##########
##
## jail for php-cgi attacks
##
##

[Definition]

# Option:  failregex
# Notes.:  regex to match this kind of request:
#
# 89.136.120.205 - - [10/Dec/2013:08:23:32 +0100] "GET /cgi-bin/php HTTP/1.1" 403 213 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
#
failregex = ^<HOST> -.*"(GET|POST).*/cgi-bin/php.*"
            ^<HOST> -.*"(GET|POST).*//.63.67.69.2d.62.69.6e/.*"

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =


