
'p(?:age(?:fetch|gett|_verifi)er|agesinventory|ath2|ic(?:grabber|s|tsnapshot|turefinder)|i(?:pl|xmatch|xray)|oe-component-client-|owermarks|rofiler|roximic|(?:s|ure)bot|urity)|qqdownload|' .
203203
'r(?:6_|adian6|ankivabot|ebi-shoveler|everseget|ganalytics|ocketcrawler|ogerbot|sscrawl|ulinki)|' .
204-
's(?:afeassign|bider|bl[.-]bot|crap[ey]|creamingfrog|earchmetricsbot|emrush|eo(?:bulls|eng|hunt|kicks|mon|profiler|stat|tool)|erpstat|istrix|ite(?:bot|intel)|n[iy]per|olomono|pbot|p(?:hi|y)der|search|webot)|' .
204+
's(?:afeassign|bider|bl[.-]bot|creamingfrog|earchmetricsbot|emrush|eo(?:bulls|eng|hunt|kicks|mon|profiler|stat|tool)|erpstat|istrix|ite(?:bot|intel)|n[iy]per|olomono|pbot|search|webot)|' .
205205
't(?:-h-u-n|agsdir|ineye|opseo|raumacadx|urnitinbot)|' .
206206
'u(?:12bot|p(?:downer|ictobot))|' .
207207
'v(?:agabondo|bseo|isbot|oyager)|' .
208208
'w(?:arebay|auuu|bsearchbot|eb(?:alta|capture|download|mastercoffee|meup|ripper)|ikio|indows(?:3|seven)|ise-guys|khtmlto|orldbot|otbox)|' .
209-
'xtractorpro|' .
210209
'yoofind~',
211210
$UANoSpace
212-
), 'Backlink/SEO/Scraper UA'); // 2022.09.19 mod 2025.07.19
211+
), 'Backlink/SEO/Scraper UA'); // 2022.09.19 mod 2025.07.24
213212

214213
$Trigger(strpos($UANoSpace, 'catch') !== false, 'Risky UA'); // 2017.01.13
215214

@@ -228,7 +227,7 @@
228227
'~\.buzz|(?<!amazona)dbot/|(?:\W|^)(?:cu|pe)rl(?:\W|$)|#boss#|' .
229228
'^(?:[aim]$|(?!linkedinbot).*http-?(?:agent|client))|-xpanse|' .
230229
'a(?:bonti|ccserver|cme.spider|dreview/\d|jbaxy|nthill$|nyevent-http|ppengine|xios)|' .
231-
'b(?:abbar\.tech|igbozz|itsight|lackbird|logsearch|logbot|salsa)|' .
230+
'b(?:igbozz|itsight|lackbird|logsearch|logbot|salsa)|' .
232231
'c(?:astlebot|atexplorador|k=\{\}|lickagy|liqzbot|ms-?checker|ontextad|orporama|ortex/\d|rowsnest|yberpatrol)|' .
233232
'd(?:eepfield|le_spider|nbcrawler|omainappender|umprendertree)|' .
234233
'expanse|' .
@@ -243,7 +242,7 @@
243242
'p(?:4bot|4load|acrawler|ageglimpse|aloalto(?:company|network)|arsijoo|egasusmonitoring|hantomjs|hpcrawl|ingdom|rlog)|' .
244243
'r(?:arelyused|obo(?:cop|spider)|yze)|' .
245244
's(?:/got|can\.lol|caninfo|creener|eekport|itedomain|mut|nap(?:preview)?bot|oapclient|ocial(?:ayer|searcher)|oso|pyglass|quider|treetbot|ynapse)|' .
246-
't(?:impi|omba|weezler|ryghost)|' .
245+
't(?:omba|weezler|ryghost)|' .
247246
'urlappendbot|urltest|' .
248247
'w(?:asalive|atchmouse|eb(?:-monitoring|bot|masteraid|money|pros|site-info\.net|thumbnail)|hatweb|ikiapiary|ininet|maid\.com|pbot/1\.|sr-agent|wwtype)|' .
249248
'xenu|xovi|' .
@@ -252,7 +251,7 @@
252251
) || preg_match(
253252
'~^Mozilla/5\.0( [A-Za-z]{2,5}/0\..)?$~',
254253
$CIDRAM['BlockInfo']['UA']
255-
), 'Unauthorised'); // 2023.09.15 mod 2025.07.19
254+
), 'Unauthorised'); // 2023.09.15 mod 2025.07.24
256255

