alert tcp any any -> any any (msg:"Supheli Arac :TE"; content:"TE"; sid:1000001; ) alert tcp any any -> any any (msg:"Supheli Arac :DDD"; content:"DDD"; sid:1000002; ) alert tcp any any -> any any (msg:"Supheli Arac :IDA"; content:"IDA"; sid:1000003; ) alert tcp any any -> any any (msg:"Supheli Arac :UDM"; content:"UDM"; sid:1000004; ) alert tcp any any -> any any (msg:"Supheli Arac :nicebot"; content:"nicebot"; sid:1000005; ) alert tcp any any -> any any (msg:"Supheli Arac :Francis/1.0 (francis@neomo.de http://www.neomo.de/)"; content:"Francis/1.0 (francis@neomo.de http://www.neomo.de/)"; sid:1000006; ) alert tcp any any -> any any (msg:"Supheli Arac :AWeb"; content:"AWeb"; sid:1000007; ) alert tcp any any -> any any (msg:"Supheli Arac :Jack"; content:"Jack"; sid:1000008; ) alert tcp any any -> any any (msg:"Supheli Arac :Pita"; content:"Pita"; sid:1000009; ) alert tcp any any -> any any (msg:"Supheli Arac :SURF"; content:"SURF"; sid:1000010; ) alert tcp any any -> any any (msg:"Supheli Arac :Yeti"; content:"Yeti"; sid:1000011; ) alert tcp any any -> any any (msg:"Supheli Arac :Strategic Board Bot (+http://www.strategicboard.com)"; content:"Strategic Board Bot (+http://www.strategicboard.com)"; sid:1000012; ) alert tcp any any -> any any (msg:"Supheli Arac :BlogzIce/1.0 (+http://icerocket.com; rhodes@icerocket.com)"; content:"BlogzIce/1.0 (+http://icerocket.com; rhodes@icerocket.com)"; sid:1000013; ) alert tcp any any -> any any (msg:"Supheli Arac :Robot: NutchCrawler- Owner: wdavies@acm.org"; content:"Robot: NutchCrawler- Owner: wdavies@acm.org"; sid:1000014; ) alert tcp any any -> any any (msg:"Supheli Arac :SmartDownload/1.2.67 (Win32; Jan 12 1999)"; content:"SmartDownload/1.2.67 (Win32; Jan 12 1999)"; sid:1000015; ) alert tcp any any -> any any (msg:"Supheli Arac :PingALink Monitoring Services 1.0 (http://www.pingalink.com)"; content:"PingALink Monitoring Services 1.0 (http://www.pingalink.com)"; sid:1000016; ) alert tcp any any -> any any (msg:"Supheli Arac :Cabot/Nutch-1.0-dev (Amfibi's web-crawling robot; http://www.amfibi.com/cabot/; agent@amfibi.com)"; content:"Cabot/Nutch-1.0-dev (Amfibi's web-crawling robot; http://www.amfibi.com/cabot/; agent@amfibi.com)"; sid:1000017; ) alert tcp any any -> any any (msg:"Supheli Arac :Mata Hari/2.00"; content:"Mata Hari/2.00"; sid:1000018; ) alert tcp any any -> any any (msg:"Supheli Arac :Attentio/Nutch-0.9-dev (Attentio's beta blog crawler; www.attentio.com; info@attentio.com)"; content:"Attentio/Nutch-0.9-dev (Attentio's beta blog crawler; www.attentio.com; info@attentio.com)"; sid:1000019; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteTruth.com site rating system"; content:"SiteTruth.com site rating system"; sid:1000020; ) alert tcp any any -> any any (msg:"Supheli Arac :Download Express 1.0"; content:"Download Express 1.0"; sid:1000021; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.05 (Macintosh; I; PPC Nav)"; content:"Mozilla/4.05 (Macintosh; I; PPC Nav)"; sid:1000022; ) alert tcp any any -> any any (msg:"Supheli Arac :IndexTheWeb.com Crawler7"; content:"IndexTheWeb.com Crawler7"; sid:1000023; ) alert tcp any any -> any any (msg:"Supheli Arac :Wwlib/Linux"; content:"Wwlib/Linux"; sid:1000024; ) alert tcp any any -> any any (msg:"Supheli Arac :REBOL Core 2.x.x.x.x"; content:"REBOL Core 2.x.x.x.x"; sid:1000025; ) alert tcp any any -> any any (msg:"Supheli Arac :PostFavorites"; content:"PostFavorites"; sid:1000026; ) alert tcp any any -> any any (msg:"Supheli Arac :ilial/Nutch-0.9-dev"; content:"ilial/Nutch-0.9-dev"; sid:1000027; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Win16; I)"; content:"Mozilla/3.0 (Win16; I)"; sid:1000028; ) alert tcp any any -> any any (msg:"Supheli Arac :Overture-WebCrawler/3.8/Fresh (atw-crawler at fast dot no; http://fast.no/support/crawler.asp)"; content:"Overture-WebCrawler/3.8/Fresh (atw-crawler at fast dot no; http://fast.no/support/crawler.asp)"; sid:1000029; ) alert tcp any any -> any any (msg:"Supheli Arac :INFOMINE/8.0 RemoteServices"; content:"INFOMINE/8.0 RemoteServices"; sid:1000030; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Yahoo Japan; for robot study; kasugiya)"; content:"Mozilla/4.0 (compatible; Yahoo Japan; for robot study; kasugiya)"; sid:1000031; ) alert tcp any any -> any any (msg:"Supheli Arac :Insitornaut"; content:"Insitornaut"; sid:1000032; ) alert tcp any any -> any any (msg:"Supheli Arac :deepak-USC/ISI"; content:"deepak-USC/ISI"; sid:1000033; ) alert tcp any any -> any any (msg:"Supheli Arac :igdeSpyder (compatible; igde.ru; +http://igde.ru/doc/tech.html)"; content:"igdeSpyder (compatible; igde.ru; +http://igde.ru/doc/tech.html)"; sid:1000034; ) alert tcp any any -> any any (msg:"Supheli Arac :NCSA Beta 1 (http://vias.ncsa.uiuc.edu/viasarchivinginformation.html)"; content:"NCSA Beta 1 (http://vias.ncsa.uiuc.edu/viasarchivinginformation.html)"; sid:1000035; ) alert tcp any any -> any any (msg:"Supheli Arac :WebStripper/2.xx"; content:"WebStripper/2.xx"; sid:1000036; ) alert tcp any any -> any any (msg:"Supheli Arac :Clushbot/3.xx-Peleus (+http://www.clush.com/bot.html)"; content:"Clushbot/3.xx-Peleus (+http://www.clush.com/bot.html)"; sid:1000037; ) alert tcp any any -> any any (msg:"Supheli Arac :Twiceler www.cuill.com/robots.html"; content:"Twiceler www.cuill.com/robots.html"; sid:1000038; ) alert tcp any any -> any any (msg:"Supheli Arac :IncyWincy page crawler(webmaster@loopimprovements.com"; content:"IncyWincy page crawler(webmaster@loopimprovements.com"; sid:1000039; ) alert tcp any any -> any any (msg:"Supheli Arac :Llaut/1.0 (http://mnm.uib.es/~gallir/llaut/bot.html)"; content:"Llaut/1.0 (http://mnm.uib.es/~gallir/llaut/bot.html)"; sid:1000040; ) alert tcp any any -> any any (msg:"Supheli Arac :autohttp"; content:"autohttp"; sid:1000041; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC)"; content:"Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC)"; sid:1000042; ) alert tcp any any -> any any (msg:"Supheli Arac :Robozilla/1.0"; content:"Robozilla/1.0"; sid:1000043; ) alert tcp any any -> any any (msg:"Supheli Arac :SpiderMonkey/7.0x (SpiderMonkey.ca info at http://spidermonkey.ca/sm.shtml)"; content:"SpiderMonkey/7.0x (SpiderMonkey.ca info at http://spidermonkey.ca/sm.shtml)"; sid:1000044; ) alert tcp any any -> any any (msg:"Supheli Arac :Aplix_SEGASATURN_browser/1.x (Japanese)"; content:"Aplix_SEGASATURN_browser/1.x (Japanese)"; sid:1000045; ) alert tcp any any -> any any (msg:"Supheli Arac :Hatena RSS/0.3 (http://r.hatena.ne.jp)"; content:"Hatena RSS/0.3 (http://r.hatena.ne.jp)"; sid:1000046; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0(compatible; Zealbot 1.0)"; content:"Mozilla/4.0(compatible; Zealbot 1.0)"; sid:1000047; ) alert tcp any any -> any any (msg:"Supheli Arac :Zao-Crawler"; content:"Zao-Crawler"; sid:1000048; ) alert tcp any any -> any any (msg:"Supheli Arac :Comrite/0.7.1 (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"; content:"Comrite/0.7.1 (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"; sid:1000049; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Scrubby/2.2; http://www.scrubtheweb.com/)"; content:"Mozilla/5.0 (compatible; Scrubby/2.2; http://www.scrubtheweb.com/)"; sid:1000050; ) alert tcp any any -> any any (msg:"Supheli Arac :InternetLinkAgent/3.1"; content:"InternetLinkAgent/3.1"; sid:1000051; ) alert tcp any any -> any any (msg:"Supheli Arac :Snapbot/1.0"; content:"Snapbot/1.0"; sid:1000052; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; BorderManager 3.0)"; content:"Mozilla/4.0 (compatible; BorderManager 3.0)"; sid:1000053; ) alert tcp any any -> any any (msg:"Supheli Arac :Cricket-A100/1.0 UP.Browser/6.3.0.7 (GUI) MMP/2.0"; content:"Cricket-A100/1.0 UP.Browser/6.3.0.7 (GUI) MMP/2.0"; sid:1000054; ) alert tcp any any -> any any (msg:"Supheli Arac :Qango.com Web Directory (http://www.qango.com/)"; content:"Qango.com Web Directory (http://www.qango.com/)"; sid:1000055; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Skampy/0.9.x [en]"; content:"Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Skampy/0.9.x [en]"; sid:1000056; ) alert tcp any any -> any any (msg:"Supheli Arac :vspider"; content:"vspider"; sid:1000057; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.76 (Windows 98; U) Opera 5.12 [en]"; content:"Mozilla/4.76 (Windows 98; U) Opera 5.12 [en]"; sid:1000058; ) alert tcp any any -> any any (msg:"Supheli Arac :multiBlocker browser"; content:"multiBlocker browser"; sid:1000059; ) alert tcp any any -> any any (msg:"Supheli Arac :KFSW-Bot (Version: 1.01 powered by KFSW www.kfsw.de)"; content:"KFSW-Bot (Version: 1.01 powered by KFSW www.kfsw.de)"; sid:1000060; ) alert tcp any any -> any any (msg:"Supheli Arac :BlackWidow"; content:"BlackWidow"; sid:1000061; ) alert tcp any any -> any any (msg:"Supheli Arac :sna-0.0.1 mikeelliott@hotmail.com"; content:"sna-0.0.1 mikeelliott@hotmail.com"; sid:1000062; ) alert tcp any any -> any any (msg:"Supheli Arac :FANGCrawl/0.01"; content:"FANGCrawl/0.01"; sid:1000063; ) alert tcp any any -> any any (msg:"Supheli Arac :gsa-crawler (Enterprise; GID-01422; jplastiras@google.com)"; content:"gsa-crawler (Enterprise; GID-01422; jplastiras@google.com)"; sid:1000064; ) alert tcp any any -> any any (msg:"Supheli Arac :BullsEye"; content:"BullsEye"; sid:1000065; ) alert tcp any any -> any any (msg:"Supheli Arac :Lynx/2.8 (;http://seebot.org)"; content:"Lynx/2.8 (;http://seebot.org)"; sid:1000066; ) alert tcp any any -> any any (msg:"Supheli Arac :scooter-venus-3.0.vns"; content:"scooter-venus-3.0.vns"; sid:1000067; ) alert tcp any any -> any any (msg:"Supheli Arac :IBrowse/2.2 (AmigaOS 3.5)"; content:"IBrowse/2.2 (AmigaOS 3.5)"; sid:1000068; ) alert tcp any any -> any any (msg:"Supheli Arac :Websquash.com (Add url robot)"; content:"Websquash.com (Add url robot)"; sid:1000069; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.08 [en] (Win98; U ;Nav)"; content:"Mozilla/4.08 [en] (Win98; U ;Nav)"; sid:1000070; ) alert tcp any any -> any any (msg:"Supheli Arac :ES.NET_Crawler/2.0 (http://search.innerprise.net/)"; content:"ES.NET_Crawler/2.0 (http://search.innerprise.net/)"; sid:1000071; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Hotbar 3.0)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Hotbar 3.0)"; sid:1000072; ) alert tcp any any -> any any (msg:"Supheli Arac :LinksManager.com (http://linksmanager.com/linkchecker.html)"; content:"LinksManager.com (http://linksmanager.com/linkchecker.html)"; sid:1000073; ) alert tcp any any -> any any (msg:"Supheli Arac :SurveyBot/2.3 (Whois Source)"; content:"SurveyBot/2.3 (Whois Source)"; sid:1000074; ) alert tcp any any -> any any (msg:"Supheli Arac :Links (2.xpre7; Linux 2.4.18 i586; x)"; content:"Links (2.xpre7; Linux 2.4.18 i586; x)"; sid:1000075; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; TridentSpider/3.1)"; content:"Mozilla/5.0 (compatible; TridentSpider/3.1)"; sid:1000076; ) alert tcp any any -> any any (msg:"Supheli Arac :192.comAgent"; content:"192.comAgent"; sid:1000077; ) alert tcp any any -> any any (msg:"Supheli Arac :CentiverseBot - investigator"; content:"CentiverseBot - investigator"; sid:1000078; ) alert tcp any any -> any any (msg:"Supheli Arac :Favorites Sweeper v.2.03"; content:"Favorites Sweeper v.2.03"; sid:1000079; ) alert tcp any any -> any any (msg:"Supheli Arac :savvybot/0.2"; content:"savvybot/0.2"; sid:1000080; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 compatible FurlBot/Furl Search 2.0 (FurlBot; http://www.furl.net; wn.furlbot@looksmart.net)"; content:"Mozilla/4.0 compatible FurlBot/Furl Search 2.0 (FurlBot; http://www.furl.net; wn.furlbot@looksmart.net)"; sid:1000081; ) alert tcp any any -> any any (msg:"Supheli Arac :OpenTextSiteCrawler/2.9.2"; content:"OpenTextSiteCrawler/2.9.2"; sid:1000082; ) alert tcp any any -> any any (msg:"Supheli Arac :BilgiBetaBot/0.8-dev (bilgi.com (Beta) ; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"; content:"BilgiBetaBot/0.8-dev (bilgi.com (Beta) ; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"; sid:1000083; ) alert tcp any any -> any any (msg:"Supheli Arac :NEC-Hayek/1.0"; content:"NEC-Hayek/1.0"; sid:1000084; ) alert tcp any any -> any any (msg:"Supheli Arac :Lycos_Spider_(T-Rex)"; content:"Lycos_Spider_(T-Rex)"; sid:1000085; ) alert tcp any any -> any any (msg:"Supheli Arac :Googlebot/Test ( http://www.googlebot.com/bot.html)"; content:"Googlebot/Test ( http://www.googlebot.com/bot.html)"; sid:1000086; ) alert tcp any any -> any any (msg:"Supheli Arac :WebDownloader for X x.xx"; content:"WebDownloader for X x.xx"; sid:1000087; ) alert tcp any any -> any any (msg:"Supheli Arac :suchbaer.de (CrawlerAgent v0.103)"; content:"suchbaer.de (CrawlerAgent v0.103)"; sid:1000088; ) alert tcp any any -> any any (msg:"Supheli Arac :iVia/4.0 CanonizeUrl (http://infomine.ucr.edu/iVia/useragents.shtml"; content:"iVia/4.0 CanonizeUrl (http://infomine.ucr.edu/iVia/useragents.shtml"; sid:1000089; ) alert tcp any any -> any any (msg:"Supheli Arac :MultiText/0.1"; content:"MultiText/0.1"; sid:1000090; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040413 Epiphany/1.2.1"; content:"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040413 Epiphany/1.2.1"; sid:1000091; ) alert tcp any any -> any any (msg:"Supheli Arac :Mariner/5.1b [de] (Win95; I ;Kolibri gncwebbot)"; content:"Mariner/5.1b [de] (Win95; I ;Kolibri gncwebbot)"; sid:1000092; ) alert tcp any any -> any any (msg:"Supheli Arac :GetRight/4.x"; content:"GetRight/4.x"; sid:1000093; ) alert tcp any any -> any any (msg:"Supheli Arac :versus 0.2 (+http://versus.integis.ch)"; content:"versus 0.2 (+http://versus.integis.ch)"; sid:1000094; ) alert tcp any any -> any any (msg:"Supheli Arac :Clushbot/2.x (+http://www.clush.com/bot.html)"; content:"Clushbot/2.x (+http://www.clush.com/bot.html)"; sid:1000095; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; Ask Jeeves/Teoma)"; content:"Mozilla/2.0 (compatible; Ask Jeeves/Teoma)"; sid:1000096; ) alert tcp any any -> any any (msg:"Supheli Arac :TCDBOT/Nutch-0.8 (PhD student research;http://www.tcd.ie; mcgettrs at t c d dot IE)"; content:"TCDBOT/Nutch-0.8 (PhD student research;http://www.tcd.ie; mcgettrs at t c d dot IE)"; sid:1000097; ) alert tcp any any -> any any (msg:"Supheli Arac :SeznamBot/1.0"; content:"SeznamBot/1.0"; sid:1000098; ) alert tcp any any -> any any (msg:"Supheli Arac :Rubbot/1.0 (+http://rubhub.com/)"; content:"Rubbot/1.0 (+http://rubhub.com/)"; sid:1000099; ) alert tcp any any -> any any (msg:"Supheli Arac :aipbot/2-beta (aipbot dev; http://aipbot.com; aipbot@aipbot.com)"; content:"aipbot/2-beta (aipbot dev; http://aipbot.com; aipbot@aipbot.com)"; sid:1000100; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/6.x (Linux 2.4.8-26mdk i686; U) [en]"; content:"Opera/6.x (Linux 2.4.8-26mdk i686; U) [en]"; sid:1000101; ) alert tcp any any -> any any (msg:"Supheli Arac :NextopiaBOT (+http://www.nextopia.com) distributed crawler client beta v0.x"; content:"NextopiaBOT (+http://www.nextopia.com) distributed crawler client beta v0.x"; sid:1000102; ) alert tcp any any -> any any (msg:"Supheli Arac :Gromit/1.0"; content:"Gromit/1.0"; sid:1000103; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; AvantGo 3.2)"; content:"Mozilla/3.0 (compatible; AvantGo 3.2)"; sid:1000104; ) alert tcp any any -> any any (msg:"Supheli Arac :LightningDownload/1.0beta2"; content:"LightningDownload/1.0beta2"; sid:1000105; ) alert tcp any any -> any any (msg:"Supheli Arac :RX Bar"; content:"RX Bar"; sid:1000106; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.5 (atw-crawler at fast dot no; http://fast.no/support.php?c=faqs/crawler)"; content:"FAST-WebCrawler/3.5 (atw-crawler at fast dot no; http://fast.no/support.php?c=faqs/crawler)"; sid:1000107; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.0; Windows NT; Site Server 3.0 Robot) WebQuest Designs"; content:"Mozilla/4.0 (compatible; MSIE 4.0; Windows NT; Site Server 3.0 Robot) WebQuest Designs"; sid:1000108; ) alert tcp any any -> any any (msg:"Supheli Arac :bumblebee@relevare.com"; content:"bumblebee@relevare.com"; sid:1000109; ) alert tcp any any -> any any (msg:"Supheli Arac :Full Web Bot 0416B"; content:"Full Web Bot 0416B"; sid:1000110; ) alert tcp any any -> any any (msg:"Supheli Arac :Full Web Bot 0516B"; content:"Full Web Bot 0516B"; sid:1000111; ) alert tcp any any -> any any (msg:"Supheli Arac :icsbot-0.1"; content:"icsbot-0.1"; sid:1000112; ) alert tcp any any -> any any (msg:"Supheli Arac :BarraHomeCrawler (albertof@barrahome.org)"; content:"BarraHomeCrawler (albertof@barrahome.org)"; sid:1000113; ) alert tcp any any -> any any (msg:"Supheli Arac :Sogou web spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"; content:"Sogou web spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"; sid:1000114; ) alert tcp any any -> any any (msg:"Supheli Arac :Crawler admin@crawler.de"; content:"Crawler admin@crawler.de"; sid:1000115; ) alert tcp any any -> any any (msg:"Supheli Arac :Tycoon Agent/Nutch-1.0-dev"; content:"Tycoon Agent/Nutch-1.0-dev"; sid:1000116; ) alert tcp any any -> any any (msg:"Supheli Arac :CERN-LineMode/2.15"; content:"CERN-LineMode/2.15"; sid:1000117; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows;) NimbleCrawler 1.12 obeys UserAgent NimbleCrawler For problems contact: crawler@health"; content:"Mozilla/5.0 (Windows;) NimbleCrawler 1.12 obeys UserAgent NimbleCrawler For problems contact: crawler@health"; sid:1000118; ) alert tcp any any -> any any (msg:"Supheli Arac :Naamah 1.0.1/Blogbot (http://blogbot.de/)"; content:"Naamah 1.0.1/Blogbot (http://blogbot.de/)"; sid:1000119; ) alert tcp any any -> any any (msg:"Supheli Arac :BrightCrawler (http://www.brightcloud.com/brightcrawler.asp)"; content:"BrightCrawler (http://www.brightcloud.com/brightcrawler.asp)"; sid:1000120; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.77C-SGI [en] (X11; U; IRIX 6.5 IP32)"; content:"Mozilla/4.77C-SGI [en] (X11; U; IRIX 6.5 IP32)"; sid:1000121; ) alert tcp any any -> any any (msg:"Supheli Arac :kulokobot www.kuloko.com kuloko@backweave.com"; content:"kulokobot www.kuloko.com kuloko@backweave.com"; sid:1000122; ) alert tcp any any -> any any (msg:"Supheli Arac :Lovel as 1.0 ( +http://www.everatom.com)"; content:"Lovel as 1.0 ( +http://www.everatom.com)"; sid:1000123; ) alert tcp any any -> any any (msg:"Supheli Arac :curl/7.7.x (i386--freebsd4.3) libcurl 7.7.x (SSL 0.9.6) (ipv6 enabled)"; content:"curl/7.7.x (i386--freebsd4.3) libcurl 7.7.x (SSL 0.9.6) (ipv6 enabled)"; sid:1000124; ) alert tcp any any -> any any (msg:"Supheli Arac :Dragonfly File Reader"; content:"Dragonfly File Reader"; sid:1000125; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler 6 / Scirus scirus-crawler@fast.no; http://www.scirus.com/srsapp/contactus/"; content:"FAST Enterprise Crawler 6 / Scirus scirus-crawler@fast.no; http://www.scirus.com/srsapp/contactus/"; sid:1000126; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ODP entries t_st; http://tuezilla.de/t_st-odp-entries-agent.html)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ODP entries t_st; http://tuezilla.de/t_st-odp-entries-agent.html)"; sid:1000127; ) alert tcp any any -> any any (msg:"Supheli Arac :Mizzu Labs 2.2"; content:"Mizzu Labs 2.2"; sid:1000128; ) alert tcp any any -> any any (msg:"Supheli Arac :nsyght.com/Nutch-x.x (nsyght.com; search.nsyght.com)"; content:"nsyght.com/Nutch-x.x (nsyght.com; search.nsyght.com)"; sid:1000129; ) alert tcp any any -> any any (msg:"Supheli Arac :Full Web Bot 2816B"; content:"Full Web Bot 2816B"; sid:1000130; ) alert tcp any any -> any any (msg:"Supheli Arac :Contact"; content:"Contact"; sid:1000131; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) VoilaBot; 1.6"; content:"Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) VoilaBot; 1.6"; sid:1000132; ) alert tcp any any -> any any (msg:"Supheli Arac :Miva (AlgoFeedback@miva.com)"; content:"Miva (AlgoFeedback@miva.com)"; sid:1000133; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible;FindITAnswersbot/1.0;+http://search.it-influentials.com/bot.htm)"; content:"Mozilla/5.0 (compatible;FindITAnswersbot/1.0;+http://search.it-influentials.com/bot.htm)"; sid:1000134; ) alert tcp any any -> any any (msg:"Supheli Arac :RebusnetBot (+http://www.rebusnet.biz)"; content:"RebusnetBot (+http://www.rebusnet.biz)"; sid:1000135; ) alert tcp any any -> any any (msg:"Supheli Arac :Jetbot/1.0"; content:"Jetbot/1.0"; sid:1000136; ) alert tcp any any -> any any (msg:"Supheli Arac :Blaiz-Bee/2.00.xxxx (+http://www.blaiz.net)"; content:"Blaiz-Bee/2.00.xxxx (+http://www.blaiz.net)"; sid:1000137; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; MS FrontPage x.0)"; content:"Mozilla/2.0 (compatible; MS FrontPage x.0)"; sid:1000138; ) alert tcp any any -> any any (msg:"Supheli Arac :CoolBot"; content:"CoolBot"; sid:1000139; ) alert tcp any any -> any any (msg:"Supheli Arac :OmniExplorer_Bot/1.0x (+http://www.omni-explorer.com) Job Crawler"; content:"OmniExplorer_Bot/1.0x (+http://www.omni-explorer.com) Job Crawler"; sid:1000140; ) alert tcp any any -> any any (msg:"Supheli Arac :Mass Downloader 2.x"; content:"Mass Downloader 2.x"; sid:1000141; ) alert tcp any any -> any any (msg:"Supheli Arac :NetNoseCrawler/v1.0"; content:"NetNoseCrawler/v1.0"; sid:1000142; ) alert tcp any any -> any any (msg:"Supheli Arac :Trailfire-bot/0.7.1 (Trailfire page content analyzer; http://trailfire.com; info@trailfire.com)"; content:"Trailfire-bot/0.7.1 (Trailfire page content analyzer; http://trailfire.com; info@trailfire.com)"; sid:1000143; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/; )"; content:"Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/; )"; sid:1000144; ) alert tcp any any -> any any (msg:"Supheli Arac :HotJava/1.0.1/JRE1.1.x"; content:"HotJava/1.0.1/JRE1.1.x"; sid:1000145; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; SuperCleaner 2.xx; Windows 98)"; content:"Mozilla/4.0 (compatible; SuperCleaner 2.xx; Windows 98)"; sid:1000146; ) alert tcp any any -> any any (msg:"Supheli Arac :KIT-Fireball/2.0 (compatible; Mozilla 4.0; MSIE 5.5)"; content:"KIT-Fireball/2.0 (compatible; Mozilla 4.0; MSIE 5.5)"; sid:1000147; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_devel (http://pauillac.inria.fr/~ailleret/prog/larbin/)"; content:"larbin_devel (http://pauillac.inria.fr/~ailleret/prog/larbin/)"; sid:1000148; ) alert tcp any any -> any any (msg:"Supheli Arac :TutorGig/1.5 (+http://www.tutorgig.com/crawler)"; content:"TutorGig/1.5 (+http://www.tutorgig.com/crawler)"; sid:1000149; ) alert tcp any any -> any any (msg:"Supheli Arac :Motoricerca-Robots.txt-Checker/1.0 (http://tool.motoricerca.info/robots-checker.phtml)"; content:"Motoricerca-Robots.txt-Checker/1.0 (http://tool.motoricerca.info/robots-checker.phtml)"; sid:1000150; ) alert tcp any any -> any any (msg:"Supheli Arac :BlitzBOT@tricus.net (Mozilla compatible)"; content:"BlitzBOT@tricus.net (Mozilla compatible)"; sid:1000151; ) alert tcp any any -> any any (msg:"Supheli Arac :gsa-crawler (Enterprise; GIX-03519; cknuetter@stubhub.com)"; content:"gsa-crawler (Enterprise; GIX-03519; cknuetter@stubhub.com)"; sid:1000152; ) alert tcp any any -> any any (msg:"Supheli Arac :EldoS TimelyWeb/3.x"; content:"EldoS TimelyWeb/3.x"; sid:1000153; ) alert tcp any any -> any any (msg:"Supheli Arac :Spider/maxbot.com admin@maxbot.com"; content:"Spider/maxbot.com admin@maxbot.com"; sid:1000154; ) alert tcp any any -> any any (msg:"Supheli Arac :OrangeSpider"; content:"OrangeSpider"; sid:1000155; ) alert tcp any any -> any any (msg:"Supheli Arac :teoma_agent1"; content:"teoma_agent1"; sid:1000156; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible;MAINSEEK_BOT)"; content:"Mozilla/5.0 (compatible;MAINSEEK_BOT)"; sid:1000157; ) alert tcp any any -> any any (msg:"Supheli Arac :bCentral Billing Post-Process"; content:"bCentral Billing Post-Process"; sid:1000158; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Link Utility; http://net-promoter.com)"; content:"Mozilla/4.0 (compatible; Link Utility; http://net-promoter.com)"; sid:1000159; ) alert tcp any any -> any any (msg:"Supheli Arac :Big Brother (http://pauillac.inria.fr/~fpottier/)"; content:"Big Brother (http://pauillac.inria.fr/~fpottier/)"; sid:1000160; ) alert tcp any any -> any any (msg:"Supheli Arac :Sleipnir/2.xx"; content:"Sleipnir/2.xx"; sid:1000161; ) alert tcp any any -> any any (msg:"Supheli Arac :LocalcomBot/1.2.x ( http://www.local.com/bot.htm)"; content:"LocalcomBot/1.2.x ( http://www.local.com/bot.htm)"; sid:1000162; ) alert tcp any any -> any any (msg:"Supheli Arac :Rainbot1.1"; content:"Rainbot1.1"; sid:1000163; ) alert tcp any any -> any any (msg:"Supheli Arac :*/Nutch-0.9-dev"; content:"*/Nutch-0.9-dev"; sid:1000164; ) alert tcp any any -> any any (msg:"Supheli Arac :ProWebGuide Link Checker (http://www.prowebguide.com)"; content:"ProWebGuide Link Checker (http://www.prowebguide.com)"; sid:1000165; ) alert tcp any any -> any any (msg:"Supheli Arac :Clushbot/3.xx-Ajax (+http://www.clush.com/bot.html)"; content:"Clushbot/3.xx-Ajax (+http://www.clush.com/bot.html)"; sid:1000166; ) alert tcp any any -> any any (msg:"Supheli Arac :RssBandit/1.5.0.10 (.NET CLR 1.1.4322.2407; WinNT 5.1.2600.0; http://www.rssbandit.org) (.NET CLR 1.1.4322.2407; WinNT 5.1.2600.0; )"; content:"RssBandit/1.5.0.10 (.NET CLR 1.1.4322.2407; WinNT 5.1.2600.0; http://www.rssbandit.org) (.NET CLR 1.1.4322.2407; WinNT 5.1.2600.0; )"; sid:1000167; ) alert tcp any any -> any any (msg:"Supheli Arac :Adaxas Spider (http://www.adaxas.net/)"; content:"Adaxas Spider (http://www.adaxas.net/)"; sid:1000168; ) alert tcp any any -> any any (msg:"Supheli Arac :curl/7.9.x (win32) libcurl 7.9.x"; content:"curl/7.9.x (win32) libcurl 7.9.x"; sid:1000169; ) alert tcp any any -> any any (msg:"Supheli Arac :Accelatech RSSCrawler/0.4"; content:"Accelatech RSSCrawler/0.4"; sid:1000170; ) alert tcp any any -> any any (msg:"Supheli Arac :Bilbo/2.3b-UNIX"; content:"Bilbo/2.3b-UNIX"; sid:1000171; ) alert tcp any any -> any any (msg:"Supheli Arac :WinampMPEG/2.00 (larbin@unspecified.mail)"; content:"WinampMPEG/2.00 (larbin@unspecified.mail)"; sid:1000172; ) alert tcp any any -> any any (msg:"Supheli Arac :Liferea/1.x.x (Linux; es_ES.UTF-8; http://liferea.sf.net/)"; content:"Liferea/1.x.x (Linux; es_ES.UTF-8; http://liferea.sf.net/)"; sid:1000173; ) alert tcp any any -> any any (msg:"Supheli Arac :MJ12bot/vx.x.x (http://majestic12.co.uk/bot.php?+)"; content:"MJ12bot/vx.x.x (http://majestic12.co.uk/bot.php?+)"; sid:1000174; ) alert tcp any any -> any any (msg:"Supheli Arac :sait/Nutch-0.9 (SAIT Research; http://www.samsung.com)"; content:"sait/Nutch-0.9 (SAIT Research; http://www.samsung.com)"; sid:1000175; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler 6 used by Comperio AS (sts@comperio.no)"; content:"FAST Enterprise Crawler 6 used by Comperio AS (sts@comperio.no)"; sid:1000176; ) alert tcp any any -> any any (msg:"Supheli Arac :WISEbot/1.0 (WISEbot@koreawisenut.com; http://wisebot.koreawisenut.com)"; content:"WISEbot/1.0 (WISEbot@koreawisenut.com; http://wisebot.koreawisenut.com)"; sid:1000177; ) alert tcp any any -> any any (msg:"Supheli Arac :Zscho.de Crawler/Nutch-1.0-Zscho.de-semantic_patch (Zscho.de Crawler"; content:"Zscho.de Crawler/Nutch-1.0-Zscho.de-semantic_patch (Zscho.de Crawler"; sid:1000178; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Yahoo! DE Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"; content:"Mozilla/5.0 (compatible; Yahoo! DE Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"; sid:1000179; ) alert tcp any any -> any any (msg:"Supheli Arac :Atomz/1.0"; content:"Atomz/1.0"; sid:1000180; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (MobilePhone SCP-5500/US/1.0) NetFront/3.0 MMP/2.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"; content:"Mozilla/4.0 (MobilePhone SCP-5500/US/1.0) NetFront/3.0 MMP/2.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"; sid:1000181; ) alert tcp any any -> any any (msg:"Supheli Arac :Look.com"; content:"Look.com"; sid:1000182; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB5; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; .NET CLR 2.0.50727)"; content:"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB5; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; .NET CLR 2.0.50727)"; sid:1000183; ) alert tcp any any -> any any (msg:"Supheli Arac :Java1.0.21.0"; content:"Java1.0.21.0"; sid:1000184; ) alert tcp any any -> any any (msg:"Supheli Arac :Computer_and_Automation_Research_Institute_Crawler crawler@ilab.sztaki.hu"; content:"Computer_and_Automation_Research_Institute_Crawler crawler@ilab.sztaki.hu"; sid:1000185; ) alert tcp any any -> any any (msg:"Supheli Arac :semanticdiscovery/0.x"; content:"semanticdiscovery/0.x"; sid:1000186; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; ICS 1.2.xxx)"; content:"Mozilla/4.0 (compatible; ICS 1.2.xxx)"; sid:1000187; ) alert tcp any any -> any any (msg:"Supheli Arac :www.doweb.co.uk crawler"; content:"www.doweb.co.uk crawler"; sid:1000188; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.2 (pimenas@systems.tuc.gr)"; content:"larbin_2.6.2 (pimenas@systems.tuc.gr)"; sid:1000189; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 efp@gmx.net"; content:"Mozilla/4.0 efp@gmx.net"; sid:1000190; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.1.1 larbin2.1.1@somewhere.com"; content:"larbin_2.1.1 larbin2.1.1@somewhere.com"; sid:1000191; ) alert tcp any any -> any any (msg:"Supheli Arac :AV Fetch 1.0"; content:"AV Fetch 1.0"; sid:1000192; ) alert tcp any any -> any any (msg:"Supheli Arac :8484 Boston Project v 1.0"; content:"8484 Boston Project v 1.0"; sid:1000193; ) alert tcp any any -> any any (msg:"Supheli Arac :Accoona-AI-Agent/1.1.2 (aicrawler at accoonabot dot com)"; content:"Accoona-AI-Agent/1.1.2 (aicrawler at accoonabot dot com)"; sid:1000194; ) alert tcp any any -> any any (msg:"Supheli Arac :suchbot"; content:"suchbot"; sid:1000195; ) alert tcp any any -> any any (msg:"Supheli Arac :SmartDownload/1.2.77 (Win32; Jun 19 2001)"; content:"SmartDownload/1.2.77 (Win32; Jun 19 2001)"; sid:1000196; ) alert tcp any any -> any any (msg:"Supheli Arac :Aleksika Spider/1.0 (+http://www.aleksika.com/)"; content:"Aleksika Spider/1.0 (+http://www.aleksika.com/)"; sid:1000197; ) alert tcp any any -> any any (msg:"Supheli Arac :WebVac (webmaster@pita.stanford.edu)"; content:"WebVac (webmaster@pita.stanford.edu)"; sid:1000198; ) alert tcp any any -> any any (msg:"Supheli Arac :WinPodder (http://winpodder.com)"; content:"WinPodder (http://winpodder.com)"; sid:1000199; ) alert tcp any any -> any any (msg:"Supheli Arac :Slarp/0.1"; content:"Slarp/0.1"; sid:1000200; ) alert tcp any any -> any any (msg:"Supheli Arac :Filangy/1.0x (Filangy; http://www.filangy.com/filangyinfo.jsp?inc=robots.jsp; filangy-agent@filangy.com)"; content:"Filangy/1.0x (Filangy; http://www.filangy.com/filangyinfo.jsp?inc=robots.jsp; filangy-agent@filangy.com)"; sid:1000201; ) alert tcp any any -> any any (msg:"Supheli Arac :htdig/3.1.x (root@localhost)"; content:"htdig/3.1.x (root@localhost)"; sid:1000202; ) alert tcp any any -> any any (msg:"Supheli Arac :OpenWebSpider/0.x.x (http://www.openwebspider.org)"; content:"OpenWebSpider/0.x.x (http://www.openwebspider.org)"; sid:1000203; ) alert tcp any any -> any any (msg:"Supheli Arac :abot/0.1 (abot; http://www.abot.com; abot@abot.com)"; content:"abot/0.1 (abot; http://www.abot.com; abot@abot.com)"; sid:1000204; ) alert tcp any any -> any any (msg:"Supheli Arac :Goofer/0.2"; content:"Goofer/0.2"; sid:1000205; ) alert tcp any any -> any any (msg:"Supheli Arac :worio heritrix bot (+http://worio.com/)"; content:"worio heritrix bot (+http://worio.com/)"; sid:1000206; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; netart generator/1.0; libwww-perl/5.64)"; content:"Mozilla/3.0 (compatible; netart generator/1.0; libwww-perl/5.64)"; sid:1000207; ) alert tcp any any -> any any (msg:"Supheli Arac :Nitro Downloader 1.x (www.klsofttools.com)"; content:"Nitro Downloader 1.x (www.klsofttools.com)"; sid:1000208; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter/2.0 G.R.A.B. V1.1.0"; content:"Scooter/2.0 G.R.A.B. V1.1.0"; sid:1000209; ) alert tcp any any -> any any (msg:"Supheli Arac :West Wind Internet Protocols 4.xx"; content:"West Wind Internet Protocols 4.xx"; sid:1000210; ) alert tcp any any -> any any (msg:"Supheli Arac :PBrowse 1.4b"; content:"PBrowse 1.4b"; sid:1000211; ) alert tcp any any -> any any (msg:"Supheli Arac :Rumours-Agent"; content:"Rumours-Agent"; sid:1000212; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; EARTHCOM/2.2; +http://enter4u.eu)"; content:"Mozilla/5.0 (compatible; EARTHCOM/2.2; +http://enter4u.eu)"; sid:1000213; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.3 (ltaa_web_crawler@groupes.epfl.ch)"; content:"larbin_2.6.3 (ltaa_web_crawler@groupes.epfl.ch)"; sid:1000214; ) alert tcp any any -> any any (msg:"Supheli Arac :PigeonBot1.0 BETA"; content:"PigeonBot1.0 BETA"; sid:1000215; ) alert tcp any any -> any any (msg:"Supheli Arac :User-Agent: Mozilla/4.0 (SKIZZLE! Distributed Internet Spider v1.0 - www.SKIZZLE.com)"; content:"User-Agent: Mozilla/4.0 (SKIZZLE! Distributed Internet Spider v1.0 - www.SKIZZLE.com)"; sid:1000216; ) alert tcp any any -> any any (msg:"Supheli Arac :Asahina-Antenna/1.x"; content:"Asahina-Antenna/1.x"; sid:1000217; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.0.1) Gecko/20030306 Camino/0.7"; content:"Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.0.1) Gecko/20030306 Camino/0.7"; sid:1000218; ) alert tcp any any -> any any (msg:"Supheli Arac :Pompos/1.x pompos@iliad.fr"; content:"Pompos/1.x pompos@iliad.fr"; sid:1000219; ) alert tcp any any -> any any (msg:"Supheli Arac :Y!J/1.0 (http://help.yahoo.co.jp/help/jp/search/indexing/indexing-15.html)"; content:"Y!J/1.0 (http://help.yahoo.co.jp/help/jp/search/indexing/indexing-15.html)"; sid:1000220; ) alert tcp any any -> any any (msg:"Supheli Arac :Flexum spider"; content:"Flexum spider"; sid:1000221; ) alert tcp any any -> any any (msg:"Supheli Arac :sohu agent"; content:"sohu agent"; sid:1000222; ) alert tcp any any -> any any (msg:"Supheli Arac :NetZippy"; content:"NetZippy"; sid:1000223; ) alert tcp any any -> any any (msg:"Supheli Arac :libcurl-agent/1.0"; content:"libcurl-agent/1.0"; sid:1000224; ) alert tcp any any -> any any (msg:"Supheli Arac :MSRBOT (http://research.microsoft.com/research/sv/msrbot)"; content:"MSRBOT (http://research.microsoft.com/research/sv/msrbot)"; sid:1000225; ) alert tcp any any -> any any (msg:"Supheli Arac :EmailSiphon"; content:"EmailSiphon"; sid:1000226; ) alert tcp any any -> any any (msg:"Supheli Arac :teomaagent crawler-admin@teoma.com"; content:"teomaagent crawler-admin@teoma.com"; sid:1000227; ) alert tcp any any -> any any (msg:"Supheli Arac :Wildsoft Surfer"; content:"Wildsoft Surfer"; sid:1000228; ) alert tcp any any -> any any (msg:"Supheli Arac :targetblaster.com/0.9k"; content:"targetblaster.com/0.9k"; sid:1000229; ) alert tcp any any -> any any (msg:"Supheli Arac :hbtronix.spider.2 -- http://hbtronix.de/spider.php"; content:"hbtronix.spider.2 -- http://hbtronix.de/spider.php"; sid:1000230; ) alert tcp any any -> any any (msg:"Supheli Arac :Faxobot/1.0"; content:"Faxobot/1.0"; sid:1000231; ) alert tcp any any -> any any (msg:"Supheli Arac :4anything.com LinkChecker v2.0"; content:"4anything.com LinkChecker v2.0"; sid:1000232; ) alert tcp any any -> any any (msg:"Supheli Arac :NASA Search 1.0"; content:"NASA Search 1.0"; sid:1000233; ) alert tcp any any -> any any (msg:"Supheli Arac :JetBrains Omea Reader 2.0 Release Candidate 1 (http://www.jetbrains.com/omea_reader/)"; content:"JetBrains Omea Reader 2.0 Release Candidate 1 (http://www.jetbrains.com/omea_reader/)"; sid:1000234; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://www.changedetection.com/bot.html )"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://www.changedetection.com/bot.html )"; sid:1000235; ) alert tcp any any -> any any (msg:"Supheli Arac :schwarzmann.biz-Spider_for_paddel.org+(http://www.innerprise.net/usp-spider.asp)"; content:"schwarzmann.biz-Spider_for_paddel.org+(http://www.innerprise.net/usp-spider.asp)"; sid:1000236; ) alert tcp any any -> any any (msg:"Supheli Arac :Teleport Pro/1.2x(.1xxx)"; content:"Teleport Pro/1.2x(.1xxx)"; sid:1000237; ) alert tcp any any -> any any (msg:"Supheli Arac :DocZilla/1.0 (Windows; U; WinNT4.0; en-US; rv:1.0.0) Gecko/20020804"; content:"DocZilla/1.0 (Windows; U; WinNT4.0; en-US; rv:1.0.0) Gecko/20020804"; sid:1000238; ) alert tcp any any -> any any (msg:"Supheli Arac :HTMLParser/1.x"; content:"HTMLParser/1.x"; sid:1000239; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Slurp/cat; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; content:"Mozilla/5.0 (Slurp/cat; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; sid:1000240; ) alert tcp any any -> any any (msg:"Supheli Arac :POE-Component-Client-HTTP/0.64 (perl; N; POE; en; rv:0.640000)"; content:"POE-Component-Client-HTTP/0.64 (perl; N; POE; en; rv:0.640000)"; sid:1000241; ) alert tcp any any -> any any (msg:"Supheli Arac :mogimogi/1.0"; content:"mogimogi/1.0"; sid:1000242; ) alert tcp any any -> any any (msg:"Supheli Arac :dodgebot/experimental"; content:"dodgebot/experimental"; sid:1000243; ) alert tcp any any -> any any (msg:"Supheli Arac :NutchCVS/0.0x-dev (Nutch; http://www.nutch.org/docs/bot.html; nutch-agent@lists.sourceforge.net)"; content:"NutchCVS/0.0x-dev (Nutch; http://www.nutch.org/docs/bot.html; nutch-agent@lists.sourceforge.net)"; sid:1000244; ) alert tcp any any -> any any (msg:"Supheli Arac :Wusage/x.0@boutell.com"; content:"Wusage/x.0@boutell.com"; sid:1000245; ) alert tcp any any -> any any (msg:"Supheli Arac :LibertyW (+http://www.lw01.com)"; content:"LibertyW (+http://www.lw01.com)"; sid:1000246; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Vagabondo/4.0Beta; webcrawler at wise-guys dot nl; http://webagent.wise-guys.nl/)"; content:"Mozilla/4.0 (compatible; Vagabondo/4.0Beta; webcrawler at wise-guys dot nl; http://webagent.wise-guys.nl/)"; sid:1000247; ) alert tcp any any -> any any (msg:"Supheli Arac :factbot : http://www.factbites.com/robots"; content:"factbot : http://www.factbites.com/robots"; sid:1000248; ) alert tcp any any -> any any (msg:"Supheli Arac :BaiDuSpider"; content:"BaiDuSpider"; sid:1000249; ) alert tcp any any -> any any (msg:"Supheli Arac :Hippias/0.9 Beta"; content:"Hippias/0.9 Beta"; sid:1000250; ) alert tcp any any -> any any (msg:"Supheli Arac :portalmmm/2.0 S500i(c20;TB)"; content:"portalmmm/2.0 S500i(c20;TB)"; sid:1000251; ) alert tcp any any -> any any (msg:"Supheli Arac :MyGetRight/1.0.0"; content:"MyGetRight/1.0.0"; sid:1000252; ) alert tcp any any -> any any (msg:"Supheli Arac :TECOMAC-Crawler/0.x"; content:"TECOMAC-Crawler/0.x"; sid:1000253; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.5.0-200506231921 http://pandora.nla.gov.au/crawl.html)"; content:"Mozilla/5.0 (compatible; heritrix/1.5.0-200506231921 http://pandora.nla.gov.au/crawl.html)"; sid:1000254; ) alert tcp any any -> any any (msg:"Supheli Arac :GetRightPro/6.0beta2"; content:"GetRightPro/6.0beta2"; sid:1000255; ) alert tcp any any -> any any (msg:"Supheli Arac :webcollage/1.xx"; content:"webcollage/1.xx"; sid:1000256; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 NAVIO_AOLTV (11; 13; Philips; PH200; 1; R2.0C36_AOL.0110OPTIK; R2.0.0139d_OPTIK)"; content:"Mozilla/3.0 NAVIO_AOLTV (11; 13; Philips; PH200; 1; R2.0C36_AOL.0110OPTIK; R2.0.0139d_OPTIK)"; sid:1000257; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; Web Link Validator 2.x)Web Link Validator http://www.relsoftware.com/ link validation software"; content:"Mozilla/3.0 (compatible; Web Link Validator 2.x)Web Link Validator http://www.relsoftware.com/ link validation software"; sid:1000258; ) alert tcp any any -> any any (msg:"Supheli Arac :SimpleFavPanel/1.2"; content:"SimpleFavPanel/1.2"; sid:1000259; ) alert tcp any any -> any any (msg:"Supheli Arac :LetsCrawl.com/1.0 +http://letscrawl.com/"; content:"LetsCrawl.com/1.0 +http://letscrawl.com/"; sid:1000260; ) alert tcp any any -> any any (msg:"Supheli Arac :SuperBot/x.x.x.xx (Windows XP)"; content:"SuperBot/x.x.x.xx (Windows XP)"; sid:1000261; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; WebCapture x.x; Auto; Windows)"; content:"Mozilla/3.0 (compatible; WebCapture x.x; Auto; Windows)"; sid:1000262; ) alert tcp any any -> any any (msg:"Supheli Arac :versus crawler eda.baykan@epfl.ch"; content:"versus crawler eda.baykan@epfl.ch"; sid:1000263; ) alert tcp any any -> any any (msg:"Supheli Arac :BuildCMS crawler (http://www.buildcms.com/crawler)"; content:"BuildCMS crawler (http://www.buildcms.com/crawler)"; sid:1000264; ) alert tcp any any -> any any (msg:"Supheli Arac :Felix - Mixcat Crawler (+http://mixcat.com)"; content:"Felix - Mixcat Crawler (+http://mixcat.com)"; sid:1000265; ) alert tcp any any -> any any (msg:"Supheli Arac :pavuk/0.9pl29b i686-pc-linux-gnu"; content:"pavuk/0.9pl29b i686-pc-linux-gnu"; sid:1000266; ) alert tcp any any -> any any (msg:"Supheli Arac :Suchknecht.at-Robot"; content:"Suchknecht.at-Robot"; sid:1000267; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.0; Windows NT; Site Server 3.0 Robot) Indonesia Interactive"; content:"Mozilla/4.0 (compatible; MSIE 4.0; Windows NT; Site Server 3.0 Robot) Indonesia Interactive"; sid:1000268; ) alert tcp any any -> any any (msg:"Supheli Arac :LocalBot/1.0 ( http://www.localbot.co.uk/)"; content:"LocalBot/1.0 ( http://www.localbot.co.uk/)"; sid:1000269; ) alert tcp any any -> any any (msg:"Supheli Arac :Firefox_1.0.6 (kasparek@naparek.cz)"; content:"Firefox_1.0.6 (kasparek@naparek.cz)"; sid:1000270; ) alert tcp any any -> any any (msg:"Supheli Arac :Bulkfeeds/r1752 (http://bulkfeeds.net/)"; content:"Bulkfeeds/r1752 (http://bulkfeeds.net/)"; sid:1000271; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; NetPromoter Spider;http://www.net-promoter.com/)"; content:"Mozilla/4.0 (compatible; NetPromoter Spider;http://www.net-promoter.com/)"; sid:1000272; ) alert tcp any any -> any any (msg:"Supheli Arac :IlTrovatore/1.2 (IlTrovatore; http://www.iltrovatore.it/bot.html; bot@iltrovatore.it)"; content:"IlTrovatore/1.2 (IlTrovatore; http://www.iltrovatore.it/bot.html; bot@iltrovatore.it)"; sid:1000273; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0)"; content:"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0)"; sid:1000274; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler/6.4 (helpdesk at fast.no)"; content:"FAST Enterprise Crawler/6.4 (helpdesk at fast.no)"; sid:1000275; ) alert tcp any any -> any any (msg:"Supheli Arac :Lynx/2.6 libwww-FM/2.14"; content:"Lynx/2.6 libwww-FM/2.14"; sid:1000276; ) alert tcp any any -> any any (msg:"Supheli Arac :EmailSpider"; content:"EmailSpider"; sid:1000277; ) alert tcp any any -> any any (msg:"Supheli Arac :Toutatis x.x-x"; content:"Toutatis x.x-x"; sid:1000278; ) alert tcp any any -> any any (msg:"Supheli Arac :Offline Explorer 1.