[Definition]
# adapted from apache-auth.conf
# Option: failregex
# Notes.: regex to match jerks trolling for exploits.
# The host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT

#examples:
#115.168.71.85 - - [25/Jul/2010:09:48:04 -0700] "GET /websql/scripts/setup.php HTTP/1.1" 401 479 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6"
#209.168.161.229 - - [25/Jul/2010:21:32:03 -0700] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 401 479 "-" "ZmEu"
#unknown.ord.scnet.net - - [28/Jul/2010:14:35:05 -0700] "GET /mysql/scripts/setup.php HTTP/1.0" 401 482 "-" "Wget/1.11.4 Red Hat modified"

failregex = <HOST>.*\"GET\ /*w00tw00t\.at\..*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*MyAdmin.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*PhpMyAdmin.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*admin.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*pma.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*phpMyAdmin.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*phpMyAdmin.*\ HTTP.*\"\ .*\d{3}

            <HOST>.*\"GET\ /*myadmin.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*mysql.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*phpadmin.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*webadmin.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*user/soapCaller\.bs.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*webdav.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*.*/admin/login\.php.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*.*/scripts/setup\.php.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*p/m/a/.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*php-my-admin.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*php-myadmin.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*sqlmanager.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*sqlweb.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*Horde.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ /*horde.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ http://.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ ftp://.*\ HTTP.*\"\ .*\d{3}
            <HOST>.*\"GET\ https://.*\ HTTP.*\"\ .*\d{3}
ignoreregex=