257256
if ($Trigger(preg_match('~ivre-|masscan~', $UANoSpace), 'Port scanner and synflood tool detected')) {
258257
$CIDRAM['Reporter']->report([14, 15, 19], ['MASSCAN port scanner and synflood tool detected.'], $CIDRAM['BlockInfo']['IPAddr']);
@@ -292,10 +291,13 @@
292291
$CIDRAM['Reporter']->report([4, 19], ['BitTorrent user agent seen at HTTP server endpoint (possible flood/DDoS attempt).'], $CIDRAM['BlockInfo']['IPAddr']);
293292
} // 2017.02.25
294293

295-
$Trigger(preg_match(
296-
'~foregenix|modat|nuclei|projectdiscovery|sslyze|threatview~',
294+
if ($Trigger(preg_match(
295+
'~foregenix|modat|nuclei|isscyberrisk|projectdiscovery|sslyze|threatview~',
297296
$UA
298-
), 'Vulnerability scanner detected; Unauthorised'); // 2023.06.16 mod 2025.01.12
297+
), 'Unauthorised vulnerability scanner detected')) {
298+
$CIDRAM['Reporter']->report([15, 19, 21], ['Unauthorised vulnerability scanner detected.'], $CIDRAM['BlockInfo']['IPAddr']);
299+
$CIDRAM['Tracking options override'] = 'extended';
300+
} // 2023.06.16 mod 2025.07.24
299301

300302
$Trigger(preg_match('~^python/|aiohttp/|\.post0~', $UANoSpace), 'Bad context (Python/AIO clients not permitted here)'); // 2021.05.18
301303

@@ -314,21 +316,32 @@
314316
} // 2022.05.08
315317

316318
$Trigger(preg_match(
317-
'~adbar|anonymous-?coward|' .
318-
'banana-?bot|bot-?test|brands-?bot|' .
319-
'clark-?crawler|' .
320-
'fidget-?spinner-?bot|friendly-?spider|' .
321-
'imagesift|' .
319+
'~80legs|' .
320+
'a(?:dbar|i2bot|ihitbot|i.?searchbot|liyun|ndibot|nonymous-?coward|wario)|' .
321+
'b(?:anana-?bot|edrockbot|ot-?test|rands-?bot|rightbot|ytespider)|' .
322+
'c(?:asperbot|cbot|hinaclaw|lark-?crawler|ohere-)|' .
323+
'd(?:atenbank|eep-?research)|' .
324+
'echobo[tx]|' .
325+
'f(?:idget-?spinner-?bot|irecrawl|riendly-?(?:crawler|spider))|' .
326+
'i(?:askspider|magesift|mg2dataset)|' .
322327
'jaddjabot|' .
323-
'keys-?so-?bot|' .
328+
'k(?:angaroobot|eys-?so-?bot)|' .
329+
'm(?:amac(?:asper|yber)|istral|ozilla/0|ycentralai)|' .
330+
'n(?:etestate|ovaact)|' .
324331
'orbbot|' .
325-
'phxbot|' .
326-
'storm-?crawler|' .
327-
't(?:est-?bot|hesis-?research-?bot|hinkchaos|iny-?(?:bot|test)|rafilatura)|' .
328-
'whatstuffwherebot|winhttp|' .
329-
'zephuli-?bot~',
332+
'p(?:angubot|anscient|erplexity|hindbot|hxbot|oseidon|ublicwebcrawler)|' .
333+
'q(?:ualifiedbot|uillbot)|' .
334+
'research.?crawler|' .
335+
's(?:bintuition|crap[ey]|idetrade|p(?:hi|y)der|torm-?crawler|ummalybot)|' .
336+
't(?:est-?bot|heknowledgeai|hesis-?research-?bot|hinkchaos|impi|iny-?(?:bot|test)|rafilatura)|' .
337+
'velenpublic|' .
338+
'w(?:ardbot|ebzio|hatstuffwherebot|inhttp)|' .
339+
'xtractorpro|' .
340+
'z(?:ephuli-?bot|grab)~',
330341
$UANoSpace
331-
), 'Scraper UA'); // 2023.11.17 mod 2025.07.19
342+
), 'Scraper UA')) {
343+
$CIDRAM['Tracking options override'] = 'extended';
344+
} // 2023.11.17 mod 2025.07.24
332345

