From 9f413a957a5ee03bcc50631691b156678cf2020d Mon Sep 17 00:00:00 2001
From: Alex 'AdUser' Z <ad_user@runbox.com>
Date: Tue, 6 Jun 2023 15:01:14 +1000
Subject: [PATCH] * nginx-bots

---
 filters/nginx-bots.pcre | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/filters/nginx-bots.pcre b/filters/nginx-bots.pcre
index b457284..24edd22 100644
--- a/filters/nginx-bots.pcre
+++ b/filters/nginx-bots.pcre
@@ -5,7 +5,9 @@
 <HOST> .* "(GET|HEAD|POST) (https?://[0-9a-z.-]+)?(:[0-9]*)?/+Ringing\.at\.your\.dorbell
 <HOST> .* "(GET|HEAD|POST) (https?://[0-9a-z.-]+)?(:[0-9]*)?/.*(wget|curl)(\\x|%)20https?://
 <HOST> .* "(GET|HEAD|POST) .*/bin/(ba|c|z)?sh( |\\x20|%20)-c
+<HOST> .* "(GET|HEAD|POST) .*XDEBUG_SESSION_START=phpstorm
 <HOST> .* "(\\x[0-9a-z]{2,6})+" 400
+<HOST> .* (\\x[0]{2,6}){2,}.* 400
 # set: defscore=10
 # phpmyadmin and variations
 <HOST> .* "(GET|HEAD|POST) (https?://[0-9a-z.-]+)?(:[0-9]*)?/+(php|sqlite)-?(manager)?