*"; content:"Offline Explorer 1.*"; sid:1000279; ) alert tcp any any -> any any (msg:"Supheli Arac :lawinfo-crawler/Nutch-0.9-dev (Crawler for lawinfo.com pages; http://www.lawinfo.com; webmaster@lawinfo.com)"; content:"lawinfo-crawler/Nutch-0.9-dev (Crawler for lawinfo.com pages; http://www.lawinfo.com; webmaster@lawinfo.com)"; sid:1000280; ) alert tcp any any -> any any (msg:"Supheli Arac :!Susie (http://www.sync2it.com/susie)"; content:"!Susie (http://www.sync2it.com/susie)"; sid:1000281; ) alert tcp any any -> any any (msg:"Supheli Arac :DoCoMo/2.0 SH902i (compatible; Y!J-SRD/1.0; http://help.yahoo.co.jp/help/jp/search/indexing/indexing-27.html)"; content:"DoCoMo/2.0 SH902i (compatible; Y!J-SRD/1.0; http://help.yahoo.co.jp/help/jp/search/indexing/indexing-27.html)"; sid:1000282; ) alert tcp any any -> any any (msg:"Supheli Arac :Tutorial Crawler 1.4 (http://www.tutorgig.com/crawler)"; content:"Tutorial Crawler 1.4 (http://www.tutorgig.com/crawler)"; sid:1000283; ) alert tcp any any -> any any (msg:"Supheli Arac :MSNPTC/1.0"; content:"MSNPTC/1.0"; sid:1000284; ) alert tcp any any -> any any (msg:"Supheli Arac :Exabot/2.0"; content:"Exabot/2.0"; sid:1000285; ) alert tcp any any -> any any (msg:"Supheli Arac :Exabot/3.0"; content:"Exabot/3.0"; sid:1000286; ) alert tcp any any -> any any (msg:"Supheli Arac :ScholarUniverse/0.8 (Nutch;+http://scholaruniverse.com/bot.jsp; fetch-agent@scholaruniverse.com)"; content:"ScholarUniverse/0.8 (Nutch;+http://scholaruniverse.com/bot.jsp; fetch-agent@scholaruniverse.com)"; sid:1000287; ) alert tcp any any -> any any (msg:"Supheli Arac :CCBot/1.0 (+http://www.commoncrawl.org/bot.html)"; content:"CCBot/1.0 (+http://www.commoncrawl.org/bot.html)"; sid:1000288; ) alert tcp any any -> any any (msg:"Supheli Arac :Drecombot/1.0 (http://career.drecom.jp/bot.html)"; content:"Drecombot/1.0 (http://career.drecom.jp/bot.html)"; sid:1000289; ) alert tcp any any -> any any (msg:"Supheli Arac :Jabot/6.x (http://odin.ingrid.org/)"; content:"Jabot/6.x (http://odin.ingrid.org/)"; sid:1000290; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/2.2.10 (Multimedia Search) (crawler@fast.no; http://www.fast.no/faq/faqfastwebsearch/faqfastwebcrawler.html)"; content:"FAST-WebCrawler/2.2.10 (Multimedia Search) (crawler@fast.no; http://www.fast.no/faq/faqfastwebsearch/faqfastwebcrawler.html)"; sid:1000291; ) alert tcp any any -> any any (msg:"Supheli Arac :Jeode/1.x.x"; content:"Jeode/1.x.x"; sid:1000292; ) alert tcp any any -> any any (msg:"Supheli Arac :Firefly/1.0 (compatible; Mozilla 4.0; MSIE 5.5)"; content:"Firefly/1.0 (compatible; Mozilla 4.0; MSIE 5.5)"; sid:1000293; ) alert tcp any any -> any any (msg:"Supheli Arac :NavissoBot"; content:"NavissoBot"; sid:1000294; ) alert tcp any any -> any any (msg:"Supheli Arac :ask.24x.info"; content:"ask.24x.info"; sid:1000295; ) alert tcp any any -> any any (msg:"Supheli Arac :Squid-Prefetch"; content:"Squid-Prefetch"; sid:1000296; ) alert tcp any any -> any any (msg:"Supheli Arac :WebSearchBench WebCrawler v0.1(Experimental)"; content:"WebSearchBench WebCrawler v0.1(Experimental)"; sid:1000297; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QihooBot 1.0 qihoobot@qihoo.net)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QihooBot 1.0 qihoobot@qihoo.net)"; sid:1000298; ) alert tcp any any -> any any (msg:"Supheli Arac :ZBot/1.00 (icaulfield@zeus.com)"; content:"ZBot/1.00 (icaulfield@zeus.com)"; sid:1000299; ) alert tcp any any -> any any (msg:"Supheli Arac :NokodoBot/1.x (+http://nokodo.com/bot.htm)"; content:"NokodoBot/1.x (+http://nokodo.com/bot.htm)"; sid:1000300; ) alert tcp any any -> any any (msg:"Supheli Arac :FaEdit/2.0.x"; content:"FaEdit/2.0.x"; sid:1000301; ) alert tcp any any -> any any (msg:"Supheli Arac :webster-internet.de pad browser"; content:"webster-internet.de pad browser"; sid:1000302; ) alert tcp any any -> any any (msg:"Supheli Arac :Watchfire WebXM 1.0"; content:"Watchfire WebXM 1.0"; sid:1000303; ) alert tcp any any -> any any (msg:"Supheli Arac :Shoula.com Crawler 2.0"; content:"Shoula.com Crawler 2.0"; sid:1000304; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.5.0 http://www.l3s.de/~kohlschuetter/projects/crawling/)"; content:"Mozilla/5.0 (compatible; heritrix/1.5.0 http://www.l3s.de/~kohlschuetter/projects/crawling/)"; sid:1000305; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; Vonna.com b o t)"; content:"Mozilla/4.0 (compatible; MSIE 4.01; Vonna.com b o t)"; sid:1000306; ) alert tcp any any -> any any (msg:"Supheli Arac :SurfMaster"; content:"SurfMaster"; sid:1000307; ) alert tcp any any -> any any (msg:"Supheli Arac :Lycos_Spider_(modspider)"; content:"Lycos_Spider_(modspider)"; sid:1000308; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; www.galaxy.com; www.psychedelix.com)"; content:"Mozilla/4.0 (compatible; MSIE 5.0; www.galaxy.com; www.psychedelix.com)"; sid:1000309; ) alert tcp any any -> any any (msg:"Supheli Arac :TAMU_CS_IRL_CRAWLER/1.0"; content:"TAMU_CS_IRL_CRAWLER/1.0"; sid:1000310; ) alert tcp any any -> any any (msg:"Supheli Arac :http://www.almaden.ibm.com/cs/crawler [wf216]"; content:"http://www.almaden.ibm.com/cs/crawler [wf216]"; sid:1000311; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkSonar/1.35"; content:"LinkSonar/1.35"; sid:1000312; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Konqueror/2.2.2)"; content:"Mozilla/5.0 (compatible; Konqueror/2.2.2)"; sid:1000313; ) alert tcp any any -> any any (msg:"Supheli Arac :GoForIt.com"; content:"GoForIt.com"; sid:1000314; ) alert tcp any any -> any any (msg:"Supheli Arac :SearchExpress Spider0.99"; content:"SearchExpress Spider0.99"; sid:1000315; ) alert tcp any any -> any any (msg:"Supheli Arac :LNSpiderguy"; content:"LNSpiderguy"; sid:1000316; ) alert tcp any any -> any any (msg:"Supheli Arac :nabot_1.0"; content:"nabot_1.0"; sid:1000317; ) alert tcp any any -> any any (msg:"Supheli Arac :Anonymizer/1.1"; content:"Anonymizer/1.1"; sid:1000318; ) alert tcp any any -> any any (msg:"Supheli Arac :WebarooBot (Webaroo Bot; http://www.webaroo.com/rooSiteOwners.html)"; content:"WebarooBot (Webaroo Bot; http://www.webaroo.com/rooSiteOwners.html)"; sid:1000319; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.0 (larbin2.6.0@unspecified.mail)"; content:"larbin_2.6.0 (larbin2.6.0@unspecified.mail)"; sid:1000320; ) alert tcp any any -> any any (msg:"Supheli Arac :SapphireWebCrawler/Nutch-1.0-dev (Sapphire Web Crawler using Nutch; http://boston.lti.cs.cmu.edu/crawler/; mhoy@cs.cmu.edu)"; content:"SapphireWebCrawler/Nutch-1.0-dev (Sapphire Web Crawler using Nutch; http://boston.lti.cs.cmu.edu/crawler/; mhoy@cs.cmu.edu)"; sid:1000321; ) alert tcp any any -> any any (msg:"Supheli Arac :Openbot/3.0+(robot-response@openfind.com.tw;+http://www.openfind.com.tw/robot.html)"; content:"Openbot/3.0+(robot-response@openfind.com.tw;+http://www.openfind.com.tw/robot.html)"; sid:1000322; ) alert tcp any any -> any any (msg:"Supheli Arac :URL_Spider_Pro/x.x+(http://www.innerprise.net/usp-spider.asp)"; content:"URL_Spider_Pro/x.x+(http://www.innerprise.net/usp-spider.asp)"; sid:1000323; ) alert tcp any any -> any any (msg:"Supheli Arac :BilgiBot/1.0(beta) (http://www.bilgi.com/; bilgi at bilgi dot com)"; content:"BilgiBot/1.0(beta) (http://www.bilgi.com/; bilgi at bilgi dot com)"; sid:1000324; ) alert tcp any any -> any any (msg:"Supheli Arac :Cyberdog/2.0 (Macintosh; 68k)"; content:"Cyberdog/2.0 (Macintosh; 68k)"; sid:1000325; ) alert tcp any any -> any any (msg:"Supheli Arac :ZeBot_www.ze.bz (ze.bz@hotmail.com)"; content:"ZeBot_www.ze.bz (ze.bz@hotmail.com)"; sid:1000326; ) alert tcp any any -> any any (msg:"Supheli Arac :Oracle Application Server Web Cache 10g"; content:"Oracle Application Server Web Cache 10g"; sid:1000327; ) alert tcp any any -> any any (msg:"Supheli Arac :infoConveraCrawler/0.8 ( http://www.authoritativeweb.com/crawl)"; content:"infoConveraCrawler/0.8 ( http://www.authoritativeweb.com/crawl)"; sid:1000328; ) alert tcp any any -> any any (msg:"Supheli Arac :CheckLinks/1.x.x"; content:"CheckLinks/1.x.x"; sid:1000329; ) alert tcp any any -> any any (msg:"Supheli Arac :eseek-larbin_2.6.2 (crawler@exactseek.com)"; content:"eseek-larbin_2.6.2 (crawler@exactseek.com)"; sid:1000330; ) alert tcp any any -> any any (msg:"Supheli Arac :psycheclone"; content:"psycheclone"; sid:1000331; ) alert tcp any any -> any any (msg:"Supheli Arac :Web Snooper"; content:"Web Snooper"; sid:1000332; ) alert tcp any any -> any any (msg:"Supheli Arac :ShablastBot 1.0"; content:"ShablastBot 1.0"; sid:1000333; ) alert tcp any any -> any any (msg:"Supheli Arac :Snoopy_v0.xx"; content:"Snoopy_v0.xx"; sid:1000334; ) alert tcp any any -> any any (msg:"Supheli Arac :LTI/LemurProject Nutch Spider/Nutch-1.0-dev (Research spider using Nutch; http://www.lemurproject.org; mhoy@cs.cmu.edu)"; content:"LTI/LemurProject Nutch Spider/Nutch-1.0-dev (Research spider using Nutch; http://www.lemurproject.org; mhoy@cs.cmu.edu)"; sid:1000335; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Slurp/cat; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; content:"Mozilla/3.0 (Slurp/cat; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; sid:1000336; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.4.0 +http://www.chepi.net)"; content:"Mozilla/5.0 (compatible; heritrix/1.4.0 +http://www.chepi.net)"; sid:1000337; ) alert tcp any any -> any any (msg:"Supheli Arac :gigabaz/3.1x (baz@gigabaz.com; http://gigabaz.com/gigabaz/)"; content:"gigabaz/3.1x (baz@gigabaz.com; http://gigabaz.com/gigabaz/)"; sid:1000338; ) alert tcp any any -> any any (msg:"Supheli Arac :Sleipnir Version2.x"; content:"Sleipnir Version2.x"; sid:1000339; ) alert tcp any any -> any any (msg:"Supheli Arac :Combine/x.0"; content:"Combine/x.0"; sid:1000340; ) alert tcp any any -> any any (msg:"Supheli Arac :MicrosoftPrototypeCrawler (How's my crawling? mailto:newbiecrawler@hotmail.com)"; content:"MicrosoftPrototypeCrawler (How's my crawling? mailto:newbiecrawler@hotmail.com)"; sid:1000341; ) alert tcp any any -> any any (msg:"Supheli Arac :Octopus"; content:"Octopus"; sid:1000342; ) alert tcp any any -> any any (msg:"Supheli Arac :MQBOT/Nutch-0.9-dev (MQBOT Nutch Crawler; http://falcon.cs.uiuc.edu; mqbot@cs.uiuc.edu)"; content:"MQBOT/Nutch-0.9-dev (MQBOT Nutch Crawler; http://falcon.cs.uiuc.edu; mqbot@cs.uiuc.edu)"; sid:1000343; ) alert tcp any any -> any any (msg:"Supheli Arac :CJ Spider/"; content:"CJ Spider/"; sid:1000344; ) alert tcp any any -> any any (msg:"Supheli Arac :Wget/1.x(.x)GNU wget http://www.gnu.org/software/wget/wget.html - file downloader"; content:"Wget/1.x(.x)GNU wget http://www.gnu.org/software/wget/wget.html - file downloader"; sid:1000345; ) alert tcp any any -> any any (msg:"Supheli Arac :Verticrawlbot"; content:"Verticrawlbot"; sid:1000346; ) alert tcp any any -> any any (msg:"Supheli Arac :iltrovatore-setaccio/1.2-dev (spidering; http://www.iltrovatore.it/aiuto/.....)"; content:"iltrovatore-setaccio/1.2-dev (spidering; http://www.iltrovatore.it/aiuto/.....)"; sid:1000347; ) alert tcp any any -> any any (msg:"Supheli Arac :TygoProwler"; content:"TygoProwler"; sid:1000348; ) alert tcp any any -> any any (msg:"Supheli Arac :Lunascape"; content:"Lunascape"; sid:1000349; ) alert tcp any any -> any any (msg:"Supheli Arac :Dumbot(version 0.1 beta - dumbfind.com)"; content:"Dumbot(version 0.1 beta - dumbfind.com)"; sid:1000350; ) alert tcp any any -> any any (msg:"Supheli Arac :GeoBot/1.0"; content:"GeoBot/1.0"; sid:1000351; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; ShunixBot/1.x.x +http://www.shunix.com/robot.htm)"; content:"Mozilla/5.0 (compatible; ShunixBot/1.x.x +http://www.shunix.com/robot.htm)"; sid:1000352; ) alert tcp any any -> any any (msg:"Supheli Arac :SBIder/0.8-dev (SBIder; http://www.sitesell.com/sbider.html; http://support.sitesell.com/contact-support.html)"; content:"SBIder/0.8-dev (SBIder; http://www.sitesell.com/sbider.html; http://support.sitesell.com/contact-support.html)"; sid:1000353; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; T-H-U-N-D-E-R-S-T-O-N-E)"; content:"Mozilla/2.0 (compatible; T-H-U-N-D-E-R-S-T-O-N-E)"; sid:1000354; ) alert tcp any any -> any any (msg:"Supheli Arac :Waypath Scout v2.x - info at waypath dot com"; content:"Waypath Scout v2.x - info at waypath dot com"; sid:1000355; ) alert tcp any any -> any any (msg:"Supheli Arac :NG/4.0.1229"; content:"NG/4.0.1229"; sid:1000356; ) alert tcp any any -> any any (msg:"Supheli Arac :SyncIT/x.x"; content:"SyncIT/x.x"; sid:1000357; ) alert tcp any any -> any any (msg:"Supheli Arac :MetaGer_PreChecker0.1"; content:"MetaGer_PreChecker0.1"; sid:1000358; ) alert tcp any any -> any any (msg:"Supheli Arac :Mag-Net"; content:"Mag-Net"; sid:1000359; ) alert tcp any any -> any any (msg:"Supheli Arac :Gigabot/3.0 (http://www.gigablast.com/spider.html)"; content:"Gigabot/3.0 (http://www.gigablast.com/spider.html)"; sid:1000360; ) alert tcp any any -> any any (msg:"Supheli Arac :page_verifier (http://www.securecomputing.com/goto/pv)"; content:"page_verifier (http://www.securecomputing.com/goto/pv)"; sid:1000361; ) alert tcp any any -> any any (msg:"Supheli Arac :PRCrawler/Nutch-0.9 (data mining development project; crawler@projectrialto.com)"; content:"PRCrawler/Nutch-0.9 (data mining development project; crawler@projectrialto.com)"; sid:1000362; ) alert tcp any any -> any any (msg:"Supheli Arac :URI::Fetch/0.06"; content:"URI::Fetch/0.06"; sid:1000363; ) alert tcp any any -> any any (msg:"Supheli Arac :Firefly/1.0"; content:"Firefly/1.0"; sid:1000364; ) alert tcp any any -> any any (msg:"Supheli Arac :Feedjit Favicon Crawler 1.0"; content:"Feedjit Favicon Crawler 1.0"; sid:1000365; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla (Mozilla@somewhere.com)"; content:"Mozilla (Mozilla@somewhere.com)"; sid:1000366; ) alert tcp any any -> any any (msg:"Supheli Arac :AcoiRobot"; content:"AcoiRobot"; sid:1000367; ) alert tcp any any -> any any (msg:"Supheli Arac :AlkalineBOT/1.3"; content:"AlkalineBOT/1.3"; sid:1000368; ) alert tcp any any -> any any (msg:"Supheli Arac :Gaisbot/3.0+(robot06@gais.cs.ccu.edu.tw;+http://gais.cs.ccu.edu.tw/robot.php)"; content:"Gaisbot/3.0+(robot06@gais.cs.ccu.edu.tw;+http://gais.cs.ccu.edu.tw/robot.php)"; sid:1000369; ) alert tcp any any -> any any (msg:"Supheli Arac :MantraAgent"; content:"MantraAgent"; sid:1000370; ) alert tcp any any -> any any (msg:"Supheli Arac :suzuran"; content:"suzuran"; sid:1000371; ) alert tcp any any -> any any (msg:"Supheli Arac :searchbot admin@google.com"; content:"searchbot admin@google.com"; sid:1000372; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; Fluffy the spider; http://www.searchhippo.com/; info@searchhippo.com)"; content:"Mozilla/3.0 (compatible; Fluffy the spider; http://www.searchhippo.com/; info@searchhippo.com)"; sid:1000373; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; www.galaxy.com; www.psychedelix.com/; http://www.galaxy.com/info/crawler.html)"; content:"Mozilla/4.0 (compatible; MSIE 5.0; www.galaxy.com; www.psychedelix.com/; http://www.galaxy.com/info/crawler.html)"; sid:1000374; ) alert tcp any any -> any any (msg:"Supheli Arac :CJB.NET Proxy"; content:"CJB.NET Proxy"; sid:1000375; ) alert tcp any any -> any any (msg:"Supheli Arac :lanshanbot/1.0 (+http://search.msn.com/msnbot.htm)"; content:"lanshanbot/1.0 (+http://search.msn.com/msnbot.htm)"; sid:1000376; ) alert tcp any any -> any any (msg:"Supheli Arac :NICO/1.0"; content:"NICO/1.0"; sid:1000377; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.5 RPT-HTTPClient/0.3-2"; content:"Mozilla/4.5 RPT-HTTPClient/0.3-2"; sid:1000378; ) alert tcp any any -> any any (msg:"Supheli Arac :Pizilla++ ver 2.45"; content:"Pizilla++ ver 2.45"; sid:1000379; ) alert tcp any any -> any any (msg:"Supheli Arac :antibot-V1.1.5/i586-linux-2.2"; content:"antibot-V1.1.5/i586-linux-2.2"; sid:1000380; ) alert tcp any any -> any any (msg:"Supheli Arac :My WinHTTP Connection"; content:"My WinHTTP Connection"; sid:1000381; ) alert tcp any any -> any any (msg:"Supheli Arac :Akregator/1.2.9; librss/remnants"; content:"Akregator/1.2.9; librss/remnants"; sid:1000382; ) alert tcp any any -> any any (msg:"Supheli Arac :CrocCrawler vx.3 [en] (http://www.croccrawler.com) (X11; I; Linux 2.0.44 i686)"; content:"CrocCrawler vx.3 [en] (http://www.croccrawler.com) (X11; I; Linux 2.0.44 i686)"; sid:1000383; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler 6 used by FAST (FAST)"; content:"FAST Enterprise Crawler 6 used by FAST (FAST)"; sid:1000384; ) alert tcp any any -> any any (msg:"Supheli Arac :YottaShopping_Bot/4.12 (+http://www.yottashopping.com) Shopping Search Engine"; content:"YottaShopping_Bot/4.12 (+http://www.yottashopping.com) Shopping Search Engine"; sid:1000385; ) alert tcp any any -> any any (msg:"Supheli Arac :holmes/3.11 (http://morfeo.centrum.cz/bot)"; content:"holmes/3.11 (http://morfeo.centrum.cz/bot)"; sid:1000386; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Deepnet Explorer)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Deepnet Explorer)"; sid:1000387; ) alert tcp any any -> any any (msg:"Supheli Arac :Dr.Web (R) online scanner: http://online.drweb.com/"; content:"Dr.Web (R) online scanner: http://online.drweb.com/"; sid:1000388; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461) RPT-HTTPClient/0.3-3E"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461) RPT-HTTPClient/0.3-3E"; sid:1000389; ) alert tcp any any -> any any (msg:"Supheli Arac :Pockey-GetHTML/x.xx"; content:"Pockey-GetHTML/x.xx"; sid:1000390; ) alert tcp any any -> any any (msg:"Supheli Arac :Trailfire-bot/0.7.1 (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"; content:"Trailfire-bot/0.7.1 (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"; sid:1000391; ) alert tcp any any -> any any (msg:"Supheli Arac :AbachoBOT (Mozilla compatible)"; content:"AbachoBOT (Mozilla compatible)"; sid:1000392; ) alert tcp any any -> any any (msg:"Supheli Arac :CreativeCommons/0.06-dev (Nutch; http://www.nutch.org/docs/en/bot.html; nutch-agent@lists.sourceforge.net)"; content:"CreativeCommons/0.06-dev (Nutch; http://www.nutch.org/docs/en/bot.html; nutch-agent@lists.sourceforge.net)"; sid:1000393; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 WebTV/1.2 (compatible; MSIE 2.0)"; content:"Mozilla/3.0 WebTV/1.2 (compatible; MSIE 2.0)"; sid:1000394; ) alert tcp any any -> any any (msg:"Supheli Arac :WordChampBot"; content:"WordChampBot"; sid:1000395; ) alert tcp any any -> any any (msg:"Supheli Arac :DataparkSearch/4.xx (http://www.dataparksearch.org/)"; content:"DataparkSearch/4.xx (http://www.dataparksearch.org/)"; sid:1000396; ) alert tcp any any -> any any (msg:"Supheli Arac :MSNBOT/0.xx (http://search.msn.com/msnbot.htm)"; content:"MSNBOT/0.xx (http://search.msn.com/msnbot.htm)"; sid:1000397; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2b) Gecko/20021007 Phoenix/0.3"; content:"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2b) Gecko/20021007 Phoenix/0.3"; sid:1000398; ) alert tcp any any -> any any (msg:"Supheli Arac :KnowItAll(knowitall@cs.washington.edu)"; content:"KnowItAll(knowitall@cs.washington.edu)"; sid:1000399; ) alert tcp any any -> any any (msg:"Supheli Arac :Mackster( http://www.ukwizz.com )"; content:"Mackster( http://www.ukwizz.com )"; sid:1000400; ) alert tcp any any -> any any (msg:"Supheli Arac :Crawler (cometsearch@cometsystems.com)"; content:"Crawler (cometsearch@cometsystems.com)"; sid:1000401; ) alert tcp any any -> any any (msg:"Supheli Arac :PrivacyFinder/1.1"; content:"PrivacyFinder/1.1"; sid:1000402; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.05 [en] (X11; I; SunOS 4.1.4 sun4m)"; content:"Mozilla/4.05 [en] (X11; I; SunOS 4.1.4 sun4m)"; sid:1000403; ) alert tcp any any -> any any (msg:"Supheli Arac :ImageVisu/v4.x.x"; content:"ImageVisu/v4.x.x"; sid:1000404; ) alert tcp any any -> any any (msg:"Supheli Arac :lanshanbot/1.0"; content:"lanshanbot/1.0"; sid:1000405; ) alert tcp any any -> any any (msg:"Supheli Arac :Googlebot/2.1 ( http://www.google.com/bot.html)"; content:"Googlebot/2.1 ( http://www.google.com/bot.html)"; sid:1000406; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; DnloadMage 1.0)"; content:"Mozilla/4.0 (compatible; DnloadMage 1.0)"; sid:1000407; ) alert tcp any any -> any any (msg:"Supheli Arac :TargetYourNews.com bot"; content:"TargetYourNews.com bot"; sid:1000408; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Konqueror/2.1.1; X11)"; content:"Mozilla/5.0 (compatible; Konqueror/2.1.1; X11)"; sid:1000409; ) alert tcp any any -> any any (msg:"Supheli Arac :Cancer Information and Support International;"; content:"Cancer Information and Support International;"; sid:1000410; ) alert tcp any any -> any any (msg:"Supheli Arac :DevComponents.com HtmlDocument Object"; content:"DevComponents.com HtmlDocument Object"; sid:1000411; ) alert tcp any any -> any any (msg:"Supheli Arac :Gigabot/x.0"; content:"Gigabot/x.0"; sid:1000412; ) alert tcp any any -> any any (msg:"Supheli Arac :yacy (www.yacy.net; v20040602; i386 Linux 2.4.26-gentoo-r13; java 1.4.2_06; MET/en)"; content:"yacy (www.yacy.net; v20040602; i386 Linux 2.4.26-gentoo-r13; java 1.4.2_06; MET/en)"; sid:1000413; ) alert tcp any any -> any any (msg:"Supheli Arac :DoCoMo/2.0/SO502i (compatible; Y!J-SRD/1.0; http://help.yahoo.co.jp/help/jp/search/indexing/indexing-27.html)"; content:"DoCoMo/2.0/SO502i (compatible; Y!J-SRD/1.0; http://help.yahoo.co.jp/help/jp/search/indexing/indexing-27.html)"; sid:1000414; ) alert tcp any any -> any any (msg:"Supheli Arac :Willow Internet Crawler by Twotrees V2.1"; content:"Willow Internet Crawler by Twotrees V2.1"; sid:1000415; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.x Multimedia"; content:"FAST-WebCrawler/3.x Multimedia"; sid:1000416; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.2.0 (crawl@compete.com)"; content:"larbin_2.2.0 (crawl@compete.com)"; sid:1000417; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)"; sid:1000418; ) alert tcp any any -> any any (msg:"Supheli Arac :sogou spider"; content:"sogou spider"; sid:1000419; ) alert tcp any any -> any any (msg:"Supheli Arac :RSSOwl/1.2.4 Preview Release 2007-04-15 (Windows; U; zhtw)"; content:"RSSOwl/1.2.4 Preview Release 2007-04-15 (Windows; U; zhtw)"; sid:1000420; ) alert tcp any any -> any any (msg:"Supheli Arac :Download Ninja 3.0"; content:"Download Ninja 3.0"; sid:1000421; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (Mozilla; http://www.mozilla.org/docs/en/bot.html; master@mozilla.com)"; content:"Mozilla/4.0 (Mozilla; http://www.mozilla.org/docs/en/bot.html; master@mozilla.com)"; sid:1000422; ) alert tcp any any -> any any (msg:"Supheli Arac :IlTrovatore-Setaccio ( http://www.iltrovatore.it)"; content:"IlTrovatore-Setaccio ( http://www.iltrovatore.it)"; sid:1000423; ) alert tcp any any -> any any (msg:"Supheli Arac :firstsbot"; content:"firstsbot"; sid:1000424; ) alert tcp any any -> any any (msg:"Supheli Arac :Pockey/x.x.x"; content:"Pockey/x.x.x"; sid:1000425; ) alert tcp any any -> any any (msg:"Supheli Arac :Cabot/Nutch-0.9 (Amfibi's web-crawling robot; http://www.amfibi.com/cabot/; agent@amfibi.com)"; content:"Cabot/Nutch-0.9 (Amfibi's web-crawling robot; http://www.amfibi.com/cabot/; agent@amfibi.com)"; sid:1000426; ) alert tcp any any -> any any (msg:"Supheli Arac :agadine/1.x.x (+http://www.agada.de)"; content:"agadine/1.x.x (+http://www.agada.de)"; sid:1000427; ) alert tcp any any -> any any (msg:"Supheli Arac :Ace Explorer"; content:"Ace Explorer"; sid:1000428; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.5) Gecko/20060731 Firefox/1.5.0.5 Flock/0.7.4.1"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.5) Gecko/20060731 Firefox/1.5.0.5 Flock/0.7.4.1"; sid:1000429; ) alert tcp any any -> any any (msg:"Supheli Arac :reciprocal links checker (http://www.recip-links.com/)"; content:"reciprocal links checker (http://www.recip-links.com/)"; sid:1000430; ) alert tcp any any -> any any (msg:"Supheli Arac :Szukacz/1.x"; content:"Szukacz/1.x"; sid:1000431; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Gecko/20070310 Mozshot/0.0.20070628; http://mozshot.nemui.org/)"; content:"Mozilla/5.0 (Gecko/20070310 Mozshot/0.0.20070628; http://mozshot.nemui.org/)"; sid:1000432; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; PWeBot/3.1; http://www.programacionweb.net/robot.php)"; content:"Mozilla/5.0 (compatible; PWeBot/3.1; http://www.programacionweb.net/robot.php)"; sid:1000433; ) alert tcp any any -> any any (msg:"Supheli Arac :WebTrends/3.0 (WinNT)"; content:"WebTrends/3.0 (WinNT)"; sid:1000434; ) alert tcp any any -> any any (msg:"Supheli Arac :NetMechanic Vx.0"; content:"NetMechanic Vx.0"; sid:1000435; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648)"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648)"; sid:1000436; ) alert tcp any any -> any any (msg:"Supheli Arac :Topodia/1.2-dev (Topodia - Crawler for HTTP content indexing; http://www.topodia.com/; support@topodia.com)"; content:"Topodia/1.2-dev (Topodia - Crawler for HTTP content indexing; http://www.topodia.com/; support@topodia.com)"; sid:1000437; ) alert tcp any any -> any any (msg:"Supheli Arac :Teoma MP"; content:"Teoma MP"; sid:1000438; ) alert tcp any any -> any any (msg:"Supheli Arac :SearchTone2.0 - IDEARE"; content:"SearchTone2.0 - IDEARE"; sid:1000439; ) alert tcp any any -> any any (msg:"Supheli Arac :Science Traveller International 1X/1.0"; content:"Science Traveller International 1X/1.0"; sid:1000440; ) alert tcp any any -> any any (msg:"Supheli Arac :OpenAcoon v4.0.x (www.openacoon.de)"; content:"OpenAcoon v4.0.x (www.openacoon.de)"; sid:1000441; ) alert tcp any any -> any any (msg:"Supheli Arac :kinjabot (http://www.kinja.com)"; content:"kinjabot (http://www.kinja.com)"; sid:1000442; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.04 (compatible; NCBrowser/2.35; ANTFresco/2.17; RISC OS-NC 5.13 Laz1UK1309)"; content:"Mozilla/3.04 (compatible; NCBrowser/2.35; ANTFresco/2.17; RISC OS-NC 5.13 Laz1UK1309)"; sid:1000443; ) alert tcp any any -> any any (msg:"Supheli Arac :rabaz (rabaz at gigabaz dot com)"; content:"rabaz (rabaz at gigabaz dot com)"; sid:1000444; ) alert tcp any any -> any any (msg:"Supheli Arac :Mercator-1.x"; content:"Mercator-1.x"; sid:1000445; ) alert tcp any any -> any any (msg:"Supheli Arac :Mercator-2.0"; content:"Mercator-2.0"; sid:1000446; ) alert tcp any any -> any any (msg:"Supheli Arac :Vision Research Lab image spider at vision.ece.ucsb.edu"; content:"Vision Research Lab image spider at vision.ece.ucsb.edu"; sid:1000447; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; IE-Favorites-Check-0.5)"; content:"Mozilla/4.0 (compatible; IE-Favorites-Check-0.5)"; sid:1000448; ) alert tcp any any -> any any (msg:"Supheli Arac :DigOut4U"; content:"DigOut4U"; sid:1000449; ) alert tcp any any -> any any (msg:"Supheli Arac :MFC_Tear_Sample"; content:"MFC_Tear_Sample"; sid:1000450; ) alert tcp any any -> any any (msg:"Supheli Arac :wume_crawler/1.1 (http://wume.cse.lehigh.edu/~xiq204/crawler/)"; content:"wume_crawler/1.1 (http://wume.cse.lehigh.edu/~xiq204/crawler/)"; sid:1000451; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; WoW Lemmings Kathune/2.0;http://www.wowlemmings.com/kathune.html)"; content:"Mozilla/5.0 (compatible; WoW Lemmings Kathune/2.0;http://www.wowlemmings.com/kathune.html)"; sid:1000452; ) alert tcp any any -> any any (msg:"Supheli Arac :Webclipping.com"; content:"Webclipping.com"; sid:1000453; ) alert tcp any any -> any any (msg:"Supheli Arac :Vagabondo/3.0 (webagent at wise-guys dot nl)"; content:"Vagabondo/3.0 (webagent at wise-guys dot nl)"; sid:1000454; ) alert tcp any any -> any any (msg:"Supheli Arac :DuckDuckBot/1.0; (+http://duckduckgo.com/duckduckbot.html)"; content:"DuckDuckBot/1.0; (+http://duckduckgo.com/duckduckbot.html)"; sid:1000455; ) alert tcp any any -> any any (msg:"Supheli Arac :User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"; content:"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"; sid:1000456; ) alert tcp any any -> any any (msg:"Supheli Arac :endo/1.0 (Mac OS X; ppc i386; http://kula.jp/endo)"; content:"endo/1.0 (Mac OS X; ppc i386; http://kula.jp/endo)"; sid:1000457; ) alert tcp any any -> any any (msg:"Supheli Arac :NetSeer/Nutch-0.9 (NetSeer Crawler; http://www.netseer.com; crawler@netseer.com)"; content:"NetSeer/Nutch-0.9 (NetSeer Crawler; http://www.netseer.com; crawler@netseer.com)"; sid:1000458; ) alert tcp any any -> any any (msg:"Supheli Arac :TurnitinBot/x.x (http://www.turnitin.com/robot/crawlerinfo.html)"; content:"TurnitinBot/x.x (http://www.turnitin.com/robot/crawlerinfo.html)"; sid:1000459; ) alert tcp any any -> any any (msg:"Supheli Arac :MFC Foundation Class Library 4.0"; content:"MFC Foundation Class Library 4.0"; sid:1000460; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.3 (crawler@fast.no; http://fast.no/support.php?c=faqs/crawler)"; content:"FAST-WebCrawler/3.3 (crawler@fast.no; http://fast.no/support.php?c=faqs/crawler)"; sid:1000461; ) alert tcp any any -> any any (msg:"Supheli Arac :Simpy/1.x (Simpy; http://www.simpy.com/?ref=bot; feedback at simpy dot com)"; content:"Simpy/1.x (Simpy; http://www.simpy.com/?ref=bot; feedback at simpy dot com)"; sid:1000462; ) alert tcp any any -> any any (msg:"Supheli Arac :NutchEC2Test/Nutch-0.9-dev (Testing Nutch on Amazon EC2.; http://lucene.apache.org/nutch/bot.html; ec2test at lucene.com)"; content:"NutchEC2Test/Nutch-0.9-dev (Testing Nutch on Amazon EC2.; http://lucene.apache.org/nutch/bot.html; ec2test at lucene.com)"; sid:1000463; ) alert tcp any any -> any any (msg:"Supheli Arac :Octora Beta - www.octora.com"; content:"Octora Beta - www.octora.com"; sid:1000464; ) alert tcp any any -> any any (msg:"Supheli Arac :yoogliFetchAgent/0.1"; content:"yoogliFetchAgent/0.1"; sid:1000465; ) alert tcp any any -> any any (msg:"Supheli Arac :Yandex/1.01.001 (compatible; Win16; I)"; content:"Yandex/1.01.001 (compatible; Win16; I)"; sid:1000466; ) alert tcp any any -> any any (msg:"Supheli Arac :webfetch/5.x.x"; content:"webfetch/5.x.x"; sid:1000467; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U;XMPP Tiscali Communicator v.10.0.1; Windows NT 5.1; it; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3"; content:"Mozilla/5.0 (Windows; U;XMPP Tiscali Communicator v.10.0.1; Windows NT 5.1; it; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3"; sid:1000468; ) alert tcp any any -> any any (msg:"Supheli Arac :Liferea/0.x.x (Linux; en_US.UTF-8; http://liferea.sf.net/)"; content:"Liferea/0.x.x (Linux; en_US.UTF-8; http://liferea.sf.net/)"; sid:1000469; ) alert tcp any any -> any any (msg:"Supheli Arac :Slurp/si (slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; content:"Slurp/si (slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; sid:1000470; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; 008/0.83; http://www.80legs.com/spider.html;) Gecko/2008032620"; content:"Mozilla/5.0 (compatible; 008/0.83; http://www.80legs.com/spider.html;) Gecko/2008032620"; sid:1000471; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; Ask Jeeves/Teoma; http://about.ask.com/en/docs/about/webmasters.shtml)"; content:"Mozilla/2.0 (compatible; Ask Jeeves/Teoma; http://about.ask.com/en/docs/about/webmasters.shtml)"; sid:1000472; ) alert tcp any any -> any any (msg:"Supheli Arac :Y!OASIS/TEST no-ad Mozilla/4.08 [en] (X11; I; FreeBSD 2.2.8-STABLE i386)"; content:"Y!OASIS/TEST no-ad Mozilla/4.08 [en] (X11; I; FreeBSD 2.2.8-STABLE i386)"; sid:1000473; ) alert tcp any any -> any any (msg:"Supheli Arac :MSNBOT_Mobile MSMOBOT Mozilla/2.0 (compatible; MSIE 4.02; Windows CE; Default)"; content:"MSNBOT_Mobile MSMOBOT Mozilla/2.0 (compatible; MSIE 4.02; Windows CE; Default)"; sid:1000474; ) alert tcp any any -> any any (msg:"Supheli Arac :plinki/0.1 (you got plinked! (thats a good thing..); http://www.plinki.com; crawl@plinki.com)"; content:"plinki/0.1 (you got plinked! (thats a good thing..); http://www.plinki.com; crawl@plinki.com)"; sid:1000475; ) alert tcp any any -> any any (msg:"Supheli Arac :ia_archiver"; content:"ia_archiver"; sid:1000476; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7 SnapPreviewBot"; content:"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7 SnapPreviewBot"; sid:1000477; ) alert tcp any any -> any any (msg:"Supheli Arac :Martini"; content:"Martini"; sid:1000478; ) alert tcp any any -> any any (msg:"Supheli Arac :Searchmee! Spider v0.98a"; content:"Searchmee! Spider v0.98a"; sid:1000479; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux 2.4.2-2 i586; en-US; m18) Gecko/20010131 Netscape6/6.01"; content:"Mozilla/5.0 (X11; U; Linux 2.4.2-2 i586; en-US; m18) Gecko/20010131 Netscape6/6.01"; sid:1000480; ) alert tcp any any -> any any (msg:"Supheli Arac :Search/1.0 (http://www.innerprise.net/es-spider.asp)"; content:"Search/1.0 (http://www.innerprise.net/es-spider.asp)"; sid:1000481; ) alert tcp any any -> any any (msg:"Supheli Arac :TJvMultiHttpGrabber Component"; content:"TJvMultiHttpGrabber Component"; sid:1000482; ) alert tcp any any -> any any (msg:"Supheli Arac :Honda-Search/0.7.2 (Nutch; http://lucene.apache.org/nutch/bot.html; search@honda-search.com)"; content:"Honda-Search/0.7.2 (Nutch; http://lucene.apache.org/nutch/bot.html; search@honda-search.com)"; sid:1000483; ) alert tcp any any -> any any (msg:"Supheli Arac :Hatena Pagetitle Agent/1.0"; content:"Hatena Pagetitle Agent/1.0"; sid:1000484; ) alert tcp any any -> any any (msg:"Supheli Arac :Vagabondo-WAP/2.0 (webcrawler at wise-guys dot nl; http://webagent.wise-guys.nl/)/1.0 Profile"; content:"Vagabondo-WAP/2.0 (webcrawler at wise-guys dot nl; http://webagent.wise-guys.nl/)/1.0 Profile"; sid:1000485; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.05 (Macintosh; I; 68K Nav)"; content:"Mozilla/4.05 (Macintosh; I; 68K Nav)"; sid:1000486; ) alert tcp any any -> any any (msg:"Supheli Arac :Links 2.0 (http://gossamer-threads.com/scripts/links/)"; content:"Links 2.0 (http://gossamer-threads.com/scripts/links/)"; sid:1000487; ) alert tcp any any -> any any (msg:"Supheli Arac :Xenu Link Sleuth 1.xx"; content:"Xenu Link Sleuth 1.xx"; sid:1000488; ) alert tcp any any -> any any (msg:"Supheli Arac :ZoomSpider - wrensoft.com"; content:"ZoomSpider - wrensoft.com"; sid:1000489; ) alert tcp any any -> any any (msg:"Supheli Arac :LiveTrans/Nutch-0.9 (maintainer: cobain at iis dot sinica dot edu dot tw; http://wkd.iis.sinica.edu.tw/LiveTrans/)"; content:"LiveTrans/Nutch-0.9 (maintainer: cobain at iis dot sinica dot edu dot tw; http://wkd.iis.sinica.edu.tw/LiveTrans/)"; sid:1000490; ) alert tcp any any -> any any (msg:"Supheli Arac :PEAR HTTP_Request class ( http://pear.php.net/ )"; content:"PEAR HTTP_Request class ( http://pear.php.net/ )"; sid:1000491; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter/3.3_SF"; content:"Scooter/3.3_SF"; sid:1000492; ) alert tcp any any -> any any (msg:"Supheli Arac :amibot"; content:"amibot"; sid:1000493; ) alert tcp any any -> any any (msg:"Supheli Arac :Tkensaku/x.x(http://www.tkensaku.com/q.html)"; content:"Tkensaku/x.x(http://www.tkensaku.com/q.html)"; sid:1000494; ) alert tcp any any -> any any (msg:"Supheli Arac :Accoona-AI-Agent/1.1.1 (crawler at accoona dot com)"; content:"Accoona-AI-Agent/1.1.1 (crawler at accoona dot com)"; sid:1000495; ) alert tcp any any -> any any (msg:"Supheli Arac :Acorn/Nutch-0.9 (Non-Profit Search Engine; acorn.isara.org; acorn at isara dot org)"; content:"Acorn/Nutch-0.9 (Non-Profit Search Engine; acorn.isara.org; acorn at isara dot org)"; sid:1000496; ) alert tcp any any -> any any (msg:"Supheli Arac :Microsoft Data Access Internet Publishing Provider Protocol Discovery"; content:"Microsoft Data Access Internet Publishing Provider Protocol Discovery"; sid:1000497; ) alert tcp any any -> any any (msg:"Supheli Arac :Enfish Tracker"; content:"Enfish Tracker"; sid:1000498; ) alert tcp any any -> any any (msg:"Supheli Arac :Sunrise/0.42g (Windows XP)"; content:"Sunrise/0.42g (Windows XP)"; sid:1000499; ) alert tcp any any -> any any (msg:"Supheli Arac :AVSearch-1.0(peter.turney@nrc.ca)"; content:"AVSearch-1.0(peter.turney@nrc.ca)"; sid:1000500; ) alert tcp any any -> any any (msg:"Supheli Arac :GetRight/4.x[a-e]"; content:"GetRight/4.x[a-e]"; sid:1000501; ) alert tcp any any -> any any (msg:"Supheli Arac :PingALink Monitoring Services 1.0"; content:"PingALink Monitoring Services 1.0"; sid:1000502; ) alert tcp any any -> any any (msg:"Supheli Arac :potbot 1.0"; content:"potbot 1.0"; sid:1000503; ) alert tcp any any -> any any (msg:"Supheli Arac :Nokia6300/2.0 (05.50) Profile/MIDP-2.0 Configuration/CLDC-1.1 (botmobi http://find.mobi/bot.html abuse@mtld.mobi)"; content:"Nokia6300/2.0 (05.50) Profile/MIDP-2.0 Configuration/CLDC-1.1 (botmobi http://find.mobi/bot.html abuse@mtld.mobi)"; sid:1000504; ) alert tcp any any -> any any (msg:"Supheli Arac :Dillo/0.8.5-i18n-misc"; content:"Dillo/0.8.5-i18n-misc"; sid:1000505; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; OnetSzukaj/5.0; http://szukaj.onet.pl)"; content:"Mozilla/5.0 (compatible; OnetSzukaj/5.0; http://szukaj.onet.pl)"; sid:1000506; ) alert tcp