type: trigger
name: kupidonia/cap-index-mobile
description: "Instant captcha for Android Chrome 149/150 coming from search to index"
filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.request in ['/', '/index.php'] && evt.Parsed.http_referer matches '(?i)(google|yandex)' && evt.Parsed.http_user_agent matches '(?i)Android.*Chrome/(149|150).*Mobile'"
groupby: "evt.Meta.source_ip"
blackhole: 1m
labels:
  service: http
  type: captcha
  remediation: true