333346
$Trigger(preg_match('~ct‑git‑scanner/~i', $CIDRAM['BlockInfo']['UA']), 'Unauthorised Git scanner'); // 2025.07.05
334347

@@ -357,12 +370,10 @@
357370
strpos($UANoSpace, '}__') !== false ||
358371
preg_match('~0wn[3e]d|dkemdif.\d|f' . 'uck|:(?:\{[\w]:|[\w\d][;:]\})~', $UANoSpace)
359372
), 'Hack UA') || // 2021.06.28
360-
$Trigger(preg_match('~(?:(aihit|casper)bot|mamac(asper|yber)|mozilla/0)~', $UANoSpace), 'Probe UA') || // 2017.02.25
361373
$Trigger(strpos($UANoSpace, 'wopbot') !== false, 'Bash/Shellshock UA') || // 2017.01.06
362374
$Trigger(preg_match('/(?:x(rumer|pymep)|хрумер)/', $UANoSpace), 'Spam UA') || // 2017.01.02
363-
$Trigger(preg_match('~loadimpact|re-?animator|root|theknowledgeai|webster~', $UANoSpace), 'Banned UA') || // 2021.02.10
375+
$Trigger(preg_match('~loadimpact|re-?animator|root|webster~', $UANoSpace), 'Banned UA') || // 2021.02.10 mod 2025.07.24
364376
$Trigger(strpos($UANoSpace, '(somename)') !== false, 'Banned UA') || // 2017.02.02
365-
$Trigger(preg_match('~80legs|chinaclaw~', $UANoSpace), 'Scraper UA') || // 2017.01.08 mod 2021.06.28
366377
$Trigger(preg_match('~brandwatch|magpie~', $UANoSpace), 'Snoop UA') || // 2017.01.13 mod 2021.06.28
367378
$Trigger(strpos($CIDRAM['BlockInfo']['UA'], 'MSIECrawler') !== false, 'Hostile / Fake IE') // 2017.02.25 mod 2021.06.28
368379
) {
@@ -389,8 +400,6 @@
389400
$CIDRAM['Reporter']->report([15], ['Shell upload attempt detected in user agent.'], $CIDRAM['BlockInfo']['IPAddr']);
390401
} elseif (strpos($CIDRAM['BlockInfo']['WhyReason'], 'Hack UA') !== false) {
391402
$CIDRAM['Reporter']->report([15, 19, 21], ['Hack identifier detected in user agent.'], $CIDRAM['BlockInfo']['IPAddr']);
392-
} elseif (strpos($CIDRAM['BlockInfo']['WhyReason'], 'Vulner') !== false) {
393-
$CIDRAM['Reporter']->report([15, 19, 21], ['Caught looking for vulnerabilities.'], $CIDRAM['BlockInfo']['IPAddr']);
394403
} elseif (strpos($CIDRAM['BlockInfo']['WhyReason'], 'UASQLi') !== false) {
395404
$CIDRAM['Reporter']->report([16], ['SQLi attempt detected in user agent.'], $CIDRAM['BlockInfo']['IPAddr']);
396405
} elseif (strpos($CIDRAM['BlockInfo']['WhyReason'], 'Probe UA') !== false) {
@@ -430,10 +439,10 @@
430439
* @link https://www.reddit.com/r/singularity/comments/1cdm97j/anthropics_claudebot_is_aggressively_scraping_the/
431440
* @link https://www.linode.com/community/questions/24842/ddos-from-anthropic-ai
432441
*/
433-
if ($Trigger((strpos($UANoSpace, 'anthropic') !== false || strpos($UANoSpace, 'claudebot') !== false), 'Unauthorised AI scanner')) {
442+
if ($Trigger(preg_match('~anthropic|claude-?(?:bot|searchbot|user|web)~', $UANoSpace), 'Unauthorised AI scanner')) {
434443
$CIDRAM['Reporter']->report([4, 19], ['AI scanner notorious for flooding and DDoS attacks detected.'], $CIDRAM['BlockInfo']['IPAddr']);
435444
$CIDRAM['Tracking options override'] = 'extended';
436-
} // 2023.08.10 mod 2024.04.27
445+
} // 2023.08.10 mod 2025.07.24
437446

