reality degenerate pattern improve

2025-01-18 23:31:58 +04:00
parent 658e125cd8
commit 5b4d3b5627
1 changed files with 9 additions and 1 deletions
@@ -4507,7 +4507,6 @@ DNS-over-HTTPS with IP:
        }

        $t = [
-            $this->suspicious('~\d+\.\d+\.\d+\.\d+.+200\s\d+\s0$~', '/logs/upstream_access', $xr, 'possibly a Reality Degenerate'),
            $this->suspicious($this->reg, '/logs/nginx_default_access', $xr, 'possibly a scanner', true),
            $this->suspicious($this->reg, '/logs/nginx_domain_access', $xr, 'possibly a scanner', true),
        ];
@@ -4519,6 +4518,15 @@ DNS-over-HTTPS with IP:
            }
        }

+        $r = $this->suspicious('~\d+\.\d+\.\d+\.\d+.+200\s\d+\s0$~', '/logs/upstream_access', $xr, 'possibly a Reality Degenerate');
+        if (!empty($r)) {
+            foreach ($r as $k => $v) {
+                if (count($v) > 30) {
+                    $ip[$k] = $v;
+                }
+            }
+        }
+
        if (!empty($return)) {
            return $ip;
        }