From 616dab4b3ac4dfd1864c938df86353d65cdfc749 Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Wed, 8 Mar 2023 19:11:01 +0000
Subject: [PATCH] Block another bogus crawler botnet UA
We're seeing tons of this, so either we're besieged by an army of
10-year-old Samsung Galaxy phones or this is a nefarious actor.
Change-Id: If52be5c4a191e5c70f55d843348ba7ca0b365e30
---
playbooks/roles/apache-ua-filter/files/ua-filter.conf | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/playbooks/roles/apache-ua-filter/files/ua-filter.conf b/playbooks/roles/apache-ua-filter/files/ua-filter.conf
index 5725d5e794..7fb40aa205 100644
--- a/playbooks/roles/apache-ua-filter/files/ua-filter.conf
+++ b/playbooks/roles/apache-ua-filter/files/ua-filter.conf
@@ -46,7 +46,8 @@
RewriteCond %{HTTP_USER_AGENT} "=UCWEB7.0.2.37/28/999" [OR]
RewriteCond %{HTTP_USER_AGENT} "=NOKIA5700/ UCWEB7.0.2.37/28/999" [OR]
RewriteCond %{HTTP_USER_AGENT} "=Openwave/ UCWEB7.0.2.37/28/999" [OR]
- RewriteCond %{HTTP_USER_AGENT} "=Mozilla/4.0 (compatible; MSIE 6.0; ) Opera/UCWEB7.0.2.37/28/999"
+ RewriteCond %{HTTP_USER_AGENT} "=Mozilla/4.0 (compatible; MSIE 6.0; ) Opera/UCWEB7.0.2.37/28/999" [OR]
+ RewriteCond %{HTTP_USER_AGENT} "=Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Mobile Safari/537.36"
RewriteRule . - [R=403,L]
</Macro>