any any -> any any (msg:"Supheli Arac :Vortex/2.2 (+http://marty.anstey.ca/robots/vortex/)"; content:"Vortex/2.2 (+http://marty.anstey.ca/robots/vortex/)"; sid:1000507; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/2.0.0-RC1 +http://www.aol.com)"; content:"Mozilla/5.0 (compatible; heritrix/2.0.0-RC1 +http://www.aol.com)"; sid:1000508; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.7) NimbleCrawler 1.11 obeys UserAgent NimbleCrawler For problems contact: crawler_at_dataalchemy.com"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.7) NimbleCrawler 1.11 obeys UserAgent NimbleCrawler For problems contact: crawler_at_dataalchemy.com"; sid:1000509; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; aiHitBot/1.0; +http://www.aihit.com/)"; content:"Mozilla/5.0 (compatible; aiHitBot/1.0; +http://www.aihit.com/)"; sid:1000510; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; HyperixScoop/1.3; +http://www.hyperix.com)"; content:"Mozilla/5.0 (compatible; HyperixScoop/1.3; +http://www.hyperix.com)"; sid:1000511; ) alert tcp any any -> any any (msg:"Supheli Arac :URL_Spider_Pro/x.x"; content:"URL_Spider_Pro/x.x"; sid:1000512; ) alert tcp any any -> any any (msg:"Supheli Arac :Under the Rainbow 2.2"; content:"Under the Rainbow 2.2"; sid:1000513; ) alert tcp any any -> any any (msg:"Supheli Arac :RAMPyBot - www.giveRAMP.com/0.1 (RAMPyBot - www.giveRAMP.com; http://www.giveramp.com/bot.html; support@giveRAMP.com)"; content:"RAMPyBot - www.giveRAMP.com/0.1 (RAMPyBot - www.giveRAMP.com; http://www.giveramp.com/bot.html; support@giveRAMP.com)"; sid:1000514; ) alert tcp any any -> any any (msg:"Supheli Arac :EmeraldShield.com WebBot (http://www.emeraldshield.com/webbot.aspx)"; content:"EmeraldShield.com WebBot (http://www.emeraldshield.com/webbot.aspx)"; sid:1000515; ) alert tcp any any -> any any (msg:"Supheli Arac :Enterprise_Search/1.0.xxx"; content:"Enterprise_Search/1.0.xxx"; sid:1000516; ) alert tcp any any -> any any (msg:"Supheli Arac :timboBot/0.9 http://www.breakingblogs.com/timbo_bot.html"; content:"timboBot/0.9 http://www.breakingblogs.com/timbo_bot.html"; sid:1000517; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; Webinator-indexer.cyberalert.com/2.56)"; content:"Mozilla/3.0 (compatible; Webinator-indexer.cyberalert.com/2.56)"; sid:1000518; ) alert tcp any any -> any any (msg:"Supheli Arac :Sylera/1.2.x"; content:"Sylera/1.2.x"; sid:1000519; ) alert tcp any any -> any any (msg:"Supheli Arac :Generic Mobile Phone (compatible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)"; content:"Generic Mobile Phone (compatible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)"; sid:1000520; ) alert tcp any any -> any any (msg:"Supheli Arac :Pompos/1.x http://dir.com/pompos.html"; content:"Pompos/1.x http://dir.com/pompos.html"; sid:1000521; ) alert tcp any any -> any any (msg:"Supheli Arac :Bloglines Title Fetch/1.0 (http://www.bloglines.com)"; content:"Bloglines Title Fetch/1.0 (http://www.bloglines.com)"; sid:1000522; ) alert tcp any any -> any any (msg:"Supheli Arac :CentiverseBot/3.0 (http://www.centiverse-project.net)"; content:"CentiverseBot/3.0 (http://www.centiverse-project.net)"; sid:1000523; ) alert tcp any any -> any any (msg:"Supheli Arac :puf/0.93.2a (Linux 2.4.18; i686)"; content:"puf/0.93.2a (Linux 2.4.18; i686)"; sid:1000524; ) alert tcp any any -> any any (msg:"Supheli Arac :MnogoSearch/3.2.xx"; content:"MnogoSearch/3.2.xx"; sid:1000525; ) alert tcp any any -> any any (msg:"Supheli Arac :Dillo/0.x.x"; content:"Dillo/0.x.x"; sid:1000526; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; SpeedySpider; www.entireweb.com)"; content:"Mozilla/4.0 (compatible; SpeedySpider; www.entireweb.com)"; sid:1000527; ) alert tcp any any -> any any (msg:"Supheli Arac :EgotoBot/4.8 (+http://www.egoto.com/about.htm)"; content:"EgotoBot/4.8 (+http://www.egoto.com/about.htm)"; sid:1000528; ) alert tcp any any -> any any (msg:"Supheli Arac :Netluchs/0.8-dev ( ; http://www.netluchs.de/; ___don't___spam_me_@netluchs.de)"; content:"Netluchs/0.8-dev ( ; http://www.netluchs.de/; ___don't___spam_me_@netluchs.de)"; sid:1000529; ) alert tcp any any -> any any (msg:"Supheli Arac :1st ZipCommander (Net) - http://www.zipcommander.com/"; content:"1st ZipCommander (Net) - http://www.zipcommander.com/"; sid:1000530; ) alert tcp any any -> any any (msg:"Supheli Arac :NutchVinegarCrawl/Nutch-0.8.1 (Vinegar; http://www.cs.washington.edu; eytanadar at gmail dot com)"; content:"NutchVinegarCrawl/Nutch-0.8.1 (Vinegar; http://www.cs.washington.edu; eytanadar at gmail dot com)"; sid:1000531; ) alert tcp any any -> any any (msg:"Supheli Arac :Biyubi/x.x (Sistema Fenix; G11; Familia Toledo; es-mx)"; content:"Biyubi/x.x (Sistema Fenix; G11; Familia Toledo; es-mx)"; sid:1000532; ) alert tcp any any -> any any (msg:"Supheli Arac :BebopBot/2.5.1 ( crawler http://www.apassion4jazz.net/bebopbot.html )"; content:"BebopBot/2.5.1 ( crawler http://www.apassion4jazz.net/bebopbot.html )"; sid:1000533; ) alert tcp any any -> any any (msg:"Supheli Arac :Bookmark Renewal Check Agent [http://www.bookmark.ne.jp/] (Version 2.0beta)"; content:"Bookmark Renewal Check Agent [http://www.bookmark.ne.jp/] (Version 2.0beta)"; sid:1000534; ) alert tcp any any -> any any (msg:"Supheli Arac :Semager/1.1 (http://www.semager.de/blog/semager-bots/)"; content:"Semager/1.1 (http://www.semager.de/blog/semager-bots/)"; sid:1000535; ) alert tcp any any -> any any (msg:"Supheli Arac :SuperBot/x.x (Win32)"; content:"SuperBot/x.x (Win32)"; sid:1000536; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.61 [en] (X11; U; ) - BrowseX (2.0.0 Windows)"; content:"Mozilla/4.61 [en] (X11; U; ) - BrowseX (2.0.0 Windows)"; sid:1000537; ) alert tcp any any -> any any (msg:"Supheli Arac :EasyDL/3.xx"; content:"EasyDL/3.xx"; sid:1000538; ) alert tcp any any -> any any (msg:"Supheli Arac :FlickBot 2.0 RPT-HTTPClient/0.3-3"; content:"FlickBot 2.0 RPT-HTTPClient/0.3-3"; sid:1000539; ) alert tcp any any -> any any (msg:"Supheli Arac :JetCar"; content:"JetCar"; sid:1000540; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 compatible ZyBorg/1.0 (wn.zyborg@looksmart.net; http://www.WISEnutbot.com)"; content:"Mozilla/4.0 compatible ZyBorg/1.0 (wn.zyborg@looksmart.net; http://www.WISEnutbot.com)"; sid:1000541; ) alert tcp any any -> any any (msg:"Supheli Arac :AtlocalBot/1.1 +(http://www.atlocal.com/local-web-site-owner.html)"; content:"AtlocalBot/1.1 +(http://www.atlocal.com/local-web-site-owner.html)"; sid:1000542; ) alert tcp any any -> any any (msg:"Supheli Arac :flunky"; content:"flunky"; sid:1000543; ) alert tcp any any -> any any (msg:"Supheli Arac :RRC (crawler_admin@bigfoot.com)"; content:"RRC (crawler_admin@bigfoot.com)"; sid:1000544; ) alert tcp any any -> any any (msg:"Supheli Arac :BackStreet Browser 3.x"; content:"BackStreet Browser 3.x"; sid:1000545; ) alert tcp any any -> any any (msg:"Supheli Arac :Aport"; content:"Aport"; sid:1000546; ) alert tcp any any -> any any (msg:"Supheli Arac :Amfibibot/0.07 (Amfibi Robot; http://www.amfibi.com; agent@amfibi.com)"; content:"Amfibibot/0.07 (Amfibi Robot; http://www.amfibi.com; agent@amfibi.com)"; sid:1000547; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler 6 (Experimental)"; content:"FAST Enterprise Crawler 6 (Experimental)"; sid:1000548; ) alert tcp any any -> any any (msg:"Supheli Arac :InternetSeer.com"; content:"InternetSeer.com"; sid:1000549; ) alert tcp any any -> any any (msg:"Supheli Arac :kalooga/kalooga-4.0-dev-datahouse (Kalooga; http://www.kalooga.com; info@kalooga.com)"; content:"kalooga/kalooga-4.0-dev-datahouse (Kalooga; http://www.kalooga.com; info@kalooga.com)"; sid:1000550; ) alert tcp any any -> any any (msg:"Supheli Arac :UdmSearch/3.1.x"; content:"UdmSearch/3.1.x"; sid:1000551; ) alert tcp any any -> any any (msg:"Supheli Arac :PEERbot www.peerbot.com"; content:"PEERbot www.peerbot.com"; sid:1000552; ) alert tcp any any -> any any (msg:"Supheli Arac :HitList"; content:"HitList"; sid:1000553; ) alert tcp any any -> any any (msg:"Supheli Arac :KakleBot - www.kakle.com/0.1 (KakleBot - www.kakle.com; http:// www.kakle.com/bot.html; support@kakle.com)"; content:"KakleBot - www.kakle.com/0.1 (KakleBot - www.kakle.com; http:// www.kakle.com/bot.html; support@kakle.com)"; sid:1000554; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0 compatible; Asterias Crawler v4; +http://www.singingfish.com/help/spider.html; webmaster@singingfish.com); SpiderThread Revision: 3.10"; content:"Mozilla/4.0 (compatible; MSIE 6.0 compatible; Asterias Crawler v4; +http://www.singingfish.com/help/spider.html; webmaster@singingfish.com); SpiderThread Revision: 3.10"; sid:1000555; ) alert tcp any any -> any any (msg:"Supheli Arac :Amfibibot/0.06 (Amfibi Web Search; http://www.amfibi.com; agent@amfibi.com)"; content:"Amfibibot/0.06 (Amfibi Web Search; http://www.amfibi.com; agent@amfibi.com)"; sid:1000556; ) alert tcp any any -> any any (msg:"Supheli Arac :isurf (tszhu@canada.com)"; content:"isurf (tszhu@canada.com)"; sid:1000557; ) alert tcp any any -> any any (msg:"Supheli Arac :ZIPPPCVS/0.xx (ZipppBot/.xx;http://www.zippp.net; webmaster@zippp.net)"; content:"ZIPPPCVS/0.xx (ZipppBot/.xx;http://www.zippp.net; webmaster@zippp.net)"; sid:1000558; ) alert tcp any any -> any any (msg:"Supheli Arac :Metaspinner/0.01 (Metaspinner; http://www.meta-spinner.de/; support@meta-spinner.de/)"; content:"Metaspinner/0.01 (Metaspinner; http://www.meta-spinner.de/; support@meta-spinner.de/)"; sid:1000559; ) alert tcp any any -> any any (msg:"Supheli Arac :WebCorp/1.0"; content:"WebCorp/1.0"; sid:1000560; ) alert tcp any any -> any any (msg:"Supheli Arac :sportsuchmaschine.de-Robot (Version: 1.02- powered by www.sportsuchmaschine.de)"; content:"sportsuchmaschine.de-Robot (Version: 1.02- powered by www.sportsuchmaschine.de)"; sid:1000561; ) alert tcp any any -> any any (msg:"Supheli Arac :InfoLink/1.x"; content:"InfoLink/1.x"; sid:1000562; ) alert tcp any any -> any any (msg:"Supheli Arac :Yahoo-MMAudVid/2.0(mms dash mm aud vid crawler dash support at yahoo dash inc.com ;Mozilla 4.0 compatible; MSIE 7.0;Windows NT 5.0; .NET CLR 2.0)"; content:"Yahoo-MMAudVid/2.0(mms dash mm aud vid crawler dash support at yahoo dash inc.com ;Mozilla 4.0 compatible; MSIE 7.0;Windows NT 5.0; .NET CLR 2.0)"; sid:1000563; ) alert tcp any any -> any any (msg:"Supheli Arac :Openfind Robot/1.1A2"; content:"Openfind Robot/1.1A2"; sid:1000564; ) alert tcp any any -> any any (msg:"Supheli Arac :Cooliris/1.5 CFNetwork/459 Darwin/10.0.0d3"; content:"Cooliris/1.5 CFNetwork/459 Darwin/10.0.0d3"; sid:1000565; ) alert tcp any any -> any any (msg:"Supheli Arac :user-agent=Mozilla/3.01Gold"; content:"user-agent=Mozilla/3.01Gold"; sid:1000566; ) alert tcp any any -> any any (msg:"Supheli Arac :Submission Spider at surfsafely.com"; content:"Submission Spider at surfsafely.com"; sid:1000567; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461; IOpener Release 1.1.04)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461; IOpener Release 1.1.04)"; sid:1000568; ) alert tcp any any -> any any (msg:"Supheli Arac :VeryGoodSearch.com.DaddyLongLegs"; content:"VeryGoodSearch.com.DaddyLongLegs"; sid:1000569; ) alert tcp any any -> any any (msg:"Supheli Arac :Clushbot/3.xx-Hector (+http://www.clush.com/bot.html)"; content:"Clushbot/3.xx-Hector (+http://www.clush.com/bot.html)"; sid:1000570; ) alert tcp any any -> any any (msg:"Supheli Arac :DeadLinkCheck/0.4.0 libwww-perl/5.xx"; content:"DeadLinkCheck/0.4.0 libwww-perl/5.xx"; sid:1000571; ) alert tcp any any -> any any (msg:"Supheli Arac :YahooSeeker/bsv3.9 (compatible; Mozilla 4.0; MSIE 5.5; http://help.yahoo.com/help/us/ysearch/crawling/crawling-02.html )"; content:"YahooSeeker/bsv3.9 (compatible; Mozilla 4.0; MSIE 5.5; http://help.yahoo.com/help/us/ysearch/crawling/crawling-02.html )"; sid:1000572; ) alert tcp any any -> any any (msg:"Supheli Arac :Scrubby/3.0 (+http://www.scrubtheweb.com/help/technology.html)"; content:"Scrubby/3.0 (+http://www.scrubtheweb.com/help/technology.html)"; sid:1000573; ) alert tcp any any -> any any (msg:"Supheli Arac :Acoon Robot v1.50.001"; content:"Acoon Robot v1.50.001"; sid:1000574; ) alert tcp any any -> any any (msg:"Supheli Arac :fly/6.01 libwww/4.0D"; content:"fly/6.01 libwww/4.0D"; sid:1000575; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; ShunixBot/1.x; http://www.shunix.com/bot.htm)"; content:"Mozilla/5.0 (compatible; ShunixBot/1.x; http://www.shunix.com/bot.htm)"; sid:1000576; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; SYCLIKControl/LinkChecker;)"; content:"Mozilla/5.0 (compatible; SYCLIKControl/LinkChecker;)"; sid:1000577; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; Ask Jeeves)"; content:"Mozilla/2.0 (compatible; Ask Jeeves)"; sid:1000578; ) alert tcp any any -> any any (msg:"Supheli Arac :TygoBot"; content:"TygoBot"; sid:1000579; ) alert tcp any any -> any any (msg:"Supheli Arac :Zoo Tycoon 2 Client -- http://www.zootycoon.com"; content:"Zoo Tycoon 2 Client -- http://www.zootycoon.com"; sid:1000580; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent"; content:"Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent"; sid:1000581; ) alert tcp any any -> any any (msg:"Supheli Arac :NextGenSearchBot 1 (for information visit http://www.eliyon.com/NextGenSearchBot)"; content:"NextGenSearchBot 1 (for information visit http://www.eliyon.com/NextGenSearchBot)"; sid:1000582; ) alert tcp any any -> any any (msg:"Supheli Arac :FeedHub FeedDiscovery/1.0 (http://www.feedhub.com)"; content:"FeedHub FeedDiscovery/1.0 (http://www.feedhub.com)"; sid:1000583; ) alert tcp any any -> any any (msg:"Supheli Arac :Spider.TerraNautic.net - v:1.04"; content:"Spider.TerraNautic.net - v:1.04"; sid:1000584; ) alert tcp any any -> any any (msg:"Supheli Arac :SygolBot http://www.sygol.net"; content:"SygolBot http://www.sygol.net"; sid:1000585; ) alert tcp any any -> any any (msg:"Supheli Arac :GoldenFeed Spider 1.0 (http://www.goldenfeed.com)"; content:"GoldenFeed Spider 1.0 (http://www.goldenfeed.com)"; sid:1000586; ) alert tcp any any -> any any (msg:"Supheli Arac :FollowSite Bot ( http://www.followsite.com/bot.html )"; content:"FollowSite Bot ( http://www.followsite.com/bot.html )"; sid:1000587; ) alert tcp any any -> any any (msg:"Supheli Arac :Bigsearch.ca/Nutch-x.x-dev (Bigsearch.ca Internet Spider; http://www.bigsearch.ca/; info@enhancededge.com)"; content:"Bigsearch.ca/Nutch-x.x-dev (Bigsearch.ca Internet Spider; http://www.bigsearch.ca/; info@enhancededge.com)"; sid:1000588; ) alert tcp any any -> any any (msg:"Supheli Arac :BSDSeek/1.0"; content:"BSDSeek/1.0"; sid:1000589; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; DAUMOA-video; +http://ws.daum.net/aboutkr.html)"; content:"Mozilla/4.0 (compatible; DAUMOA-video; +http://ws.daum.net/aboutkr.html)"; sid:1000590; ) alert tcp any any -> any any (msg:"Supheli Arac :W3C-WebCon/5.x.x libwww/5.x.x"; content:"W3C-WebCon/5.x.x libwww/5.x.x"; sid:1000591; ) alert tcp any any -> any any (msg:"Supheli Arac :CE-Preload"; content:"CE-Preload"; sid:1000592; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; InterseekWeb/3.x)"; content:"Mozilla/5.0 (compatible; InterseekWeb/3.x)"; sid:1000593; ) alert tcp any any -> any any (msg:"Supheli Arac :MojeekBot/0.x (archi; http://www.mojeek.com/bot.html)"; content:"MojeekBot/0.x (archi; http://www.mojeek.com/bot.html)"; sid:1000594; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/9.60 (Windows NT 5.1; U; de) Presto/2.1.1"; content:"Opera/9.60 (Windows NT 5.1; U; de) Presto/2.1.1"; sid:1000595; ) alert tcp any any -> any any (msg:"Supheli Arac :elfbot/1.0 (+http://www.uchoose.de/crawler/elfbot/)"; content:"elfbot/1.0 (+http://www.uchoose.de/crawler/elfbot/)"; sid:1000596; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Charlotte/1.0b; http://www.searchme.com/support/)"; content:"Mozilla/5.0 (compatible; Charlotte/1.0b; http://www.searchme.com/support/)"; sid:1000597; ) alert tcp any any -> any any (msg:"Supheli Arac :Azureus 2.x.x.x"; content:"Azureus 2.x.x.x"; sid:1000598; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Vagabondo/2.1; webcrawler at wise-guys dot nl; http://webagent.wise-guys.nl/)"; content:"Mozilla/5.0 (compatible; Vagabondo/2.1; webcrawler at wise-guys dot nl; http://webagent.wise-guys.nl/)"; sid:1000599; ) alert tcp any any -> any any (msg:"Supheli Arac :autowebdir 1.1 (www.autowebdir.com)"; content:"autowebdir 1.1 (www.autowebdir.com)"; sid:1000600; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww/5.3.2"; content:"libwww/5.3.2"; sid:1000601; ) alert tcp any any -> any any (msg:"Supheli Arac :Marketwave Hit List"; content:"Marketwave Hit List"; sid:1000602; ) alert tcp any any -> any any (msg:"Supheli Arac :onCHECK Linkchecker von www.scientec.de fuer www.onsinn.de"; content:"onCHECK Linkchecker von www.scientec.de fuer www.onsinn.de"; sid:1000603; ) alert tcp any any -> any any (msg:"Supheli Arac :BaiduImagespider+(+http://www.baidu.jp/search/s308.html)"; content:"BaiduImagespider+(+http://www.baidu.jp/search/s308.html)"; sid:1000604; ) alert tcp any any -> any any (msg:"Supheli Arac :IOI/2.0 (ISC Open Index crawler; http://index.isc.org/; bot@index.isc.org)"; content:"IOI/2.0 (ISC Open Index crawler; http://index.isc.org/; bot@index.isc.org)"; sid:1000605; ) alert tcp any any -> any any (msg:"Supheli Arac :Weblink's checker/"; content:"Weblink's checker/"; sid:1000606; ) alert tcp any any -> any any (msg:"Supheli Arac :OliverPerry"; content:"OliverPerry"; sid:1000607; ) alert tcp any any -> any any (msg:"Supheli Arac :Avant Browser (http://www.avantbrowser.com)"; content:"Avant Browser (http://www.avantbrowser.com)"; sid:1000608; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Pogodak.hr/3.1)"; content:"Mozilla/5.0 (compatible; Pogodak.hr/3.1)"; sid:1000609; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.0.1) Gecko/20021219 Chimera/0.6"; content:"Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.0.1) Gecko/20021219 Chimera/0.6"; sid:1000610; ) alert tcp any any -> any any (msg:"Supheli Arac :BlockNote.Net"; content:"BlockNote.Net"; sid:1000611; ) alert tcp any any -> any any (msg:"Supheli Arac :VSE/1.0 (testcrawler@hotmail.com)"; content:"VSE/1.0 (testcrawler@hotmail.com)"; sid:1000612; ) alert tcp any any -> any any (msg:"Supheli Arac :msnbot-Products/1.0 (+http://search.msn.com/msnbot.htm)"; content:"msnbot-Products/1.0 (+http://search.msn.com/msnbot.htm)"; sid:1000613; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible) GM RSS Panel X"; content:"Mozilla/5.0 (compatible) GM RSS Panel X"; sid:1000614; ) alert tcp any any -> any any (msg:"Supheli Arac :NetinfoBot/1.0 (http://netinfo.bg/netinfobot.html)"; content:"NetinfoBot/1.0 (http://netinfo.bg/netinfobot.html)"; sid:1000615; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.01 [en](Win95;I)"; content:"Mozilla/4.01 [en](Win95;I)"; sid:1000616; ) alert tcp any any -> any any (msg:"Supheli Arac :suchpadbot/1.0 (+http://www.suchpad.de)"; content:"suchpadbot/1.0 (+http://www.suchpad.de)"; sid:1000617; ) alert tcp any any -> any any (msg:"Supheli Arac :Klondike/1.50 (WSP Win32) (Google WAP Proxy/1.0)"; content:"Klondike/1.50 (WSP Win32) (Google WAP Proxy/1.0)"; sid:1000618; ) alert tcp any any -> any any (msg:"Supheli Arac :Anonymized by ProxyOS: http://www.megaproxy.com"; content:"Anonymized by ProxyOS: http://www.megaproxy.com"; sid:1000619; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Crayon Crawler; snprtz|T04056566514940; (R1 1.5))"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Crayon Crawler; snprtz|T04056566514940; (R1 1.5))"; sid:1000620; ) alert tcp any any -> any any (msg:"Supheli Arac :Ocelli/1.x (http://www.globalspec.com/Ocelli)"; content:"Ocelli/1.x (http://www.globalspec.com/Ocelli)"; sid:1000621; ) alert tcp any any -> any any (msg:"Supheli Arac :envolk[ITS]spider/1.6(+http://www.envolk.com/envolkspider.html)"; content:"envolk[ITS]spider/1.6(+http://www.envolk.com/envolkspider.html)"; sid:1000622; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320; SPV M700; OpVer 19.123.2.733) OrangeBot-Mobile 2008.0 (mobilesearch.support@orange-ftgroup.com)"; content:"Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320; SPV M700; OpVer 19.123.2.733) OrangeBot-Mobile 2008.0 (mobilesearch.support@orange-ftgroup.com)"; sid:1000623; ) alert tcp any any -> any any (msg:"Supheli Arac :Motorola-V3m Obigo"; content:"Motorola-V3m Obigo"; sid:1000624; ) alert tcp any any -> any any (msg:"Supheli Arac :EuripBot/0.x (+http://www.eurip.com) GetFile"; content:"EuripBot/0.x (+http://www.eurip.com) GetFile"; sid:1000625; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (WorldGate Gazelle 3.5.1 build 11; FreeBSD2.2.8-STABLE)"; content:"Mozilla/3.0 (WorldGate Gazelle 3.5.1 build 11; FreeBSD2.2.8-STABLE)"; sid:1000626; ) alert tcp any any -> any any (msg:"Supheli Arac :Express WebPictures (www.express-soft.com)"; content:"Express WebPictures (www.express-soft.com)"; sid:1000627; ) alert tcp any any -> any any (msg:"Supheli Arac :BigBrother/1.6e"; content:"BigBrother/1.6e"; sid:1000628; ) alert tcp any any -> any any (msg:"Supheli Arac :MaSagool/1.0 (MaSagool; http://sagool.jp/; info@sagool.jp)"; content:"MaSagool/1.0 (MaSagool; http://sagool.jp/; info@sagool.jp)"; sid:1000629; ) alert tcp any any -> any any (msg:"Supheli Arac :Sqworm/2.9.85-BETA (beta_release; 20011115-775; i686-pc-linux-gnu)"; content:"Sqworm/2.9.85-BETA (beta_release; 20011115-775; i686-pc-linux-gnu)"; sid:1000630; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (+http://www.eurekster.com/mammoth) Mammoth/0.1"; content:"Mozilla/5.0 (+http://www.eurekster.com/mammoth) Mammoth/0.1"; sid:1000631; ) alert tcp any any -> any any (msg:"Supheli Arac :Kenjin Spider"; content:"Kenjin Spider"; sid:1000632; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows 95; Transmission Segment; Hotbar 2.0)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows 95; Transmission Segment; Hotbar 2.0)"; sid:1000633; ) alert tcp any any -> any any (msg:"Supheli Arac :GetWeb/0.1 libwww-perl/5.16"; content:"GetWeb/0.1 libwww-perl/5.16"; sid:1000634; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; AOL 4.0; Windows 98; GoBeez (www.gobeez.com))"; content:"Mozilla/4.0 (compatible; MSIE 5.5; AOL 4.0; Windows 98; GoBeez (www.gobeez.com))"; sid:1000635; ) alert tcp any any -> any any (msg:"Supheli Arac :GhostRouteHunter/20021130 (https://www.sixxs.net/tools/grh/; info@sixxs.net)"; content:"GhostRouteHunter/20021130 (https://www.sixxs.net/tools/grh/; info@sixxs.net)"; sid:1000636; ) alert tcp any any -> any any (msg:"Supheli Arac :UptimeBot(www.uptimebot.com)"; content:"UptimeBot(www.uptimebot.com)"; sid:1000637; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozi!"; content:"Mozi!"; sid:1000638; ) alert tcp any any -> any any (msg:"Supheli Arac :Python-urllib/1.1x"; content:"Python-urllib/1.1x"; sid:1000639; ) alert tcp any any -> any any (msg:"Supheli Arac :HenryTheMiragoRobot (http://www.miragorobot.com/scripts/mrinfo.asp)"; content:"HenryTheMiragoRobot (http://www.miragorobot.com/scripts/mrinfo.asp)"; sid:1000640; ) alert tcp any any -> any any (msg:"Supheli Arac :NITLE Blog Spider/0.01"; content:"NITLE Blog Spider/0.01"; sid:1000641; ) alert tcp any any -> any any (msg:"Supheli Arac :Speedy Spider (Entireweb; Beta/1.0; http://www.entireweb.com/about/search_tech/speedyspider/)"; content:"Speedy Spider (Entireweb; Beta/1.0; http://www.entireweb.com/about/search_tech/speedyspider/)"; sid:1000642; ) alert tcp any any -> any any (msg:"Supheli Arac :ConveraMultiMediaCrawler/0.1 (+http://www.authoritativeweb.com/crawl)"; content:"ConveraMultiMediaCrawler/0.1 (+http://www.authoritativeweb.com/crawl)"; sid:1000643; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0"; content:"Mozilla/2.0"; sid:1000644; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0"; content:"Mozilla/4.0"; sid:1000645; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.7"; content:"Mozilla/4.7"; sid:1000646; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0"; content:"Mozilla/5.0"; sid:1000647; ) alert tcp any any -> any any (msg:"Supheli Arac :w3m/0.x.xx"; content:"w3m/0.x.xx"; sid:1000648; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.0QI"; content:"Scooter-3.0QI"; sid:1000649; ) alert tcp any any -> any any (msg:"Supheli Arac :iTunes/x.x.x"; content:"iTunes/x.x.x"; sid:1000650; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (INGRID/3.0 MT; webcrawler@NOSPAMexperimental.net; http://aanmelden.ilse.nl/?aanmeld_mode=webhints)"; content:"Mozilla/3.0 (INGRID/3.0 MT; webcrawler@NOSPAMexperimental.net; http://aanmelden.ilse.nl/?aanmeld_mode=webhints)"; sid:1000651; ) alert tcp any any -> any any (msg:"Supheli Arac :puf/0.91beta6a (Linux 2.2.18; i686)"; content:"puf/0.91beta6a (Linux 2.2.18; i686)"; sid:1000652; ) alert tcp any any -> any any (msg:"Supheli Arac :parallelContextFocusCrawler1.1parallelContextFocusCrawler1.1"; content:"parallelContextFocusCrawler1.1parallelContextFocusCrawler1.1"; sid:1000653; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Planetweb/2.100 JS SSL US; Dreamcast US)"; content:"Mozilla/3.0 (Planetweb/2.100 JS SSL US; Dreamcast US)"; sid:1000654; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; Ask Jeeves/Teoma; http://sp.ask.com/docs/about/tech_crawling.html)"; content:"Mozilla/2.0 (compatible; Ask Jeeves/Teoma; http://sp.ask.com/docs/about/tech_crawling.html)"; sid:1000655; ) alert tcp any any -> any any (msg:"Supheli Arac :Nutch"; content:"Nutch"; sid:1000656; ) alert tcp any any -> any any (msg:"Supheli Arac :Zao-Crawler 0.2b"; content:"Zao-Crawler 0.2b"; sid:1000657; ) alert tcp any any -> any any (msg:"Supheli Arac :Sleipnir Version 1.xx"; content:"Sleipnir Version 1.xx"; sid:1000658; ) alert tcp any any -> any any (msg:"Supheli Arac :Linkbot x.0"; content:"Linkbot x.0"; sid:1000659; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; BanBots/2.0b; Fetch; +http://www.banbots.com)"; content:"Mozilla/5.0 (compatible; BanBots/2.0b; Fetch; +http://www.banbots.com)"; sid:1000660; ) alert tcp any any -> any any (msg:"Supheli Arac :ZeBot_lseek.net (bot@ze.bz)"; content:"ZeBot_lseek.net (bot@ze.bz)"; sid:1000661; ) alert tcp any any -> any any (msg:"Supheli Arac :Bitacle Robot (V:1.0;) (http://www.bitacle.com)"; content:"Bitacle Robot (V:1.0;) (http://www.bitacle.com)"; sid:1000662; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Covac UPPS Cathan 1.2.5;)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Covac UPPS Cathan 1.2.5;)"; sid:1000663; ) alert tcp any any -> any any (msg:"Supheli Arac :NABOT/5.0"; content:"NABOT/5.0"; sid:1000664; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.5 [en]C-CCK-MCD {RuralNet} (Win98; I)"; content:"Mozilla/4.5 [en]C-CCK-MCD {RuralNet} (Win98; I)"; sid:1000665; ) alert tcp any any -> any any (msg:"Supheli Arac :Verzamelgids/2.2 (http://www.verzamelgids.nl)"; content:"Verzamelgids/2.2 (http://www.verzamelgids.nl)"; sid:1000666; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; XTbot/1.0v; +http://www.externaltest.com)"; content:"Mozilla/5.0 (compatible; XTbot/1.0v; +http://www.externaltest.com)"; sid:1000667; ) alert tcp any any -> any any (msg:"Supheli Arac :TerrawizBot/1.0 (+http://www.terrawiz.com/bot.html)"; content:"TerrawizBot/1.0 (+http://www.terrawiz.com/bot.html)"; sid:1000668; ) alert tcp any any -> any any (msg:"Supheli Arac :kalooga/KaloogaBot (Kalooga; http://www.kalooga.com/info.html?page=crawler; crawler@kalooga.com)"; content:"kalooga/KaloogaBot (Kalooga; http://www.kalooga.com/info.html?page=crawler; crawler@kalooga.com)"; sid:1000669; ) alert tcp any any -> any any (msg:"Supheli Arac :GreatNews/1.0"; content:"GreatNews/1.0"; sid:1000670; ) alert tcp any any -> any any (msg:"Supheli Arac :Pockey-GetHTML/4.12.0 (Win32; GUI; ix86)"; content:"Pockey-GetHTML/4.12.0 (Win32; GUI; ix86)"; sid:1000671; ) alert tcp any any -> any any (msg:"Supheli Arac :ArabyBot (compatible; Mozilla/5.0; GoogleBot; FAST Crawler 6.4; http://www.araby.com;)"; content:"ArabyBot (compatible; Mozilla/5.0; GoogleBot; FAST Crawler 6.4; http://www.araby.com;)"; sid:1000672; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.5b1 [en] (X11; I; Linux 2.0.35 i586)"; content:"Mozilla/4.5b1 [en] (X11; I; Linux 2.0.35 i586)"; sid:1000673; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; Windows NT Windows CE)"; content:"Mozilla/4.0 (compatible; MSIE 4.01; Windows NT Windows CE)"; sid:1000674; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 compatible ZyBorg/1.0 Dead Link Checker (wn.zyborg@looksmart.net; http://www.WISEnutbot.com)"; content:"Mozilla/4.0 compatible ZyBorg/1.0 Dead Link Checker (wn.zyborg@looksmart.net; http://www.WISEnutbot.com)"; sid:1000675; ) alert tcp any any -> any any (msg:"Supheli Arac :Feedshow/x.0 (http://www.feedshow.com; 1 subscriber)"; content:"Feedshow/x.0 (http://www.feedshow.com; 1 subscriber)"; sid:1000676; ) alert tcp any any -> any any (msg:"Supheli Arac :LijitSpider/Nutch-0.9 (Reports crawler; http://www.lijit.com/; info(a)lijit(d)com)"; content:"LijitSpider/Nutch-0.9 (Reports crawler; http://www.lijit.com/; info(a)lijit(d)com)"; sid:1000677; ) alert tcp any any -> any any (msg:"Supheli Arac :Vagabondo/2.0 MT"; content:"Vagabondo/2.0 MT"; sid:1000678; ) alert tcp any any -> any any (msg:"Supheli Arac :Filtrbox/1.0"; content:"Filtrbox/1.0"; sid:1000679; ) alert tcp any any -> any any (msg:"Supheli Arac :DiaGem/1.1 (http://www.skyrocket.gr.jp/diagem.html)"; content:"DiaGem/1.1 (http://www.skyrocket.gr.jp/diagem.html)"; sid:1000680; ) alert tcp any any -> any any (msg:"Supheli Arac :Scope (Mars+)"; content:"Scope (Mars+)"; sid:1000681; ) alert tcp any any -> any any (msg:"Supheli Arac :DataCha0s/2.0"; content:"DataCha0s/2.0"; sid:1000682; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkWalker"; content:"LinkWalker"; sid:1000683; ) alert tcp any any -> any any (msg:"Supheli Arac :Marvin v0.3"; content:"Marvin v0.3"; sid:1000684; ) alert tcp any any -> any any (msg:"Supheli Arac :del.icio.us-thumbnails/1.0 Mozilla/5.0 (compatible; Konqueror/3.4; FreeBSD) KHTML/3.4.2 (like Gecko)"; content:"del.icio.us-thumbnails/1.0 Mozilla/5.0 (compatible; Konqueror/3.4; FreeBSD) KHTML/3.4.2 (like Gecko)"; sid:1000685; ) alert tcp any any -> any any (msg:"Supheli Arac :Sigram/Nutch-1.0-dev (Test agent for Nutch development; http://www.sigram.com/bot.html; bot at sigram dot com)"; content:"Sigram/Nutch-1.0-dev (Test agent for Nutch development; http://www.sigram.com/bot.html; bot at sigram dot com)"; sid:1000686; ) alert tcp any any -> any any (msg:"Supheli Arac :RebusnetPADBot/1.5x (+http://www.rebusnet.biz)"; content:"RebusnetPADBot/1.5x (+http://www.rebusnet.biz)"; sid:1000687; ) alert tcp any any -> any any (msg:"Supheli Arac :linkbot"; content:"linkbot"; sid:1000688; ) alert tcp any any -> any any (msg:"Supheli Arac :Hotzonu/x.0"; content:"Hotzonu/x.0"; sid:1000689; ) alert tcp any any -> any any (msg:"Supheli Arac :Slider_Search_v1-de"; content:"Slider_Search_v1-de"; sid:1000690; ) alert tcp any any -> any any (msg:"Supheli Arac :Haier-T10C/1.0 iPanel/2.0 WAP2.0 (compatible; UP.Browser/6.2.2.4; UPG1; UP/4.0; Embedded)"; content:"Haier-T10C/1.0 iPanel/2.0 WAP2.0 (compatible; UP.Browser/6.2.2.4; UPG1; UP/4.0; Embedded)"; sid:1000691; ) alert tcp any any -> any any (msg:"Supheli Arac :www.arianna.it"; content:"www.arianna.it"; sid:1000692; ) alert tcp any any -> any any (msg:"Supheli Arac :CydralSpider/1.x (Cydral Web Image Search; http://www.cydral.com)"; content:"CydralSpider/1.x (Cydral Web Image Search; http://www.cydral.com)"; sid:1000693; ) alert tcp any any -> any any (msg:"Supheli Arac :ABCdatos BotLink/5.xx.xxx#BBL"; content:"ABCdatos BotLink/5.xx.xxx#BBL"; sid:1000694; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; HbTools 4.7.2)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; HbTools 4.7.2)"; sid:1000695; ) alert tcp any any -> any any (msg:"Supheli Arac :DA 3.5 (www.lidan.com)"; content:"DA 3.5 (www.lidan.com)"; sid:1000696; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Sage)"; content:"Mozilla/5.0 (Sage)"; sid:1000697; ) alert tcp any any -> any any (msg:"Supheli Arac :lwp-trivial/1.32"; content:"lwp-trivial/1.32"; sid:1000698; ) alert tcp any any -> any any (msg:"Supheli Arac :lwp-trivial/1.34"; content:"lwp-trivial/1.34"; sid:1000699; ) alert tcp any any -> any any (msg:"Supheli Arac :lwp-trivial/1.35"; content:"lwp-trivial/1.35"; sid:1000700; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; archive.org_bot/1.13.1x http://crawler.archive.org)"; content:"Mozilla/5.0 (compatible; archive.org_bot/1.13.1x http://crawler.archive.org)"; sid:1000701; ) alert tcp any any -> any any (msg:"Supheli Arac :Project XP5 [2.03.07-111203]"; content:"Project XP5 [2.03.07-111203]"; sid:1000702; ) alert tcp any any -> any any (msg:"Supheli Arac :FeedHub MetaDataFetcher/1.0 (http://www.feedhub.com)"; content:"FeedHub MetaDataFetcher/1.0 (http://www.feedhub.com)"; sid:1000703; ) alert tcp any any -> any any (msg:"Supheli Arac :Trampelpfad-Spider"; content:"Trampelpfad-Spider"; sid:1000704; ) alert tcp any any -> any any (msg:"Supheli Arac :W3SiteSearch Crawler_v1.1 http://www.w3sitesearch.de"; content:"W3SiteSearch Crawler_v1.1 http://www.w3sitesearch.de"; sid:1000705; ) alert tcp any any -> any any (msg:"Supheli Arac :NetNewsWire/2.x (Mac OS X; http://ranchero.com/netnewswire/)"; content:"NetNewsWire/2.x (Mac OS X; http://ranchero.com/netnewswire/)"; sid:1000706; ) alert tcp any any -> any any (msg:"Supheli Arac :asterias/2.0"; content:"asterias/2.0"; sid:1000707; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; archive.org_bot/1.5.0-200506132127 http://crawler.archive.org) Hurricane Katrina"; content:"Mozilla/5.0 (compatible; archive.org_bot/1.5.0-200506132127 http://crawler.archive.org) Hurricane Katrina"; sid:1000708; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; AnsearchBot/1.x; +http://www.ansearch.com.au/)"; content:"Mozilla/5.0 (compatible; AnsearchBot/1.x; +http://www.ansearch.com.au/)"; sid:1000709; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.08 [en] (WinNT; U)"; content:"Mozilla/4.08 [en] (WinNT; U)"; sid:1000710; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.41"; content:"libwww-perl/5.41"; sid:1000711; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.45"; content:"libwww-perl/5.45"; sid:1000712; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.48"; content:"libwww-perl/5.48"; sid:1000713; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.50"; content:"libwww-perl/5.50"; sid:1000714; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.53"; content:"libwww-perl/5.53"; sid:1000715; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.63"; content:"libwww-perl/5.63"; sid:1000716; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.64"; content:"libwww-perl/5.64"; sid:1000717; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.65"; content:"libwww-perl/5.65"; sid:1000718; ) alert tcp any any -> any any (msg:"Supheli Arac :CFNetwork/x.x"; content:"CFNetwork/x.x"; sid:1000719; ) alert tcp any any -> any any (msg:"Supheli Arac :Tecomi Bot (http://www.tecomi.com/bot.htm)"; content:"Tecomi Bot (http://www.tecomi.com/bot.htm)"; sid:1000720; ) alert tcp any any -> any any (msg:"Supheli Arac :WebWatcherMonitor/2.01"; content:"WebWatcherMonitor/2.01"; sid:1000721; ) alert tcp any any -> any any (msg:"Supheli Arac :EmailWolf 1.00"; content:"EmailWolf 1.00"; sid:1000722; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.75C-ja [ja] (X11; U; OSF1 V5.1 alpha)"; content:"Mozilla/4.75C-ja [ja] (X11; U; OSF1 V5.1 alpha)"; sid:1000723; ) alert tcp any any -> any any (msg:"Supheli Arac :http://www.ip2location.com"; content:"http://www.ip2location.com"; sid:1000724; ) alert tcp any any -> any any (msg:"Supheli Arac :Sensis.com.au Web Crawler (search_comments\at\sensis\dot\com\dot\au)"; content:"Sensis.com.au Web Crawler (search_comments\at\sensis\dot\com\dot\au)"; sid:1000725; ) alert tcp any any -> any any (msg:"Supheli Arac :Rome Client (http://tinyurl.com/64t5n) Ver: 0.9"; content:"Rome Client (http://tinyurl.com/64t5n) Ver: 0.9"; sid:1000726; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/9.00 (Windows NT 5.1; U; de)"; content:"Opera/9.00 (Windows NT 5.1; U; de)"; sid:1000727; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.52 FP/2.1"; content:"libwww-perl/5.52 FP/2.1"; sid:1000728; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.52 FP/4.0"; content:"libwww-perl/5.52 FP/4.0"; sid:1000729; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; StumbleUpon.com 1.760; .NET CLR 1.1.4322)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; StumbleUpon.com 1.760; .NET CLR 1.1.4322)"; sid:1000730; ) alert tcp any any -> any any (msg:"Supheli Arac :TJG/Spider"; content:"TJG/Spider"; sid:1000731; ) alert tcp any any -> any any (msg:"Supheli Arac :IAArchiver-1.0"; content:"IAArchiver-1.0"; sid:1000732; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; +http://www.evri.com/evrinid)"; content:"Mozilla/5.0 (compatible; +http://www.evri.com/evrinid)"; sid:1000733; ) alert tcp any any -> any any (msg:"Supheli Arac :WFARC"; content:"WFARC"; sid:1000734; ) alert tcp any any -> any any (msg:"Supheli Arac :Yahoo! Mindset"; content:"Yahoo! Mindset"; sid:1000735; ) alert tcp any any -> any any (msg:"Supheli Arac :WebQL"; content:"WebQL"; sid:1000736; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.5 (compatible; iCab 2.5.3; Macintosh; I; PPC)"; content:"Mozilla/4.5 (compatible; iCab 2.5.3; Macintosh; I; PPC)"; sid:1000737; ) alert tcp any any -> any any (msg:"Supheli Arac :OPWV-SDK UP.Browser/7.0.2.3.119 (GUI) MMP/2.0 Push/PO"; content:"OPWV-SDK UP.Browser/7.0.2.3.119 (GUI) MMP/2.0 Push/PO"; sid:1000738; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Embedded Web Browser from: http://bsalsa.com/; MSIECrawler)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Embedded Web Browser from: http://bsalsa.com/; MSIECrawler)"; sid:1000739; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-W3-1.0"; content:"Scooter-W3-1.0"; sid:1000740; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-W3.1.2"; content:"Scooter-W3.1.2"; sid:1000741; ) alert tcp any any -> any any (msg:"Supheli Arac :Fast PartnerSite Crawler"; content:"Fast PartnerSite Crawler"; sid:1000742; ) alert tcp any any -> any any (msg:"Supheli Arac :dloader(NaverRobot)/1.0"; content:"dloader(NaverRobot)/1.0"; sid:1000743; ) alert tcp any any -> any any (msg:"Supheli Arac :CamelHttpStream/1.0"; content:"CamelHttpStream/1.0"; sid:1000744; ) alert tcp any any -> any any (msg:"Supheli Arac :ideare - SignSite/1.x"; content:"ideare - SignSite/1.x"; sid:1000745; ) alert tcp any any -> any any (msg:"Supheli Arac :disco/Nutch-1.0-dev (experimental crawler; www.discoveryengine.com; disco-crawl@discoveryengine.com)"; content:"disco/Nutch-1.0-dev (experimental crawler; www.discoveryengine.com; disco-crawl@discoveryengine.com)"; sid:1000746; ) alert tcp any any -> any any (msg:"Supheli Arac :IRLbot/3.0 (compatible; MSIE 6.0; http://irl.cs.tamu.edu/crawler/)"; content:"IRLbot/3.0 (compatible; MSIE 6.0; http://irl.cs.tamu.edu/crawler/)"; sid:1000747; ) alert tcp any any -> any any (msg:"Supheli Arac :Xylix"; content:"Xylix"; sid:1000748; ) alert tcp any any -> any any (msg:"Supheli Arac :eApolloBot/2.0 (compatible; heritrix/2.0.0-SNAPSHOT-20071024.170148 +http://www.eapollo-opto.com)"; content:"eApolloBot/2.0 (compatible; heritrix/2.0.0-SNAPSHOT-20071024.170148 +http://www.eapollo-opto.com)"; sid:1000749; ) alert tcp any any -> any any (msg:"Supheli Arac :China Local Browse 2.6"; content:"China Local Browse 2.6"; sid:1000750; ) alert tcp any any -> any any (msg:"Supheli Arac :Filangy/0.01-beta (Filangy; http://www.nutch.org/docs/en/bot.html; filangy-agent@filangy.com)"; content:"Filangy/0.01-beta (Filangy; http://www.nutch.org/docs/en/bot.html; filangy-agent@filangy.com)"; sid:1000751; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Synapse)"; content:"Mozilla/4.0 (compatible; Synapse)"; sid:1000752; ) alert tcp any any -> any any (msg:"Supheli Arac :Utopia WebWasher 