438447
/**
439448
* @link https://github.com/CIDRAM/CIDRAM/issues/606

‎modules/module_extras.php‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Optional security extras module (last modified: 2025.07.21).
11+
* This file: Optional security extras module (last modified: 2025.07.22).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -182,6 +182,13 @@
182182
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for ' . $Exploit . ' vulnerability.'], $CIDRAM['BlockInfo']['IPAddr']);
183183
}
184184

185+
/** Probing for common vulnerabilities and exploits. */
186+
if (
187+
$Trigger(preg_match('~/services/contributor/1&(?:amp;)?id=1(?:(?:%20|[ +-])(?:union|all|select)|.*(?:null,|md5\\(|--(?:%20|[ +-])?))~', $LCNrURI), $Exploit = 'CVE-2021-24666') // 2025.07.22
188+
) {
189+
$CIDRAM['Reporter']->report([15, 16, 21], ['Caught probing for ' . $Exploit . ' vulnerability.'], $CIDRAM['BlockInfo']['IPAddr']);
190+
}
191+
185192
/** Probing for exposed Git data. */
186193
if ($Trigger(preg_match('~\.git(?:config)?(?:$|\W)~', $LCNrURI), 'Probing for exposed Git data')) {
187194
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Git data.'], $CIDRAM['BlockInfo']['IPAddr']);
@@ -381,10 +388,7 @@
381388
$Trigger(strpos($CIDRAM['BlockInfo']['Query'], ',\'\',') !== false, 'Bad query'); // 2017.02.25
382389

383390
$Trigger(preg_match('/(?<![a-z])id=.*(?:benchmark\\(|id[xy]=|sleep\\()/', $QueryNoSpace), 'Query SQLi'); // 2017.03.01 mod 2023.11.10
384-
$Trigger(preg_match(
385-
'~(?:from|union|where).*select|then.*else|(?:o[nr]|where).*isnull|(?:inner|left|outer|right)join~',
386-
$QueryNoSpace
387-
), 'Query SQLi'); // 2017.03.01 mod 2023.08.30
391+
$Trigger(preg_match('~(?:from|union|where).*select|then.*else|(?:o[nr]|where).*isnull|(?:inner|left|outer|right)join~', $QueryNoSpace), 'Query SQLi'); // 2017.03.01 mod 2023.08.30
388392

389393
$Trigger(preg_match('/cpis_.*i0seclab@intermal\.com/', $QueryNoSpace), 'Hack attempt'); // 2018.02.20
390394
$Trigger(preg_match('/^(?:3x=3x|of=1&a=1)/i', $CIDRAM['BlockInfo']['Query']), 'Hack attempt'); // 2023.07.13 mod 2023.09.02

‎modules/module_refspam.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Referrer spam module (last modified: 2023.12.01).
11+
* This file: Referrer spam module (last modified: 2025.07.24).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -218,6 +218,10 @@
218218
], $CIDRAM['BlockInfo']['IPAddr']);
219219
} // 2023.06.16
220220

221+
if ($Trigger(preg_match('~//blog//wp-login\.php$~i', $CIDRAM['BlockInfo']['Referrer']), 'Hack attempt via referrer header injection detected')) {
222+
$CIDRAM['Reporter']->report([10, 15, 21], ['Hack attempt via referrer header injection detected.'], $CIDRAM['BlockInfo']['IPAddr']);
223+
} // 2025.07.24
224+
221225
$Trigger($RefLC === '(null)', 'Illegal referrer'); // 2018.03.13
222226
};
223227

