type: trigger
name: kupidonia/cap-bot-android10-chrome
description: "Instant captcha for bots using Android 10 with Mobile Chrome 149/150/151"
filter: "evt.Meta.service == 'http' and evt.Parsed.http_user_agent contains 'Android 10' and evt.Parsed.http_user_agent contains 'Mobile' and (evt.Parsed.http_user_agent contains 'Chrome/148' or evt.Parsed.http_user_agent contains 'Chrome/149' or evt.Parsed.http_user_agent contains 'Chrome/150' or evt.Parsed.http_user_agent contains 'Chrome/151')"
groupby: evt.Meta.source_ip
blackhole: 1m
labels:
  service: http
  type: bot
  remediation: captcha
---
type: leaky
name: kupidonia/ban-fast-quiz-solver
description: "Ban bots that submit quiz results too fast or too many times"
filter: "evt.Meta.service == 'http' and evt.Parsed.request contains '/viktoriny-result/' and evt.Parsed.verb == 'POST'"
groupby: evt.Meta.source_ip
leakspeed: 3m
capacity: 10
blackhole: 30m
labels:
  service: http
  type: bot
  remediation: ban
---
type: trigger
name: kupidonia/ban-smart-bot-android10
description: "Instant ban for bot using Android 10 submitting quiz results"
filter: "evt.Meta.service == 'http' and evt.Parsed.request contains '/viktoriny-result/' and evt.Parsed.verb == 'POST' and evt.Parsed.http_user_agent contains 'Android 10' and evt.Parsed.http_user_agent contains 'Mobile' and (evt.Parsed.http_user_agent contains 'Chrome/148' or evt.Parsed.http_user_agent contains 'Chrome/149' or evt.Parsed.http_user_agent contains 'Chrome/150')"
groupby: evt.Meta.source_ip
blackhole: 15m
labels:
  service: http
  type: bot
  remediation: ban
---
type: trigger
name: kupidonia/cap-old-os
description: "Send ancient OS (Old Android, Win 7/8, Headless) to captcha"
filter: >
  evt.Meta.service == 'http' and (
  evt.Parsed.http_user_agent contains 'Android 7' or 
  evt.Parsed.http_user_agent contains 'Android 8' or 
  evt.Parsed.http_user_agent contains 'Android 9' or 
  evt.Parsed.http_user_agent contains 'Android 10' or 
  evt.Parsed.http_user_agent contains 'Android 11' or 
  evt.Parsed.http_user_agent contains 'Windows NT 6.1' or 
  evt.Parsed.http_user_agent contains 'Windows NT 6.2' or 
  evt.Parsed.http_user_agent contains 'Windows NT 6.3' or 
  evt.Parsed.http_user_agent contains 'HeadlessChrome'
  )
groupby: evt.Meta.source_ip
blackhole: 2m
labels:
  service: http
  type: bot
  remediation: captcha