Block EgyScan security scanner via rule 10000040 (wargio#147)

viiftw · Jun 17, 2024 · 3366b2f · 3366b2f
1 parent 63d36b1
commit 3366b2f
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/naxsi_rules/blocking/10000000_scanner.rules b/naxsi_rules/blocking/10000000_scanner.rules
@@ -85,3 +85,6 @@ MainRule id:10000038 "s:$UWA:8" "str:wpscan" "mz:$HEADERS_VAR:User-Agent" "msg:W
 
 # WinHttpReq in User-Agent
 MainRule id:10000039 "s:$UWA:8" "str:WinHttpReq" "mz:$HEADERS_VAR:User-Agent" "msg:WinHttpReq in user-agent";
+
+# EgyScan security scanner uses AliElTop in some of the attacks
+MainRule id:10000040 "s:$UWA:8" "str:AliElTop" "mz:ANY" "msg:EgyScan security scanner";