‎modules/modules.dat‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,7 @@ module_bgpview.php:
203203
module_botua.php:
204204
Name: "Bot user agents module"
205205
False Positive Risk: "Medium"
206-
Version: "2025.201.0"
206+
Version: "2025.204.0"
207207
Dependencies:
208208
PHP: "^5.4|^7|^8"
209209
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -215,7 +215,7 @@ module_botua.php:
215215
To:
216216
- "module_botua.php"
217217
Checksum:
218-
- "eea3ad338f778c90d7fae205d3b61c154c9c6ba7c2f4000a61e282980cd2e395:26815"
218+
- "976c8e99a4ea64732c84908e6da706c08af399d780058777fc8b37c6065af8f0:27204"
219219
Used with: "modules"
220220
Reannotate: "modules.dat"
221221
module_cookies.php:
@@ -239,7 +239,7 @@ module_cookies.php:
239239
module_extras.php:
240240
Name: "Optional security extras module"
241241
False Positive Risk: "Medium"
242-
Version: "2025.201.0"
242+
Version: "2025.204.0"
243243
Dependencies:
244244
PHP: "^5.4|^7|^8"
245245
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -254,7 +254,7 @@ module_extras.php:
254254
- "module_extras.php"
255255
- "module_extras.yaml"
256256
Checksum:
257-
- "f2f2aa2c6d55815f4dbc54d4afec1244485b5c1b2a477dc9f6bbde1950ce08a1:37153"
257+
- "baac683d8d17fd1aebf277177948eca962b9bb04aeb466d217220dc0dc77c4b9:37564"
258258
- "7b891d1fa4b1c52c410220bc758e8cb7064bd6040430fb149a5b60e9ae2e0838:890"
259259
Used with: "modules"
260260
Reannotate: "modules.dat"
@@ -305,7 +305,7 @@ module_projecthoneypot.php:
305305
module_refspam.php:
306306
Name: "Referrer spam module"
307307
False Positive Risk: "Medium"
308-
Version: "2023.334.0"
308+
Version: "2025.204.0"
309309
Dependencies:
310310
PHP: "^7.1|^8"
311311
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -318,7 +318,7 @@ module_refspam.php:
318318
To:
319319
- "module_refspam.php"
320320
Checksum:
321-
- "f4fa6f28a692edd2204774982a08e3a9ce9e4f83cf4ec0508e9fa2bc414735b8:13394"
321+
- "272163903124f9dcc799fe98c0eeaa591815507b54327a741a77a9c631b222c9:13371"
322322
Used with: "modules"
323323
Reannotate: "modules.dat"
324324
module_sfs.php:

‎modules/modules.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,11 @@ PHPMailer:
5353
Referrer spam module:
5454
Name: "Referrer spam module"
5555
False Positive Risk: "Medium"
56-
Version: "2025.197.0"
56+
Version: "2025.204.0"
5757
Dependencies:
5858
intl: "*"
5959
Files:
6060
modules/refspam.php:
6161
From: "https://raw.githubusercontent.com/CIDRAM/CIDRAM-Extras/master/modules/refspam.php"
62-
Checksum: "00922342042389bf9e19eee0ae67b957ed46e08d272a5d54c09b101c3275cbf5:12899"
62+
Checksum: "85684e22c718ed4e6878b4d02f6ea4ff86eff1a47d1bdce818c0124bee488d73:13205"
6363
Used with: "modules"

‎modules/refspam.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Referrer spam module (last modified: 2025.07.17).
11+
* This file: Referrer spam module (last modified: 2025.07.24).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -210,6 +210,10 @@
210210
], $this->BlockInfo['IPAddr']);
211211
} // 2023.06.16
212212

213+
if ($this->trigger(preg_match('~//blog//wp-login\.php$~i', $this->BlockInfo['Referrer']), 'Hack attempt via referrer header injection detected')) {
214+
$this->Reporter->report([10, 15, 21], ['Hack attempt via referrer header injection detected.'], $this->BlockInfo['IPAddr']);
215+
} // 2025.07.24
216+
213217
$this->trigger($RefLC === '(null)', 'Illegal referrer'); // 2018.03.13
214218
};
215219

0 commit comments

Comments
 (0)