3.0"; content:"Utopia WebWasher 3.0"; sid:1000753; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; PerMan Surfer 3.0; Win95)"; content:"Mozilla/3.0 (compatible; PerMan Surfer 3.0; Win95)"; sid:1000754; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.6 (atw-crawler at fast dot no; http://fast.no/support/crawler.asp)"; content:"FAST-WebCrawler/3.6 (atw-crawler at fast dot no; http://fast.no/support/crawler.asp)"; sid:1000755; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) TrueRobot; 1.5"; content:"Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) TrueRobot; 1.5"; sid:1000756; ) alert tcp any any -> any any (msg:"Supheli Arac :RSSOwl/1.2.3 2006-11-26 (Windows; U; zhtw)"; content:"RSSOwl/1.2.3 2006-11-26 (Windows; U; zhtw)"; sid:1000757; ) alert tcp any any -> any any (msg:"Supheli Arac :Bookmark Buddy bookmark checker (http://www.bookmarkbuddy.net/)"; content:"Bookmark Buddy bookmark checker (http://www.bookmarkbuddy.net/)"; sid:1000758; ) alert tcp any any -> any any (msg:"Supheli Arac :NETCOMplete/x.xx"; content:"NETCOMplete/x.xx"; sid:1000759; ) alert tcp any any -> any any (msg:"Supheli Arac :intraVnews/1.x"; content:"intraVnews/1.x"; sid:1000760; ) alert tcp any any -> any any (msg:"Supheli Arac :bwh3_user_agent"; content:"bwh3_user_agent"; sid:1000761; ) alert tcp any any -> any any (msg:"Supheli Arac :Vagabondo/2.0 MT (webagent at wise-guys dot nl)"; content:"Vagabondo/2.0 MT (webagent at wise-guys dot nl)"; sid:1000762; ) alert tcp any any -> any any (msg:"Supheli Arac :HenrytheMiragoRobot"; content:"HenrytheMiragoRobot"; sid:1000763; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; SiteKiosk 4.0; MSIE 5.0; Windows 98; SiteCoach 1.0)"; content:"Mozilla/4.0 (compatible; SiteKiosk 4.0; MSIE 5.0; Windows 98; SiteCoach 1.0)"; sid:1000764; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; DX-Browser 5.0.0.0)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; DX-Browser 5.0.0.0)"; sid:1000765; ) alert tcp any any -> any any (msg:"Supheli Arac :Semager/1.x (http://www.semager.de)"; content:"Semager/1.x (http://www.semager.de)"; sid:1000766; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; EZResult -- Internet Search Engine)"; content:"Mozilla/2.0 (compatible; EZResult -- Internet Search Engine)"; sid:1000767; ) alert tcp any any -> any any (msg:"Supheli Arac :Balihoo/Nutch-1.0-dev (Crawler for Balihoo.com search engine - obeys robots.txt and robots meta tags ; http://balihoo.com/index.aspx; robot at balihoo dot com)"; content:"Balihoo/Nutch-1.0-dev (Crawler for Balihoo.com search engine - obeys robots.txt and robots meta tags ; http://balihoo.com/index.aspx; robot at balihoo dot com)"; sid:1000768; ) alert tcp any any -> any any (msg:"Supheli Arac :MDbot/1.0 (+http://www.megadownload.net/bot.html)"; content:"MDbot/1.0 (+http://www.megadownload.net/bot.html)"; sid:1000769; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; http://www.Abolimba.de)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; http://www.Abolimba.de)"; sid:1000770; ) alert tcp any any -> any any (msg:"Supheli Arac :User-Agent: BoardReader Favicon Fetcher /1.0 info@boardreader.com"; content:"User-Agent: BoardReader Favicon Fetcher /1.0 info@boardreader.com"; sid:1000771; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (SunOS 5.8 sun4u; U) Opera 5.0 [en]"; content:"Mozilla/5.0 (SunOS 5.8 sun4u; U) Opera 5.0 [en]"; sid:1000772; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/8.xx (Windows NT 5.1; U; en)"; content:"Opera/8.xx (Windows NT 5.1; U; en)"; sid:1000773; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkSweeper/1.x"; content:"LinkSweeper/1.x"; sid:1000774; ) alert tcp any any -> any any (msg:"Supheli Arac :cfetch/1.0"; content:"cfetch/1.0"; sid:1000775; ) alert tcp any any -> any any (msg:"Supheli Arac :Digger/1.0 JDK/1.3.0rc3"; content:"Digger/1.0 JDK/1.3.0rc3"; sid:1000776; ) alert tcp any any -> any any (msg:"Supheli Arac :T-Online Browser"; content:"T-Online Browser"; sid:1000777; ) alert tcp any any -> any any (msg:"Supheli Arac :Go!Zilla 3.x (www.gozilla.com)"; content:"Go!Zilla 3.x (www.gozilla.com)"; sid:1000778; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.7 (compatible; WhizBang; http://www.whizbang.com/crawler)"; content:"Mozilla/4.7 (compatible; WhizBang; http://www.whizbang.com/crawler)"; sid:1000779; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; Linkman)"; content:"Mozilla/3.0 (compatible; Linkman)"; sid:1000780; ) alert tcp any any -> any any (msg:"Supheli Arac :INFOMINE/8.0 Adders"; content:"INFOMINE/8.0 Adders"; sid:1000781; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.x.x +http://www.accelobot.com)"; content:"Mozilla/5.0 (compatible; heritrix/1.x.x +http://www.accelobot.com)"; sid:1000782; ) alert tcp any any -> any any (msg:"Supheli Arac :BStop.BravoBrian.it Agent Detector"; content:"BStop.BravoBrian.it Agent Detector"; sid:1000783; ) alert tcp any any -> any any (msg:"Supheli Arac :Webster v0.3 ( http://webster.healeys.net/ )"; content:"Webster v0.3 ( http://webster.healeys.net/ )"; sid:1000784; ) alert tcp any any -> any any (msg:"Supheli Arac :YahooSeeker-Testing/v3.9 (compatible; Mozilla 4.0; MSIE 5.5; http://search.yahoo.com/)"; content:"YahooSeeker-Testing/v3.9 (compatible; Mozilla 4.0; MSIE 5.5; http://search.yahoo.com/)"; sid:1000785; ) alert tcp any any -> any any (msg:"Supheli Arac :Oracle Ultra Search"; content:"Oracle Ultra Search"; sid:1000786; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Netcraft Web Server Survey)"; content:"Mozilla/4.0 (compatible; Netcraft Web Server Survey)"; sid:1000787; ) alert tcp any any -> any any (msg:"Supheli Arac :LapozzBot/1.5 (+http://robot.lapozz.hu)"; content:"LapozzBot/1.5 (+http://robot.lapozz.hu)"; sid:1000788; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Ask Jeeves/Teoma; http://about.ask.com/en/docs/about/webmasters.shtml)"; content:"Mozilla/5.0 (compatible; Ask Jeeves/Teoma; http://about.ask.com/en/docs/about/webmasters.shtml)"; sid:1000789; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.4t http://www.truveo.com/)"; content:"Mozilla/5.0 (compatible; heritrix/1.4t http://www.truveo.com/)"; sid:1000790; ) alert tcp any any -> any any (msg:"Supheli Arac :Haste/0.12 (HOME: http://haste.kytoon.com/)"; content:"Haste/0.12 (HOME: http://haste.kytoon.com/)"; sid:1000791; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.10.2 +http://i.stanford.edu/)"; content:"Mozilla/5.0 (compatible; heritrix/1.10.2 +http://i.stanford.edu/)"; sid:1000792; ) alert tcp any any -> any any (msg:"Supheli Arac :Jabot/7.x.x (http://odin.ingrid.org/)"; content:"Jabot/7.x.x (http://odin.ingrid.org/)"; sid:1000793; ) alert tcp any any -> any any (msg:"Supheli Arac :Charon/1.x (Amiga)"; content:"Charon/1.x (Amiga)"; sid:1000794; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.01 (Win16; I)"; content:"Mozilla/2.01 (Win16; I)"; sid:1000795; ) alert tcp any any -> any any (msg:"Supheli Arac :TheSuBot/0.1 (www.thesubot.de)"; content:"TheSuBot/0.1 (www.thesubot.de)"; sid:1000796; ) alert tcp any any -> any any (msg:"Supheli Arac :UtilMind HTTPGet"; content:"UtilMind HTTPGet"; sid:1000797; ) alert tcp any any -> any any (msg:"Supheli Arac :OpenTaggerBot (http://www.opentagger.com/opentaggerbot.htm)"; content:"OpenTaggerBot (http://www.opentagger.com/opentaggerbot.htm)"; sid:1000798; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Konqueror/2.2.2; Linux 2.4.14-xfs; X11; i686)"; content:"Mozilla/5.0 (compatible; Konqueror/2.2.2; Linux 2.4.14-xfs; X11; i686)"; sid:1000799; ) alert tcp any any -> any any (msg:"Supheli Arac :Y!J-SRD/1.0"; content:"Y!J-SRD/1.0"; sid:1000800; ) alert tcp any any -> any any (msg:"Supheli Arac :Szukacz/1.x (robot; www.szukacz.pl/jakdzialarobot.html; szukacz@proszynski.pl)"; content:"Szukacz/1.x (robot; www.szukacz.pl/jakdzialarobot.html; szukacz@proszynski.pl)"; sid:1000801; ) alert tcp any any -> any any (msg:"Supheli Arac :WebVulnCrawl.unknown/1.0 libwww-perl/5.803"; content:"WebVulnCrawl.unknown/1.0 libwww-perl/5.803"; sid:1000802; ) alert tcp any any -> any any (msg:"Supheli Arac :Feed::Find/0.0x"; content:"Feed::Find/0.0x"; sid:1000803; ) alert tcp any any -> any any (msg:"Supheli Arac :AltaVista Intranet V2.0 evreka.com crawler@evreka.com"; content:"AltaVista Intranet V2.0 evreka.com crawler@evreka.com"; sid:1000804; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; PagestackerBot; http://www.pagestacker.com)"; content:"Mozilla/5.0 (compatible; PagestackerBot; http://www.pagestacker.com)"; sid:1000805; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.5 (compatible; OmniWeb/4.0.5; Mac_PowerPC)"; content:"Mozilla/4.5 (compatible; OmniWeb/4.0.5; Mac_PowerPC)"; sid:1000806; ) alert tcp any any -> any any (msg:"Supheli Arac :xine/1.0"; content:"xine/1.0"; sid:1000807; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler/6 (www.fastsearch.com)"; content:"FAST Enterprise Crawler/6 (www.fastsearch.com)"; sid:1000808; ) alert tcp any any -> any any (msg:"Supheli Arac :Carnegie_Mellon_University_WebCrawler http://www.andrew.cmu.edu/~brgordon/webbot/index.html"; content:"Carnegie_Mellon_University_WebCrawler http://www.andrew.cmu.edu/~brgordon/webbot/index.html"; sid:1000809; ) alert tcp any any -> any any (msg:"Supheli Arac :SmiffyDCMetaSpider/1.0"; content:"SmiffyDCMetaSpider/1.0"; sid:1000810; ) alert tcp any any -> any any (msg:"Supheli Arac :About/0.1libwww-perl/5.47"; content:"About/0.1libwww-perl/5.47"; sid:1000811; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; Linux i686; U;rv: 1.7.13) Gecko/20070322 Kazehakase/0.4.4.1"; content:"Mozilla/5.0 (X11; Linux i686; U;rv: 1.7.13) Gecko/20070322 Kazehakase/0.4.4.1"; sid:1000812; ) alert tcp any any -> any any (msg:"Supheli Arac :libwww-perl/5.800"; content:"libwww-perl/5.800"; sid:1000813; ) alert tcp any any -> any any (msg:"Supheli Arac :FreeFind.com-SiteSearchEngine/1.0 (http://freefind.com; spiderinfo@freefind.com)"; content:"FreeFind.com-SiteSearchEngine/1.0 (http://freefind.com; spiderinfo@freefind.com)"; sid:1000814; ) alert tcp any any -> any any (msg:"Supheli Arac :Gungho/0.08004 (http://code.google.com/p/gungho-crawler/wiki/Index)"; content:"Gungho/0.08004 (http://code.google.com/p/gungho-crawler/wiki/Index)"; sid:1000815; ) alert tcp any any -> any any (msg:"Supheli Arac :MSFrontPage/4.0"; content:"MSFrontPage/4.0"; sid:1000816; ) alert tcp any any -> any any (msg:"Supheli Arac :toCrawl/UrlDispatcher"; content:"toCrawl/UrlDispatcher"; sid:1000817; ) alert tcp any any -> any any (msg:"Supheli Arac :lcabotAccept: */*"; content:"lcabotAccept: */*"; sid:1000818; ) alert tcp any any -> any any (msg:"Supheli Arac :MediaCrawler-1.0 (Experimental)"; content:"MediaCrawler-1.0 (Experimental)"; sid:1000819; ) alert tcp any any -> any any (msg:"Supheli Arac :iGetter/2 (Macintosh; U; PPC Mac OS X; en)"; content:"iGetter/2 (Macintosh; U; PPC Mac OS X; en)"; sid:1000820; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.04 (compatible; ANTFresco/2.13; RISC OS 4.02)"; content:"Mozilla/3.04 (compatible; ANTFresco/2.13; RISC OS 4.02)"; sid:1000821; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; BlogRefsBot/0.1; http://www.blogrefs.com/about/bloggers)"; content:"Mozilla/5.0 (compatible; BlogRefsBot/0.1; http://www.blogrefs.com/about/bloggers)"; sid:1000822; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.5 (compatible; OmniWeb/4.1-beta-1; Mac_PowerPC)"; content:"Mozilla/4.5 (compatible; OmniWeb/4.1-beta-1; Mac_PowerPC)"; sid:1000823; ) alert tcp any any -> any any (msg:"Supheli Arac :mammoth/1.0 ( http://www.sli-systems.com/)"; content:"mammoth/1.0 ( http://www.sli-systems.com/)"; sid:1000824; ) alert tcp any any -> any any (msg:"Supheli Arac :Links (0.9xpre12; Linux 2.2.14-5.0 i686; 80x24)"; content:"Links (0.9xpre12; Linux 2.2.14-5.0 i686; 80x24)"; sid:1000825; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; WebCapture 3.0; Windows)"; content:"Mozilla/4.0 (compatible; WebCapture 3.0; Windows)"; sid:1000826; ) alert tcp any any -> any any (msg:"Supheli Arac :semaforo.net"; content:"semaforo.net"; sid:1000827; ) alert tcp any any -> any any (msg:"Supheli Arac :UIowaCrawler/1.0"; content:"UIowaCrawler/1.0"; sid:1000828; ) alert tcp any any -> any any (msg:"Supheli Arac :Microsoft Data Access Internet Publishing Provider Cache Manager"; content:"Microsoft Data Access Internet Publishing Provider Cache Manager"; sid:1000829; ) alert tcp any any -> any any (msg:"Supheli Arac :AVSearch-3.0(AltaVista/AVC)"; content:"AVSearch-3.0(AltaVista/AVC)"; sid:1000830; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; MSIE 6.0; Podtech Network; crawler_admin@podtech.net)"; content:"Mozilla/5.0 (compatible; MSIE 6.0; Podtech Network; crawler_admin@podtech.net)"; sid:1000831; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)"; content:"Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)"; sid:1000832; ) alert tcp any any -> any any (msg:"Supheli Arac :Pluggd/Nutch-0.9 (automated crawler http://www.pluggd.com;support at pluggd dot com)"; content:"Pluggd/Nutch-0.9 (automated crawler http://www.pluggd.com;support at pluggd dot com)"; sid:1000833; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST MetaWeb Crawler (helpdesk at fastsearch dot com)"; content:"FAST MetaWeb Crawler (helpdesk at fastsearch dot com)"; sid:1000834; ) alert tcp any any -> any any (msg:"Supheli Arac :Webglimpse 2.xx.x (http://webglimpse.net)"; content:"Webglimpse 2.xx.x (http://webglimpse.net)"; sid:1000835; ) alert tcp any any -> any any (msg:"Supheli Arac :SearchByUsa/2 (SearchByUsa; http://www.SearchByUsa.com/bot.html; info@SearchByUsa.com)"; content:"SearchByUsa/2 (SearchByUsa; http://www.SearchByUsa.com/bot.html; info@SearchByUsa.com)"; sid:1000836; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Exabot-Thumbnails)"; content:"Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Exabot-Thumbnails)"; sid:1000837; ) alert tcp any any -> any any (msg:"Supheli Arac :PlagiarBot/1.0"; content:"PlagiarBot/1.0"; sid:1000838; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteSucker/1.x.x"; content:"SiteSucker/1.x.x"; sid:1000839; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5"; content:"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5"; sid:1000840; ) alert tcp any any -> any any (msg:"Supheli Arac :de.searchengine.comBot 1.2 (http://de.searchengine.com/spider)"; content:"de.searchengine.comBot 1.2 (http://de.searchengine.com/spider)"; sid:1000841; ) alert tcp any any -> any any (msg:"Supheli Arac :Arachnoidea (arachnoidea@euroseek.com)"; content:"Arachnoidea (arachnoidea@euroseek.com)"; sid:1000842; ) alert tcp any any -> any any (msg:"Supheli Arac :NG-Search/0.90 (NG-SearchBot; http://www.ng-search.com; )"; content:"NG-Search/0.90 (NG-SearchBot; http://www.ng-search.com; )"; sid:1000843; ) alert tcp any any -> any any (msg:"Supheli Arac :ASSORT/0.10"; content:"ASSORT/0.10"; sid:1000844; ) alert tcp any any -> any any (msg:"Supheli Arac :Nucleus SiteList LinkChecker/1.1"; content:"Nucleus SiteList LinkChecker/1.1"; sid:1000845; ) alert tcp any any -> any any (msg:"Supheli Arac :augurnfind V-1.x"; content:"augurnfind V-1.x"; sid:1000846; ) alert tcp any any -> any any (msg:"Supheli Arac :WebBug/5.x"; content:"WebBug/5.x"; sid:1000847; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; LinkStash Bookmark Manager; http://www.xrayz.co.uk/)"; content:"Mozilla/5.0 (compatible; LinkStash Bookmark Manager; http://www.xrayz.co.uk/)"; sid:1000848; ) alert tcp any any -> any any (msg:"Supheli Arac :CoBITSProbe"; content:"CoBITSProbe"; sid:1000849; ) alert tcp any any -> any any (msg:"Supheli Arac :dlman"; content:"dlman"; sid:1000850; ) alert tcp any any -> any any (msg:"Supheli Arac :McBot/5.001 (windows; U; NT4.0; en-us)"; content:"McBot/5.001 (windows; U; NT4.0; en-us)"; sid:1000851; ) alert tcp any any -> any any (msg:"Supheli Arac :ArachBot"; content:"ArachBot"; sid:1000852; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; obot)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; obot)"; sid:1000853; ) alert tcp any any -> any any (msg:"Supheli Arac :Chat Catcher/1.0"; content:"Chat Catcher/1.0"; sid:1000854; ) alert tcp any any -> any any (msg:"Supheli Arac :NaverBot_dloader/1.5"; content:"NaverBot_dloader/1.5"; sid:1000855; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; SkreemRBot +http://skreemr.com)"; content:"Mozilla/5.0 (compatible; SkreemRBot +http://skreemr.com)"; sid:1000856; ) alert tcp any any -> any any (msg:"Supheli Arac :iCCrawler (http://www.iccenter.net)"; content:"iCCrawler (http://www.iccenter.net)"; sid:1000857; ) alert tcp any any -> any any (msg:"Supheli Arac :Sosospider+(+http://help.soso.com/webspider.htm)"; content:"Sosospider+(+http://help.soso.com/webspider.htm)"; sid:1000858; ) alert tcp any any -> any any (msg:"Supheli Arac :SeznamBot/1.0 (+http://fulltext.seznam.cz/)"; content:"SeznamBot/1.0 (+http://fulltext.seznam.cz/)"; sid:1000859; ) alert tcp any any -> any any (msg:"Supheli Arac :HTTPResume v. 1.x"; content:"HTTPResume v. 1.x"; sid:1000860; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (X11; I; OSF1 V4.0 alpha)"; content:"Mozilla/3.0 (X11; I; OSF1 V4.0 alpha)"; sid:1000861; ) alert tcp any any -> any any (msg:"Supheli Arac :Acoon-Robot v3.xx (http://www.acoon.de and http://www.acoon.com)"; content:"Acoon-Robot v3.xx (http://www.acoon.de and http://www.acoon.com)"; sid:1000862; ) alert tcp any any -> any any (msg:"Supheli Arac :Webspinne/1.0 webmaster@webspinne.de"; content:"Webspinne/1.0 webmaster@webspinne.de"; sid:1000863; ) alert tcp any any -> any any (msg:"Supheli Arac :Baiduspider+(+http://www.baidu.com/search/spider_jp.html)"; content:"Baiduspider+(+http://www.baidu.com/search/spider_jp.html)"; sid:1000864; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; Windows ME; Link Checker 2.x.xx http://www.kyosoft.com)"; content:"Mozilla/4.0 (compatible; MSIE 5.0; Windows ME; Link Checker 2.x.xx http://www.kyosoft.com)"; sid:1000865; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 [en] (Ask Jeeves Corporate Spider)"; content:"Mozilla/4.0 [en] (Ask Jeeves Corporate Spider)"; sid:1000866; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ODP links test; http://tuezilla.de/test-odp-links-agent.html)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ODP links test; http://tuezilla.de/test-odp-links-agent.html)"; sid:1000867; ) alert tcp any any -> any any (msg:"Supheli Arac :Demo Bot DOT 16b"; content:"Demo Bot DOT 16b"; sid:1000868; ) alert tcp any any -> any any (msg:"Supheli Arac :Commerce Browser Center"; content:"Commerce Browser Center"; sid:1000869; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Proximic crawler; +http://www.proximic.com/en/about-us/contact-us.html)"; content:"Mozilla/5.0 (compatible; Proximic crawler; +http://www.proximic.com/en/about-us/contact-us.html)"; sid:1000870; ) alert tcp any any -> any any (msg:"Supheli Arac :Microsoft Small Business Indexer"; content:"Microsoft Small Business Indexer"; sid:1000871; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008092215 Firefox/3.0.1 Orca/1.1 beta 3"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008092215 Firefox/3.0.1 Orca/1.1 beta 3"; sid:1000872; ) alert tcp any any -> any any (msg:"Supheli Arac :autoemailspider"; content:"autoemailspider"; sid:1000873; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Zenbot/1.3; +http://zen.co.za/webmasters/)"; content:"Mozilla/5.0 (compatible; Zenbot/1.3; +http://zen.co.za/webmasters/)"; sid:1000874; ) alert tcp any any -> any any (msg:"Supheli Arac :JDK/1.1"; content:"JDK/1.1"; sid:1000875; ) alert tcp any any -> any any (msg:"Supheli Arac :WSB WebCrawler V1.0 (Beta)- cl@cs.uni-dortmund.de"; content:"WSB WebCrawler V1.0 (Beta)- cl@cs.uni-dortmund.de"; sid:1000876; ) alert tcp any any -> any any (msg:"Supheli Arac :Covac TexAs Arachbot"; content:"Covac TexAs Arachbot"; sid:1000877; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.7 (atw-crawler at fast dot no; http://fast.no/support/crawler.asp)"; content:"FAST-WebCrawler/3.7 (atw-crawler at fast dot no; http://fast.no/support/crawler.asp)"; sid:1000878; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.72 [en] (BACS http://www.ba.be)"; content:"Mozilla/4.72 [en] (BACS http://www.ba.be)"; sid:1000879; ) alert tcp any any -> any any (msg:"Supheli Arac :Pagestacker Bot"; content:"Pagestacker Bot"; sid:1000880; ) alert tcp any any -> any any (msg:"Supheli Arac :Patwebbot (http://www.herz-power.de/technik.html)"; content:"Patwebbot (http://www.herz-power.de/technik.html)"; sid:1000881; ) alert tcp any any -> any any (msg:"Supheli Arac :AmfibiBOT"; content:"AmfibiBOT"; sid:1000882; ) alert tcp any any -> any any (msg:"Supheli Arac :A1 Keyword Research/1.0.2 (+http://www.micro-sys.dk/products/keyword-research/) miggibot/2007.03.27"; content:"A1 Keyword Research/1.0.2 (+http://www.micro-sys.dk/products/keyword-research/) miggibot/2007.03.27"; sid:1000883; ) alert tcp any any -> any any (msg:"Supheli Arac :WinWAP/3.x (3.x.x.xx; Win32) (Google WAP Proxy/1.0)"; content:"WinWAP/3.x (3.x.x.xx; Win32) (Google WAP Proxy/1.0)"; sid:1000884; ) alert tcp any any -> any any (msg:"Supheli Arac :WebZIP/x.x (http://www.spidersoft.com)"; content:"WebZIP/x.x (http://www.spidersoft.com)"; sid:1000885; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Lotus-Notes/5.0; Windows-NT)"; content:"Mozilla/4.0 (compatible; Lotus-Notes/5.0; Windows-NT)"; sid:1000886; ) alert tcp any any -> any any (msg:"Supheli Arac :aardvark-crawler"; content:"aardvark-crawler"; sid:1000887; ) alert tcp any any -> any any (msg:"Supheli Arac :e-SocietyRobot(http://www.yama.info.waseda.ac.jp/~yamana/es/)"; content:"e-SocietyRobot(http://www.yama.info.waseda.ac.jp/~yamana/es/)"; sid:1000888; ) alert tcp any any -> any any (msg:"Supheli Arac :ScoutAnt/0.1; +http://www.ant.com/what_is_ant.com/"; content:"ScoutAnt/0.1; +http://www.ant.com/what_is_ant.com/"; sid:1000889; ) alert tcp any any -> any any (msg:"Supheli Arac :Jakarta Commons-HttpClient/2.0xxx"; content:"Jakarta Commons-HttpClient/2.0xxx"; sid:1000890; ) alert tcp any any -> any any (msg:"Supheli Arac :ISC Systems iRc Search 2.1"; content:"ISC Systems iRc Search 2.1"; sid:1000891; ) alert tcp any any -> any any (msg:"Supheli Arac :AIBOT/2.1 By +(www.21seek.com A Real artificial intelligence search engine China)"; content:"AIBOT/2.1 By +(www.21seek.com A Real artificial intelligence search engine China)"; sid:1000892; ) alert tcp any any -> any any (msg:"Supheli Arac :Mylinea.com Crawler 2.0"; content:"Mylinea.com Crawler 2.0"; sid:1000893; ) alert tcp any any -> any any (msg:"Supheli Arac :FindAnISP.com_ISP_Finder_v99a"; content:"FindAnISP.com_ISP_Finder_v99a"; sid:1000894; ) alert tcp any any -> any any (msg:"Supheli Arac :( Robots.txt Validator http://www.searchengineworld.com/cgi-bin/robotcheck.cgi )"; content:"( Robots.txt Validator http://www.searchengineworld.com/cgi-bin/robotcheck.cgi )"; sid:1000895; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible;archive.org_bot/heritrix-1.9.0-200608171144 +http://pandora.nla.gov.au/crawl.html)"; content:"Mozilla/5.0 (compatible;archive.org_bot/heritrix-1.9.0-200608171144 +http://pandora.nla.gov.au/crawl.html)"; sid:1000896; ) alert tcp any any -> any any (msg:"Supheli Arac :FeedZcollector v1.x (Platinum) http://www.feeds4all.com/feedzcollector"; content:"FeedZcollector v1.x (Platinum) http://www.feeds4all.com/feedzcollector"; sid:1000897; ) alert tcp any any -> any any (msg:"Supheli Arac :FSurf15a 01"; content:"FSurf15a 01"; sid:1000898; ) alert tcp any any -> any any (msg:"Supheli Arac :LECodeChecker/3.0 libgetdoc/1.0"; content:"LECodeChecker/3.0 libgetdoc/1.0"; sid:1000899; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (fantomBrowser)"; content:"Mozilla/4.0 (fantomBrowser)"; sid:1000900; ) alert tcp any any -> any any (msg:"Supheli Arac :FeedDemon/2.7 (http://www.newsgator.com/; Microsoft Windows XP)"; content:"FeedDemon/2.7 (http://www.newsgator.com/; Microsoft Windows XP)"; sid:1000901; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; BTinternet V8.1)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; BTinternet V8.1)"; sid:1000902; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SIMBAR Enabled; InfoPath.1)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SIMBAR Enabled; InfoPath.1)"; sid:1000903; ) alert tcp any any -> any any (msg:"Supheli Arac :WebReaper [info@webreaper.net]"; content:"WebReaper [info@webreaper.net]"; sid:1000904; ) alert tcp any any -> any any (msg:"Supheli Arac :Eurobot/1.0 (http://www.ayell.eu)"; content:"Eurobot/1.0 (http://www.ayell.eu)"; sid:1000905; ) alert tcp any any -> any any (msg:"Supheli Arac :SoftHypermarketFileCheckBot/1.0+(+http://www.softhypermaket.com)"; content:"SoftHypermarketFileCheckBot/1.0+(+http://www.softhypermaket.com)"; sid:1000906; ) alert tcp any any -> any any (msg:"Supheli Arac :Missouri College Browse"; content:"Missouri College Browse"; sid:1000907; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; PEAR HTTP_Request class; http://feed.moo.jp/)"; content:"Mozilla/5.0 (compatible; PEAR HTTP_Request class; http://feed.moo.jp/)"; sid:1000908; ) alert tcp any any -> any any (msg:"Supheli Arac :InetURL/1.0"; content:"InetURL/1.0"; sid:1000909; ) alert tcp any any -> any any (msg:"Supheli Arac :curl/7.10.x (i386-redhat-linux-gnu) libcurl/7.10.x OpenSSL/0.9.7a ipv6 zlib/1.1.4"; content:"curl/7.10.x (i386-redhat-linux-gnu) libcurl/7.10.x OpenSSL/0.9.7a ipv6 zlib/1.1.4"; sid:1000910; ) alert tcp any any -> any any (msg:"Supheli Arac :A-Online Search"; content:"A-Online Search"; sid:1000911; ) alert tcp any any -> any any (msg:"Supheli Arac :Mister Pix II 2.02a"; content:"Mister Pix II 2.02a"; sid:1000912; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkLint-checkonly/2.x.x"; content:"LinkLint-checkonly/2.x.x"; sid:1000913; ) alert tcp any any -> any any (msg:"Supheli Arac :great-plains-web-spider/flatlandbot (Flatland Industries Web Spider; http://www.flatlandindustries.com/flatlandbot.php; jason@flatlandindustries.com)"; content:"great-plains-web-spider/flatlandbot (Flatland Industries Web Spider; http://www.flatlandindustries.com/flatlandbot.php; jason@flatlandindustries.com)"; sid:1000914; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; iRider 2.21.1108; FDM)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; iRider 2.21.1108; FDM)"; sid:1000915; ) alert tcp any any -> any any (msg:"Supheli Arac :MLBot (www.metadatalabs.com)"; content:"MLBot (www.metadatalabs.com)"; sid:1000916; ) alert tcp any any -> any any (msg:"Supheli Arac :BlogBridge 2.13 (http://www.blogbridge.com/)"; content:"BlogBridge 2.13 (http://www.blogbridge.com/)"; sid:1000917; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Hermit Search. Com; +http://www.hermitsearch.com)"; content:"Mozilla/5.0 (compatible; Hermit Search. Com; +http://www.hermitsearch.com)"; sid:1000918; ) alert tcp any any -> any any (msg:"Supheli Arac :MJ12bot/vx.x.x (http://www.majestic12.co.uk/projects/dsearch/mj12bot.php)"; content:"MJ12bot/vx.x.x (http://www.majestic12.co.uk/projects/dsearch/mj12bot.php)"; sid:1000919; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/5.12 (Windows 98; U) [en]"; content:"Opera/5.12 (Windows 98; U) [en]"; sid:1000920; ) alert tcp any any -> any any (msg:"Supheli Arac :DeepIndex"; content:"DeepIndex"; sid:1000921; ) alert tcp any any -> any any (msg:"Supheli Arac :kulturarw3/0.1"; content:"kulturarw3/0.1"; sid:1000922; ) alert tcp any any -> any any (msg:"Supheli Arac :NewsGator FetchLinks extension/0.2.0 (http://graemef.com)"; content:"NewsGator FetchLinks extension/0.2.0 (http://graemef.com)"; sid:1000923; ) alert tcp any any -> any any (msg:"Supheli Arac :Checkbot/1.xx LWP/5.xx"; content:"Checkbot/1.xx LWP/5.xx"; sid:1000924; ) alert tcp any any -> any any (msg:"Supheli Arac :RSSMicro.com RSS/Atom Feed Robot"; content:"RSSMicro.com RSS/Atom Feed Robot"; sid:1000925; ) alert tcp any any -> any any (msg:"Supheli Arac :yacybot (x86 Windows XP 5.1; java 1.5.0_06; Europe/de) yacy.net"; content:"yacybot (x86 Windows XP 5.1; java 1.5.0_06; Europe/de) yacy.net"; sid:1000926; ) alert tcp any any -> any any (msg:"Supheli Arac :Infoseek SideWinder/1.45 (Compatible; MSIE 10.0; UNIX)"; content:"Infoseek SideWinder/1.45 (Compatible; MSIE 10.0; UNIX)"; sid:1000927; ) alert tcp any any -> any any (msg:"Supheli Arac :Bloglines-Images/0.1 (http://www.bloglines.com)"; content:"Bloglines-Images/0.1 (http://www.bloglines.com)"; sid:1000928; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows 98; .NET CLR 1.1.4322; MEGAUPLOAD 2.0)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows 98; .NET CLR 1.1.4322; MEGAUPLOAD 2.0)"; sid:1000929; ) alert tcp any any -> any any (msg:"Supheli Arac :DAP x.x"; content:"DAP x.x"; sid:1000930; ) alert tcp any any -> any any (msg:"Supheli Arac :sitecheck.internetseer.com (For more info see: http://sitecheck.internetseer.com)"; content:"sitecheck.internetseer.com (For more info see: http://sitecheck.internetseer.com)"; sid:1000931; ) alert tcp any any -> any any (msg:"Supheli Arac :OpenWebSpider/x"; content:"OpenWebSpider/x"; sid:1000932; ) alert tcp any any -> any any (msg:"Supheli Arac :LeechGet 200x (www.leechget.de)"; content:"LeechGet 200x (www.leechget.de)"; sid:1000933; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; grub-client-2.x)"; content:"Mozilla/4.0 (compatible; grub-client-2.x)"; sid:1000934; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkPimpin v1.0"; content:"LinkPimpin v1.0"; sid:1000935; ) alert tcp any any -> any any (msg:"Supheli Arac :Dual Proxy"; content:"Dual Proxy"; sid:1000936; ) alert tcp any any -> any any (msg:"Supheli Arac :FyberSpider (+http://www.fybersearch.com/fyberspider.php)"; content:"FyberSpider (+http://www.fybersearch.com/fyberspider.php)"; sid:1000937; ) alert tcp any any -> any any (msg:"Supheli Arac :Combine/3 http://combine.it.lth.se/"; content:"Combine/3 http://combine.it.lth.se/"; sid:1000938; ) alert tcp any any -> any any (msg:"Supheli Arac :Download Demon/3.x.x.x"; content:"Download Demon/3.x.x.x"; sid:1000939; ) alert tcp any any -> any any (msg:"Supheli Arac :HiDownload"; content:"HiDownload"; sid:1000940; ) alert tcp any any -> any any (msg:"Supheli Arac :Swooglebot/2.0. (+http://swoogle.umbc.edu/swooglebot.htm)"; content:"Swooglebot/2.0. (+http://swoogle.umbc.edu/swooglebot.htm)"; sid:1000941; ) alert tcp any any -> any any (msg:"Supheli Arac :OntoSpider/1.0 libwww-perl/5.65"; content:"OntoSpider/1.0 libwww-perl/5.65"; sid:1000942; ) alert tcp any any -> any any (msg:"Supheli Arac :Gagglebot"; content:"Gagglebot"; sid:1000943; ) alert tcp any any -> any any (msg:"Supheli Arac :ContactBot/0.2"; content:"ContactBot/0.2"; sid:1000944; ) alert tcp any any -> any any (msg:"Supheli Arac :BTbot/0.x (+http://www.btbot.com/btbot.html)"; content:"BTbot/0.x (+http://www.btbot.com/btbot.html)"; sid:1000945; ) alert tcp any any -> any any (msg:"Supheli Arac :DaviesBot/1.7 (www.wholeweb.net)"; content:"DaviesBot/1.7 (www.wholeweb.net)"; sid:1000946; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.2 (larbin2.6.2@unspecified.mail)"; content:"larbin_2.6.2 (larbin2.6.2@unspecified.mail)"; sid:1000947; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter2_Mercator_x-x.0"; content:"Scooter2_Mercator_x-x.0"; sid:1000948; ) alert tcp any any -> any any (msg:"Supheli Arac :Orca Browser (http://www.orcabrowser.com)"; content:"Orca Browser (http://www.orcabrowser.com)"; sid:1000949; ) alert tcp any any -> any any (msg:"Supheli Arac :Trailfire/0.7.1 (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"; content:"Trailfire/0.7.1 (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"; sid:1000950; ) alert tcp any any -> any any (msg:"Supheli Arac :Bobby/4.0.x RPT-HTTPClient/0.3-3E"; content:"Bobby/4.0.x RPT-HTTPClient/0.3-3E"; sid:1000951; ) alert tcp any any -> any any (msg:"Supheli Arac :DataFountains/DMOZ Feature Vector Corpus Creator (http://ivia.ucr.edu/useragents.shtml)"; content:"DataFountains/DMOZ Feature Vector Corpus Creator (http://ivia.ucr.edu/useragents.shtml)"; sid:1000952; ) alert tcp any any -> any any (msg:"Supheli Arac :webcrawl.net"; content:"webcrawl.net"; sid:1000953; ) alert tcp any any -> any any (msg:"Supheli Arac :myDaemon"; content:"myDaemon"; sid:1000954; ) alert tcp any any -> any any (msg:"Supheli Arac :exactseek-crawler-2.63 (crawler@exactseek.com)"; content:"exactseek-crawler-2.63 (crawler@exactseek.com)"; sid:1000955; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter/2.0 G.R.A.B. X2.0"; content:"Scooter/2.0 G.R.A.B. X2.0"; sid:1000956; ) alert tcp any any -> any any (msg:"Supheli Arac :BravoBrian bstop.bravobrian.it"; content:"BravoBrian bstop.bravobrian.it"; sid:1000957; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteSpider +(http://www.SiteSpider.com/)"; content:"SiteSpider +(http://www.SiteSpider.com/)"; sid:1000958; ) alert tcp any any -> any any (msg:"Supheli Arac :Gigabot/2.0/gigablast.com/spider.html"; content:"Gigabot/2.0/gigablast.com/spider.html"; sid:1000959; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; robtexbot/1.0; http://www.robtex.com/ )"; content:"Mozilla/5.0 (compatible; robtexbot/1.0; http://www.robtex.com/ )"; sid:1000960; ) alert tcp any any -> any any (msg:"Supheli Arac :egothor/3.0a (+http://www.xdefine.org/robot.html)"; content:"egothor/3.0a (+http://www.xdefine.org/robot.html)"; sid:1000961; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Bot; +http://pressemitteilung.ws/spamfilter"; content:"Mozilla/5.0 (compatible; Bot; +http://pressemitteilung.ws/spamfilter"; sid:1000962; ) alert tcp any any -> any any (msg:"Supheli Arac :GetBot"; content:"GetBot"; sid:1000963; ) alert tcp any any -> any any (msg:"Supheli Arac :Piffany_Web_Scraper_v0.x"; content:"Piffany_Web_Scraper_v0.x"; sid:1000964; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"; content:"Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"; sid:1000965; ) alert tcp any any -> any any (msg:"Supheli Arac :FairAd Client"; content:"FairAd Client"; sid:1000966; ) alert tcp any any -> any any (msg:"Supheli Arac :BravoBrian SpiderEngine MarcoPolo"; content:"BravoBrian SpiderEngine MarcoPolo"; sid:1000967; ) alert tcp any any -> any any (msg:"Supheli Arac :WebCopier vx.xa"; content:"WebCopier vx.xa"; sid:1000968; ) alert tcp any any -> any any (msg:"Supheli Arac :HTTPEyes"; content:"HTTPEyes"; sid:1000969; ) alert tcp any any -> any any (msg:"Supheli Arac :GrapeFX/0.3 libwww/5.4.0"; content:"GrapeFX/0.3 libwww/5.4.0"; sid:1000970; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Vagabondo/2.2; webcrawler at wise-guys dot nl; http://webagent.wise-guys.nl/)"; content:"Mozilla/4.0 (compatible; Vagabondo/2.2; webcrawler at wise-guys dot nl; http://webagent.wise-guys.nl/)"; sid:1000971; ) alert tcp any any -> any any (msg:"Supheli Arac :AlertInfo 2.0 (Powered by Newsbrain)"; content:"AlertInfo 2.0 (Powered by Newsbrain)"; sid:1000972; ) alert tcp any any -> any any (msg:"Supheli Arac :NetPumper/x.xx"; content:"NetPumper/x.xx"; sid:1000973; ) alert tcp any any -> any any (msg:"Supheli Arac :BlogzIce/1.0 +http://www.icerocket.com/"; content:"BlogzIce/1.0 +http://www.icerocket.com/"; sid:1000974; ) alert tcp any any -> any any (msg:"Supheli Arac :BDNcentral Crawler v2.3 [en] (http://www.bdncentral.com/robot.html) (X11; I; Linux 2.0.44 i686)"; content:"BDNcentral Crawler v2.3 [en] (http://www.bdncentral.com/robot.html) (X11; I; Linux 2.0.44 i686)"; sid:1000975; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; www.euro-directory.com; urlchecker1.0)"; content:"Mozilla/4.0 (compatible; www.euro-directory.com; urlchecker1.0)"; sid:1000976; ) alert tcp any any -> any any (msg:"Supheli Arac :Mister PiX version.dll"; content:"Mister PiX version.dll"; sid:1000977; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.x Multimedia (mm dash crawler at fast dot no)"; content:"FAST-WebCrawler/3.x Multimedia (mm dash crawler at fast dot no)"; sid:1000978; ) alert tcp any any -> any any (msg:"Supheli Arac :AmigaVoyager/3.4.4 (MorphOS/PPC native)"; content:"AmigaVoyager/3.4.4 (MorphOS/PPC native)"; sid:1000979; ) alert tcp any any -> any any (msg:"Supheli Arac :FavIconizer"; content:"FavIconizer"; sid:1000980; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (FM Scene 4.6.1)"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (FM Scene 4.6.1)"; sid:1000981; ) alert tcp any any -> any any (msg:"Supheli Arac :Searchspider/1.2 (SearchSpider; http://www.searchspider.com; webmaster@searchspider.com)"; content:"Searchspider/1.2 (SearchSpider; http://www.searchspider.com; webmaster@searchspider.com)"; sid:1000982; ) alert tcp any any -> any any (msg:"Supheli Arac :WebCopier vx.x"; content:"WebCopier vx.x"; sid:1000983; ) alert tcp any any -> any any (msg:"Supheli Arac :Acoon Robot v1.52 (http://www.acoon.de)"; content:"Acoon Robot v1.52 (http://www.acoon.de)"; sid:1000984; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; MSIE 3.0; AK; Windows 95)"; content:"Mozilla/2.0 (compatible; MSIE 3.0; AK; Windows 95)"; sid:1000985; ) alert tcp any any -> any any (msg:"Supheli Arac :AVSearch-2.0-fusionIdx-14-CompetitorWebSites"; content:"AVSearch-2.0-fusionIdx-14-CompetitorWebSites"; sid:1000986; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 Galeon/1.0.2 (X11; Linux i686; U;) Gecko/20011224"; content:"Mozilla/5.0 Galeon/1.0.2 (X11; Linux i686; U;) Gecko/20011224"; sid:1000987; ) alert tcp any any -> any any (msg:"Supheli Arac :Insitor.com search and find world wide!"; content:"Insitor.com search and find world wide!"; sid:1000988; ) alert tcp any any -> any any (msg:"Supheli Arac :YahooSeeker/CafeKelsa-dev (compatible; Konqueror/3.2; FreeBSD ;cafekelsa-dev-webmaster@yahoo-inc.com )"; content:"YahooSeeker/CafeKelsa-dev (compatible; Konqueror/3.2; FreeBSD ;cafekelsa-dev-webmaster@yahoo-inc.com )"; sid:1000989; ) alert tcp any any -> any any (msg:"Supheli Arac :GSiteCrawler/v1.xx rev. xxx (http://gsitecrawler.com/)"; content:"GSiteCrawler/v1.xx rev. xxx (http://gsitecrawler.com/)"; sid:1000990; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801"; content:"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801"; sid:1000991; ) alert tcp any any -> any any (msg:"Supheli Arac :Download.exe(1.1) (+http://www.sql-und-xml.de/freeware-tools/)"; content:"Download.exe(1.1) (+http://www.sql-und-xml.de/freeware-tools/)"; sid:1000992; ) alert tcp any any -> any any (msg:"Supheli Arac :URL Spider Pro/x.xx (innerprise.net)"; content:"URL Spider Pro/x.xx (innerprise.net)"; sid:1000993; ) alert tcp any any -> any any (msg:"Supheli Arac :Vayala|Creep-v0.0.1 (codepoet@wildties.com)"; content:"Vayala|Creep-v0.0.1 (codepoet@wildties.com)"; sid:1000994; ) alert tcp any any -> any any (msg:"Supheli Arac :Stamina/1.4"; content:"Stamina/1.4"; sid:1000995; ) alert tcp any any -> any any (msg:"Supheli Arac :Snappy/1.1 ( http://www.urltrends.com/ )"; content:"Snappy/1.1 ( http://www.urltrends.com/ )"; sid:1000996; ) alert tcp any any -> any any (msg:"Supheli Arac :RedBot/redbot-1.0 (Rediff.com Crawler; redbot at rediff dot com)"; content:"RedBot/redbot-1.0 (Rediff.com Crawler; redbot at rediff dot com)"; sid:1000997; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (Compatible; AOL-IWENG 3.0; Win16)"; content:"Mozilla/2.0 (Compatible; AOL-IWENG 3.0; Win16)"; sid:1000998; ) alert tcp any any -> any any (msg:"Supheli Arac :www4mail/2.x libwww-FM/2.14 (Unix; I)"; content:"www4mail/2.x libwww-FM/2.14 (Unix; I)"; sid:1000999; ) alert tcp any any -> any any (msg:"Supheli Arac :Nocilla/1.0"; content:"Nocilla/1.0"; sid:1001000; ) alert tcp any any -> any any (msg:"Supheli Arac :NEC Research Agent -- compuman at research.nj.nec.com"; content:"NEC Research Agent -- compuman at research.nj.nec.com"; sid:1001001; ) alert tcp any any -> any any (msg:"Supheli Arac :IpselonBot/0.xx-beta (Ipselon; http://www.ipselon.com; ipselonbot@ipselon.com)"; content:"IpselonBot/0.xx-beta (Ipselon; http://www.ipselon.com; ipselonbot@ipselon.com)"; sid:1001002; ) alert tcp any any -> any any (msg:"Supheli Arac :yoofind/yoofind-0.1-dev (yoono webcrawler; http://www.yoono.com ; MyEmail)"; content:"yoofind/yoofind-0.1-dev (yoono webcrawler; http://www.yoono.com ; MyEmail)"; sid:1001003; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Abonti/0.8 - http://www.abonti.com)"; content:"Mozilla/5.0 (compatible; Abonti/0.8 - http://www.abonti.com)"; sid:1001004; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; worio bot heritrix/1.10.0 +http://worio.com)"; content:"Mozilla/5.0 (compatible; worio bot heritrix/1.10.0 +http://worio.com)"; sid:1001005; ) alert tcp any any -> any any (msg:"Supheli Arac :HolmesBot (http://holmes.ge)"; content:"HolmesBot (http://holmes.ge)"; sid:1001006; ) alert tcp any any -> any any (msg:"Supheli Arac :LightningDownload/1.x.x [Accelerated x]"; content:"LightningDownload/1.x.x [Accelerated x]"; sid:1001007; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.4/Nirvana (crawler@fast.no; http://fast.no/support.php?c=faqs/crawler)"; content:"FAST-WebCrawler/3.4/Nirvana (crawler@fast.no; http://fast.no/support.php?c=faqs/crawler)"; sid:1001008; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.01 (compatible; NORAD National Defence Network)"; content:"Mozilla/4.01 (compatible; NORAD National Defence Network)"; sid:1001009; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.8 (atw-crawler at fast dot no; http://fast.no/support/crawler.asp)"; content:"FAST-WebCrawler/3.8 (atw-crawler at fast dot no; http://fast.no/support/crawler.asp)"; sid:1001010; ) alert tcp any any -> any any (msg:"Supheli Arac :Snoopy v1.xx- : User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MyIE2)"; content:"Snoopy v1.xx- : User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MyIE2)"; sid:1001011; ) alert tcp any any -> any any (msg:"Supheli Arac :Arikus_Spider"; content:"Arikus_Spider"; sid:1001012; ) alert tcp any any -> any any (msg:"Supheli Arac :SandCrawler - Compatibility Testing"; content:"SandCrawler - Compatibility Testing"; sid:1001013; ) alert tcp any any -> any any (msg:"Supheli Arac :Sphider"; content:"Sphider"; sid:1001014; ) alert tcp any any -> any any (msg:"Supheli Arac :Industry Program 1.0.x"; content:"Industry Program 1.0.x"; sid:1001015; ) alert tcp any any -> any any (msg:"Supheli Arac :BloobyBot"; content:"BloobyBot"; sid:1001016; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Cerberian Drtrs Version-3.2-Build-0)"; content:"Mozilla/4.0 (compatible; Cerberian Drtrs Version-3.2-Build-0)"; sid:1001017; ) alert tcp any any -> any any (msg:"Supheli Arac :BigCliqueBOT/1.03-dev (bigclicbot; http://www.bigclique.com; bot@bigclique.com)"; content:"BigCliqueBOT/1.03-dev (bigclicbot; http://www.bigclique.com; bot@bigclique.com)"; sid:1001018; ) alert tcp any any -> any any (msg:"Supheli Arac :ESurf15a 15"; content:"ESurf15a 15"; sid:1001019; ) alert tcp any any -> any any (msg:"Supheli Arac :OOZBOT/0.20 ( http://www.setooz.com/oozbot.html ; agentname at setooz dot_com )"; content:"OOZBOT/0.20 ( http://www.setooz.com/oozbot.html ; agentname at setooz dot_com )"; sid:1001020; ) alert tcp any any -> any any (msg:"Supheli Arac :Robot@SuperSnooper.Com"; content:"Robot@SuperSnooper.Com"; sid:1001021; ) alert tcp any any -> any any (msg:"Supheli Arac :hgrepurl/1.0"; content:"hgrepurl/1.0"; sid:1001022; ) alert tcp any any -> any any (msg:"Supheli Arac :Activeworlds"; content:"Activeworlds"; sid:1001023; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; bgft)"; content:"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; bgft)"; sid:1001024; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Heritrix/1.8.0 http://www.hanzoarchives.com)"; content:"Mozilla/5.0 (compatible; Heritrix/1.8.0 http://www.hanzoarchives.com)"; sid:1001025; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Diffbot/0.1; +http://www.diffbot.com)"; content:"Mozilla/5.0 (compatible; Diffbot/0.1; +http://www.diffbot.com)"; sid:1001026; ) alert tcp any any -> any any (msg:"Supheli Arac :http://OzySoftware.com/Index.html"; content:"http://OzySoftware.com/Index.html"; sid:1001027; ) alert tcp any any -> any any (msg:"Supheli Arac :Matrix S.p.A. - FAST Enterprise Crawler 6 (Unknown admin e-mail address)"; content:"Matrix S.p.A. - FAST Enterprise Crawler 6 (Unknown admin e-mail address)"; sid:1001028; ) alert tcp any any -> any any (msg:"Supheli Arac :XMLSlurp/0.1 libwww-perl/5.805"; content:"XMLSlurp/0.1 libwww-perl/5.805"; sid:1001029; ) alert tcp any any -> any any (msg:"Supheli Arac :LWP::Simple/5.22"; content:"LWP::Simple/5.22"; sid:1001030; ) alert tcp any any -> any any (msg:"Supheli Arac :LWP::Simple/5.36"; content:"LWP::Simple/5.36"; sid:1001031; ) alert tcp any any -> any any (msg:"Supheli Arac :LWP::Simple/5.48"; content:"LWP::Simple/5.48"; sid:1001032; ) alert tcp any any -> any any (msg:"Supheli Arac :LWP::Simple/5.50"; content:"LWP::Simple/5.50"; sid:1001033; ) alert tcp any any -> any any (msg:"Supheli Arac :LWP::Simple/5.51"; content:"LWP::Simple/5.51"; sid:1001034; ) alert tcp any any -> any any (msg:"Supheli Arac :LWP::Simple/5.53"; content:"LWP::Simple/5.53"; sid:1001035; ) alert tcp any any -> any any (msg:"Supheli Arac :LWP::Simple/5.63"; content:"LWP::Simple/5.63"; sid:1001036; ) alert tcp any any -> any any (msg:"Supheli Arac :generic_crawler/01.0217/"; content:"generic_crawler/01.0217/"; sid:1001037; ) alert tcp any any -> any any (msg:"Supheli Arac :AU-MIC/2.0 MMP/2.0"; content:"AU-MIC/2.0 MMP/2.0"; sid:1001038; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.01 (compatible; AmigaVoyager/2.95; AmigaOS/MC680x0)"; content:"Mozilla/3.01 (compatible; AmigaVoyager/2.95; AmigaOS/MC680x0)"; sid:1001039; ) alert tcp any any -> any any (msg:"Supheli Arac :Asahina-Antenna/1.x (libhina.pl/x.x ; libtime.pl/x.x)"; content:"Asahina-Antenna/1.x (libhina.pl/x.x ; libtime.pl/x.x)"; sid:1001040; ) alert tcp any any -> any any (msg:"Supheli Arac :SearchSight/2.0 (http://SearchSight.com/)"; content:"SearchSight/2.0 (http://SearchSight.com/)"; sid:1001041; ) alert tcp any any -> any any (msg:"Supheli Arac :DNSRight.com WebBot Link Ckeck Tool. Report abuse to: dnsr@dnsright.com"; content:"DNSRight.com WebBot Link Ckeck Tool. Report abuse to: dnsr@dnsright.com"; sid:1001042; ) alert tcp any any -> any any (msg:"Supheli Arac :PuxaRapido v1.0"; content:"PuxaRapido v1.0"; sid:1001043; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (+http://www.sli-systems.com/) Mammoth/0.1"; content:"Mozilla/5.0 (+http://www.sli-systems.com/) Mammoth/0.1"; sid:1001044; ) alert tcp any any -> any any (msg:"Supheli Arac :Vespa Crawler"; content:"Vespa Crawler"; sid:1001045; ) alert tcp any any -> any any (msg:"Supheli Arac :voyager/1.0"; content:"voyager/1.0"; sid:1001046; ) alert tcp any any -> any any (msg:"Supheli Arac :AltaVista Intranet V2.0 AVS EVAL search@freeit.com"; content:"AltaVista Intranet V2.0 AVS EVAL search@freeit.com"; sid:1001047; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.6 [en] (http://www.cnet.com/)"; content:"Mozilla/4.6 [en] (http://www.cnet.com/)"; sid:1001048; ) alert tcp any any -> any any (msg:"Supheli Arac :GOFORITBOT ( http://www.goforit.com/about/ )"; content:"GOFORITBOT ( http://www.goforit.com/about/ )"; sid:1001049; ) alert tcp any any -> any any (msg:"Supheli Arac :Waypath development crawler - info at waypath dot com"; content:"Waypath development crawler - info at waypath dot com"; sid:1001050; ) alert tcp any any -> any any (msg:"Supheli Arac :StackRambler/x.x"; content:"StackRambler/x.x"; sid:1001051; ) alert tcp any any -> any any (msg:"Supheli Arac :Cityreview Robot (+http://www.cityreview.org/crawler/)"; content:"Cityreview Robot (+http://www.cityreview.org/crawler/)"; sid:1001052; ) alert tcp any any -> any any (msg:"Supheli Arac :WebSearch.COM.AU/3.0.1 (The Australian Search Engine; http://WebSearch.COM.AU; Search@WebSearch.COM.AU)"; content:"WebSearch.COM.AU/3.0.1 (The Australian Search Engine; http://WebSearch.COM.AU; Search@WebSearch.COM.AU)"; sid:1001053; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) VoilaBot BETA 1.2 (http://www.voila.com/)"; content:"Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) VoilaBot BETA 1.2 (http://www.voila.com/)"; sid:1001054; ) alert tcp any any -> any any (msg:"Supheli Arac :sitecheck.internetseer.com"; content:"sitecheck.internetseer.com"; sid:1001055; ) alert tcp any any -> any any (msg:"Supheli Arac :MVAClient"; content:"MVAClient"; sid:1001056; ) alert tcp any any -> any any (msg:"Supheli Arac :Zeus ThemeSite Viewer Webster Pro V2.9 Win32"; content:"Zeus ThemeSite Viewer Webster Pro V2.9 Win32"; sid:1001057; ) alert tcp any any -> any any (msg:"Supheli Arac :Progressive Download HTTP check"; content:"Progressive Download HTTP check"; sid:1001058; ) alert tcp any any -> any any (msg:"Supheli Arac :http://Anonymouse.org/ (Unix)"; content:"http://Anonymouse.org/ (Unix)"; sid:1001059; ) alert tcp any any -> any any (msg:"Supheli Arac :LTI/LemurProject Nutch Spider/Nutch-1.0-dev (lti crawler for CMU; http://www.lti.cs.cmu.edu; changkuk at cmu dot edu)"; content:"LTI/LemurProject Nutch Spider/Nutch-1.0-dev (lti crawler for CMU; http://www.lti.cs.cmu.edu; changkuk at cmu dot edu)"; sid:1001060; ) alert tcp any any -> any any (msg:"Supheli Arac :ESISmartSpider"; content:"ESISmartSpider"; sid:1001061; ) alert tcp any any -> any any (msg:"Supheli Arac :EroCrawler"; content:"EroCrawler"; sid:1001062; ) alert tcp any any -> any any (msg:"Supheli Arac :Test spider"; content:"Test spider"; sid:1001063; ) alert tcp any any -> any any (msg:"Supheli Arac :BDFetch"; content:"BDFetch"; sid:1001064; ) alert tcp any any -> any any (msg:"Supheli Arac :DA 4.0"; content:"DA 4.0"; sid:1001065; ) alert tcp any any -> any any (msg:"Supheli Arac :DA 5.0"; content:"DA 5.0"; sid:1001066; ) alert tcp any any -> any any (msg:"Supheli Arac :DA 7.0"; content:"DA 7.0"; sid:1001067; ) alert tcp any any -> any any (msg:"Supheli Arac :Apple-PubSub/65.1.1"; content:"Apple-PubSub/65.1.1"; sid:1001068; ) alert tcp any any -> any any (msg:"Supheli Arac :WWWOFFLE/2.x"; content:"WWWOFFLE/2.x"; sid:1001069; ) alert tcp any any -> any any (msg:"Supheli Arac :pipeLiner/0.xx (PipeLine Spider; http://www.pipeline-search.com/webmaster.html)"; content:"pipeLiner/0.xx (PipeLine Spider; http://www.pipeline-search.com/webmaster.html)"; sid:1001070; ) alert tcp any any -> any any (msg:"Supheli Arac :spider.yellopet.com - www.yellopet.com"; content:"spider.yellopet.com - www.yellopet.com"; sid:1001071; ) alert tcp any any -> any any (msg:"Supheli Arac :URLGetFile"; content:"URLGetFile"; sid:1001072; ) alert tcp any any -> any any (msg:"Supheli Arac :speedfind ramBot xtreme 8.1"; content:"speedfind ramBot xtreme 8.1"; sid:1001073; ) alert tcp any any -> any any (msg:"Supheli Arac :EMPAS_ROBOT"; content:"EMPAS_ROBOT"; sid:1001074; ) alert tcp any any -> any any (msg:"Supheli Arac :libWeb/clsHTTP -- hiongun@kt.co.kr"; content:"libWeb/clsHTTP -- hiongun@kt.co.kr"; sid:1001075; ) alert tcp any any -> any any (msg:"Supheli Arac :wwwster/1.x (Beta- mailto:gue@cis.uni-muenchen.de)"; content:"wwwster/1.x (Beta- mailto:gue@cis.uni-muenchen.de)"; sid:1001076; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Version: xxxx Type:xx)"; content:"Mozilla/5.0 (Version: xxxx Type:xx)"; sid:1001077; ) alert tcp any any -> any any (msg:"Supheli Arac :tivraSpider/1.0 (crawler@tivra.com)"; content:"tivraSpider/1.0 (crawler@tivra.com)"; sid:1001078; ) alert tcp any any -> any any (msg:"Supheli Arac :Findexa Crawler (http://www.findexa.no/gulesider/article26548.ece)"; content:"Findexa Crawler (http://www.findexa.no/gulesider/article26548.ece)"; sid:1001079; ) alert tcp any any -> any any (msg:"Supheli Arac :OWR_Crawler 0.1"; content:"OWR_Crawler 0.1"; sid:1001080; ) alert tcp any any -> any any (msg:"Supheli Arac :dtSearchSpider"; content:"dtSearchSpider"; sid:1001081; ) alert tcp any any -> any any (msg:"Supheli Arac :UKWizz/Nutch-0.8.1 (UKWizz Nutch crawler; http://www.ukwizz.com/)"; content:"UKWizz/Nutch-0.8.1 (UKWizz Nutch crawler; http://www.ukwizz.com/)"; sid:1001082; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter/3.3.QA.pczukor"; content:"Scooter/3.3.QA.pczukor"; sid:1001083; ) alert tcp any any -> any any (msg:"Supheli Arac :Irvine/1.x.x"; content:"Irvine/1.x.x"; sid:1001084; ) alert tcp any any -> any any (msg:"Supheli Arac :Lynx/2.8.4rel.1 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/0.9.6c (human-guided@lerly.net)"; content:"Lynx/2.8.4rel.1 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/0.9.6c (human-guided@lerly.net)"; sid:1001085; ) alert tcp any any -> any any (msg:"Supheli Arac :Microsoft_Internet_Explorer_5.00.438 (fjones@isd.net)"; content:"Microsoft_Internet_Explorer_5.00.438 (fjones@isd.net)"; sid:1001086; ) alert tcp any any -> any any (msg:"Supheli Arac :Deep Link Calculator v1.0"; content:"Deep Link Calculator v1.0"; sid:1001087; ) alert tcp any any -> any any (msg:"Supheli Arac :Argus/1.1 (Nutch; http://www.simpy.com/bot.html; feedback at simpy dot com)"; content:"Argus/1.1 (Nutch; http://www.simpy.com/bot.html; feedback at simpy dot com)"; sid:1001088; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/2.2.7 (crawler@fast.no; http://www.fast.no/faq/faqfastwebsearch/faqfastwebcrawler.html)http://www.fast.no"; content:"FAST-WebCrawler/2.2.7 (crawler@fast.no; http://www.fast.no/faq/faqfastwebsearch/faqfastwebcrawler.html)http://www.fast.no"; sid:1001089; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.01 (Compatible; Links2Go Similarity Engine)"; content:"Mozilla/3.01 (Compatible; Links2Go Similarity Engine)"; sid:1001090; ) alert tcp any any -> any any (msg:"Supheli Arac :Nokia-WAPToolkit/1.2 googlebot(at)googlebot.com"; content:"Nokia-WAPToolkit/1.2 googlebot(at)googlebot.com"; sid:1001091; ) alert tcp any any -> any any (msg:"Supheli Arac :BTWebClient/180B(9704)"; content:"BTWebClient/180B(9704)"; sid:1001092; ) alert tcp any any -> any any (msg:"Supheli Arac :FlashGet"; content:"FlashGet"; sid:1001093; ) alert tcp any any -> any any (msg:"Supheli Arac :Franklin Locator 1.8"; content:"Franklin Locator 1.8"; sid:1001094; ) alert tcp any any -> any any (msg:"Supheli Arac :SQ Webscanner"; content:"SQ Webscanner"; sid:1001095; ) alert tcp any any -> any any (msg:"Supheli Arac :multicrawler ( http://sw.deri.org/2006/04/multicrawler/robots.html)"; content:"multicrawler ( http://sw.deri.org/2006/04/multicrawler/robots.html)"; sid:1001096; ) alert tcp any any -> any any (msg:"Supheli Arac :Ziggy -- The Clown From Hell!!"; content:"Ziggy -- The Clown From Hell!!"; sid:1001097; ) alert tcp any any -> any any (msg:"Supheli Arac :Homerbot: www.homerweb.com"; content:"Homerbot: www.homerweb.com"; sid:1001098; ) alert tcp any any -> any any (msg:"Supheli Arac :geourl/2.0b2"; content:"geourl/2.0b2"; sid:1001099; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; REL Software Web Link Validator 2.x)"; content:"Mozilla/3.0 (compatible; REL Software Web Link Validator 2.x)"; sid:1001100; ) alert tcp any any -> any any (msg:"Supheli Arac :DTAAgent"; content:"DTAAgent"; sid:1001101; ) alert tcp any any -> any any (msg:"Supheli Arac :MJBot (SEO assessment)"; content:"MJBot (SEO assessment)"; sid:1001102; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteBar/x.x.x (Bookmark Server; http://sitebar.org/)"; content:"SiteBar/x.x.x (Bookmark Server; http://sitebar.org/)"; sid:1001103; ) alert tcp any any -> any any (msg:"Supheli Arac :LWP::Simple/5.803"; content:"LWP::Simple/5.803"; sid:1001104; ) alert tcp any any -> any any (msg:"Supheli Arac :User-Agent: BoardReader Image Fetcher /1.0 info@boardreader.com"; content:"User-Agent: BoardReader Image Fetcher /1.0 info@boardreader.com"; sid:1001105; ) alert tcp any any -> any any (msg:"Supheli Arac :Download Master"; content:"Download Master"; sid:1001106; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; MSIECrawler)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; MSIECrawler)"; sid:1001107; ) alert tcp any any -> any any (msg:"Supheli Arac :ramBot xtreme x.x"; content:"ramBot xtreme x.x"; sid:1001108; ) alert tcp any any -> any any (msg:"Supheli Arac :Fast Crawler Gold Edition"; content:"Fast Crawler Gold Edition"; sid:1001109; ) alert tcp any any -> any any (msg:"Supheli Arac :Noago Spider"; content:"Noago Spider"; sid:1001110; ) alert tcp any any -> any any (msg:"Supheli Arac :Seekbot/1.0 (http://www.seekbot.net/bot.html) RobotsTxtFetcher/1.0 (XDF)"; content:"Seekbot/1.0 (http://www.seekbot.net/bot.html) RobotsTxtFetcher/1.0 (XDF)"; sid:1001111; ) alert tcp any any -> any any (msg:"Supheli Arac :KIT-Fireball/2.0"; content:"KIT-Fireball/2.0"; sid:1001112; ) alert tcp any any -> any any (msg:"Supheli Arac :StarDownloader/1.xx"; content:"StarDownloader/1.xx"; sid:1001113; ) alert tcp any any -> any any (msg:"Supheli Arac :disco/Nutch-0.9 (experimental crawler; www.discoveryengine.com; disco-crawl@discoveryengine.com)"; content:"disco/Nutch-0.9 (experimental crawler; www.discoveryengine.com; disco-crawl@discoveryengine.com)"; sid:1001114; ) alert tcp any any -> any any (msg:"Supheli Arac :gonzo1[P] +http://www.suchen.de/popups/faq.jsp"; content:"gonzo1[P] +http://www.suchen.de/popups/faq.jsp"; sid:1001115; ) alert tcp any any -> any any (msg:"Supheli Arac :ASPSeek/1.2.xa"; content:"ASPSeek/1.2.xa"; sid:1001116; ) alert tcp any any -> any any (msg:"Supheli Arac :k2spider"; content:"k2spider"; sid:1001117; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteXpert"; content:"SiteXpert"; sid:1001118; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.0.EU"; content:"Scooter-3.0.EU"; sid:1001119; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.0.FS"; content:"Scooter-3.0.FS"; sid:1001120; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.0.HD"; content:"Scooter-3.0.HD"; sid:1001121; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.2.BT"; content:"Scooter-3.2.BT"; sid:1001122; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.2.EX"; content:"Scooter-3.2.EX"; sid:1001123; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.2.JT"; content:"Scooter-3.2.JT"; sid:1001124; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.3dev"; content:"Scooter-3.3dev"; sid:1001125; ) alert tcp any any -> any any (msg:"Supheli Arac :BabalooSpider/1.3 (BabalooSpider; http://www.babaloo.si; spider@babaloo.si)"; content:"BabalooSpider/1.3 (BabalooSpider; http://www.babaloo.si; spider@babaloo.si)"; sid:1001126; ) alert tcp any any -> any any (msg:"Supheli Arac :ObjectsSearch/0.01-dev (ObjectsSearch;http://www.ObjectsSearch.com/bot.html; support@thesoftwareobjects.com)"; content:"ObjectsSearch/0.01-dev (ObjectsSearch;http://www.ObjectsSearch.com/bot.html; support@thesoftwareobjects.com)"; sid:1001127; ) alert tcp any any -> any any (msg:"Supheli Arac :DataSpear/1.0 (Spider; http://www.dataspear.com/spider.html; spider@dataspear.com)"; content:"DataSpear/1.0 (Spider; http://www.dataspear.com/spider.html; spider@dataspear.com)"; sid:1001128; ) alert tcp any any -> any any (msg:"Supheli Arac :Goblin/0.9 (http://www.goguides.org/)"; content:"Goblin/0.9 (http://www.goguides.org/)"; sid:1001129; ) alert tcp any any -> any any (msg:"Supheli Arac :FARK.com link verifier"; content:"FARK.com link verifier"; sid:1001130; ) alert tcp any any -> any any (msg:"Supheli Arac :WebRankSpider/1.37 (+http://ulm191.server4you.de/crawler/)"; content:"WebRankSpider/1.37 (+http://ulm191.server4you.de/crawler/)"; sid:1001131; ) alert tcp any any -> any any (msg:"Supheli Arac :MyGetRight/1.0b"; content:"MyGetRight/1.0b"; sid:1001132; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MRA 4.3 (build 01218))"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MRA 4.3 (build 01218))"; sid:1001133; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.2 (hamasaki@grad.nii.ac.jp)"; content:"larbin_2.6.2 (hamasaki@grad.nii.ac.jp)"; sid:1001134; ) alert tcp any any -> any any (msg:"Supheli Arac :Toutatis x-xx.x (hoppa.com)"; content:"Toutatis x-xx.x (hoppa.com)"; sid:1001135; ) alert tcp any any -> any any (msg:"Supheli Arac :MicroBaz"; content:"MicroBaz"; sid:1001136; ) alert tcp any any -> any any (msg:"Supheli Arac :YahooSeeker/1.0 (compatible; Mozilla 4.0; MSIE 5.5; http://help.yahoo.com/help/us/shop/merchant/)"; content:"YahooSeeker/1.0 (compatible; Mozilla 4.0; MSIE 5.5; http://help.yahoo.com/help/us/shop/merchant/)"; sid:1001137; ) alert tcp any any -> any any (msg:"Supheli Arac :Incutio HttpClient v0.x"; content:"Incutio HttpClient v0.x"; sid:1001138; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.2.2 (sugayama@lab7.kuis.kyoto-u.ac.jp)"; content:"larbin_2.2.2 (sugayama@lab7.kuis.kyoto-u.ac.jp)"; sid:1001139; ) alert tcp any any -> any any (msg:"Supheli Arac :RoboCrawl (http://www.canadiancontent.net)"; content:"RoboCrawl (http://www.canadiancontent.net)"; sid:1001140; ) alert tcp any any -> any any (msg:"Supheli Arac :GNODSPIDER (www.gnod.net)"; content:"GNODSPIDER (www.gnod.net)"; sid:1001141; ) alert tcp any any -> any any (msg:"Supheli Arac :SmartDownload/1.2.77 (Win32; Feb 1 2000)"; content:"SmartDownload/1.2.77 (Win32; Feb 1 2000)"; sid:1001142; ) alert tcp any any -> any any (msg:"Supheli Arac :NPBot-1/2.0"; content:"NPBot-1/2.0"; sid:1001143; ) alert tcp any any -> any any (msg:"Supheli Arac :Feed Seeker Bot (RSS Feed Seeker http://www.MyNewFavoriteThing.com/fsb.php)"; content:"Feed Seeker Bot (RSS Feed Seeker http://www.MyNewFavoriteThing.com/fsb.php)"; sid:1001144; ) alert tcp any any -> any any (msg:"Supheli Arac :Baiduspider+(+http://help.baidu.jp/system/05.html)"; content:"Baiduspider+(+http://help.baidu.jp/system/05.html)"; sid:1001145; ) alert tcp any any -> any any (msg:"Supheli Arac :Cowbot-0.1.x (NHN Corp. / +82-2-3011-1954 / nhnbot@naver.com)"; content:"Cowbot-0.1.x (NHN Corp. / +82-2-3011-1954 / nhnbot@naver.com)"; sid:1001146; ) alert tcp any any -> any any (msg:"Supheli Arac :InfoSeek Sidewinder/1.0A"; content:"InfoSeek Sidewinder/1.0A"; sid:1001147; ) alert tcp any any -> any any (msg:"Supheli Arac :InfoSeek Sidewinder/1.1A"; content:"InfoSeek Sidewinder/1.1A"; sid:1001148; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Crazy Browser 1.x.x)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Crazy Browser 1.x.x)"; sid:1001149; ) alert tcp any any -> any any (msg:"Supheli Arac :Googlebot-Image/1.0 ( http://www.googlebot.com/bot.html)"; content:"Googlebot-Image/1.0 ( http://www.googlebot.com/bot.html)"; sid:1001150; ) alert tcp any any -> any any (msg:"Supheli Arac ::robot/1.0 (linux) ( admin e-mail: undefined http://www.neofonie.de/loesungen/search/robot.html )"; content:":robot/1.0 (linux) ( admin e-mail: undefined http://www.neofonie.de/loesungen/search/robot.html )"; sid:1001151; ) alert tcp any any -> any any (msg:"Supheli Arac :NuSearch Spider www.nusearch.com"; content:"NuSearch Spider www.nusearch.com"; sid:1001152; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; MSIECrawler; Windows 95)"; content:"Mozilla/4.0 (compatible; MSIE 4.01; MSIECrawler; Windows 95)"; sid:1001153; ) alert tcp any any -> any any (msg:"Supheli Arac :ShopWiki/1.0 ( +http://www.shopwiki.com/)"; content:"ShopWiki/1.0 ( +http://www.shopwiki.com/)"; sid:1001154; ) alert tcp any any -> any any (msg:"Supheli Arac :IRLbot/1.0 ( http://irl.cs.tamu.edu/crawler)"; content:"IRLbot/1.0 ( http://irl.cs.tamu.edu/crawler)"; sid:1001155; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman3.0)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman3.0)"; sid:1001156; ) alert tcp any any -> any any (msg:"Supheli Arac :ScollSpider/2.0 (+http://www.webwobot.com/ScollSpider.php)"; content:"ScollSpider/2.0 (+http://www.webwobot.com/ScollSpider.php)"; sid:1001157; ) alert tcp any any -> any any (msg:"Supheli Arac :DSurf15a 01"; content:"DSurf15a 01"; sid:1001158; ) alert tcp any any -> any any (msg:"Supheli Arac :DSurf15a 71"; content:"DSurf15a 71"; sid:1001159; ) alert tcp any any -> any any (msg:"Supheli Arac :DSurf15a 81"; content:"DSurf15a 81"; sid:1001160; ) alert tcp any any -> any any (msg:"Supheli Arac :DSurf15a VA"; content:"DSurf15a VA"; sid:1001161; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Theophrastus/x.x; http://users.cs.cf.ac.uk/N.A.Smith/theophrastus.php)"; content:"Mozilla/5.0 (compatible; Theophrastus/x.x; http://users.cs.cf.ac.uk/N.A.Smith/theophrastus.php)"; sid:1001162; ) alert tcp any any -> any any (msg:"Supheli Arac :Gigabot/2.0att"; content:"Gigabot/2.0att"; sid:1001163; ) alert tcp any any -> any any (msg:"Supheli Arac :Googlebot-Image/1.0"; content:"Googlebot-Image/1.0"; sid:1001164; ) alert tcp any any -> any any (msg:"Supheli Arac :Enterprise_Search/1.00.xxx;MSSQL (http://www.innerprise.net/es-spider.asp)"; content:"Enterprise_Search/1.00.xxx;MSSQL (http://www.innerprise.net/es-spider.asp)"; sid:1001165; ) alert tcp any any -> any any (msg:"Supheli Arac :FineBot"; content:"FineBot"; sid:1001166; ) alert tcp any any -> any any (msg:"Supheli Arac :Naamah 1.0a/Blogbot (http://blogbot.de/)"; content:"Naamah 1.0a/Blogbot (http://blogbot.de/)"; sid:1001167; ) alert tcp any any -> any any (msg:"Supheli Arac :DeepIndex (www.en.deepindex.com)"; content:"DeepIndex (www.en.deepindex.com)"; sid:1001168; ) alert tcp any any -> any any (msg:"Supheli Arac :suchbaer.de"; content:"suchbaer.de"; sid:1001169; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; B_L_I_T_Z_B_O_T)"; content:"Mozilla/4.0 (compatible; B_L_I_T_Z_B_O_T)"; sid:1001170; ) alert tcp any any -> any any (msg:"Supheli Arac :BPImageWalker/2.0 (www.bdbrandprotect.com)"; content:"BPImageWalker/2.0 (www.bdbrandprotect.com)"; sid:1001171; ) alert tcp any any -> any any (msg:"Supheli Arac :BMCLIENT"; content:"BMCLIENT"; sid:1001172; ) alert tcp any any -> any any (msg:"Supheli Arac :+SitiDi.net/SitiDiBot/1.0 (+Have Good Day)"; content:"+SitiDi.net/SitiDiBot/1.0 (+Have Good Day)"; sid:1001173; ) alert tcp any any -> any any (msg:"Supheli Arac :MSIE 4.0 (Win95)"; content:"MSIE 4.0 (Win95)"; sid:1001174; ) alert tcp any any -> any any (msg:"Supheli Arac :Production Bot 0116B"; content:"Production Bot 0116B"; sid:1001175; ) alert tcp any any -> any any (msg:"Supheli Arac :Teradex Mapper; mapper@teradex.com; http://www.teradex.com"; content:"Teradex Mapper; mapper@teradex.com; http://www.teradex.com"; sid:1001176; ) alert tcp any any -> any any (msg:"Supheli Arac :DBrowse 1.4b"; content:"DBrowse 1.4b"; sid:1001177; ) alert tcp any any -> any any (msg:"Supheli Arac :DBrowse 1.4d"; content:"DBrowse 1.4d"; sid:1001178; ) alert tcp any any -> any any (msg:"Supheli Arac :Go!Zilla/4.x.x.xx"; content:"Go!Zilla/4.x.x.xx"; sid:1001179; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible;MSIE 6.0; Windows NT 5.0; H010818)"; content:"Mozilla/4.0 (compatible;MSIE 6.0; Windows NT 5.0; H010818)"; sid:1001180; ) alert tcp any any -> any any (msg:"Supheli Arac :XRL/2.00b1 (Linux; i686; en-us) (+http://metamark.net/about)"; content:"XRL/2.00b1 (Linux; i686; en-us) (+http://metamark.net/about)"; sid:1001181; ) alert tcp any any -> any any (msg:"Supheli Arac :W3CLineMode/5.4.0 libwww/5.x.x"; content:"W3CLineMode/5.4.0 libwww/5.x.x"; sid:1001182; ) alert tcp any any -> any any (msg:"Supheli Arac :JobSpider_BA/1.1"; content:"JobSpider_BA/1.1"; sid:1001183; ) alert tcp any any -> any any (msg:"Supheli Arac :OmniExplorer_Bot/1.1x (+http://www.omni-explorer.com) Torrent Crawler"; content:"OmniExplorer_Bot/1.1x (+http://www.omni-explorer.com) Torrent Crawler"; sid:1001184; ) alert tcp any any -> any any (msg:"Supheli Arac :Denmex websearch (http://search.denmex.com)"; content:"Denmex websearch (http://search.denmex.com)"; sid:1001185; ) alert tcp any any -> any any (msg:"Supheli Arac :Java 1.1"; content:"Java 1.1"; sid:1001186; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; MSIE 3.02; Update a; AOL 3.0; Windows 95)"; content:"Mozilla/2.0 (compatible; MSIE 3.02; Update a; AOL 3.0; Windows 95)"; sid:1001187; ) alert tcp any any -> any any (msg:"Supheli Arac :User-Agent: LjSEEK Picture-Bot /1.0 contact@ljseek.com"; content:"User-Agent: LjSEEK Picture-Bot /1.0 contact@ljseek.com"; sid:1001188; ) alert tcp any any -> any any (msg:"Supheli Arac :combine/0.0"; content:"combine/0.0"; sid:1001189; ) alert tcp any any -> any any (msg:"Supheli Arac :free-downloads.net download-link validator /0.1"; content:"free-downloads.net download-link validator /0.1"; sid:1001190; ) alert tcp any any -> any any (msg:"Supheli Arac :QweeryBot/3.01 ( http://qweerybot.qweery.nl)"; content:"QweeryBot/3.01 ( http://qweerybot.qweery.nl)"; sid:1001191; ) alert tcp any any -> any any (msg:"Supheli Arac :Production Bot 2016B"; content:"Production Bot 2016B"; sid:1001192; ) alert tcp any any -> any any (msg:"Supheli Arac :ccubee/x.x"; content:"ccubee/x.x"; sid:1001193; ) alert tcp any any -> any any (msg:"Supheli Arac :http://hilfe.acont.de/bot.html ACONTBOT"; content:"http://hilfe.acont.de/bot.html ACONTBOT"; sid:1001194; ) alert tcp any any -> any any (msg:"Supheli Arac :gonzo2[P] +http://www.suchen.de/faq.html"; content:"gonzo2[P] +http://www.suchen.de/faq.html"; sid:1001195; ) alert tcp any any -> any any (msg:"Supheli Arac :MapoftheInternet.com ( http://MapoftheInternet.com)"; content:"MapoftheInternet.com ( http://MapoftheInternet.com)"; sid:1001196; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; Lunascape 2.1.3)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; Lunascape 2.1.3)"; sid:1001197; ) alert tcp any any -> any any (msg:"Supheli Arac :DataSpearSpiderBot/0.2 (DataSpear Spider Bot; http://dssb.dataspear.com/bot.html; dssb@dataspear.com)"; content:"DataSpearSpiderBot/0.2 (DataSpear Spider Bot; http://dssb.dataspear.com/bot.html; dssb@dataspear.com)"; sid:1001198; ) alert tcp any any -> any any (msg:"Supheli Arac :Feed24.com"; content:"Feed24.com"; sid:1001199; ) alert tcp any any -> any any (msg:"Supheli Arac :Syntryx ANT Scout Chassis Pheromone; Mozilla/4.0 compatible crawler"; content:"Syntryx ANT Scout Chassis Pheromone; Mozilla/4.0 compatible crawler"; sid:1001200; ) alert tcp any any -> any any (msg:"Supheli Arac :AskAboutOil/0.06-rcp (Nutch; http://www.nutch.org/docs/en/bot.html; nutch-agent@askaboutoil.com)"; content:"AskAboutOil/0.06-rcp (Nutch; http://www.nutch.org/docs/en/bot.html; nutch-agent@askaboutoil.com)"; sid:1001201; ) alert tcp any any -> any any (msg:"Supheli Arac :Wotbox/alpha0.x.x (bot@wotbox.com; http://www.wotbox.com) Java/1.4.1_02"; content:"Wotbox/alpha0.x.x (bot@wotbox.com; http://www.wotbox.com) Java/1.4.1_02"; sid:1001202; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; LinksManager.com_bot http://linksmanager.com/linkchecker.html)"; content:"Mozilla/5.0 (compatible; LinksManager.com_bot http://linksmanager.com/linkchecker.html)"; sid:1001203; ) alert tcp any any -> any any (msg:"Supheli Arac :IconSurf/2.0 favicon monitor (see http://iconsurf.com/robot.html)"; content:"IconSurf/2.0 favicon monitor (see http://iconsurf.com/robot.html)"; sid:1001204; ) alert tcp any any -> any any (msg:"Supheli Arac :Google Talk"; content:"Google Talk"; sid:1001205; ) alert tcp any any -> any any (msg:"Supheli Arac :PageBitesHyperBot/600 (http://www.pagebites.com/)"; content:"PageBitesHyperBot/600 (http://www.pagebites.com/)"; sid:1001206; ) alert tcp any any -> any any (msg:"Supheli Arac :http://www.istarthere.com_spider@istarthere.com"; content:"http://www.istarthere.com_spider@istarthere.com"; sid:1001207; ) alert tcp any any -> any any (msg:"Supheli Arac :Chitika ContentHit 1.0"; content:"Chitika ContentHit 1.0"; sid:1001208; ) alert tcp any any -> any any (msg:"Supheli Arac :RAYSPIDER/Nutch-0.9"; content:"RAYSPIDER/Nutch-0.9"; sid:1001209; ) alert tcp any any -> any any (msg:"Supheli Arac :BanBots/1.2 (spider@banbots.com)"; content:"BanBots/1.2 (spider@banbots.com)"; sid:1001210; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Slurp/si; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; content:"Mozilla/3.0 (Slurp/si; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; sid:1001211; ) alert tcp any any -> any any (msg:"Supheli Arac :DISCo Pump x.x"; content:"DISCo Pump x.x"; sid:1001212; ) alert tcp any any -> any any (msg:"Supheli Arac :NuSearch Spider (compatible; MSIE 6.0)"; content:"NuSearch Spider (compatible; MSIE 6.0)"; sid:1001213; ) alert tcp any any -> any any (msg:"Supheli Arac :Nutch/Nutch-0.9 (Eurobot; http://www.ayell.eu )"; content:"Nutch/Nutch-0.9 (Eurobot; http://www.ayell.eu )"; sid:1001214; ) alert tcp any any -> any any (msg:"Supheli Arac :Spinne/2.0"; content:"Spinne/2.0"; sid:1001215; ) alert tcp any any -> any any (msg:"Supheli Arac :Openfind data gatherer- Openbot/3.0+(robot-response@openfind.com.tw;+http://www.openfind.com.tw/robot.html)"; content:"Openfind data gatherer- Openbot/3.0+(robot-response@openfind.com.tw;+http://www.openfind.com.tw/robot.html)"; sid:1001216; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 5.11 [en]"; content:"Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 5.11 [en]"; sid:1001217; ) alert tcp any any -> any any (msg:"Supheli Arac :fetch libfetch/2.0"; content:"fetch libfetch/2.0"; sid:1001218; ) alert tcp any any -> any any (msg:"Supheli Arac :HatenaScreenshot/1.0 (checker)"; content:"HatenaScreenshot/1.0 (checker)"; sid:1001219; ) alert tcp any any -> any any (msg:"Supheli Arac :Space Bison/0.02 [fu] (Win67; X; SK)"; content:"Space Bison/0.02 [fu] (Win67; X; SK)"; sid:1001220; ) alert tcp any any -> any any (msg:"Supheli Arac :Gaisbot/3.0 (indexer@gais.cs.ccu.edu.tw; http://gais.cs.ccu.edu.tw/robot.php)"; content:"Gaisbot/3.0 (indexer@gais.cs.ccu.edu.tw; http://gais.cs.ccu.edu.tw/robot.php)"; sid:1001221; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; MSIE 2.1; Mac_PowerPC)"; content:"Mozilla/2.0 (compatible; MSIE 2.1; Mac_PowerPC)"; sid:1001222; ) alert tcp any any -> any any (msg:"Supheli Arac :SearchdayBot"; content:"SearchdayBot"; sid:1001223; ) alert tcp any any -> any any (msg:"Supheli Arac :YahooFeedSeeker/2.0 (compatible; Mozilla 4.0; MSIE 5.5; http://publisher.yahoo.com/rssguide)"; content:"YahooFeedSeeker/2.0 (compatible; Mozilla 4.0; MSIE 5.5; http://publisher.yahoo.com/rssguide)"; sid:1001224; ) alert tcp any any -> any any (msg:"Supheli Arac :Searchit-Now Robot/2.2 (+http://www.searchit-now.co.uk)"; content:"Searchit-Now Robot/2.2 (+http://www.searchit-now.co.uk)"; sid:1001225; ) alert tcp any any -> any any (msg:"Supheli Arac :MetaProducts Download Express/1.x"; content:"MetaProducts Download Express/1.x"; sid:1001226; ) alert tcp any any -> any any (msg:"Supheli Arac :ANTFresco/x.xx"; content:"ANTFresco/x.xx"; sid:1001227; ) alert tcp any any -> any any (msg:"Supheli Arac :MovableType/x.x"; content:"MovableType/x.x"; sid:1001228; ) alert tcp any any -> any any (msg:"Supheli Arac :InfoSeek Sidewinder/0.9"; content:"InfoSeek Sidewinder/0.9"; sid:1001229; ) alert tcp any any -> any any (msg:"Supheli Arac :grub crawler(http://www.grub.org)"; content:"grub crawler(http://www.grub.org)"; sid:1001230; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Konqueror/2.0.1; X11); Supports MD5-Digest; Supports gzip encoding"; content:"Mozilla/5.0 (compatible; Konqueror/2.0.1; X11); Supports MD5-Digest; Supports gzip encoding"; sid:1001231; ) alert tcp any any -> any any (msg:"Supheli Arac :FreshDownload/x.xx"; content:"FreshDownload/x.xx"; sid:1001232; ) alert tcp any any -> any any (msg:"Supheli Arac :Xerka WebBot v1.0.0 [UPVOpenDir]"; content:"Xerka WebBot v1.0.0 [UPVOpenDir]"; sid:1001233; ) alert tcp any any -> any any (msg:"Supheli Arac :GAIS Robot/1.0B2"; content:"GAIS Robot/1.0B2"; sid:1001234; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)"; sid:1001235; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Vagabondo/2.0 MT; webcrawler@NOSPAMwise-guys.nl; http://webagent.wise-guys.nl/)"; content:"Mozilla/3.0 (Vagabondo/2.0 MT; webcrawler@NOSPAMwise-guys.nl; http://webagent.wise-guys.nl/)"; sid:1001236; ) alert tcp any any -> any any (msg:"Supheli Arac :RedCell/0.1 (InfoSec Search Bot (Coming Soon); http://www.telegenetic.net/bot.html; lhall@telegenetic.net)"; content:"RedCell/0.1 (InfoSec Search Bot (Coming Soon); http://www.telegenetic.net/bot.html; lhall@telegenetic.net)"; sid:1001237; ) alert tcp any any -> any any (msg:"Supheli Arac :EARTHCOM.info/1.x [www.earthcom.info]"; content:"EARTHCOM.info/1.x [www.earthcom.info]"; sid:1001238; ) alert tcp any any -> any any (msg:"Supheli Arac :Nebullabot/2.2 (http://bot.nebulla.info)"; content:"Nebullabot/2.2 (http://bot.nebulla.info)"; sid:1001239; ) alert tcp any any -> any any (msg:"Supheli Arac :Search-Engine-Studio"; content:"Search-Engine-Studio"; sid:1001240; ) alert tcp any any -> any any (msg:"Supheli Arac :wadaino.jp-crawler 0.2 (http://wadaino.jp/)"; content:"wadaino.jp-crawler 0.2 (http://wadaino.jp/)"; sid:1001241; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; www.linkguard.com Linkguard Online 1.0; Windows NT)"; content:"Mozilla/4.0 (compatible; www.linkguard.com Linkguard Online 1.0; Windows NT)"; sid:1001242; ) alert tcp any any -> any any (msg:"Supheli Arac :UCMore Crawler App"; content:"UCMore Crawler App"; sid:1001243; ) alert tcp any any -> any any (msg:"Supheli Arac :DataparkSearch/4.47 (+http://dataparksearch.org/bot)"; content:"DataparkSearch/4.47 (+http://dataparksearch.org/bot)"; sid:1001244; ) alert tcp any any -> any any (msg:"Supheli Arac :ScanWeb"; content:"ScanWeb"; sid:1001245; ) alert tcp any any -> any any (msg:"Supheli Arac :WebVal/1.0"; content:"WebVal/1.0"; sid:1001246; ) alert tcp any any -> any any (msg:"Supheli Arac :Spinne/2.0 med_AH"; content:"Spinne/2.0 med_AH"; sid:1001247; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (fantomCrew Browser)"; content:"Mozilla/4.0 (fantomCrew Browser)"; sid:1001248; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.0; Windows NT; Site Server 3.0 Robot) ACR"; content:"Mozilla/4.0 (compatible; MSIE 4.0; Windows NT; Site Server 3.0 Robot) ACR"; sid:1001249; ) alert tcp any any -> any any (msg:"Supheli Arac :Link Valet Online 1.x"; content:"Link Valet Online 1.x"; sid:1001250; ) alert tcp any any -> any any (msg:"Supheli Arac :crawler@alexa.com"; content:"crawler@alexa.com"; sid:1001251; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; YesupBot/1.0; +http://www.yesup.net/bot.html)"; content:"Mozilla/5.0 (compatible; YesupBot/1.0; +http://www.yesup.net/bot.html)"; sid:1001252; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.2) Gecko/20010726 Netscape6/6.1"; content:"Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.2) Gecko/20010726 Netscape6/6.1"; sid:1001253; ) alert tcp any any -> any any (msg:"Supheli Arac :Html Link Validator (www.lithopssoft.com)"; content:"Html Link Validator (www.lithopssoft.com)"; sid:1001254; ) alert tcp any any -> any any (msg:"Supheli Arac :Steeler/3.3 (http://www.tkl.iis.u-tokyo.ac.jp/~crawler/)"; content:"Steeler/3.3 (http://www.tkl.iis.u-tokyo.ac.jp/~crawler/)"; sid:1001255; ) alert tcp any any -> any any (msg:"Supheli Arac :htdig/3.1.6 (unconfigured@htdig.searchengine.maintainer)"; content:"htdig/3.1.6 (unconfigured@htdig.searchengine.maintainer)"; sid:1001256; ) alert tcp any any -> any any (msg:"Supheli Arac :LightningDownload/1.x.x"; content:"LightningDownload/1.x.x"; sid:1001257; ) alert tcp any any -> any any (msg:"Supheli Arac :Rational SiteCheck (Windows NT)"; content:"Rational SiteCheck (Windows NT)"; sid:1001258; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.2 test"; content:"FAST-WebCrawler/3.2 test"; sid:1001259; ) alert tcp any any -> any any (msg:"Supheli Arac :WannaBe (Macintosh; PPC)"; content:"WannaBe (Macintosh; PPC)"; sid:1001260; ) alert tcp any any -> any any (msg:"Supheli Arac :DatenBot( http://www.sicher-durchs-netz.de/bot.html)"; content:"DatenBot( http://www.sicher-durchs-netz.de/bot.html)"; sid:1001261; ) alert tcp any any -> any any (msg:"Supheli Arac :Wells Search II"; content:"Wells Search II"; sid:1001262; ) alert tcp any any -> any any (msg:"Supheli Arac :webGobbler/1.x.x"; content:"webGobbler/1.x.x"; sid:1001263; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Slurp.so/Goo; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; content:"Mozilla/3.0 (Slurp.so/Goo; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; sid:1001264; ) alert tcp any any -> any any (msg:"Supheli Arac :LMQueueBot/0.2"; content:"LMQueueBot/0.2"; sid:1001265; ) alert tcp any any -> any any (msg:"Supheli Arac :SapphireWebCrawler/1.0 (Sapphire Web Crawler using Nutch; http://boston.lti.cs.cmu.edu/crawler/; mhoy@cs.cmu.edu)"; content:"SapphireWebCrawler/1.0 (Sapphire Web Crawler using Nutch; http://boston.lti.cs.cmu.edu/crawler/; mhoy@cs.cmu.edu)"; sid:1001266; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Google Desktop) Paros/3.2.12"; content:"Mozilla/5.0 (compatible; Google Desktop) Paros/3.2.12"; sid:1001267; ) alert tcp any any -> any any (msg:"Supheli Arac :Journster [alpha] (http://journster.com/)"; content:"Journster [alpha] (http://journster.com/)"; sid:1001268; ) alert tcp any any -> any any (msg:"Supheli Arac :Aplix_SANYO_browser/1.x (Japanese)"; content:"Aplix_SANYO_browser/1.x (Japanese)"; sid:1001269; ) alert tcp any any -> any any (msg:"Supheli Arac :luchs.at URL checker"; content:"luchs.at URL checker"; sid:1001270; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; DNS-Digger/1.0; +http://www.dnsdigger.com)"; content:"Mozilla/5.0 (compatible; DNS-Digger/1.0; +http://www.dnsdigger.com)"; sid:1001271; ) alert tcp any any -> any any (msg:"Supheli Arac :NG/1.0"; content:"NG/1.0"; sid:1001272; ) alert tcp any any -> any any (msg:"Supheli Arac :URLBase/6.x"; content:"URLBase/6.x"; sid:1001273; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; AIRF)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; AIRF)"; sid:1001274; ) alert tcp any any -> any any (msg:"Supheli Arac :Weblog Attitude Diffusion 1.0"; content:"Weblog Attitude Diffusion 1.0"; sid:1001275; ) alert tcp any any -> any any (msg:"Supheli Arac :NetWhatCrawler/0.06-dev (NetWhatCrawler from NetWhat.com; http://www.netwhat.com; support@netwhat.com)"; content:"NetWhatCrawler/0.06-dev (NetWhatCrawler from NetWhat.com; http://www.netwhat.com; support@netwhat.com)"; sid:1001276; ) alert tcp any any -> any any (msg:"Supheli Arac :QuickTime\xaa.7.0.4 (qtver=7.0.4;cpu=PPC;os=Mac 10.3.9)"; content:"QuickTime\xaa.7.0.4 (qtver=7.0.4;cpu=PPC;os=Mac 10.3.9)"; sid:1001277; ) alert tcp any any -> any any (msg:"Supheli Arac :WiseWire-Spider2"; content:"WiseWire-Spider2"; sid:1001278; ) alert tcp any any -> any any (msg:"Supheli Arac :RedKernel WWW-Spider 2/0 (+http://www-spider.redkernel-softwares.com/)"; content:"RedKernel WWW-Spider 2/0 (+http://www-spider.redkernel-softwares.com/)"; sid:1001279; ) alert tcp any any -> any any (msg:"Supheli Arac :Dart Communications PowerTCP"; content:"Dart Communications PowerTCP"; sid:1001280; ) alert tcp any any -> any any (msg:"Supheli Arac :Twisted PageGetter"; content:"Twisted PageGetter"; sid:1001281; ) alert tcp any any -> any any (msg:"Supheli Arac :Lynx/2.8.3dev.9 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/0.9.6"; content:"Lynx/2.8.3dev.9 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/0.9.6"; sid:1001282; ) alert tcp any any -> any any (msg:"Supheli Arac :ASPSeek/1.2.5"; content:"ASPSeek/1.2.5"; sid:1001283; ) alert tcp any any -> any any (msg:"Supheli Arac :ASPSeek/1.2.x"; content:"ASPSeek/1.2.x"; sid:1001284; ) alert tcp any any -> any any (msg:"Supheli Arac :ICRA_label_spider/x.0"; content:"ICRA_label_spider/x.0"; sid:1001285; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.01SGoldC-SGI (X11; I; IRIX 6.3 IP32)"; content:"Mozilla/3.01SGoldC-SGI (X11; I; IRIX 6.3 IP32)"; sid:1001286; ) alert tcp any any -> any any (msg:"Supheli Arac :QEAVis Agent/Nutch-0.9 (Quantitative Evaluation of Academic Websites Visibility; http://nlp.uned.es/qeavis"; content:"QEAVis Agent/Nutch-0.9 (Quantitative Evaluation of Academic Websites Visibility; http://nlp.uned.es/qeavis"; sid:1001287; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; Opera/3.0; Windows 3.1) v3.1"; content:"Mozilla/3.0 (compatible; Opera/3.0; Windows 3.1) v3.1"; sid:1001288; ) alert tcp any any -> any any (msg:"Supheli Arac :JoBo/@JOBO_VERSION@(http://www.matuschek.net/jobo.html)"; content:"JoBo/@JOBO_VERSION@(http://www.matuschek.net/jobo.html)"; sid:1001289; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; BecomeBot/2.x; MSIE 6.0 compatible; http://www.become.com/site_owners.html)"; content:"Mozilla/5.0 (compatible; BecomeBot/2.x; MSIE 6.0 compatible; http://www.become.com/site_owners.html)"; sid:1001290; ) alert tcp any any -> any any (msg:"Supheli Arac :Flexum/2.0"; content:"Flexum/2.0"; sid:1001291; ) alert tcp any any -> any any (msg:"Supheli Arac :WDG_Validator/1.1"; content:"WDG_Validator/1.1"; sid:1001292; ) alert tcp any any -> any any (msg:"Supheli Arac :WWSBOT 1.x [--- http://www.analyzer.nu ---]"; content:"WWSBOT 1.x [--- http://www.analyzer.nu ---]"; sid:1001293; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkLint-spider/2.x.x"; content:"LinkLint-spider/2.x.x"; sid:1001294; ) alert tcp any any -> any any (msg:"Supheli Arac :IP*Works! V5 HTTP/S Component - by /n software - www.nsoftware.com"; content:"IP*Works! V5 HTTP/S Component - by /n software - www.nsoftware.com"; sid:1001295; ) alert tcp any any -> any any (msg:"Supheli Arac :augurfind"; content:"augurfind"; sid:1001296; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (agadine3.0) www.agada.de"; content:"Mozilla/4.0 (agadine3.0) www.agada.de"; sid:1001297; ) alert tcp any any -> any any (msg:"Supheli Arac :RufusBot (Rufus Web Miner; http://64.124.122.252/feedback.html)"; content:"RufusBot (Rufus Web Miner; http://64.124.122.252/feedback.html)"; sid:1001298; ) alert tcp any any -> any any (msg:"Supheli Arac :info@pubblisito.com- (http://www.pubblisito.com) il Sud dei Motori di Ricerca"; content:"info@pubblisito.com- (http://www.pubblisito.com) il Sud dei Motori di Ricerca"; sid:1001299; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; QXW03018)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; QXW03018)"; sid:1001300; ) alert tcp any any -> any any (msg:"Supheli Arac :NationalDirectoryAddURL/1.0"; content:"NationalDirectoryAddURL/1.0"; sid:1001301; ) alert tcp any any -> any any (msg:"Supheli Arac :carleson/1.0"; content:"carleson/1.0"; sid:1001302; ) alert tcp any any -> any any (msg:"Supheli Arac :curl/7.8 (i686-pc-linux-gnu) libcurl 7.8 (OpenSSL 0.9.6)"; content:"curl/7.8 (i686-pc-linux-gnu) libcurl 7.8 (OpenSSL 0.9.6)"; sid:1001303; ) alert tcp any any -> any any (msg:"Supheli Arac :exactseek-pagereaper-2.63 (crawler@exactseek.com)"; content:"exactseek-pagereaper-2.63 (crawler@exactseek.com)"; sid:1001304; ) alert tcp any any -> any any (msg:"Supheli Arac :Diamond/x.0"; content:"Diamond/x.0"; sid:1001305; ) alert tcp any any -> any any (msg:"Supheli Arac :YodaoBot/1.0 (http://www.yodao.com/help/webmaster/spider/; )"; content:"YodaoBot/1.0 (http://www.yodao.com/help/webmaster/spider/; )"; sid:1001306; ) alert tcp any any -> any any (msg:"Supheli Arac :Microsoft Data Access Internet Publishing Provider DAV"; content:"Microsoft Data Access Internet Publishing Provider DAV"; sid:1001307; ) alert tcp any any -> any any (msg:"Supheli Arac :S.T.A.L.K.E.R. (http://www.seo-tools.net/en/bot.aspx)"; content:"S.T.A.L.K.E.R. (http://www.seo-tools.net/en/bot.aspx)"; sid:1001308; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:x.xx) Gecko/20030504 Mozilla Firebird/0.6"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:x.xx) Gecko/20030504 Mozilla Firebird/0.6"; sid:1001309; ) alert tcp any any -> any any (msg:"Supheli Arac :-DIE-KRAEHE- META-SEARCH-ENGINE/1.1 http://www.die-kraehe.de"; content:"-DIE-KRAEHE- META-SEARCH-ENGINE/1.1 http://www.die-kraehe.de"; sid:1001310; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061129 BonEcho/2.0"; content:"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061129 BonEcho/2.0"; sid:1001311; ) alert tcp any any -> any any (msg:"Supheli Arac :Lockstep Spider/1.0"; content:"Lockstep Spider/1.0"; sid:1001312; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (hhjhj@yahoo.com)"; content:"Mozilla/4.0 (hhjhj@yahoo.com)"; sid:1001313; ) alert tcp any any -> any any (msg:"Supheli Arac :(DreamPassport/3.0; isao/MyDiGiRabi)"; content:"(DreamPassport/3.0; isao/MyDiGiRabi)"; sid:1001314; ) alert tcp any any -> any any (msg:"Supheli Arac :RealDownload/4.0.0.4x"; content:"RealDownload/4.0.0.4x"; sid:1001315; ) alert tcp any any -> any any (msg:"Supheli Arac :sogou develop spider"; content:"sogou develop spider"; sid:1001316; ) alert tcp any any -> any any (msg:"Supheli Arac :WebAuto/3.4xxx (WinNT; I)"; content:"WebAuto/3.4xxx (WinNT; I)"; sid:1001317; ) alert tcp any any -> any any (msg:"Supheli Arac :IncyWincy data gatherer(webmaster@loopimprovements.com"; content:"IncyWincy data gatherer(webmaster@loopimprovements.com"; sid:1001318; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; Indy Library)"; content:"Mozilla/3.0 (compatible; Indy Library)"; sid:1001319; ) alert tcp any any -> any any (msg:"Supheli Arac :R6_CommentReader_(www.radian6.com/crawler)"; content:"R6_CommentReader_(www.radian6.com/crawler)"; sid:1001320; ) alert tcp any any -> any any (msg:"Supheli Arac :aranhabot"; content:"aranhabot"; sid:1001321; ) alert tcp any any -> any any (msg:"Supheli Arac :GoGuides.Org Link Check"; content:"GoGuides.Org Link Check"; sid:1001322; ) alert tcp any any -> any any (msg:"Supheli Arac :yggdrasil/Nutch-0.9 (yggdrasil biorelated search engine; www dot biotec dot tu minus dresden do de slash schroeder; heiko dot dietze at biotec dot tu minus dresden dot de)"; content:"yggdrasil/Nutch-0.9 (yggdrasil biorelated search engine; www dot biotec dot tu minus dresden do de slash schroeder; heiko dot dietze at biotec dot tu minus dresden dot de)"; sid:1001323; ) alert tcp any any -> any any (msg:"Supheli Arac :updated/0.1-alpha (updated crawler; http://www.updated.com; crawler@updated.com)"; content:"updated/0.1-alpha (updated crawler; http://www.updated.com; crawler@updated.com)"; sid:1001324; ) alert tcp any any -> any any (msg:"Supheli Arac :lc/$ROADS::Version libwww-perl/5.00"; content:"lc/$ROADS::Version libwww-perl/5.00"; sid:1001325; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 usww.com-Spider-for-w8.net"; content:"Mozilla/5.0 usww.com-Spider-for-w8.net"; sid:1001326; ) alert tcp any any -> any any (msg:"Supheli Arac :mailto:webcraft@bea.com"; content:"mailto:webcraft@bea.com"; sid:1001327; ) alert tcp any any -> any any (msg:"Supheli Arac :WebsiteWorth v1.0"; content:"WebsiteWorth v1.0"; sid:1001328; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; KITV4.7 Wanadoo)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; KITV4.7 Wanadoo)"; sid:1001329; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.6.0 http://www.worio.com/)"; content:"Mozilla/5.0 (compatible; heritrix/1.6.0 http://www.worio.com/)"; sid:1001330; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/1.22 (compatible; MSIE 2.0d; Windows NT)"; content:"Mozilla/1.22 (compatible; MSIE 2.0d; Windows NT)"; sid:1001331; ) alert tcp any any -> any any (msg:"Supheli Arac :Bookdog/x.x"; content:"Bookdog/x.x"; sid:1001332; ) alert tcp any any -> any any (msg:"Supheli Arac :ContentSmartz"; content:"ContentSmartz"; sid:1001333; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; SPENG)"; content:"Mozilla/4.0 (compatible; SPENG)"; sid:1001334; ) alert tcp any any -> any any (msg:"Supheli Arac :EuripBot/0.x (+http://www.eurip.com) PreCheck"; content:"EuripBot/0.x (+http://www.eurip.com) PreCheck"; sid:1001335; ) alert tcp any any -> any any (msg:"Supheli Arac :PWeBot/1.2 Inspector (http://www.programacionweb.net/robot.php)"; content:"PWeBot/1.2 Inspector (http://www.programacionweb.net/robot.php)"; sid:1001336; ) alert tcp any any -> any any (msg:"Supheli Arac :Qweery_robot.txt_CheckBot/3.01 (http://qweerybot.qweery.com)"; content:"Qweery_robot.txt_CheckBot/3.01 (http://qweerybot.qweery.com)"; sid:1001337; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html)"; content:"Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html)"; sid:1001338; ) alert tcp any any -> any any (msg:"Supheli Arac :SlySearch (slysearch@slysearch.com)"; content:"SlySearch (slysearch@slysearch.com)"; sid:1001339; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Phonifier; +http://www.phonifier.com)"; content:"Mozilla/5.0 (compatible; Phonifier; +http://www.phonifier.com)"; sid:1001340; ) alert tcp any any -> any any (msg:"Supheli Arac :LG/U8138/v1.0"; content:"LG/U8138/v1.0"; sid:1001341; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla 4.0(compatible; BotSeer/1.0; +http://botseer.ist.psu.edu)"; content:"Mozilla 4.0(compatible; BotSeer/1.0; +http://botseer.ist.psu.edu)"; sid:1001342; ) alert tcp any any -> any any (msg:"Supheli Arac :AlkalineBOT/1.4 (1.4.0326.0 RTM)"; content:"AlkalineBOT/1.4 (1.4.0326.0 RTM)"; sid:1001343; ) alert tcp any any -> any any (msg:"Supheli Arac :ShopWiki/1.0 ( +http://www.shopwiki.com/wiki/Help:Bot)"; content:"ShopWiki/1.0 ( +http://www.shopwiki.com/wiki/Help:Bot)"; sid:1001344; ) alert tcp any any -> any any (msg:"Supheli Arac :Pagebull http://www.pagebull.com/"; content:"Pagebull http://www.pagebull.com/"; sid:1001345; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0_(compatible;_MSIE_5.0;_Windows_95)_VoilaBot/1.6 libwww/5.3.2"; content:"Mozilla/4.0_(compatible;_MSIE_5.0;_Windows_95)_VoilaBot/1.6 libwww/5.3.2"; sid:1001346; ) alert tcp any any -> any any (msg:"Supheli Arac :NaverBot-1.0 (NHN Corp. / +82-2-3011-1954 / nhnbot@naver.com)"; content:"NaverBot-1.0 (NHN Corp. / +82-2-3011-1954 / nhnbot@naver.com)"; sid:1001347; ) alert tcp any any -> any any (msg:"Supheli Arac :GammaSpider/1.0"; content:"GammaSpider/1.0"; sid:1001348; ) alert tcp any any -> any any (msg:"Supheli Arac :JoBo/1.x (http://www.matuschek.net/jobo.html)"; content:"JoBo/1.x (http://www.matuschek.net/jobo.html)"; sid:1001349; ) alert tcp any any -> any any (msg:"Supheli Arac :Nokia6610/1.0 (3.09) Profile/MIDP-1.0 Configuration/CLDC-1.0 (compatible;YahooSeeker/M1A1-R2D2; http://help.yahoo.com/help/us/ysearch/crawling/crawling-01.html)"; content:"Nokia6610/1.0 (3.09) Profile/MIDP-1.0 Configuration/CLDC-1.0 (compatible;YahooSeeker/M1A1-R2D2; http://help.yahoo.com/help/us/ysearch/crawling/crawling-01.html)"; sid:1001350; ) alert tcp any any -> any any (msg:"Supheli Arac :MoonBrowser (version 0.41 Beta4)"; content:"MoonBrowser (version 0.41 Beta4)"; sid:1001351; ) alert tcp any any -> any any (msg:"Supheli Arac :vspider/3.x"; content:"vspider/3.x"; sid:1001352; ) alert tcp any any -> any any (msg:"Supheli Arac :Zao/0.1 (http://www.kototoi.org/zao/)"; content:"Zao/0.1 (http://www.kototoi.org/zao/)"; sid:1001353; ) alert tcp any any -> any any (msg:"Supheli Arac :LEIA/3.01pr (LEIAcrawler; [SNIP])"; content:"LEIA/3.01pr (LEIAcrawler; [SNIP])"; sid:1001354; ) alert tcp any any -> any any (msg:"Supheli Arac :J-PHONE/3.0/J-SH07"; content:"J-PHONE/3.0/J-SH07"; sid:1001355; ) alert tcp any any -> any any (msg:"Supheli Arac :iSiloX/4.xx Windows/32"; content:"iSiloX/4.xx Windows/32"; sid:1001356; ) alert tcp any any -> any any (msg:"Supheli Arac :Pockey7.x.x(WIN32GUI)"; content:"Pockey7.x.x(WIN32GUI)"; sid:1001357; ) alert tcp any any -> any any (msg:"Supheli Arac :K-Meleon/0.6 (Windows; U; Windows NT 5.1; en-US; rv:0.9.5) Gecko/20011011"; content:"K-Meleon/0.6 (Windows; U; Windows NT 5.1; en-US; rv:0.9.5) Gecko/20011011"; sid:1001358; ) alert tcp any any -> any any (msg:"Supheli Arac :Hatena Mobile Gateway/1.0"; content:"Hatena Mobile Gateway/1.0"; sid:1001359; ) alert tcp any any -> any any (msg:"Supheli Arac :SWB/V1.4 (HP)"; content:"SWB/V1.4 (HP)"; sid:1001360; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/6.01 (larbin@unspecified.mail)"; content:"Opera/6.01 (larbin@unspecified.mail)"; sid:1001361; ) alert tcp any any -> any any (msg:"Supheli Arac :CoralWebPrx/0.1.1x (See http://coralcdn.org/)"; content:"CoralWebPrx/0.1.1x (See http://coralcdn.org/)"; sid:1001362; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 whoiam [http://www.axxus.de/]"; content:"Mozilla/5.0 whoiam [http://www.axxus.de/]"; sid:1001363; ) alert tcp any any -> any any (msg:"Supheli Arac :dds explorer v1.0 beta"; content:"dds explorer v1.0 beta"; sid:1001364; ) alert tcp any any -> any any (msg:"Supheli Arac :TeamSoft WinInet Component"; content:"TeamSoft WinInet Component"; sid:1001365; ) alert tcp any any -> any any (msg:"Supheli Arac :cg-eye interactive"; content:"cg-eye interactive"; sid:1001366; ) alert tcp any any -> any any (msg:"Supheli Arac :FileHound x.x"; content:"FileHound x.x"; sid:1001367; ) alert tcp any any -> any any (msg:"Supheli Arac :DoCoMo/1.0/P502i/c10 (Google CHTML Proxy/1.0)"; content:"DoCoMo/1.0/P502i/c10 (Google CHTML Proxy/1.0)"; sid:1001368; ) alert tcp any any -> any any (msg:"Supheli Arac :RoboCrawl (www.canadiancontent.net)"; content:"RoboCrawl (www.canadiancontent.net)"; sid:1001369; ) alert tcp any any -> any any (msg:"Supheli Arac :WWW-Mechanize/1.1x"; content:"WWW-Mechanize/1.1x"; sid:1001370; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; grub-client-0.2.x; Crawl your stuff with http://grub.org)"; content:"Mozilla/4.0 (compatible; grub-client-0.2.x; Crawl your stuff with http://grub.org)"; sid:1001371; ) alert tcp any any -> any any (msg:"Supheli Arac :Exabot-Images/1.0"; content:"Exabot-Images/1.0"; sid:1001372; ) alert tcp any any -> any any (msg:"Supheli Arac :RedCell/0.1 (RedCell; telegenetic.net/bot.html; lhall_at_telegenetic.net)"; content:"RedCell/0.1 (RedCell; telegenetic.net/bot.html; lhall_at_telegenetic.net)"; sid:1001373; ) alert tcp any any -> any any (msg:"Supheli Arac :search.ch V1.4.2 (spiderman@search.ch; http://www.search.ch)"; content:"search.ch V1.4.2 (spiderman@search.ch; http://www.search.ch)"; sid:1001374; ) alert tcp any any -> any any (msg:"Supheli Arac :InternetArchive/0.8-dev(Nutch;http://lucene.apache.org/nutch/bot.html;nutch-agent@lucene.apache"; content:"InternetArchive/0.8-dev(Nutch;http://lucene.apache.org/nutch/bot.html;nutch-agent@lucene.apache"; sid:1001375; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; MuscatFerret/1.6.x; claude@euroferret.com)"; content:"Mozilla/3.0 (compatible; MuscatFerret/1.6.x; claude@euroferret.com)"; sid:1001376; ) alert tcp any any -> any any (msg:"Supheli Arac :TinEye/1.1 (http://tineye.com/crawler.html)"; content:"TinEye/1.1 (http://tineye.com/crawler.html)"; sid:1001377; ) alert tcp any any -> any any (msg:"Supheli Arac :BIGLOTRON (Beta 2;GNU/Linux)"; content:"BIGLOTRON (Beta 2;GNU/Linux)"; sid:1001378; ) alert tcp any any -> any any (msg:"Supheli Arac :Goblin/0.9.x (http://www.goguides.org/goblin-info.html)"; content:"Goblin/0.9.x (http://www.goguides.org/goblin-info.html)"; sid:1001379; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; Webinator-DEV01.home.iprospect.com/2.56)"; content:"Mozilla/3.0 (compatible; Webinator-DEV01.home.iprospect.com/2.56)"; sid:1001380; ) alert tcp any any -> any any (msg:"Supheli Arac :JOC Web Spider"; content:"JOC Web Spider"; sid:1001381; ) alert tcp any any -> any any (msg:"Supheli Arac :virus_detector (virus_harvester@securecomputing.com)"; content:"virus_detector (virus_harvester@securecomputing.com)"; sid:1001382; ) alert tcp any any -> any any (msg:"Supheli Arac :NeuralBot/0.2"; content:"NeuralBot/0.2"; sid:1001383; ) alert tcp any any -> any any (msg:"Supheli Arac :cosmos/0.9_(robot@xyleme.com)"; content:"cosmos/0.9_(robot@xyleme.com)"; sid:1001384; ) alert tcp any any -> any any (msg:"Supheli Arac :Website Explorer/0.9.x.x"; content:"Website Explorer/0.9.x.x"; sid:1001385; ) alert tcp any any -> any any (msg:"Supheli Arac :Bloodhound/Nutch-0.9 (Testing Crawler for Research - obeys robots.txt and robots meta tags ; http://balihoo.com/index.aspx; robot at balihoo dot com)"; content:"Bloodhound/Nutch-0.9 (Testing Crawler for Research - obeys robots.txt and robots meta tags ; http://balihoo.com/index.aspx; robot at balihoo dot com)"; sid:1001386; ) alert tcp any any -> any any (msg:"Supheli Arac :WebReaper [webreaper@webreaper.net]"; content:"WebReaper [webreaper@webreaper.net]"; sid:1001387; ) alert tcp any any -> any any (msg:"Supheli Arac :AltaVista Intranet V2.0 Compaq Altavista Eval sveand@altavista.net"; content:"AltaVista Intranet V2.0 Compaq Altavista Eval sveand@altavista.net"; sid:1001388; ) alert tcp any any -> any any (msg:"Supheli Arac :CyberPatrol SiteCat Webbot (http://www.cyberpatrol.com/cyberpatrolcrawler.asp)"; content:"CyberPatrol SiteCat Webbot (http://www.cyberpatrol.com/cyberpatrolcrawler.asp)"; sid:1001389; ) alert tcp any any -> any any (msg:"Supheli Arac :Download Wonder"; content:"Download Wonder"; sid:1001390; ) alert tcp any any -> any any (msg:"Supheli Arac :Links - http://gossamer-threads.com/scripts/links/"; content:"Links - http://gossamer-threads.com/scripts/links/"; sid:1001391; ) alert tcp any any -> any any (msg:"Supheli Arac :IncyWincy(http://www.loopimprovements.com/robot.html)"; content:"IncyWincy(http://www.loopimprovements.com/robot.html)"; sid:1001392; ) alert tcp any any -> any any (msg:"Supheli Arac :stat statcrawler@gmail.com"; content:"stat statcrawler@gmail.com"; sid:1001393; ) alert tcp any any -> any any (msg:"Supheli Arac :PEval 1.4b"; content:"PEval 1.4b"; sid:1001394; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.61 [de] (OS/2; I)"; content:"Mozilla/4.61 [de] (OS/2; I)"; sid:1001395; ) alert tcp any any -> any any (msg:"Supheli Arac :WebMiner/x.x [en] (Win98; I)"; content:"WebMiner/x.x [en] (Win98; I)"; sid:1001396; ) alert tcp any any -> any any (msg:"Supheli Arac :vb wininet"; content:"vb wininet"; sid:1001397; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.02Gold (Win95; I)"; content:"Mozilla/2.02Gold (Win95; I)"; sid:1001398; ) alert tcp any any -> any any (msg:"Supheli Arac :Chilkat/1.0.0 (+http://www.chilkatsoft.com/ChilkatHttpUA.asp)"; content:"Chilkat/1.0.0 (+http://www.chilkatsoft.com/ChilkatHttpUA.asp)"; sid:1001399; ) alert tcp any any -> any any (msg:"Supheli Arac :LEIA/2.90"; content:"LEIA/2.90"; sid:1001400; ) alert tcp any any -> any any (msg:"Supheli Arac :dCSbot/1.1"; content:"dCSbot/1.1"; sid:1001401; ) alert tcp any any -> any any (msg:"Supheli Arac :VSE/1.0 (testcrawler@vivisimo.com)"; content:"VSE/1.0 (testcrawler@vivisimo.com)"; sid:1001402; ) alert tcp any any -> any any (msg:"Supheli Arac :LexiBot/1.00"; content:"LexiBot/1.00"; sid:1001403; ) alert tcp any any -> any any (msg:"Supheli Arac :AnswerChase PROve x.0"; content:"AnswerChase PROve x.0"; sid:1001404; ) alert tcp any any -> any any (msg:"Supheli Arac :SpeedDownload/1.x"; content:"SpeedDownload/1.x"; sid:1001405; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkAlarm/2.x"; content:"LinkAlarm/2.x"; sid:1001406; ) alert tcp any any -> any any (msg:"Supheli Arac :InfoFly/1.0 (http://www.versions-project.org/)"; content:"InfoFly/1.0 (http://www.versions-project.org/)"; sid:1001407; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC; AtHome021)"; content:"Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC; AtHome021)"; sid:1001408; ) alert tcp any any -> any any (msg:"Supheli Arac :Jyxobot/x"; content:"Jyxobot/x"; sid:1001409; ) alert tcp any any -> any any (msg:"Supheli Arac :Custo x.x (www.netwu.com)"; content:"Custo x.x (www.netwu.com)"; sid:1001410; ) alert tcp any any -> any any (msg:"Supheli Arac :Folkd.com Spider/0.1 beta 1 (www.folkd.com)"; content:"Folkd.com Spider/0.1 beta 1 (www.folkd.com)"; sid:1001411; ) alert tcp any any -> any any (msg:"Supheli Arac :Jakarta Commons-HttpClient/3.0-rcx"; content:"Jakarta Commons-HttpClient/3.0-rcx"; sid:1001412; ) alert tcp any any -> any any (msg:"Supheli Arac :ELinks (0.x.x; Linux 2.4.20 i586; 132x60)"; content:"ELinks (0.x.x; Linux 2.4.20 i586; 132x60)"; sid:1001413; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; ScollSpider; http://www.webwobot.com)"; content:"Mozilla/3.0 (compatible; ScollSpider; http://www.webwobot.com)"; sid:1001414; ) alert tcp any any -> any any (msg:"Supheli Arac :SnoopRob/x.x"; content:"SnoopRob/x.x"; sid:1001415; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) (dns_admin@c-a-s-h.com)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) (dns_admin@c-a-s-h.com)"; sid:1001416; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter_trk3-3.0.3"; content:"Scooter_trk3-3.0.3"; sid:1001417; ) alert tcp any any -> any any (msg:"Supheli Arac :CydralSpider/3.0 (Cydral Image Search; http://www.cydral.com)"; content:"CydralSpider/3.0 (Cydral Image Search; http://www.cydral.com)"; sid:1001418; ) alert tcp any any -> any any (msg:"Supheli Arac :Sqworm/2.9.81-BETA (beta_release; 20011102-760; i686-pc-linux-gnu)"; content:"Sqworm/2.9.81-BETA (beta_release; 20011102-760; i686-pc-linux-gnu)"; sid:1001419; ) alert tcp any any -> any any (msg:"Supheli Arac :MetagerBot/0.8-dev (MetagerBot; http://metager.de; )"; content:"MetagerBot/0.8-dev (MetagerBot; http://metager.de; )"; sid:1001420; ) alert tcp any any -> any any (msg:"Supheli Arac :InfoNaviRobot(F107)"; content:"InfoNaviRobot(F107)"; sid:1001421; ) alert tcp any any -> any any (msg:"Supheli Arac :Go-Ahead-Got-It/1.1"; content:"Go-Ahead-Got-It/1.1"; sid:1001422; ) alert tcp any any -> any any (msg:"Supheli Arac :dbDig(http://www.prairielandconsulting.com)"; content:"dbDig(http://www.prairielandconsulting.com)"; sid:1001423; ) alert tcp any any -> any any (msg:"Supheli Arac :SlySearch/1.0 http://www.plagiarism.org/crawler/robotinfo.html"; content:"SlySearch/1.0 http://www.plagiarism.org/crawler/robotinfo.html"; sid:1001424; ) alert tcp any any -> any any (msg:"Supheli Arac :NavissoBot/1.7 (+http://navisso.com/)"; content:"NavissoBot/1.7 (+http://navisso.com/)"; sid:1001425; ) alert tcp any any -> any any (msg:"Supheli Arac :NutchCVS/0.7.1 (Nutch running at UW; http://www.nutch.org/docs/en/bot.html; sycrawl@cs.washington.edu)"; content:"NutchCVS/0.7.1 (Nutch running at UW; http://www.nutch.org/docs/en/bot.html; sycrawl@cs.washington.edu)"; sid:1001426; ) alert tcp any any -> any any (msg:"Supheli Arac :Turnpike Emporium LinkChecker/0.1"; content:"Turnpike Emporium LinkChecker/0.1"; sid:1001427; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Galbot/1.0; +http://www.galbot.com/bot.html)"; content:"Mozilla/5.0 (compatible; Galbot/1.0; +http://www.galbot.com/bot.html)"; sid:1001428; ) alert tcp any any -> any any (msg:"Supheli Arac :Cogentbot/1.X (+http://www.cogentsoftwaresolutions.com/bot.html)"; content:"Cogentbot/1.X (+http://www.cogentsoftwaresolutions.com/bot.html)"; sid:1001429; ) alert tcp any any -> any any (msg:"Supheli Arac :link_check3.plx libwww-perl/5.65"; content:"link_check3.plx libwww-perl/5.65"; sid:1001430; ) alert tcp any any -> any any (msg:"Supheli Arac :Metaeuro Web Crawler/0.2 (MetaEuro Web Search Clustering Engine; http://www.metaeuro.com; crawler at metaeuro dot com)"; content:"Metaeuro Web Crawler/0.2 (MetaEuro Web Search Clustering Engine; http://www.metaeuro.com; crawler at metaeuro dot com)"; sid:1001431; ) alert tcp any any -> any any (msg:"Supheli Arac :Interarchy/x.x.x (InterarchyCrawler)"; content:"Interarchy/x.x.x (InterarchyCrawler)"; sid:1001432; ) alert tcp any any -> any any (msg:"Supheli Arac :Missauga Locate 1.0.0"; content:"Missauga Locate 1.0.0"; sid:1001433; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 compatible ZyBorg/1.0 (ZyBorg@WISEnutbot.com; http://www.WISEnutbot.com)"; content:"Mozilla/4.0 compatible ZyBorg/1.0 (ZyBorg@WISEnutbot.com; http://www.WISEnutbot.com)"; sid:1001434; ) alert tcp any any -> any any (msg:"Supheli Arac :Yahoo-Blogs/v3.9 (compatible; Mozilla 4.0; MSIE 5.5; http://help.yahoo.com/help/us/ysearch/crawling/crawling-02.html )"; content:"Yahoo-Blogs/v3.9 (compatible; Mozilla 4.0; MSIE 5.5; http://help.yahoo.com/help/us/ysearch/crawling/crawling-02.html )"; sid:1001435; ) alert tcp any any -> any any (msg:"Supheli Arac :YottaCars_Bot/4.12 (+http://www.yottacars.com) Car Search Engine"; content:"YottaCars_Bot/4.12 (+http://www.yottacars.com) Car Search Engine"; sid:1001436; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) (samualt9@bigfoot.com)"; content:"Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) (samualt9@bigfoot.com)"; sid:1001437; ) alert tcp any any -> any any (msg:"Supheli Arac :Firefox (kastaneta03@hotmail.com)"; content:"Firefox (kastaneta03@hotmail.com)"; sid:1001438; ) alert tcp any any -> any any (msg:"Supheli Arac :VWBOT/Nutch-0.9-dev (VWBOT Nutch Crawler; http://vwbot.cs.uiuc.edu;+vwbot@cs.uiuc.edu"; content:"VWBOT/Nutch-0.9-dev (VWBOT Nutch Crawler; http://vwbot.cs.uiuc.edu;+vwbot@cs.uiuc.edu"; sid:1001439; ) alert tcp any any -> any any (msg:"Supheli Arac :psbot/0.1 (+http://www.picsearch.com/bot.html)"; content:"psbot/0.1 (+http://www.picsearch.com/bot.html)"; sid:1001440; ) alert tcp any any -> any any (msg:"Supheli Arac :Alligator 1.31 (www.nearsoftware.com)"; content:"Alligator 1.31 (www.nearsoftware.com)"; sid:1001441; ) alert tcp any any -> any any (msg:"Supheli Arac :Gamespy_Arcade"; content:"Gamespy_Arcade"; sid:1001442; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Clustered-Search-Bot/1.0; support@clush.com; http://www.clush.com/)"; content:"Mozilla/5.0 (Clustered-Search-Bot/1.0; support@clush.com; http://www.clush.com/)"; sid:1001443; ) alert tcp any any -> any any (msg:"Supheli Arac :holmes/x.x"; content:"holmes/x.x"; sid:1001444; ) alert tcp any any -> any any (msg:"Supheli Arac :spider.batsch.com"; content:"spider.batsch.com"; sid:1001445; ) alert tcp any any -> any any (msg:"Supheli Arac :Lincoln State Web Browser"; content:"Lincoln State Web Browser"; sid:1001446; ) alert tcp any any -> any any (msg:"Supheli Arac :WinGet 1.1"; content:"WinGet 1.1"; sid:1001447; ) alert tcp any any -> any any (msg:"Supheli Arac :WebFilter Robot 1.0"; content:"WebFilter Robot 1.0"; sid:1001448; ) alert tcp any any -> any any (msg:"Supheli Arac :WebFilter Robot 1.x"; content:"WebFilter Robot 1.x"; sid:1001449; ) alert tcp any any -> any any (msg:"Supheli Arac :Pingdom GIGRIB (http://www.pingdom.com)"; content:"Pingdom GIGRIB (http://www.pingdom.com)"; sid:1001450; ) alert tcp any any -> any any (msg:"Supheli Arac :SeznamBot/2.0-test (+http://fulltext.sblog.cz/)"; content:"SeznamBot/2.0-test (+http://fulltext.sblog.cz/)"; sid:1001451; ) alert tcp any any -> any any (msg:"Supheli Arac :gridwell (http://search.gridwell.com)"; content:"gridwell (http://search.gridwell.com)"; sid:1001452; ) alert tcp any any -> any any (msg:"Supheli Arac :Toutatis x.x (hoppa.com)"; content:"Toutatis x.x (hoppa.com)"; sid:1001453; ) alert tcp any any -> any any (msg:"Supheli Arac :Zippy v2.0 - Zippyfinder.com"; content:"Zippy v2.0 - Zippyfinder.com"; sid:1001454; ) alert tcp any any -> any any (msg:"Supheli Arac :AESOP_com_SpiderMan"; content:"AESOP_com_SpiderMan"; sid:1001455; ) alert tcp any any -> any any (msg:"Supheli Arac :WorldLight"; content:"WorldLight"; sid:1001456; ) alert tcp any any -> any any (msg:"Supheli Arac :IncyWincy/2.1(loopimprovements.com/robot.html)"; content:"IncyWincy/2.1(loopimprovements.com/robot.html)"; sid:1001457; ) alert tcp any any -> any any (msg:"Supheli Arac :KDDI-SN22 UP.Browser/6.0.7 (GUI) MMP/1.1 (Google WAP Proxy/1.0)"; content:"KDDI-SN22 UP.Browser/6.0.7 (GUI) MMP/1.1 (Google WAP Proxy/1.0)"; sid:1001458; ) alert tcp any any -> any any (msg:"Supheli Arac :VayalaCreep-v0.0.1 (haploid@haploid.com)"; content:"VayalaCreep-v0.0.1 (haploid@haploid.com)"; sid:1001459; ) alert tcp any any -> any any (msg:"Supheli Arac :dev-spider2.searchpsider.com/1.3b"; content:"dev-spider2.searchpsider.com/1.3b"; sid:1001460; ) alert tcp any any -> any any (msg:"Supheli Arac :Sogou Orion spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"; content:"Sogou Orion spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"; sid:1001461; ) alert tcp any any -> any any (msg:"Supheli Arac :Spinne/2.0 med"; content:"Spinne/2.0 med"; sid:1001462; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; YANDEX)"; content:"Mozilla/4.0 (compatible; MSIE 5.0; YANDEX)"; sid:1001463; ) alert tcp any any -> any any (msg:"Supheli Arac :httpunit/1.5"; content:"httpunit/1.5"; sid:1001464; ) alert tcp any any -> any any (msg:"Supheli Arac :httpunit/1.x"; content:"httpunit/1.x"; sid:1001465; ) alert tcp any any -> any any (msg:"Supheli Arac :MIIxpc/4.2"; content:"MIIxpc/4.2"; sid:1001466; ) alert tcp any any -> any any (msg:"Supheli Arac :accoona"; content:"accoona"; sid:1001467; ) alert tcp any any -> any any (msg:"Supheli Arac :OutfoxMelonBot/0.5 (for internet experiments; http://; outfoxbot@gmail.com)"; content:"OutfoxMelonBot/0.5 (for internet experiments; http://; outfoxbot@gmail.com)"; sid:1001468; ) alert tcp any any -> any any (msg:"Supheli Arac :FollowSite.com ( http://www.followsite.com/b.html )"; content:"FollowSite.com ( http://www.followsite.com/b.html )"; sid:1001469; ) alert tcp any any -> any any (msg:"Supheli Arac :KWC-KX9/1109 UP.Browser/6.2.3.9.g.1.107 (GUI) MMP/2.0 UP.Link/6.3.0.0.0"; content:"KWC-KX9/1109 UP.Browser/6.2.3.9.g.1.107 (GUI) MMP/2.0 UP.Link/6.3.0.0.0"; sid:1001470; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.7.6) Gecko/20050405 Epiphany/1.6.1 (Ubuntu) (Ubuntu package 1.0.2)"; content:"Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.7.6) Gecko/20050405 Epiphany/1.6.1 (Ubuntu) (Ubuntu package 1.0.2)"; sid:1001471; ) alert tcp any any -> any any (msg:"Supheli Arac :NSPlayer/10.0.0.xxxx WMFSDK/10.0"; content:"NSPlayer/10.0.0.xxxx WMFSDK/10.0"; sid:1001472; ) alert tcp any any -> any any (msg:"Supheli Arac :Apexoo Spider 1.x"; content:"Apexoo Spider 1.x"; sid:1001473; ) alert tcp any any -> any any (msg:"Supheli Arac :Educate Search VxB"; content:"Educate Search VxB"; sid:1001474; ) alert tcp any any -> any any (msg:"Supheli Arac :SietsCrawler/1.1 (+http://www.siets.biz)"; content:"SietsCrawler/1.1 (+http://www.siets.biz)"; sid:1001475; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; http://www.IsMySiteUp.Net/bot/ )"; content:"Mozilla/5.0 (compatible; http://www.IsMySiteUp.Net/bot/ )"; sid:1001476; ) alert tcp any any -> any any (msg:"Supheli Arac :googlebot (larbin2.6.0@unspecified.mail)"; content:"googlebot (larbin2.6.0@unspecified.mail)"; sid:1001477; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; ibisBrowser)"; content:"Mozilla/4.0 (compatible; ibisBrowser)"; sid:1001478; ) alert tcp any any -> any any (msg:"Supheli Arac :Lotus-Notes/4.5 ( Windows-NT )"; content:"Lotus-Notes/4.5 ( Windows-NT )"; sid:1001479; ) alert tcp any any -> any any (msg:"Supheli Arac :TulipChain/5.x (http://ostermiller.org/tulipchain/) Java/1.x.1_0x (http://java.sun.com/) Linux/2.4.17"; content:"TulipChain/5.x (http://ostermiller.org/tulipchain/) Java/1.x.1_0x (http://java.sun.com/) Linux/2.4.17"; sid:1001480; ) alert tcp any any -> any any (msg:"Supheli Arac :noxtrumbot/1.0 (crawler@noxtrum.com)"; content:"noxtrumbot/1.0 (crawler@noxtrum.com)"; sid:1001481; ) alert tcp any any -> any any (msg:"Supheli Arac :Harvest-NG/1.0.2"; content:"Harvest-NG/1.0.2"; sid:1001482; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkScan/11.0beta2 UnixShareware robot from Elsop.com (used by Indiafocus/Indiainfo)"; content:"LinkScan/11.0beta2 UnixShareware robot from Elsop.com (used by Indiafocus/Indiainfo)"; sid:1001483; ) alert tcp any any -> any any (msg:"Supheli Arac :Infoseek SideWinder/2.0B (Linux 2.4 i686)"; content:"Infoseek SideWinder/2.0B (Linux 2.4 i686)"; sid:1001484; ) alert tcp any any -> any any (msg:"Supheli Arac :Iltrovatore-Setaccio/0.3-dev (Indexing; http://www.iltrovatore.it/bot.html; info@iltrovatore.it)"; content:"Iltrovatore-Setaccio/0.3-dev (Indexing; http://www.iltrovatore.it/bot.html; info@iltrovatore.it)"; sid:1001485; ) alert tcp any any -> any any (msg:"Supheli Arac :EchO!/2.0"; content:"EchO!/2.0"; sid:1001486; ) alert tcp any any -> any any (msg:"Supheli Arac :Yahoo-VerticalCrawler-FormerWebCrawler/3.9 crawler at trd dot overture dot com; http://www.alltheweb.com/help/webmaster/crawler"; content:"Yahoo-VerticalCrawler-FormerWebCrawler/3.9 crawler at trd dot overture dot com; http://www.alltheweb.com/help/webmaster/crawler"; sid:1001487; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; NetPositive/2.2)"; content:"Mozilla/3.0 (compatible; NetPositive/2.2)"; sid:1001488; ) alert tcp any any -> any any (msg:"Supheli Arac :FeedForAll rss2html.php v2"; content:"FeedForAll rss2html.php v2"; sid:1001489; ) alert tcp any any -> any any (msg:"Supheli Arac :Xenu's Link Sleuth 1.x[a-z]"; content:"Xenu's Link Sleuth 1.x[a-z]"; sid:1001490; ) alert tcp any any -> any any (msg:"Supheli Arac :eStyleSearch 4 (compatible; MSIE 6.0; Windows NT 5.0)"; content:"eStyleSearch 4 (compatible; MSIE 6.0; Windows NT 5.0)"; sid:1001491; ) alert tcp any any -> any any (msg:"Supheli Arac :HTML2JPG Enterprise"; content:"HTML2JPG Enterprise"; sid:1001492; ) alert tcp any any -> any any (msg:"Supheli Arac :NewsGatorOnline/2.0 (http://www.newsgator.com; 1 subscribers)"; content:"NewsGatorOnline/2.0 (http://www.newsgator.com; 1 subscribers)"; sid:1001493; ) alert tcp any any -> any any (msg:"Supheli Arac :INGRID/3.0 MT (webcrawler@NOSPAMexperimental.net; http://webmaster.ilse.nl/jsp/webmaster.jsp)"; content:"INGRID/3.0 MT (webcrawler@NOSPAMexperimental.net; http://webmaster.ilse.nl/jsp/webmaster.jsp)"; sid:1001494; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"; sid:1001495; ) alert tcp any any -> any any (msg:"Supheli Arac :Wotbox/alpha0.6 (bot@wotbox.com; http://www.wotbox.com)"; content:"Wotbox/alpha0.6 (bot@wotbox.com; http://www.wotbox.com)"; sid:1001496; ) alert tcp any any -> any any (msg:"Supheli Arac :IPiumBot laurion(dot)com"; content:"IPiumBot laurion(dot)com"; sid:1001497; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Exabot Test/3.0; +http://www.exabot.com/go/robot)"; content:"Mozilla/5.0 (compatible; Exabot Test/3.0; +http://www.exabot.com/go/robot)"; sid:1001498; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; MuscatFerret/1.5; olly@muscat.co.uk)"; content:"Mozilla/3.0 (compatible; MuscatFerret/1.5; olly@muscat.co.uk)"; sid:1001499; ) alert tcp any any -> any any (msg:"Supheli Arac :ASPSeek/1.2.xxpre"; content:"ASPSeek/1.2.xxpre"; sid:1001500; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; ChristCrawler.com ChristCrawler@ChristCENTRAL.com)"; content:"Mozilla/4.0 (compatible; ChristCrawler.com ChristCrawler@ChristCENTRAL.com)"; sid:1001501; ) alert tcp any any -> any any (msg:"Supheli Arac :WebarooBot (Webaroo Bot; http://64.124.122.252/feedback.html)"; content:"WebarooBot (Webaroo Bot; http://64.124.122.252/feedback.html)"; sid:1001502; ) alert tcp any any -> any any (msg:"Supheli Arac :Yahoo Pipes 1.0"; content:"Yahoo Pipes 1.0"; sid:1001503; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; Win32) via proxy gateway CERN-HTTPD/3.0 libwww/2.17"; content:"Mozilla/4.0 (compatible; MSIE 5.0; Win32) via proxy gateway CERN-HTTPD/3.0 libwww/2.17"; sid:1001504; ) alert tcp any any -> any any (msg:"Supheli Arac :Gigabot/2.0 (gigablast.com)"; content:"Gigabot/2.0 (gigablast.com)"; sid:1001505; ) alert tcp any any -> any any (msg:"Supheli Arac :HLoader"; content:"HLoader"; sid:1001506; ) alert tcp any any -> any any (msg:"Supheli Arac :Gigabot/2.0; http://www.gigablast.com/spider.html"; content:"Gigabot/2.0; http://www.gigablast.com/spider.html"; sid:1001507; ) alert tcp any any -> any any (msg:"Supheli Arac :AnswerChase x.0"; content:"AnswerChase x.0"; sid:1001508; ) alert tcp any any -> any any (msg:"Supheli Arac :amzn_assoc"; content:"amzn_assoc"; sid:1001509; ) alert tcp any any -> any any (msg:"Supheli Arac :uTorrent/1500"; content:"uTorrent/1500"; sid:1001510; ) alert tcp any any -> any any (msg:"Supheli Arac :BlogMap (http://www.feedmap.net)"; content:"BlogMap (http://www.feedmap.net)"; sid:1001511; ) alert tcp any any -> any any (msg:"Supheli Arac :Doubanbot/1.0 (bot@douban.com http://www.douban.com)"; content:"Doubanbot/1.0 (bot@douban.com http://www.douban.com)"; sid:1001512; ) alert tcp any any -> any any (msg:"Supheli Arac :NPBot (http://www.nameprotect.com/botinfo.html)"; content:"NPBot (http://www.nameprotect.com/botinfo.html)"; sid:1001513; ) alert tcp any any -> any any (msg:"Supheli Arac :WinkBot/0.06 (Wink.com search engine web crawler; http://www.wink.com/Wink:WinkBot; winkbot@wink.com)"; content:"WinkBot/0.06 (Wink.com search engine web crawler; http://www.wink.com/Wink:WinkBot; winkbot@wink.com)"; sid:1001514; ) alert tcp any any -> any any (msg:"Supheli Arac :Speedy Spider (Beta/x.x; speedy@entireweb.com)"; content:"Speedy Spider (Beta/x.x; speedy@entireweb.com)"; sid:1001515; ) alert tcp any any -> any any (msg:"Supheli Arac :InnerpriseBot/1.0 (http://www.innerprise.com/)"; content:"InnerpriseBot/1.0 (http://www.innerprise.com/)"; sid:1001516; ) alert tcp any any -> any any (msg:"Supheli Arac :Hybrid/1.2 [en] (OS Independent)"; content:"Hybrid/1.2 [en] (OS Independent)"; sid:1001517; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteWinder"; content:"SiteWinder"; sid:1001518; ) alert tcp any any -> any any (msg:"Supheli Arac :holmes/3.xx (OnetSzukaj/5.0; +http://szukaj.onet.pl)"; content:"holmes/3.xx (OnetSzukaj/5.0; +http://szukaj.onet.pl)"; sid:1001519; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-ARS-1.1-ih"; content:"Scooter-ARS-1.1-ih"; sid:1001520; ) alert tcp any any -> any any (msg:"Supheli Arac :ColdFusion"; content:"ColdFusion"; sid:1001521; ) alert tcp any any -> any any (msg:"Supheli Arac :Download-Tipp Linkcheck (http://download-tipp.de/)"; content:"Download-Tipp Linkcheck (http://download-tipp.de/)"; sid:1001522; ) alert tcp any any -> any any (msg:"Supheli Arac :HTTP::Lite/2.x.x"; content:"HTTP::Lite/2.x.x"; sid:1001523; ) alert tcp any any -> any any (msg:"Supheli Arac :Buscaplus Robi/1.0 (http://www.buscaplus.com/robi/)"; content:"Buscaplus Robi/1.0 (http://www.buscaplus.com/robi/)"; sid:1001524; ) alert tcp any any -> any any (msg:"Supheli Arac :CSE HTML Validator Professional (http://www.htmlvalidator.com/)"; content:"CSE HTML Validator Professional (http://www.htmlvalidator.com/)"; sid:1001525; ) alert tcp any any -> any any (msg:"Supheli Arac :WincerSong Agent v1.0"; content:"WincerSong Agent v1.0"; sid:1001526; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:0.9.2) Gecko/20010726 Netscape6/6.1"; content:"Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:0.9.2) Gecko/20010726 Netscape6/6.1"; sid:1001527; ) alert tcp any any -> any any (msg:"Supheli Arac :yarienavoir.net/0.2"; content:"yarienavoir.net/0.2"; sid:1001528; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.01Gold (X11; I; SunOS 5.5.1 sun4m)"; content:"Mozilla/3.01Gold (X11; I; SunOS 5.5.1 sun4m)"; sid:1001529; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Advanced Email Extractor v2.xx)"; content:"Mozilla/4.0 (compatible; Advanced Email Extractor v2.xx)"; sid:1001530; ) alert tcp any any -> any any (msg:"Supheli Arac :mozDex/0.xx-dev (mozDex; http://www.mozdex.com/en/bot.html; spider@mozdex.com)"; content:"mozDex/0.xx-dev (mozDex; http://www.mozdex.com/en/bot.html; spider@mozdex.com)"; sid:1001531; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.76 [en] (X11; U; SunOS 5.7 sun4u)"; content:"Mozilla/4.76 [en] (X11; U; SunOS 5.7 sun4u)"; sid:1001532; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.2 (listonATccDOTgatechDOTedu)"; content:"larbin_2.6.2 (listonATccDOTgatechDOTedu)"; sid:1001533; ) alert tcp any any -> any any (msg:"Supheli Arac :amaya/x.xx libwww/x.x.x"; content:"amaya/x.xx libwww/x.x.x"; sid:1001534; ) alert tcp any any -> any any (msg:"Supheli Arac :DownloadDirect.1.0"; content:"DownloadDirect.1.0"; sid:1001535; ) alert tcp any any -> any any (msg:"Supheli Arac :WhizBang! Lab"; content:"WhizBang! Lab"; sid:1001536; ) alert tcp any any -> any any (msg:"Supheli Arac :wxDownload Fast"; content:"wxDownload Fast"; sid:1001537; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Win32) WebWasher 3.0"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Win32) WebWasher 3.0"; sid:1001538; ) alert tcp any any -> any any (msg:"Supheli Arac :Simpy 1.x; http://www.simpy.com/"; content:"Simpy 1.x; http://www.simpy.com/"; sid:1001539; ) alert tcp any any -> any any (msg:"Supheli Arac :NetResearchServer/x.x(loopimprovements.com/robot.html)"; content:"NetResearchServer/x.x(loopimprovements.com/robot.html)"; sid:1001540; ) alert tcp any any -> any any (msg:"Supheli Arac :rico/0.1"; content:"rico/0.1"; sid:1001541; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Webduniabot/1.0; +http://search.webdunia.com/bot.aspx)"; content:"Mozilla/5.0 (compatible; Webduniabot/1.0; +http://search.webdunia.com/bot.aspx)"; sid:1001542; ) alert tcp any any -> any any (msg:"Supheli Arac :Alcatel-BG3/1.0 UP.Browser/5.0.3.1.2"; content:"Alcatel-BG3/1.0 UP.Browser/5.0.3.1.2"; sid:1001543; ) alert tcp any any -> any any (msg:"Supheli Arac :InstallShield DigitalWizard"; content:"InstallShield DigitalWizard"; sid:1001544; ) alert tcp any any -> any any (msg:"Supheli Arac :Feedreader 3.xx (Powered by Newsbrain)"; content:"Feedreader 3.xx (Powered by Newsbrain)"; sid:1001545; ) alert tcp any any -> any any (msg:"Supheli Arac :OutfoxBot/0.x (For internet experiments; http://; outfox.agent@gmail.com)"; content:"OutfoxBot/0.x (For internet experiments; http://; outfox.agent@gmail.com)"; sid:1001546; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MathPlayer2.0)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MathPlayer2.0)"; sid:1001547; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (JemmaTheTourist;http://www.activtourist.com)"; content:"Mozilla/4.0 (JemmaTheTourist;http://www.activtourist.com)"; sid:1001548; ) alert tcp any any -> any any (msg:"Supheli Arac :Morris - Mixcat Crawler ( http://mixcat.com)"; content:"Morris - Mixcat Crawler ( http://mixcat.com)"; sid:1001549; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.7 (compatible; Intelliseek; http://www.intelliseek.com)"; content:"Mozilla/4.7 (compatible; Intelliseek; http://www.intelliseek.com)"; sid:1001550; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; Girafabot; girafabot at girafa dot com; http://www.girafa.com)"; content:"Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; Girafabot; girafabot at girafa dot com; http://www.girafa.com)"; sid:1001551; ) alert tcp any any -> any any (msg:"Supheli Arac :HomePageSearch(hpsearch.uni-trier.de)"; content:"HomePageSearch(hpsearch.uni-trier.de)"; sid:1001552; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; MSIE 3.0B; Win32)"; content:"Mozilla/2.0 (compatible; MSIE 3.0B; Win32)"; sid:1001553; ) alert tcp any any -> any any (msg:"Supheli Arac :Mac Finder 1.0.xx"; content:"Mac Finder 1.0.xx"; sid:1001554; ) alert tcp any any -> any any (msg:"Supheli Arac :minibot"; content:"minibot"; sid:1001555; ) alert tcp any any -> any any (msg:"Supheli Arac :RAMPyBot/0.8-dev (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"; content:"RAMPyBot/0.8-dev (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"; sid:1001556; ) alert tcp any any -> any any (msg:"Supheli Arac :Blaiz-Bee/2.00.8222 (BE Internet Search Engine http://www.rawgrunt.com)"; content:"Blaiz-Bee/2.00.8222 (BE Internet Search Engine http://www.rawgrunt.com)"; sid:1001557; ) alert tcp any any -> any any (msg:"Supheli Arac :Seeker.lookseek.com"; content:"Seeker.lookseek.com"; sid:1001558; ) alert tcp any any -> any any (msg:"Supheli Arac :Intelix/0.x (cs; http://www.microton.cz/intelix/; microton@@microton.cz)"; content:"Intelix/0.x (cs; http://www.microton.cz/intelix/; microton@@microton.cz)"; sid:1001559; ) alert tcp any any -> any any (msg:"Supheli Arac :ArchitextSpider"; content:"ArchitextSpider"; sid:1001560; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1) VoilaBot BETA 1.2 (support.voilabot@orange-ftgroup.com)"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1) VoilaBot BETA 1.2 (support.voilabot@orange-ftgroup.com)"; sid:1001561; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729) (Prevx 3.0.5)"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729) (Prevx 3.0.5)"; sid:1001562; ) alert tcp any any -> any any (msg:"Supheli Arac :contype"; content:"contype"; sid:1001563; ) alert tcp any any -> any any (msg:"Supheli Arac :voyager/2.0 (http://www.kosmix.com/html/crawler.html)"; content:"voyager/2.0 (http://www.kosmix.com/html/crawler.html)"; sid:1001564; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler 6 used by WWU (wardi@uni-muenster.de)"; content:"FAST Enterprise Crawler 6 used by WWU (wardi@uni-muenster.de)"; sid:1001565; ) alert tcp any any -> any any (msg:"Supheli Arac :A1 Sitemap Generator/1.0 (+http://www.micro-sys.dk/products/sitemap-generator/) miggibot/2006.01.24"; content:"A1 Sitemap Generator/1.0 (+http://www.micro-sys.dk/products/sitemap-generator/) miggibot/2006.01.24"; sid:1001566; ) alert tcp any any -> any any (msg:"Supheli Arac :iCab/2.5.2 (Macintosh; I; PPC)"; content:"iCab/2.5.2 (Macintosh; I; PPC)"; sid:1001567; ) alert tcp any any -> any any (msg:"Supheli Arac :Sqworm/2.9.89-BETA (beta_release; 20020130-839; i686-pc-linux-gnu)"; content:"Sqworm/2.9.89-BETA (beta_release; 20020130-839; i686-pc-linux-gnu)"; sid:1001568; ) alert tcp any any -> any any (msg:"Supheli Arac :boitho.com-dc/0.xx (http://www.boitho.com/dcbot.html)"; content:"boitho.com-dc/0.xx (http://www.boitho.com/dcbot.html)"; sid:1001569; ) alert tcp any any -> any any (msg:"Supheli Arac :UofTDB_experiment (leehyun@cs.toronto.edu)"; content:"UofTDB_experiment (leehyun@cs.toronto.edu)"; sid:1001570; ) alert tcp any any -> any any (msg:"Supheli Arac :TSurf15a 11"; content:"TSurf15a 11"; sid:1001571; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.2"; content:"Scooter-3.2"; sid:1001572; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter/1.0"; content:"Scooter/1.0"; sid:1001573; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter/3.3"; content:"Scooter/3.3"; sid:1001574; ) alert tcp any any -> any any (msg:"Supheli Arac :DA 4.0 (www.downloadaccelerator.com)"; content:"DA 4.0 (www.downloadaccelerator.com)"; sid:1001575; ) alert tcp any any -> any any (msg:"Supheli Arac :atSpider/1.0"; content:"atSpider/1.0"; sid:1001576; ) alert tcp any any -> any any (msg:"Supheli Arac :Bot mailto:craftbot@yahoo.com"; content:"Bot mailto:craftbot@yahoo.com"; sid:1001577; ) alert tcp any any -> any any (msg:"Supheli Arac :SearchGuild/DMOZ/Experiment (searchguild@gmail.com)"; content:"SearchGuild/DMOZ/Experiment (searchguild@gmail.com)"; sid:1001578; ) alert tcp any any -> any any (msg:"Supheli Arac :Filangy/1.0x (Filangy; http://www.nutch.org/docs/en/bot.html; filangy-agent@filangy.com)"; content:"Filangy/1.0x (Filangy; http://www.nutch.org/docs/en/bot.html; filangy-agent@filangy.com)"; sid:1001579; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/xxx.x (KHTML like Gecko) Safari/12x.x"; content:"Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/xxx.x (KHTML like Gecko) Safari/12x.x"; sid:1001580; ) alert tcp any any -> any any (msg:"Supheli Arac :WEP Search 00"; content:"WEP Search 00"; sid:1001581; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; TargetSeek/1.0; +http://www.targetgroups.net/TargetSeek.html)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; TargetSeek/1.0; +http://www.targetgroups.net/TargetSeek.html)"; sid:1001582; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkScan/x.x Unix"; content:"LinkScan/x.x Unix"; sid:1001583; ) alert tcp any any -> any any (msg:"Supheli Arac :SlySearch/1.x http://www.slysearch.com"; content:"SlySearch/1.x http://www.slysearch.com"; sid:1001584; ) alert tcp any any -> any any (msg:"Supheli Arac :Linkbot"; content:"Linkbot"; sid:1001585; ) alert tcp any any -> any any (msg:"Supheli Arac :verzamelgids.nl - Networking4all Bot/x.x"; content:"verzamelgids.nl - Networking4all Bot/x.x"; sid:1001586; ) alert tcp any any -> any any (msg:"Supheli Arac :lmspider (lmspider@scansoft.com)"; content:"lmspider (lmspider@scansoft.com)"; sid:1001587; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; SnapPreviewBot; en-US; rv:1.8.0.9) Gecko/20061206 Firefox/1.5.0.9"; content:"Mozilla/5.0 (compatible; SnapPreviewBot; en-US; rv:1.8.0.9) Gecko/20061206 Firefox/1.5.0.9"; sid:1001588; ) alert tcp any any -> any any (msg:"Supheli Arac :Vakes/0.01 (Vakes; http://www.vakes.com/; search@vakes.com)"; content:"Vakes/0.01 (Vakes; http://www.vakes.com/; search@vakes.com)"; sid:1001589; ) alert tcp any any -> any any (msg:"Supheli Arac :Links SQL (http://gossamer-threads.com/scripts/links-sql/)"; content:"Links SQL (http://gossamer-threads.com/scripts/links-sql/)"; sid:1001590; ) alert tcp any any -> any any (msg:"Supheli Arac :W3CRobot/5.4.0 libwww/5.4.0"; content:"W3CRobot/5.4.0 libwww/5.4.0"; sid:1001591; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.4/PartnerSite (crawler@fast.no; http://fast.no/support.php?c=faqs/crawler)"; content:"FAST-WebCrawler/3.4/PartnerSite (crawler@fast.no; http://fast.no/support.php?c=faqs/crawler)"; sid:1001592; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.7 [en]C-CCK-MCD {Yahoo;YIP052400} (Win95; I)"; content:"Mozilla/4.7 [en]C-CCK-MCD {Yahoo;YIP052400} (Win95; I)"; sid:1001593; ) alert tcp any any -> any any (msg:"Supheli Arac :Net-Seekr Bot/Net-Seekr Bot V1 (http://www.net-seekr.com)"; content:"Net-Seekr Bot/Net-Seekr Bot V1 (http://www.net-seekr.com)"; sid:1001594; ) alert tcp any any -> any any (msg:"Supheli Arac :pulseBot (pulse Web Miner)"; content:"pulseBot (pulse Web Miner)"; sid:1001595; ) alert tcp any any -> any any (msg:"Supheli Arac :Java1.1.xx.x"; content:"Java1.1.xx.x"; sid:1001596; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.x (I-Opener 1.1; Netpliance)"; content:"Mozilla/3.x (I-Opener 1.1; Netpliance)"; sid:1001597; ) alert tcp any any -> any any (msg:"Supheli Arac :NetLookout/2.24"; content:"NetLookout/2.24"; sid:1001598; ) alert tcp any any -> any any (msg:"Supheli Arac :HeinrichderMiragoRobot"; content:"HeinrichderMiragoRobot"; sid:1001599; ) alert tcp any any -> any any (msg:"Supheli Arac :Aberja Checkomat"; content:"Aberja Checkomat"; sid:1001600; ) alert tcp any any -> any any (msg:"Supheli Arac :genieBot (http://64.5.245.11/faq/faq.html)"; content:"genieBot (http://64.5.245.11/faq/faq.html)"; sid:1001601; ) alert tcp any any -> any any (msg:"Supheli Arac :iFeed.jp/2.0 (www.psychedelix.com/agents/agents.rss; 0 subscribers)"; content:"iFeed.jp/2.0 (www.psychedelix.com/agents/agents.rss; 0 subscribers)"; sid:1001602; ) alert tcp any any -> any any (msg:"Supheli Arac :polybot 1.0 (http://cis.poly.edu/polybot/)"; content:"polybot 1.0 (http://cis.poly.edu/polybot/)"; sid:1001603; ) alert tcp any any -> any any (msg:"Supheli Arac :MARTINI"; content:"MARTINI"; sid:1001604; ) alert tcp any any -> any any (msg:"Supheli Arac :(Privoxy/1.0)"; content:"(Privoxy/1.0)"; sid:1001605; ) alert tcp any any -> any any (msg:"Supheli Arac :AbachoBOT"; content:"AbachoBOT"; sid:1001606; ) alert tcp any any -> any any (msg:"Supheli Arac :DoCoMo/1.0/Nxxxi/c10"; content:"DoCoMo/1.0/Nxxxi/c10"; sid:1001607; ) alert tcp any any -> any any (msg:"Supheli Arac :Hi! I'm CsCrawler my homepage: http://www.kde.cs.uni-kassel.de/lehre/ss2005/googlespam/crawler.html RPT-HTTPClient/0.3-3"; content:"Hi! I'm CsCrawler my homepage: http://www.kde.cs.uni-kassel.de/lehre/ss2005/googlespam/crawler.html RPT-HTTPClient/0.3-3"; sid:1001608; ) alert tcp any any -> any any (msg:"Supheli Arac :SurferF3 1/0"; content:"SurferF3 1/0"; sid:1001609; ) alert tcp any any -> any any (msg:"Supheli Arac :Kevin http://websitealert.net/kevin/"; content:"Kevin http://websitealert.net/kevin/"; sid:1001610; ) alert tcp any any -> any any (msg:"Supheli Arac :aipbot/1.0 (aipbot; http://www.aipbot.com; aipbot@aipbot.com)"; content:"aipbot/1.0 (aipbot; http://www.aipbot.com; aipbot@aipbot.com)"; sid:1001611; ) alert tcp any any -> any any (msg:"Supheli Arac :Windows-Media-Player/10.00.00.xxxx"; content:"Windows-Media-Player/10.00.00.xxxx"; sid:1001612; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Active Cache Request"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Active Cache Request"; sid:1001613; ) alert tcp any any -> any any (msg:"Supheli Arac :ColdFusion (BookmarkTracker.com)"; content:"ColdFusion (BookmarkTracker.com)"; sid:1001614; ) alert tcp any any -> any any (msg:"Supheli Arac :Knowledge.com/0.x"; content:"Knowledge.com/0.x"; sid:1001615; ) alert tcp any any -> any any (msg:"Supheli Arac :Carnegie_Mellon_University_Research_WebBOT--"; content:"Carnegie_Mellon_University_Research_WebBOT--"; sid:1001616; ) alert tcp any any -> any any (msg:"Supheli Arac :Arquivo-web-crawler (compatible; heritrix/1.12.1 +http://arquivo-web.fccn.pt)"; content:"Arquivo-web-crawler (compatible; heritrix/1.12.1 +http://arquivo-web.fccn.pt)"; sid:1001617; ) alert tcp any any -> any any (msg:"Supheli Arac :TOPOS robot/1.1 (http://www.topos.com.ua/)"; content:"TOPOS robot/1.1 (http://www.topos.com.ua/)"; sid:1001618; ) alert tcp any any -> any any (msg:"Supheli Arac :WebFetch"; content:"WebFetch"; sid:1001619; ) alert tcp any any -> any any (msg:"Supheli Arac :KE_1.0/2.0 libwww/5.2.8"; content:"KE_1.0/2.0 libwww/5.2.8"; sid:1001620; ) alert tcp any any -> any any (msg:"Supheli Arac :Factbot 1.09 (see http://www.factbites.com/webmasters.php)"; content:"Factbot 1.09 (see http://www.factbites.com/webmasters.php)"; sid:1001621; ) alert tcp any any -> any any (msg:"Supheli Arac :SBIder/0.7 (SBIder; http://www.sitesell.com/sbider.html; http://support.sitesell.com/contact-support.html)"; content:"SBIder/0.7 (SBIder; http://www.sitesell.com/sbider.html; http://support.sitesell.com/contact-support.html)"; sid:1001622; ) alert tcp any any -> any any (msg:"Supheli Arac :Sunrise XP/2.x"; content:"Sunrise XP/2.x"; sid:1001623; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (WinNT; I)"; content:"Mozilla/3.0 (WinNT; I)"; sid:1001624; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; MSIE 3.02; Update a; AK; Windows NT)"; content:"Mozilla/2.0 (compatible; MSIE 3.02; Update a; AK; Windows NT)"; sid:1001625; ) alert tcp any any -> any any (msg:"Supheli Arac :thumbshots-de-Bot (Version: 1.02- powered by www.thumbshots.de)"; content:"thumbshots-de-Bot (Version: 1.02- powered by www.thumbshots.de)"; sid:1001626; ) alert tcp any any -> any any (msg:"Supheli Arac :findlinks/x.xxx (+http://wortschatz.uni-leipzig.de/findlinks/)"; content:"findlinks/x.xxx (+http://wortschatz.uni-leipzig.de/findlinks/)"; sid:1001627; ) alert tcp any any -> any any (msg:"Supheli Arac :Gallent Search Spider v1.4 Robot 2 (http://robot.GallentSearch.com)"; content:"Gallent Search Spider v1.4 Robot 2 (http://robot.GallentSearch.com)"; sid:1001628; ) alert tcp any any -> any any (msg:"Supheli Arac :Finjan-prefetch"; content:"Finjan-prefetch"; sid:1001629; ) alert tcp any any -> any any (msg:"Supheli Arac :OpenISearch/1.x (www.openisearch.com)"; content:"OpenISearch/1.x (www.openisearch.com)"; sid:1001630; ) alert tcp any any -> any any (msg:"Supheli Arac :mozilla/5.0 (compatible; heritrix/1.0.4 http://innovationblog.com)"; content:"mozilla/5.0 (compatible; heritrix/1.0.4 http://innovationblog.com)"; sid:1001631; ) alert tcp any any -> any any (msg:"Supheli Arac :WAVcheck 1.0.x (http://www.webbanalys.se/apps/WAVcheck/)"; content:"WAVcheck 1.0.x (http://www.webbanalys.se/apps/WAVcheck/)"; sid:1001632; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; ScoutJet; +http://www.scoutjet.com/)"; content:"Mozilla/5.0 (compatible; ScoutJet; +http://www.scoutjet.com/)"; sid:1001633; ) alert tcp any any -> any any (msg:"Supheli Arac :CDR/1.7.1 Simulator/0.7(+http://timewe.net) Profile/MIDP-1.0 Configuration/CLDC-1.0"; content:"CDR/1.7.1 Simulator/0.7(+http://timewe.net) Profile/MIDP-1.0 Configuration/CLDC-1.0"; sid:1001634; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/2.2.6 (crawler@fast.no; http://www.fast.no/faq/faqfastwebsearch/faqfastwebcrawler.html)"; content:"FAST-WebCrawler/2.2.6 (crawler@fast.no; http://www.fast.no/faq/faqfastwebsearch/faqfastwebcrawler.html)"; sid:1001635; ) alert tcp any any -> any any (msg:"Supheli Arac :iVia Page Fetcher (http://ivia.ucr.edu/useragents.shtml)"; content:"iVia Page Fetcher (http://ivia.ucr.edu/useragents.shtml)"; sid:1001636; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.8/Fresh (atw-crawler at fast dot no; http://fast.no/support/crawler.asp)"; content:"FAST-WebCrawler/3.8/Fresh (atw-crawler at fast dot no; http://fast.no/support/crawler.asp)"; sid:1001637; ) alert tcp any any -> any any (msg:"Supheli Arac :EuripBot/0.x (+http://www.eurip.com) GetRobots"; content:"EuripBot/0.x (+http://www.eurip.com) GetRobots"; sid:1001638; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; IDBot/1.0; +http://www.id-search.org/bot.html)"; content:"Mozilla/5.0 (compatible; IDBot/1.0; +http://www.id-search.org/bot.html)"; sid:1001639; ) alert tcp any any -> any any (msg:"Supheli Arac :msnbot-media/1.0 (+http://search.msn.com/msnbot.htm)"; content:"msnbot-media/1.0 (+http://search.msn.com/msnbot.htm)"; sid:1001640; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteSnagger"; content:"SiteSnagger"; sid:1001641; ) alert tcp any any -> any any (msg:"Supheli Arac :Gordon's Spider/Nutch-0.9 (http://www.sharethis.com; gordon@sharethis.com)"; content:"Gordon's Spider/Nutch-0.9 (http://www.sharethis.com; gordon@sharethis.com)"; sid:1001642; ) alert tcp any any -> any any (msg:"Supheli Arac :Nikita the Spider (http://NikitaTheSpider.com/)"; content:"Nikita the Spider (http://NikitaTheSpider.com/)"; sid:1001643; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler 6 used by Pages Jaunes (pvincent@pagesjaunes.fr)"; content:"FAST Enterprise Crawler 6 used by Pages Jaunes (pvincent@pagesjaunes.fr)"; sid:1001644; ) alert tcp any any -> any any (msg:"Supheli Arac :AnnoMille spider 0.1 alpha - http://www.annomille.it"; content:"AnnoMille spider 0.1 alpha - http://www.annomille.it"; sid:1001645; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.01 (compatible; Netbox/3.5 R92; Linux 2.2)"; content:"Mozilla/3.01 (compatible; Netbox/3.5 R92; Linux 2.2)"; sid:1001646; ) alert tcp any any -> any any (msg:"Supheli Arac :Rankivabot/3.2 (www.rankiva.com; 3.2; vzmxikn)"; content:"Rankivabot/3.2 (www.rankiva.com; 3.2; vzmxikn)"; sid:1001647; ) alert tcp any any -> any any (msg:"Supheli Arac :Tumblr/1.0 RSS syndication (+http://www.tumblr.com/) (support@tumblr.com)"; content:"Tumblr/1.0 RSS syndication (+http://www.tumblr.com/) (support@tumblr.com)"; sid:1001648; ) alert tcp any any -> any any (msg:"Supheli Arac :Lachesis"; content:"Lachesis"; sid:1001649; ) alert tcp any any -> any any (msg:"Supheli Arac :Misterbot-Nutch/0.7.1 (Misterbot-Nutch; http://www.misterbot.fr; admin@misterbot.fr)"; content:"Misterbot-Nutch/0.7.1 (Misterbot-Nutch; http://www.misterbot.fr; admin@misterbot.fr)"; sid:1001650; ) alert tcp any any -> any any (msg:"Supheli Arac :Kontiki Client x.xx"; content:"Kontiki Client x.xx"; sid:1001651; ) alert tcp any any -> any any (msg:"Supheli Arac :Ad Muncher v4x Build xxxxx"; content:"Ad Muncher v4x Build xxxxx"; sid:1001652; ) alert tcp any any -> any any (msg:"Supheli Arac :Bloglines/3.1 (http://www.bloglines.com)"; content:"Bloglines/3.1 (http://www.bloglines.com)"; sid:1001653; ) alert tcp any any -> any any (msg:"Supheli Arac :ActiveWorlds/3.xx (xxx)"; content:"ActiveWorlds/3.xx (xxx)"; sid:1001654; ) alert tcp any any -> any any (msg:"Supheli Arac :Web Image Collector"; content:"Web Image Collector"; sid:1001655; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteBar/x.x"; content:"SiteBar/x.x"; sid:1001656; ) alert tcp any any -> any any (msg:"Supheli Arac :PROve AnswerBot 4.0"; content:"PROve AnswerBot 4.0"; sid:1001657; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkScan/9.0g Unix"; content:"LinkScan/9.0g Unix"; sid:1001658; ) alert tcp any any -> any any (msg:"Supheli Arac :Gulper Web Bot 0.2.4 (www.ecsl.cs.sunysb.edu/~maxim/cgi-bin/Link/GulperBot)"; content:"Gulper Web Bot 0.2.4 (www.ecsl.cs.sunysb.edu/~maxim/cgi-bin/Link/GulperBot)"; sid:1001659; ) alert tcp any any -> any any (msg:"Supheli Arac :Seekbot/1.0 (http://www.seekbot.net/bot.html) HTTPFetcher/0.3"; content:"Seekbot/1.0 (http://www.seekbot.net/bot.html) HTTPFetcher/0.3"; sid:1001660; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; NaverBot/1.0; http://help.naver.com/delete_main.asp)"; content:"Mozilla/4.0 (compatible; NaverBot/1.0; http://help.naver.com/delete_main.asp)"; sid:1001661; ) alert tcp any any -> any any (msg:"Supheli Arac :nttdirectory_robot/0.9 (super-robot@super.navi.ocn.ne.jp)"; content:"nttdirectory_robot/0.9 (super-robot@super.navi.ocn.ne.jp)"; sid:1001662; ) alert tcp any any -> any any (msg:"Supheli Arac :UPG1 UP/4.0 (compatible; Blazer 1.0)"; content:"UPG1 UP/4.0 (compatible; Blazer 1.0)"; sid:1001663; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible)"; content:"Mozilla/3.0 (compatible)"; sid:1001664; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"; content:"Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"; sid:1001665; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.12.1 +http://newstin.com/)"; content:"Mozilla/5.0 (compatible; heritrix/1.12.1 +http://newstin.com/)"; sid:1001666; ) alert tcp any any -> any any (msg:"Supheli Arac :ichiro/x.0 (ichiro@nttr.co.jp)"; content:"ichiro/x.0 (ichiro@nttr.co.jp)"; sid:1001667; ) alert tcp any any -> any any (msg:"Supheli Arac :Goldfire Server"; content:"Goldfire Server"; sid:1001668; ) alert tcp any any -> any any (msg:"Supheli Arac :Trampelpfad-Spider-v0.1"; content:"Trampelpfad-Spider-v0.1"; sid:1001669; ) alert tcp any any -> any any (msg:"Supheli Arac :Acoon-Robot 4.0.x.[xx] (http://www.acoon.de)"; content:"Acoon-Robot 4.0.x.[xx] (http://www.acoon.de)"; sid:1001670; ) alert tcp any any -> any any (msg:"Supheli Arac :GigabotSiteSearch/2.0 (sitesearch.gigablast.com)"; content:"GigabotSiteSearch/2.0 (sitesearch.gigablast.com)"; sid:1001671; ) alert tcp any any -> any any (msg:"Supheli Arac :Excalibur Internet Spider V6.5.4"; content:"Excalibur Internet Spider V6.5.4"; sid:1001672; ) alert tcp any any -> any any (msg:"Supheli Arac :Skywalker/0.1 (Skywalker; anonymous; anonymous)"; content:"Skywalker/0.1 (Skywalker; anonymous; anonymous)"; sid:1001673; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DigExt; Gateway2000; sureseeker.com)"; content:"Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DigExt; Gateway2000; sureseeker.com)"; sid:1001674; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Fetch API Request"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Fetch API Request"; sid:1001675; ) alert tcp any any -> any any (msg:"Supheli Arac :ZipppBot/0.xx (ZipppBot; http://www.zippp.net; webmaster@zippp.net)"; content:"ZipppBot/0.xx (ZipppBot; http://www.zippp.net; webmaster@zippp.net)"; sid:1001676; ) alert tcp any any -> any any (msg:"Supheli Arac :blogWatcher_Spider/0.1 (http://www.lr.pi.titech.ac.jp/blogWatcher/)"; content:"blogWatcher_Spider/0.1 (http://www.lr.pi.titech.ac.jp/blogWatcher/)"; sid:1001677; ) alert tcp any any -> any any (msg:"Supheli Arac :Hitwise Spider v1.0 http://www.hitwise.com"; content:"Hitwise Spider v1.0 http://www.hitwise.com"; sid:1001678; ) alert tcp any any -> any any (msg:"Supheli Arac :CoteoNutchCrawler/Nutch-0.9 (info [at] coteo [dot] com)"; content:"CoteoNutchCrawler/Nutch-0.9 (info [at] coteo [dot] com)"; sid:1001679; ) alert tcp any any -> any any (msg:"Supheli Arac :cosmos/0.8_(robot@xyleme.com)"; content:"cosmos/0.8_(robot@xyleme.com)"; sid:1001680; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; MojeekBot/2.0; http://www.mojeek.com/bot.html)"; content:"Mozilla/5.0 (compatible; MojeekBot/2.0; http://www.mojeek.com/bot.html)"; sid:1001681; ) alert tcp any any -> any any (msg:"Supheli Arac :boitho.com-robot/1.x (http://www.boitho.com/bot.html)"; content:"boitho.com-robot/1.x (http://www.boitho.com/bot.html)"; sid:1001682; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; WSN Links)"; content:"Mozilla/4.0 (compatible; WSN Links)"; sid:1001683; ) alert tcp any any -> any any (msg:"Supheli Arac :OmniExplorer_Bot/x.xx (+http://www.omni-explorer.com) WorldIndexer"; content:"OmniExplorer_Bot/x.xx (+http://www.omni-explorer.com) WorldIndexer"; sid:1001684; ) alert tcp any any -> any any (msg:"Supheli Arac :tags2dir.com/0.8 (+http://tags2dir.com/directory/)"; content:"tags2dir.com/0.8 (+http://tags2dir.com/directory/)"; sid:1001685; ) alert tcp any any -> any any (msg:"Supheli Arac :NameOfAgent (CMS Spider)"; content:"NameOfAgent (CMS Spider)"; sid:1001686; ) alert tcp any any -> any any (msg:"Supheli Arac :oBot ((compatible;Win32))"; content:"oBot ((compatible;Win32))"; sid:1001687; ) alert tcp any any -> any any (msg:"Supheli Arac :Ack (http://www.ackerm.com/)"; content:"Ack (http://www.ackerm.com/)"; sid:1001688; ) alert tcp any any -> any any (msg:"Supheli Arac :Shim-Crawler(Mozilla-compatible; http://www.logos.ic.i.u-tokyo.ac.jp/crawler/; crawl@logos.ic.i.u-tokyo.ac.jp)"; content:"Shim-Crawler(Mozilla-compatible; http://www.logos.ic.i.u-tokyo.ac.jp/crawler/; crawl@logos.ic.i.u-tokyo.ac.jp)"; sid:1001689; ) alert tcp any any -> any any (msg:"Supheli Arac :Atomic_Email_Hunter/4.0"; content:"Atomic_Email_Hunter/4.0"; sid:1001690; ) alert tcp any any -> any any (msg:"Supheli Arac :RMA/1.0 (compatible; RealMedia)"; content:"RMA/1.0 (compatible; RealMedia)"; sid:1001691; ) alert tcp any any -> any any (msg:"Supheli Arac :PeopleChat/Search_Engine"; content:"PeopleChat/Search_Engine"; sid:1001692; ) alert tcp any any -> any any (msg:"Supheli Arac :Tagyu Agent/1.0"; content:"Tagyu Agent/1.0"; sid:1001693; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkCheck (linkcheck@inter7.com http://www.inter7.com/linkcheck)"; content:"LinkCheck (linkcheck@inter7.com http://www.inter7.com/linkcheck)"; sid:1001694; ) alert tcp any any -> any any (msg:"Supheli Arac :Microsoft Log Parser 2.2"; content:"Microsoft Log Parser 2.2"; sid:1001695; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.0.VNS"; content:"Scooter-3.0.VNS"; sid:1001696; ) alert tcp any any -> any any (msg:"Supheli Arac :zedzo.digest/0.1 (http://www.zedzo.com/)"; content:"zedzo.digest/0.1 (http://www.zedzo.com/)"; sid:1001697; ) alert tcp any any -> any any (msg:"Supheli Arac :ICOO Loader v.x.x.x"; content:"ICOO Loader v.x.x.x"; sid:1001698; ) alert tcp any any -> any any (msg:"Supheli Arac :USyd-NLP-Spider (http://www.it.usyd.edu.au/~vinci/bot.html)"; content:"USyd-NLP-Spider (http://www.it.usyd.edu.au/~vinci/bot.html)"; sid:1001699; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla"; content:"Mozilla"; sid:1001700; ) alert tcp any any -> any any (msg:"Supheli Arac :SSurf15a 11"; content:"SSurf15a 11"; sid:1001701; ) alert tcp any any -> any any (msg:"Supheli Arac :sproose/0.1-alpha (sproose crawler; http://www.sproose.com/bot.html; crawler@sproose.com)"; content:"sproose/0.1-alpha (sproose crawler; http://www.sproose.com/bot.html; crawler@sproose.com)"; sid:1001702; ) alert tcp any any -> any any (msg:"Supheli Arac :GeoURLBot 1.0 (http://geourl.org)"; content:"GeoURLBot 1.0 (http://geourl.org)"; sid:1001703; ) alert tcp any any -> any any (msg:"Supheli Arac :ejupiter.com"; content:"ejupiter.com"; sid:1001704; ) alert tcp any any -> any any (msg:"Supheli Arac :Frelicbot/1.0 +http://www.frelic.com/"; content:"Frelicbot/1.0 +http://www.frelic.com/"; sid:1001705; ) alert tcp any any -> any any (msg:"Supheli Arac :IUPUI Research Bot v 1.9a"; content:"IUPUI Research Bot v 1.9a"; sid:1001706; ) alert tcp any any -> any any (msg:"Supheli Arac :Execrawl/1.0 (Execrawl; http://www.execrawl.com/; bot@execrawl.com)"; content:"Execrawl/1.0 (Execrawl; http://www.execrawl.com/; bot@execrawl.com)"; sid:1001707; ) alert tcp any any -> any any (msg:"Supheli Arac :ScoutAbout"; content:"ScoutAbout"; sid:1001708; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"; sid:1001709; ) alert tcp any any -> any any (msg:"Supheli Arac :CrawlerBoy Pinpoint.com"; content:"CrawlerBoy Pinpoint.com"; sid:1001710; ) alert tcp any any -> any any (msg:"Supheli Arac :DeepIndexer.ca"; content:"DeepIndexer.ca"; sid:1001711; ) alert tcp any any -> any any (msg:"Supheli Arac :moiNAG 0.02"; content:"moiNAG 0.02"; sid:1001712; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.2.DIL"; content:"Scooter-3.2.DIL"; sid:1001713; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.2.NIV"; content:"Scooter-3.2.NIV"; sid:1001714; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.2.SF0"; content:"Scooter-3.2.SF0"; sid:1001715; ) alert tcp any any -> any any (msg:"Supheli Arac :WapOnWindows 1.0"; content:"WapOnWindows 1.0"; sid:1001716; ) alert tcp any any -> any any (msg:"Supheli Arac :WebAlta Crawler/1.2.1 (http://www.webalta.ru/bot.html)"; content:"WebAlta Crawler/1.2.1 (http://www.webalta.ru/bot.html)"; sid:1001717; ) alert tcp any any -> any any (msg:"Supheli Arac :RixBot (http://babelserver.org/rix)"; content:"RixBot (http://babelserver.org/rix)"; sid:1001718; ) alert tcp any any -> any any (msg:"Supheli Arac :BunnySlippers"; content:"BunnySlippers"; sid:1001719; ) alert tcp any any -> any any (msg:"Supheli Arac :JordoMedia/1.0 RSS File Reader (http://www.jordomedia.com)"; content:"JordoMedia/1.0 RSS File Reader (http://www.jordomedia.com)"; sid:1001720; ) alert tcp any any -> any any (msg:"Supheli Arac :flyindex.net 1.0/http://www.flyindex.net"; content:"flyindex.net 1.0/http://www.flyindex.net"; sid:1001721; ) alert tcp any any -> any any (msg:"Supheli Arac :EARTHCOM.info/1.xbeta [www.earthcom.info]"; content:"EARTHCOM.info/1.xbeta [www.earthcom.info]"; sid:1001722; ) alert tcp any any -> any any (msg:"Supheli Arac :iaskspider"; content:"iaskspider"; sid:1001723; ) alert tcp any any -> any any (msg:"Supheli Arac :VisBot/2.0 (Visvo.com Crawler; http://www.visvo.com/bot.html; bot@visvo.com)"; content:"VisBot/2.0 (Visvo.com Crawler; http://www.visvo.com/bot.html; bot@visvo.com)"; sid:1001724; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; MSN Companion 2.0; 800x600; Compaq)"; content:"Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; MSN Companion 2.0; 800x600; Compaq)"; sid:1001725; ) alert tcp any any -> any any (msg:"Supheli Arac :MagpieRSS/0.7x (+http://magpierss.sf.net)"; content:"MagpieRSS/0.7x (+http://magpierss.sf.net)"; sid:1001726; ) alert tcp any any -> any any (msg:"Supheli Arac :Amoi 8512/R21.0 NF-Browser/3.3"; content:"Amoi 8512/R21.0 NF-Browser/3.3"; sid:1001727; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Powermarks/3.5; Windows 95/98/2000/NT)"; content:"Mozilla/4.0 (compatible; Powermarks/3.5; Windows 95/98/2000/NT)"; sid:1001728; ) alert tcp any any -> any any (msg:"Supheli Arac :AideRSS/1.0 (aiderss.com)"; content:"AideRSS/1.0 (aiderss.com)"; sid:1001729; ) alert tcp any any -> any any (msg:"Supheli Arac :Seekbot/1.0 (http://www.seekbot.net/bot.html) RobotsTxtFetcher/1.2"; content:"Seekbot/1.0 (http://www.seekbot.net/bot.html) RobotsTxtFetcher/1.2"; sid:1001730; ) alert tcp any any -> any any (msg:"Supheli Arac :TestCrawler/Nutch-0.9 (Testing Crawler for Research ; http://balihoo.com/index.aspx; tgautier at balihoo dot com)"; content:"TestCrawler/Nutch-0.9 (Testing Crawler for Research ; http://balihoo.com/index.aspx; tgautier at balihoo dot com)"; sid:1001731; ) alert tcp any any -> any any (msg:"Supheli Arac :HPL/Nutch-0.9 -"; content:"HPL/Nutch-0.9 -"; sid:1001732; ) alert tcp any any -> any any (msg:"Supheli Arac :IncyWincy(http://www.look.com)"; content:"IncyWincy(http://www.look.com)"; sid:1001733; ) alert tcp any any -> any any (msg:"Supheli Arac :OSSProxy 1.3.305.321 (Build 305.321 Win32 en-us)(Dec 21 2005 16:30:54)"; content:"OSSProxy 1.3.305.321 (Build 305.321 Win32 en-us)(Dec 21 2005 16:30:54)"; sid:1001734; ) alert tcp any any -> any any (msg:"Supheli Arac :VadixBot"; content:"VadixBot"; sid:1001735; ) alert tcp any any -> any any (msg:"Supheli Arac :Blogpulse (info@blogpulse.com)"; content:"Blogpulse (info@blogpulse.com)"; sid:1001736; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; AspTear 1.5)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; AspTear 1.5)"; sid:1001737; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; scan4mail (advanced version) http://www.peterspages.net/?scan4mail)"; content:"Mozilla/3.0 (compatible; scan4mail (advanced version) http://www.peterspages.net/?scan4mail)"; sid:1001738; ) alert tcp any any -> any any (msg:"Supheli Arac :Softizerbot (http://www.softizer.com)"; content:"Softizerbot (http://www.softizer.com)"; sid:1001739; ) alert tcp any any -> any any (msg:"Supheli Arac :FastCrawler 3.0.1 (crawler@1klik.dk)"; content:"FastCrawler 3.0.1 (crawler@1klik.dk)"; sid:1001740; ) alert tcp any any -> any any (msg:"Supheli Arac :exactseek.com"; content:"exactseek.com"; sid:1001741; ) alert tcp any any -> any any (msg:"Supheli Arac :MusicWalker2.0 ( http://www.somusical.com)"; content:"MusicWalker2.0 ( http://www.somusical.com)"; sid:1001742; ) alert tcp any any -> any any (msg:"Supheli Arac :Combine/2.0 http://combine.it.lth.se/"; content:"Combine/2.0 http://combine.it.lth.se/"; sid:1001743; ) alert tcp any any -> any any (msg:"Supheli Arac :PHP/4.0.6"; content:"PHP/4.0.6"; sid:1001744; ) alert tcp any any -> any any (msg:"Supheli Arac :PHP/4.1.1"; content:"PHP/4.1.1"; sid:1001745; ) alert tcp any any -> any any (msg:"Supheli Arac :PHP/4.1.2"; content:"PHP/4.1.2"; sid:1001746; ) alert tcp any any -> any any (msg:"Supheli Arac :FastBug http://www.ay-up.com"; content:"FastBug http://www.ay-up.com"; sid:1001747; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) Web Link Validator 2.x)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) Web Link Validator 2.x)"; sid:1001748; ) alert tcp any any -> any any (msg:"Supheli Arac :DC-Sakura/x.xx"; content:"DC-Sakura/x.xx"; sid:1001749; ) alert tcp any any -> any any (msg:"Supheli Arac :Wavefire/0.8-dev (Wavefire; http://www.wavefire.com; info@wavefire.com)"; content:"Wavefire/0.8-dev (Wavefire; http://www.wavefire.com; info@wavefire.com)"; sid:1001750; ) alert tcp any any -> any any (msg:"Supheli Arac :eventax/1.3 (eventax; http://www.eventax.de/; info@eventax.de)"; content:"eventax/1.3 (eventax; http://www.eventax.de/; info@eventax.de)"; sid:1001751; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Arachmo)"; content:"Mozilla/4.0 (compatible; Arachmo)"; sid:1001752; ) alert tcp any any -> any any (msg:"Supheli Arac :Privoxy/3.0 (Anonymous)"; content:"Privoxy/3.0 (Anonymous)"; sid:1001753; ) alert tcp any any -> any any (msg:"Supheli Arac :unknownght.com Web Server IIS vs Apache Survey. See Results at www.DNSRight.com"; content:"unknownght.com Web Server IIS vs Apache Survey. See Results at www.DNSRight.com"; sid:1001754; ) alert tcp any any -> any any (msg:"Supheli Arac :billbot wjj@cs.cmu.edu"; content:"billbot wjj@cs.cmu.edu"; sid:1001755; ) alert tcp any any -> any any (msg:"Supheli Arac :Search+"; content:"Search+"; sid:1001756; ) alert tcp any any -> any any (msg:"Supheli Arac :FastSearch Web Crawler for Verizon SuperPages (kevin.watters@fastsearch.com)"; content:"FastSearch Web Crawler for Verizon SuperPages (kevin.watters@fastsearch.com)"; sid:1001757; ) alert tcp any any -> any any (msg:"Supheli Arac :http://www.almaden.ibm.com/cs/crawler [rc1.wf.ibm.com]"; content:"http://www.almaden.ibm.com/cs/crawler [rc1.wf.ibm.com]"; sid:1001758; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; FatBot 2.0; http://www.thefind.com/main/CrawlerFAQs.fhtml)"; content:"Mozilla/5.0 (compatible; FatBot 2.0; http://www.thefind.com/main/CrawlerFAQs.fhtml)"; sid:1001759; ) alert tcp any any -> any any (msg:"Supheli Arac :Enterprise_Search/1.0"; content:"Enterprise_Search/1.0"; sid:1001760; ) alert tcp any any -> any any (msg:"Supheli Arac :wish-project (http://wish.slis.tsukuba.ac.jp/)"; content:"wish-project (http://wish.slis.tsukuba.ac.jp/)"; sid:1001761; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Vagabondo/1.x MT; webagent@wise-guys.nl; http://webagent.wise-guys.nl/)"; content:"Mozilla/3.0 (Vagabondo/1.x MT; webagent@wise-guys.nl; http://webagent.wise-guys.nl/)"; sid:1001762; ) alert tcp any any -> any any (msg:"Supheli Arac :whatUseek_winona/3.0"; content:"whatUseek_winona/3.0"; sid:1001763; ) alert tcp any any -> any any (msg:"Supheli Arac :Allrati/1.1 (+)"; content:"Allrati/1.1 (+)"; sid:1001764; ) alert tcp any any -> any any (msg:"Supheli Arac :URLBlaze"; content:"URLBlaze"; sid:1001765; ) alert tcp any any -> any any (msg:"Supheli Arac :Speedy_Spider (http://www.entireweb.com)"; content:"Speedy_Spider (http://www.entireweb.com)"; sid:1001766; ) alert tcp any any -> any any (msg:"Supheli Arac :FocusedSampler/1.0"; content:"FocusedSampler/1.0"; sid:1001767; ) alert tcp any any -> any any (msg:"Supheli Arac :VMBot/0.x.x (VMBot; http://www.VerticalMatch.com/; vmbot@tradedot.com)"; content:"VMBot/0.x.x (VMBot; http://www.VerticalMatch.com/; vmbot@tradedot.com)"; sid:1001768; ) alert tcp any any -> any any (msg:"Supheli Arac :Clushbot/3.x-BinaryFury (+http://www.clush.com/bot.html)"; content:"Clushbot/3.x-BinaryFury (+http://www.clush.com/bot.html)"; sid:1001769; ) alert tcp any any -> any any (msg:"Supheli Arac :WebLight/4.x.x (support@illumit.com; http://www.illumit.com/Products/weblight/)"; content:"WebLight/4.x.x (support@illumit.com; http://www.illumit.com/Products/weblight/)"; sid:1001770; ) alert tcp any any -> any any (msg:"Supheli Arac :GalaxyBot/1.0 (http://www.galaxy.com/galaxybot.html)"; content:"GalaxyBot/1.0 (http://www.galaxy.com/galaxybot.html)"; sid:1001771; ) alert tcp any any -> any any (msg:"Supheli Arac :LapozzBot/1.4 ( http://robot.lapozz.com)"; content:"LapozzBot/1.4 ( http://robot.lapozz.com)"; sid:1001772; ) alert tcp any any -> any any (msg:"Supheli Arac :Convera Internet Spider V6.x"; content:"Convera Internet Spider V6.x"; sid:1001773; ) alert tcp any any -> any any (msg:"Supheli Arac :EvaalSE - bot@evaal.com"; content:"EvaalSE - bot@evaal.com"; sid:1001774; ) alert tcp any any -> any any (msg:"Supheli Arac :ReadABlog Spider (compatible; 1.1; feed update; www.readablog.com)"; content:"ReadABlog Spider (compatible; 1.1; feed update; www.readablog.com)"; sid:1001775; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows;) NimbleCrawler 1.12 obeys UserAgent NimbleCrawler For problems contact: crawler@healthline.com"; content:"Mozilla/5.0 (Windows;) NimbleCrawler 1.12 obeys UserAgent NimbleCrawler For problems contact: crawler@healthline.com"; sid:1001776; ) alert tcp any any -> any any (msg:"Supheli Arac :LARBIN-EXPERIMENTAL (efp@gmx.net)"; content:"LARBIN-EXPERIMENTAL (efp@gmx.net)"; sid:1001777; ) alert tcp any any -> any any (msg:"Supheli Arac :Zend_Http_Client"; content:"Zend_Http_Client"; sid:1001778; ) alert tcp any any -> any any (msg:"Supheli Arac :SearchSpider.com/1.1"; content:"SearchSpider.com/1.1"; sid:1001779; ) alert tcp any any -> any any (msg:"Supheli Arac :Rotondo/3.1 libwww/5.3.1"; content:"Rotondo/3.1 libwww/5.3.1"; sid:1001780; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/5.0 (Linux 2.0.38 i386; U) [en]"; content:"Opera/5.0 (Linux 2.0.38 i386; U) [en]"; sid:1001781; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; en-US; Nautilus/1.0Final) Gecko/20020408"; content:"Mozilla/5.0 (X11; U; Linux i686; en-US; Nautilus/1.0Final) Gecko/20020408"; sid:1001782; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; heritrix/1.3.0 http://www.cs.washington.edu/research/networking/websys/)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; heritrix/1.3.0 http://www.cs.washington.edu/research/networking/websys/)"; sid:1001783; ) alert tcp any any -> any any (msg:"Supheli Arac :MasterSeek"; content:"MasterSeek"; sid:1001784; ) alert tcp any any -> any any (msg:"Supheli Arac :BlitzBOT@tricus.net"; content:"BlitzBOT@tricus.net"; sid:1001785; ) alert tcp any any -> any any (msg:"Supheli Arac :DataFountains/DMOZ Downloader"; content:"DataFountains/DMOZ Downloader"; sid:1001786; ) alert tcp any any -> any any (msg:"Supheli Arac :ImageWalker/2.0 (www.bdbrandprotect.com)"; content:"ImageWalker/2.0 (www.bdbrandprotect.com)"; sid:1001787; ) alert tcp any any -> any any (msg:"Supheli Arac :BruinBot (+http://webarchive.cs.ucla.edu/bruinbot.html)"; content:"BruinBot (+http://webarchive.cs.ucla.edu/bruinbot.html)"; sid:1001788; ) alert tcp any any -> any any (msg:"Supheli Arac :Claymont.com"; content:"Claymont.com"; sid:1001789; ) alert tcp any any -> any any (msg:"Supheli Arac :snap.com beta crawler v0"; content:"snap.com beta crawler v0"; sid:1001790; ) alert tcp any any -> any any (msg:"Supheli Arac :Extreme Picture Finder"; content:"Extreme Picture Finder"; sid:1001791; ) alert tcp any any -> any any (msg:"Supheli Arac :NationalDirectory-WebSpider/1.3"; content:"NationalDirectory-WebSpider/1.3"; sid:1001792; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; support@illumit.com; http://www.illumit.com/Products/weblight/)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; support@illumit.com; http://www.illumit.com/Products/weblight/)"; sid:1001793; ) alert tcp any any -> any any (msg:"Supheli Arac :WebReaper vx.x - www.webreaper.net"; content:"WebReaper vx.x - www.webreaper.net"; sid:1001794; ) alert tcp any any -> any any (msg:"Supheli Arac :EmeraldShield.com WebBot"; content:"EmeraldShield.com WebBot"; sid:1001795; ) alert tcp any any -> any any (msg:"Supheli Arac :fastbot crawler beta 2.0 (+http://www.fastbot.de)"; content:"fastbot crawler beta 2.0 (+http://www.fastbot.de)"; sid:1001796; ) alert tcp any any -> any any (msg:"Supheli Arac :RufusBot (Rufus Web Miner; http://www.webaroo.com/rooSiteOwners.html)"; content:"RufusBot (Rufus Web Miner; http://www.webaroo.com/rooSiteOwners.html)"; sid:1001797; ) alert tcp any any -> any any (msg:"Supheli Arac :Yahoo-MMCrawler/3.x (mm dash crawler at trd dot overture dot com)"; content:"Yahoo-MMCrawler/3.x (mm dash crawler at trd dot overture dot com)"; sid:1001798; ) alert tcp any any -> any any (msg:"Supheli Arac :Spider-Sleek/2.0 (+http://search-info.com/linktous.html)"; content:"Spider-Sleek/2.0 (+http://search-info.com/linktous.html)"; sid:1001799; ) alert tcp any any -> any any (msg:"Supheli Arac :Webdup/0.9"; content:"Webdup/0.9"; sid:1001800; ) alert tcp any any -> any any (msg:"Supheli Arac :ia_archiver-web.archive.org"; content:"ia_archiver-web.archive.org"; sid:1001801; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; de/1.13.2 +http://www.de.com)"; content:"Mozilla/5.0 (compatible; de/1.13.2 +http://www.de.com)"; sid:1001802; ) alert tcp any any -> any any (msg:"Supheli Arac :Feedfetcher-Google-iGoogleGadgets; (+http://www.google.com/feedfetcher.html)"; content:"Feedfetcher-Google-iGoogleGadgets; (+http://www.google.com/feedfetcher.html)"; sid:1001803; ) alert tcp any any -> any any (msg:"Supheli Arac :ICC-Crawler(Mozilla-compatible;http://kc.nict.go.jp/icc/crawl.html;icc-crawl-contact(at)ml(dot)nict(dot)go(dot)jp)"; content:"ICC-Crawler(Mozilla-compatible;http://kc.nict.go.jp/icc/crawl.html;icc-crawl-contact(at)ml(dot)nict(dot)go(dot)jp)"; sid:1001804; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:x.xxx) Gecko/20041027 Mnenhy/0.6.0.104"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:x.xxx) Gecko/20041027 Mnenhy/0.6.0.104"; sid:1001805; ) alert tcp any any -> any any (msg:"Supheli Arac :KummHttp/1.1 (compatible; KummClient; Linux rulez)"; content:"KummHttp/1.1 (compatible; KummClient; Linux rulez)"; sid:1001806; ) alert tcp any any -> any any (msg:"Supheli Arac :GeonaBot 1.x; http://www.geona.com/"; content:"GeonaBot 1.x; http://www.geona.com/"; sid:1001807; ) alert tcp any any -> any any (msg:"Supheli Arac :BW-C-2.0"; content:"BW-C-2.0"; sid:1001808; ) alert tcp any any -> any any (msg:"Supheli Arac :Hatena Antenna/0.4 (http://a.hatena.ne.jp/help#robot)"; content:"Hatena Antenna/0.4 (http://a.hatena.ne.jp/help#robot)"; sid:1001809; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Custo 3 (Netwu.com); Windows NT 5.1)"; content:"Mozilla/5.0 (compatible; Custo 3 (Netwu.com); Windows NT 5.1)"; sid:1001810; ) alert tcp any any -> any any (msg:"Supheli Arac :http://Ask.24x.Info/ (http://narres.it/)"; content:"http://Ask.24x.Info/ (http://narres.it/)"; sid:1001811; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; DepSpid/5.0x; +http://about.depspid.net)"; content:"Mozilla/4.0 (compatible; DepSpid/5.0x; +http://about.depspid.net)"; sid:1001812; ) alert tcp any any -> any any (msg:"Supheli Arac :gsa-crawler (Enterprise; GID-01742;gsatesting@rediffmail.com)"; content:"gsa-crawler (Enterprise; GID-01742;gsatesting@rediffmail.com)"; sid:1001813; ) alert tcp any any -> any any (msg:"Supheli Arac :ExactSearch"; content:"ExactSearch"; sid:1001814; ) alert tcp any any -> any any (msg:"Supheli Arac :WebFindBot(http://www.web-find.com)"; content:"WebFindBot(http://www.web-find.com)"; sid:1001815; ) alert tcp any any -> any any (msg:"Supheli Arac :AUDIOVOX-SMT5600"; content:"AUDIOVOX-SMT5600"; sid:1001816; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-ARS-1.1"; content:"Scooter-ARS-1.1"; sid:1001817; ) alert tcp any any -> any any (msg:"Supheli Arac :boitho.com-robot/1.x"; content:"boitho.com-robot/1.x"; sid:1001818; ) alert tcp any any -> any any (msg:"Supheli Arac :IlseBot/1.x"; content:"IlseBot/1.x"; sid:1001819; ) alert tcp any any -> any any (msg:"Supheli Arac :Scrubby/2.x (http://www.scrubtheweb.com/)"; content:"Scrubby/2.x (http://www.scrubtheweb.com/)"; sid:1001820; ) alert tcp any any -> any any (msg:"Supheli Arac :WordPress/x.x.x.x PHP/4.x.xx"; content:"WordPress/x.x.x.x PHP/4.x.xx"; sid:1001821; ) alert tcp any any -> any any (msg:"Supheli Arac :iaskspider2 (iask@staff.sina.com.cn)"; content:"iaskspider2 (iask@staff.sina.com.cn)"; sid:1001822; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (Sleek Spider/1.2)"; content:"Mozilla/4.0 (Sleek Spider/1.2)"; sid:1001823; ) alert tcp any any -> any any (msg:"Supheli Arac :COAST WebMaster Pro/4.x.x.xx (Windows NT)"; content:"COAST WebMaster Pro/4.x.x.xx (Windows NT)"; sid:1001824; ) alert tcp any any -> any any (msg:"Supheli Arac :NP/0.1 (NP; http://www.nameprotect.com; npbot@nameprotect.com)"; content:"NP/0.1 (NP; http://www.nameprotect.com; npbot@nameprotect.com)"; sid:1001825; ) alert tcp any any -> any any (msg:"Supheli Arac :monkeyagent"; content:"monkeyagent"; sid:1001826; ) alert tcp any any -> any any (msg:"Supheli Arac :WebPix 1.0 (www.netwu.com)"; content:"WebPix 1.0 (www.netwu.com)"; sid:1001827; ) alert tcp any any -> any any (msg:"Supheli Arac :PrivacyFinder Cache Bot v1.0"; content:"PrivacyFinder Cache Bot v1.0"; sid:1001828; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9a8) Gecko/2007100619 GranParadiso/3.0a8"; content:"Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9a8) Gecko/2007100619 GranParadiso/3.0a8"; sid:1001829; ) alert tcp any any -> any any (msg:"Supheli Arac :nutchsearch/Nutch-0.9 (Nutch Search 1.0; herceg_novi at yahoo dot com)"; content:"nutchsearch/Nutch-0.9 (Nutch Search 1.0; herceg_novi at yahoo dot com)"; sid:1001830; ) alert tcp any any -> any any (msg:"Supheli Arac :urlfan-bot/1.0; +http://www.urlfan.com/site/bot/350.html"; content:"urlfan-bot/1.0; +http://www.urlfan.com/site/bot/350.html"; sid:1001831; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.02 [en] (X11; I; SunOS 5.6 sun4u)"; content:"Mozilla/4.02 [en] (X11; I; SunOS 5.6 sun4u)"; sid:1001832; ) alert tcp any any -> any any (msg:"Supheli Arac :woriobot ( http://www.worio.com/)"; content:"woriobot ( http://www.worio.com/)"; sid:1001833; ) alert tcp any any -> any any (msg:"Supheli Arac :NetAnts/1.2x"; content:"NetAnts/1.2x"; sid:1001834; ) alert tcp any any -> any any (msg:"Supheli Arac :Shim Crawler"; content:"Shim Crawler"; sid:1001835; ) alert tcp any any -> any any (msg:"Supheli Arac :WWWeasel Robot v1.00 (http://wwweasel.de)"; content:"WWWeasel Robot v1.00 (http://wwweasel.de)"; sid:1001836; ) alert tcp any any -> any any (msg:"Supheli Arac :UCmore"; content:"UCmore"; sid:1001837; ) alert tcp any any -> any any (msg:"Supheli Arac :RSurf15a 41"; content:"RSurf15a 41"; sid:1001838; ) alert tcp any any -> any any (msg:"Supheli Arac :RSurf15a 51"; content:"RSurf15a 51"; sid:1001839; ) alert tcp any any -> any any (msg:"Supheli Arac :RSurf15a 81"; content:"RSurf15a 81"; sid:1001840; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.1 (larbin2.6.1@unspecified.mail)"; content:"larbin_2.6.1 (larbin2.6.1@unspecified.mail)"; sid:1001841; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/7.x (Windows NT 5.1; U) [en]"; content:"Opera/7.x (Windows NT 5.1; U) [en]"; sid:1001842; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Win9x; en; Stable) Gecko/20020911 Beonex/0.8.1-stable"; content:"Mozilla/5.0 (Windows; U; Win9x; en; Stable) Gecko/20020911 Beonex/0.8.1-stable"; sid:1001843; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)"; content:"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)"; sid:1001844; ) alert tcp any any -> any any (msg:"Supheli Arac :SocSciBot ()"; content:"SocSciBot ()"; sid:1001845; ) alert tcp any any -> any any (msg:"Supheli Arac :AgentName/0.1 libwww-perl/5.48"; content:"AgentName/0.1 libwww-perl/5.48"; sid:1001846; ) alert tcp any any -> any any (msg:"Supheli Arac :DeepIndex ( http://www.zetbot.com )"; content:"DeepIndex ( http://www.zetbot.com )"; sid:1001847; ) alert tcp any any -> any any (msg:"Supheli Arac :SafariBookmarkChecker (+http://www.coriolis.ch/)"; content:"SafariBookmarkChecker (+http://www.coriolis.ch/)"; sid:1001848; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; Opera/3.0; Windows 95/NT4) 3.2"; content:"Mozilla/3.0 (compatible; Opera/3.0; Windows 95/NT4) 3.2"; sid:1001849; ) alert tcp any any -> any any (msg:"Supheli Arac :GreenBrowser"; content:"GreenBrowser"; sid:1001850; ) alert tcp any any -> any any (msg:"Supheli Arac :HenriLeRobotMirago (http://www.miragorobot.com/scripts/frinfo.asp)"; content:"HenriLeRobotMirago (http://www.miragorobot.com/scripts/frinfo.asp)"; sid:1001851; ) alert tcp any any -> any any (msg:"Supheli Arac :geniebot wgao@genieknows.com"; content:"geniebot wgao@genieknows.com"; sid:1001852; ) alert tcp any any -> any any (msg:"Supheli Arac :noyona_0_1"; content:"noyona_0_1"; sid:1001853; ) alert tcp any any -> any any (msg:"Supheli Arac :Drupal (+http://drupal.org/)"; content:"Drupal (+http://drupal.org/)"; sid:1001854; ) alert tcp any any -> any any (msg:"Supheli Arac :MediaSearch/0.1"; content:"MediaSearch/0.1"; sid:1001855; ) alert tcp any any -> any any (msg:"Supheli Arac :msnbot/x.xx ( http://search.msn.com/msnbot.htm)"; content:"msnbot/x.xx ( http://search.msn.com/msnbot.htm)"; sid:1001856; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.3_for_(http://cosco.hiit.fi/search/) tsilande@hiit.fi"; content:"larbin_2.6.3_for_(http://cosco.hiit.fi/search/) tsilande@hiit.fi"; sid:1001857; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)"; sid:1001858; ) alert tcp any any -> any any (msg:"Supheli Arac :Zearchit"; content:"Zearchit"; sid:1001859; ) alert tcp any any -> any any (msg:"Supheli Arac :YahooSeeker/1.0 (compatible; Mozilla 4.0; MSIE 5.5; http://search.yahoo.com/yahooseeker.html)"; content:"YahooSeeker/1.0 (compatible; Mozilla 4.0; MSIE 5.5; http://search.yahoo.com/yahooseeker.html)"; sid:1001860; ) alert tcp any any -> any any (msg:"Supheli Arac :PagmIEDownload"; content:"PagmIEDownload"; sid:1001861; ) alert tcp any any -> any any (msg:"Supheli Arac :naoFavicon4IE/1.xx"; content:"naoFavicon4IE/1.xx"; sid:1001862; ) alert tcp any any -> any any (msg:"Supheli Arac :FLATARTS_FAVICO"; content:"FLATARTS_FAVICO"; sid:1001863; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; ezPeer+ v1.0 Beta (0.4.1.98); ezPeer+ v1.0 (0.5.0.00); .NET CLR 1.1.4322; MSIECrawler)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; ezPeer+ v1.0 Beta (0.4.1.98); ezPeer+ v1.0 (0.5.0.00); .NET CLR 1.1.4322; MSIECrawler)"; sid:1001864; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; GPU p2p crawler http://gpu.sourceforge.net/search_engine.php)"; content:"Mozilla/4.0 (compatible; GPU p2p crawler http://gpu.sourceforge.net/search_engine.php)"; sid:1001865; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible;archive.org_bot/1.7.1; collectionId=316; Archive-It; +http://www.archive-it.org)"; content:"Mozilla/5.0 (compatible;archive.org_bot/1.7.1; collectionId=316; Archive-It; +http://www.archive-it.org)"; sid:1001866; ) alert tcp any any -> any any (msg:"Supheli Arac :Guestbook Auto Submitter"; content:"Guestbook Auto Submitter"; sid:1001867; ) alert tcp any any -> any any (msg:"Supheli Arac :squidclam"; content:"squidclam"; sid:1001868; ) alert tcp any any -> any any (msg:"Supheli Arac :TeragramCrawler"; content:"TeragramCrawler"; sid:1001869; ) alert tcp any any -> any any (msg:"Supheli Arac :GetRight/3.x.x"; content:"GetRight/3.x.x"; sid:1001870; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; iaskspider/1.0; MSIE 6.0)"; content:"Mozilla/5.0 (compatible; iaskspider/1.0; MSIE 6.0)"; sid:1001871; ) alert tcp any any -> any any (msg:"Supheli Arac :Nsauditor/1.x"; content:"Nsauditor/1.x"; sid:1001872; ) alert tcp any any -> any any (msg:"Supheli Arac :Talkro Web-Shot/1.0 (E-mail: webshot@daumsoft.com- Home: http://222.122.15.190/webshot)"; content:"Talkro Web-Shot/1.0 (E-mail: webshot@daumsoft.com- Home: http://222.122.15.190/webshot)"; sid:1001873; ) alert tcp any any -> any any (msg:"Supheli Arac :Nokia7110/1.0 (05.01) (Google WAP Proxy/1.0)"; content:"Nokia7110/1.0 (05.01) (Google WAP Proxy/1.0)"; sid:1001874; ) alert tcp any any -> any any (msg:"Supheli Arac :IWAgent/ 1.0 - www.brandprotect.com"; content:"IWAgent/ 1.0 - www.brandprotect.com"; sid:1001875; ) alert tcp any any -> any any (msg:"Supheli Arac :voyager-hc/1.0"; content:"voyager-hc/1.0"; sid:1001876; ) alert tcp any any -> any any (msg:"Supheli Arac :xyro_(xcrawler@cosmos.inria.fr)"; content:"xyro_(xcrawler@cosmos.inria.fr)"; sid:1001877; ) alert tcp any any -> any any (msg:"Supheli Arac :www.business-socket.com registry verify/1.x"; content:"www.business-socket.com registry verify/1.x"; sid:1001878; ) alert tcp any any -> any any (msg:"Supheli Arac :DonutP; Windows98SE"; content:"DonutP; Windows98SE"; sid:1001879; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 gURLChecker/0.x.x (Linux)"; content:"Mozilla/5.0 gURLChecker/0.x.x (Linux)"; sid:1001880; ) alert tcp any any -> any any (msg:"Supheli Arac :HTTP Retriever"; content:"HTTP Retriever"; sid:1001881; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; BecomeJPBot/2.3; MSIE 6.0 compatible; +http://www.become.co.jp/site_owners.html)"; content:"Mozilla/5.0 (compatible; BecomeJPBot/2.3; MSIE 6.0 compatible; +http://www.become.co.jp/site_owners.html)"; sid:1001882; ) alert tcp any any -> any any (msg:"Supheli Arac :GetRight/4.5xx"; content:"GetRight/4.5xx"; sid:1001883; ) alert tcp any any -> any any (msg:"Supheli Arac :e-sense 1.0 ea(www.vigiltech.com/esensedisclaim.html)"; content:"e-sense 1.0 ea(www.vigiltech.com/esensedisclaim.html)"; sid:1001884; ) alert tcp any any -> any any (msg:"Supheli Arac :CougarSearch/0.x (+http://www.cougarsearch.com/faq.shtml)"; content:"CougarSearch/0.x (+http://www.cougarsearch.com/faq.shtml)"; sid:1001885; ) alert tcp any any -> any any (msg:"Supheli Arac :Steeler/1.x (http://www.tkl.iis.u-tokyo.ac.jp/~crawler/)"; content:"Steeler/1.x (http://www.tkl.iis.u-tokyo.ac.jp/~crawler/)"; sid:1001886; ) alert tcp any any -> any any (msg:"Supheli Arac :IlTrovatore-Setaccio/1.2 ( http://www.iltrovatore.it/aiuto/faq.html)"; content:"IlTrovatore-Setaccio/1.2 ( http://www.iltrovatore.it/aiuto/faq.html)"; sid:1001887; ) alert tcp any any -> any any (msg:"Supheli Arac :NutchOrg/0.0x-dev (Nutch; http://www.nutch.org/docs/bot.html; nutch-agent@lists.sourceforge.net)"; content:"NutchOrg/0.0x-dev (Nutch; http://www.nutch.org/docs/bot.html; nutch-agent@lists.sourceforge.net)"; sid:1001888; ) alert tcp any any -> any any (msg:"Supheli Arac :Dumbot(version 0.1 beta)"; content:"Dumbot(version 0.1 beta)"; sid:1001889; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (Compatible); URLBase 6"; content:"Mozilla/4.0 (Compatible); URLBase 6"; sid:1001890; ) alert tcp any any -> any any (msg:"Supheli Arac :HyperEstraier/1.x.xx"; content:"HyperEstraier/1.x.xx"; sid:1001891; ) alert tcp any any -> any any (msg:"Supheli Arac :http://www.trendtech.dk/spider.asp)"; content:"http://www.trendtech.dk/spider.asp)"; sid:1001892; ) alert tcp any any -> any any (msg:"Supheli Arac :zerxbot/Version 0.6 libwww-perl/5.79"; content:"zerxbot/Version 0.6 libwww-perl/5.79"; sid:1001893; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; egothor/8.0g; +http://ego.ms.mff.cuni.cz/)"; content:"Mozilla/5.0 (compatible; egothor/8.0g; +http://ego.ms.mff.cuni.cz/)"; sid:1001894; ) alert tcp any any -> any any (msg:"Supheli Arac :Ceramic Tile Installation Guide (http://www.floorstransformed.com)"; content:"Ceramic Tile Installation Guide (http://www.floorstransformed.com)"; sid:1001895; ) alert tcp any any -> any any (msg:"Supheli Arac :RaBot/1.0 Agent-admin/phortse@hanmail.net"; content:"RaBot/1.0 Agent-admin/phortse@hanmail.net"; sid:1001896; ) alert tcp any any -> any any (msg:"Supheli Arac :HeinrichderMiragoRobot (http://www.miragorobot.com/scripts/deinfo.asp)"; content:"HeinrichderMiragoRobot (http://www.miragorobot.com/scripts/deinfo.asp)"; sid:1001897; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; BecomeBot/1.xx; MSIE 6.0 compatible; http://www.become.com/webmasters.html)"; content:"Mozilla/5.0 (compatible; BecomeBot/1.xx; MSIE 6.0 compatible; http://www.become.com/webmasters.html)"; sid:1001898; ) alert tcp any any -> any any (msg:"Supheli Arac :EasyDL/3.xx http://keywen.com/Encyclopedia/Bot"; content:"EasyDL/3.xx http://keywen.com/Encyclopedia/Bot"; sid:1001899; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; http://www.UptimeAuditor.com/bot/ )"; content:"Mozilla/5.0 (compatible; http://www.UptimeAuditor.com/bot/ )"; sid:1001900; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (DreamPassport/3.0)"; content:"Mozilla/3.0 (DreamPassport/3.0)"; sid:1001901; ) alert tcp any any -> any any (msg:"Supheli Arac :W3C-checklink/3.x.x.x libwww-perl/5.xx"; content:"W3C-checklink/3.x.x.x libwww-perl/5.xx"; sid:1001902; ) alert tcp any any -> any any (msg:"Supheli Arac :FavOrg"; content:"FavOrg"; sid:1001903; ) alert tcp any any -> any any (msg:"Supheli Arac :Oracle iMTCrawler"; content:"Oracle iMTCrawler"; sid:1001904; ) alert tcp any any -> any any (msg:"Supheli Arac :Agent-SharewarePlazaFileCheckBot/2.0+(+http://www.SharewarePlaza.com)"; content:"Agent-SharewarePlazaFileCheckBot/2.0+(+http://www.SharewarePlaza.com)"; sid:1001905; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (MobilePhone PM-8200/US/1.0) NetFront/3.x MMP/2.0"; content:"Mozilla/4.0 (MobilePhone PM-8200/US/1.0) NetFront/3.x MMP/2.0"; sid:1001906; ) alert tcp any any -> any any (msg:"Supheli Arac :Inet library"; content:"Inet library"; sid:1001907; ) alert tcp any any -> any any (msg:"Supheli Arac :appie 1.1 (www.walhello.com)"; content:"appie 1.1 (www.walhello.com)"; sid:1001908; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; NetNose-Crawler 2.0; A New Search Experience: http://www.netnose.com)"; content:"Mozilla/4.0 (compatible; MSIE 5.0; NetNose-Crawler 2.0; A New Search Experience: http://www.netnose.com)"; sid:1001909; ) alert tcp any any -> any any (msg:"Supheli Arac :ICE Browser/5.05 (Java 1.4.0; Windows 2000 5.0 x86)"; content:"ICE Browser/5.05 (Java 1.4.0; Windows 2000 5.0 x86)"; sid:1001910; ) alert tcp any any -> any any (msg:"Supheli Arac :FuseBulb.Com"; content:"FuseBulb.Com"; sid:1001911; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/1.10 [en] (Compatible; RISC OS 3.70; Oregano 1.10)"; content:"Mozilla/1.10 [en] (Compatible; RISC OS 3.70; Oregano 1.10)"; sid:1001912; ) alert tcp any any -> any any (msg:"Supheli Arac :bluefish 0.6 HTML editor"; content:"bluefish 0.6 HTML editor"; sid:1001913; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; AOL 3.0; Mac_PowerPC)"; content:"Mozilla/2.0 (compatible; AOL 3.0; Mac_PowerPC)"; sid:1001914; ) alert tcp any any -> any any (msg:"Supheli Arac :BlogSearch/1.x +http://www.icerocket.com/"; content:"BlogSearch/1.x +http://www.icerocket.com/"; sid:1001915; ) alert tcp any any -> any any (msg:"Supheli Arac :Rank Exec (rankexec.com) Reciprocal Link Manager 1.x/bot"; content:"Rank Exec (rankexec.com) Reciprocal Link Manager 1.x/bot"; sid:1001916; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteBar/3.x.x (Bookmark Server; http://sitebar.org/)"; content:"SiteBar/3.x.x (Bookmark Server; http://sitebar.org/)"; sid:1001917; ) alert tcp any any -> any any (msg:"Supheli Arac :Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)"; content:"Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)"; sid:1001918; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 URL-Spider"; content:"Mozilla/5.0 URL-Spider"; sid:1001919; ) alert tcp any any -> any any (msg:"Supheli Arac :Web Link Validator 1.5"; content:"Web Link Validator 1.5"; sid:1001920; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (MobilePhone SCP-5500/US/1.0) NetFront/3.0 MMP/2.0 FAKE (compatible; Googlebot/2.1; http://www.google.com/bot.html)"; content:"Mozilla/4.0 (MobilePhone SCP-5500/US/1.0) NetFront/3.0 MMP/2.0 FAKE (compatible; Googlebot/2.1; http://www.google.com/bot.html)"; sid:1001921; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Yoono; http://www.yoono.com/)"; content:"Mozilla/5.0 (compatible; Yoono; http://www.yoono.com/)"; sid:1001922; ) alert tcp any any -> any any (msg:"Supheli Arac :Rewebber/1.2 libwww-perl/5.41"; content:"Rewebber/1.2 libwww-perl/5.41"; sid:1001923; ) alert tcp any any -> any any (msg:"Supheli Arac :ParaSite/1.0b (http://www.ianett.com/parasite/)"; content:"ParaSite/1.0b (http://www.ianett.com/parasite/)"; sid:1001924; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.7 [en](BecomeBot@exava.com)"; content:"Mozilla/4.7 [en](BecomeBot@exava.com)"; sid:1001925; ) alert tcp any any -> any any (msg:"Supheli Arac :IEFav172Free"; content:"IEFav172Free"; sid:1001926; ) alert tcp any any -> any any (msg:"Supheli Arac :Expired Domain Sleuth"; content:"Expired Domain Sleuth"; sid:1001927; ) alert tcp any any -> any any (msg:"Supheli Arac :Download Druid 2.x"; content:"Download Druid 2.x"; sid:1001928; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter/1.1 (custom)"; content:"Scooter/1.1 (custom)"; sid:1001929; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; BOTW Spider; +http://botw.org)"; content:"Mozilla/4.0 (compatible; BOTW Spider; +http://botw.org)"; sid:1001930; ) alert tcp any any -> any any (msg:"Supheli Arac :daypopbot/0.x"; content:"daypopbot/0.x"; sid:1001931; ) alert tcp any any -> any any (msg:"Supheli Arac :terraminds-bot/1.0 (support@terraminds.de)"; content:"terraminds-bot/1.0 (support@terraminds.de)"; sid:1001932; ) alert tcp any any -> any any (msg:"Supheli Arac :webbandit/4.xx.0"; content:"webbandit/4.xx.0"; sid:1001933; ) alert tcp any any -> any any (msg:"Supheli Arac :Cowbot-0.1 (NHN Corp. / +82-2-3011-1954 / nhnbot@naver.com)"; content:"Cowbot-0.1 (NHN Corp. / +82-2-3011-1954 / nhnbot@naver.com)"; sid:1001934; ) alert tcp any any -> any any (msg:"Supheli Arac :Jambot/0.1.x (Jambot; http://www.jambot.com/blog; crawler@jambot.com)"; content:"Jambot/0.1.x (Jambot; http://www.jambot.com/blog; crawler@jambot.com)"; sid:1001935; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.2.1_de_Viennot (Laurent.Viennot@inria.fr)"; content:"larbin_2.2.1_de_Viennot (Laurent.Viennot@inria.fr)"; sid:1001936; ) alert tcp any any -> any any (msg:"Supheli Arac :2Bone_LinkChecker/1.0 libwww-perl/5.64"; content:"2Bone_LinkChecker/1.0 libwww-perl/5.64"; sid:1001937; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.12.1 +http://www.page-store.com)"; content:"Mozilla/5.0 (compatible; heritrix/1.12.1 +http://www.page-store.com)"; sid:1001938; ) alert tcp any any -> any any (msg:"Supheli Arac :linknzbot"; content:"linknzbot"; sid:1001939; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter/1.0 scooter@pa.dec.com"; content:"Scooter/1.0 scooter@pa.dec.com"; sid:1001940; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; pogodak.ba/3.x)"; content:"Mozilla/5.0 (compatible; pogodak.ba/3.x)"; sid:1001941; ) alert tcp any any -> any any (msg:"Supheli Arac :complex_network_group/Nutch-0.9-dev (discovering the structure of the world-wide-web; http://cantor.ee.ucla.edu/~networks/crawl; nimakhaj@gmail.com)"; content:"complex_network_group/Nutch-0.9-dev (discovering the structure of the world-wide-web; http://cantor.ee.ucla.edu/~networks/crawl; nimakhaj@gmail.com)"; sid:1001942; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; FDSE robot)"; content:"Mozilla/4.0 (compatible; FDSE robot)"; sid:1001943; ) alert tcp any any -> any any (msg:"Supheli Arac :Crawler"; content:"Crawler"; sid:1001944; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:x.x.x) Gecko/20041107 Firefox/x.x"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:x.x.x) Gecko/20041107 Firefox/x.x"; sid:1001945; ) alert tcp any any -> any any (msg:"Supheli Arac :ChristCRAWLER 2.0"; content:"ChristCRAWLER 2.0"; sid:1001946; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2"; content:"Mozilla/1.22 (compatible; MSIE 5.01; PalmOS 3.0) EudoraWeb 2"; sid:1001947; ) alert tcp any any -> any any (msg:"Supheli Arac :Spida/0.1"; content:"Spida/0.1"; sid:1001948; ) alert tcp any any -> any any (msg:"Supheli Arac :Sleipnir"; content:"Sleipnir"; sid:1001949; ) alert tcp any any -> any any (msg:"Supheli Arac :Gulliver/1.3"; content:"Gulliver/1.3"; sid:1001950; ) alert tcp any any -> any any (msg:"Supheli Arac :Mediapartners-Google/2.1 ( http://www.googlebot.com/bot.html)"; content:"Mediapartners-Google/2.1 ( http://www.googlebot.com/bot.html)"; sid:1001951; ) alert tcp any any -> any any (msg:"Supheli Arac :sna-0.0.1 (mikemuzio@msn.com)"; content:"sna-0.0.1 (mikemuzio@msn.com)"; sid:1001952; ) alert tcp any any -> any any (msg:"Supheli Arac :beautybot/1.0 (+http://www.uchoose.de/crawler/beautybot/)"; content:"beautybot/1.0 (+http://www.uchoose.de/crawler/beautybot/)"; sid:1001953; ) alert tcp any any -> any any (msg:"Supheli Arac :Megite2.0 (http://www.megite.com)"; content:"Megite2.0 (http://www.megite.com)"; sid:1001954; ) alert tcp any any -> any any (msg:"Supheli Arac :PicoSearch/1.0"; content:"PicoSearch/1.0"; sid:1001955; ) alert tcp any any -> any any (msg:"Supheli Arac :Cocoal.icio.us/1.0 (v36) (Mac OS X; http://www.scifihifi.com/cocoalicious)"; content:"Cocoal.icio.us/1.0 (v36) (Mac OS X; http://www.scifihifi.com/cocoalicious)"; sid:1001956; ) alert tcp any any -> any any (msg:"Supheli Arac :mylinkcheck/1.02"; content:"mylinkcheck/1.02"; sid:1001957; ) alert tcp any any -> any any (msg:"Supheli Arac :REAP-crawler Nutch/Nutch-1.0-dev (Reap Project; http://reap.cs.cmu.edu/REAP-crawler/; Reap Project)"; content:"REAP-crawler Nutch/Nutch-1.0-dev (Reap Project; http://reap.cs.cmu.edu/REAP-crawler/; Reap Project)"; sid:1001958; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Quantcastbot/1.0; www.quantcast.com)"; content:"Mozilla/5.0 (compatible; Quantcastbot/1.0; www.quantcast.com)"; sid:1001959; ) alert tcp any any -> any any (msg:"Supheli Arac :Piffany_Web_Spider_v0.x"; content:"Piffany_Web_Spider_v0.x"; sid:1001960; ) alert tcp any any -> any any (msg:"Supheli Arac :ozelot/2.7.3 (Search engine indexer; www.flying-cat.de/ozelot; ozelot@flying-cat.de)"; content:"ozelot/2.7.3 (Search engine indexer; www.flying-cat.de/ozelot; ozelot@flying-cat.de)"; sid:1001961; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; EARTHCOM.info/2.01; http://www.earthcom.info)"; content:"Mozilla/5.0 (compatible; EARTHCOM.info/2.01; http://www.earthcom.info)"; sid:1001962; ) alert tcp any any -> any any (msg:"Supheli Arac :Kevin http://dznet.com/kevin/"; content:"Kevin http://dznet.com/kevin/"; sid:1001963; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.04 [en] (X11; I; IRIX 5.3 IP22)"; content:"Mozilla/4.04 [en] (X11; I; IRIX 5.3 IP22)"; sid:1001964; ) alert tcp any any -> any any (msg:"Supheli Arac :Skampy/0.9.x (http://www.skaffe.com/skampy-info.html)"; content:"Skampy/0.9.x (http://www.skaffe.com/skampy-info.html)"; sid:1001965; ) alert tcp any any -> any any (msg:"Supheli Arac :Siigle Orumcex v.001 Turkey (http://www.siigle.com)"; content:"Siigle Orumcex v.001 Turkey (http://www.siigle.com)"; sid:1001966; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.7 (compatible; OffByOne; Windows 98) Webster Pro V3.2"; content:"Mozilla/4.7 (compatible; OffByOne; Windows 98) Webster Pro V3.2"; sid:1001967; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter-3.2.snippet"; content:"Scooter-3.2.snippet"; sid:1001968; ) alert tcp any any -> any any (msg:"Supheli Arac :Libby_1.1/libwww-perl/5.47"; content:"Libby_1.1/libwww-perl/5.47"; sid:1001969; ) alert tcp any any -> any any (msg:"Supheli Arac :jBrowser/J2ME Profile/MIDP-1.0 Configuration/CLDC-1.0 (Google WAP Proxy/1.0)"; content:"jBrowser/J2ME Profile/MIDP-1.0 Configuration/CLDC-1.0 (Google WAP Proxy/1.0)"; sid:1001970; ) alert tcp any any -> any any (msg:"Supheli Arac :Star Downloader"; content:"Star Downloader"; sid:1001971; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Iplexx Spider/1.0 http://www.iplexx.at)"; content:"Mozilla/4.0 (compatible; Iplexx Spider/1.0 http://www.iplexx.at)"; sid:1001972; ) alert tcp any any -> any any (msg:"Supheli Arac :GurujiBot/1.0 (+http://www.guruji.com/WebmasterFAQ.html)"; content:"GurujiBot/1.0 (+http://www.guruji.com/WebmasterFAQ.html)"; sid:1001973; ) alert tcp any any -> any any (msg:"Supheli Arac :WebCompass 2.0"; content:"WebCompass 2.0"; sid:1001974; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; SummizeBot +http://www.summize.com)"; content:"Mozilla/5.0 (compatible; SummizeBot +http://www.summize.com)"; sid:1001975; ) alert tcp any any -> any any (msg:"Supheli Arac :gazz/x.x (gazz@nttrd.com)"; content:"gazz/x.x (gazz@nttrd.com)"; sid:1001976; ) alert tcp any any -> any any (msg:"Supheli Arac :http://www.almaden.ibm.com/cs/crawler"; content:"http://www.almaden.ibm.com/cs/crawler"; sid:1001977; ) alert tcp any any -> any any (msg:"Supheli Arac :FFC Trap Door Spider"; content:"FFC Trap Door Spider"; sid:1001978; ) alert tcp any any -> any any (msg:"Supheli Arac :Lynx/2-4-2 (Bobcat/0.5 [DOS] Jp Beta04)"; content:"Lynx/2-4-2 (Bobcat/0.5 [DOS] Jp Beta04)"; sid:1001979; ) alert tcp any any -> any any (msg:"Supheli Arac :Mahiti.Com/Mahiti Crawler-1.0 (Mahiti.Com; http://mahiti.com ; mahiti.com)"; content:"Mahiti.Com/Mahiti Crawler-1.0 (Mahiti.Com; http://mahiti.com ; mahiti.com)"; sid:1001980; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; KeepNI web site monitor)"; content:"Mozilla/4.0 (compatible; KeepNI web site monitor)"; sid:1001981; ) alert tcp any any -> any any (msg:"Supheli Arac :webhack"; content:"webhack"; sid:1001982; ) alert tcp any any -> any any (msg:"Supheli Arac :PJspider/3.0 (pjspider@portaljuice.com; http://www.portaljuice.com)"; content:"PJspider/3.0 (pjspider@portaljuice.com; http://www.portaljuice.com)"; sid:1001983; ) alert tcp any any -> any any (msg:"Supheli Arac :Shareaza v1.x.x.xx"; content:"Shareaza v1.x.x.xx"; sid:1001984; ) alert tcp any any -> any any (msg:"Supheli Arac :BaboomBot/1.x.x (+http://www.baboom.us)"; content:"BaboomBot/1.x.x (+http://www.baboom.us)"; sid:1001985; ) alert tcp any any -> any any (msg:"Supheli Arac :GenesisBrowser (HTTP 1.1; 0.9; XP SP2; .NET CLR 2.0.50727)"; content:"GenesisBrowser (HTTP 1.1; 0.9; XP SP2; .NET CLR 2.0.50727)"; sid:1001986; ) alert tcp any any -> any any (msg:"Supheli Arac :Aladin/3.324"; content:"Aladin/3.324"; sid:1001987; ) alert tcp any any -> any any (msg:"Supheli Arac :SpiderMan"; content:"SpiderMan"; sid:1001988; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Net M@nager V3.02 - www.vinn.com.au)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Net M@nager V3.02 - www.vinn.com.au)"; sid:1001989; ) alert tcp any any -> any any (msg:"Supheli Arac :SquidClamAV_Redirector 1.x.x"; content:"SquidClamAV_Redirector 1.x.x"; sid:1001990; ) alert tcp any any -> any any (msg:"Supheli Arac :ConveraCrawler/0.9d (+http://www.authoritativeweb.com/crawl)"; content:"ConveraCrawler/0.9d (+http://www.authoritativeweb.com/crawl)"; sid:1001991; ) alert tcp any any -> any any (msg:"Supheli Arac :Jigsaw/2.2.x W3C_CSS_Validator_JFouffa/2.0"; content:"Jigsaw/2.2.x W3C_CSS_Validator_JFouffa/2.0"; sid:1001992; ) alert tcp any any -> any any (msg:"Supheli Arac :MFHttpScan"; content:"MFHttpScan"; sid:1001993; ) alert tcp any any -> any any (msg:"Supheli Arac :Z-Add Link Checker (http://w3.z-add.co.uk/linkcheck/)"; content:"Z-Add Link Checker (http://w3.z-add.co.uk/linkcheck/)"; sid:1001994; ) alert tcp any any -> any any (msg:"Supheli Arac :QuepasaCreep v0.9.1x"; content:"QuepasaCreep v0.9.1x"; sid:1001995; ) alert tcp any any -> any any (msg:"Supheli Arac :CrawlConvera0.1 (CrawlConvera@yahoo.com)"; content:"CrawlConvera0.1 (CrawlConvera@yahoo.com)"; sid:1001996; ) alert tcp any any -> any any (msg:"Supheli Arac :Apple iPhone v1.1.4 CoreMedia v1.0.0.4A102"; content:"Apple iPhone v1.1.4 CoreMedia v1.0.0.4A102"; sid:1001997; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; SYMPA; Katiesoft 7; SimulBrowse 3.0)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; SYMPA; Katiesoft 7; SimulBrowse 3.0)"; sid:1001998; ) alert tcp any any -> any any (msg:"Supheli Arac :FnooleBot/2.5.2 (+http://www.fnoole.com/addurl.html)"; content:"FnooleBot/2.5.2 (+http://www.fnoole.com/addurl.html)"; sid:1001999; ) alert tcp any any -> any any (msg:"Supheli Arac :BlogPulseLive (support@blogpulse.com)"; content:"BlogPulseLive (support@blogpulse.com)"; sid:1002000; ) alert tcp any any -> any any (msg:"Supheli Arac :ASPseek/1.2.9d"; content:"ASPseek/1.2.9d"; sid:1002001; ) alert tcp any any -> any any (msg:"Supheli Arac :ASPseek/1.2.xx"; content:"ASPseek/1.2.xx"; sid:1002002; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"; content:"Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"; sid:1002003; ) alert tcp any any -> any any (msg:"Supheli Arac :exooba/exooba crawler (exooba; exooba)"; content:"exooba/exooba crawler (exooba; exooba)"; sid:1002004; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; MOSBookmarks/v2.6-Plus; Link Checker)"; content:"Mozilla/5.0 (compatible; MOSBookmarks/v2.6-Plus; Link Checker)"; sid:1002005; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/5.11 (Windows ME; U) [ru]"; content:"Opera/5.11 (Windows ME; U) [ru]"; sid:1002006; ) alert tcp any any -> any any (msg:"Supheli Arac :grub-client"; content:"grub-client"; sid:1002007; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Win95; I)"; content:"Mozilla/3.0 (Win95; I)"; sid:1002008; ) alert tcp any any -> any any (msg:"Supheli Arac :Octora Beta Bot - www.octora.com"; content:"Octora Beta Bot - www.octora.com"; sid:1002009; ) alert tcp any any -> any any (msg:"Supheli Arac :SnykeBot/0.6 (http://www.snyke.com)"; content:"SnykeBot/0.6 (http://www.snyke.com)"; sid:1002010; ) alert tcp any any -> any any (msg:"Supheli Arac :GetRight/6.1 (Pro)"; content:"GetRight/6.1 (Pro)"; sid:1002011; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ZoomSpider.net bot; .NET CLR 1.1.4322)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ZoomSpider.net bot; .NET CLR 1.1.4322)"; sid:1002012; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) REL Software Web Link Validator 2.x)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) REL Software Web Link Validator 2.x)"; sid:1002013; ) alert tcp any any -> any any (msg:"Supheli Arac :JCheckLinks/0.1 RPT-HTTPClient/0.3-1"; content:"JCheckLinks/0.1 RPT-HTTPClient/0.3-1"; sid:1002014; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; MSIE 3.0; Windows 3.1)"; content:"Mozilla/2.0 (compatible; MSIE 3.0; Windows 3.1)"; sid:1002015; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; PeoplePal 3.0; MSIECrawler)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; PeoplePal 3.0; MSIECrawler)"; sid:1002016; ) alert tcp any any -> any any (msg:"Supheli Arac :Twiceler-0.9 http://www.cuill.com/twiceler/robot.html"; content:"Twiceler-0.9 http://www.cuill.com/twiceler/robot.html"; sid:1002017; ) alert tcp any any -> any any (msg:"Supheli Arac :QPCreep Test Rig ( We are not indexing- just testing )"; content:"QPCreep Test Rig ( We are not indexing- just testing )"; sid:1002018; ) alert tcp any any -> any any (msg:"Supheli Arac :Production Bot DOT 3016B"; content:"Production Bot DOT 3016B"; sid:1002019; ) alert tcp any any -> any any (msg:"Supheli Arac :pipeLiner/0.3a (PipeLine Spider;http://www.pipeline-search.com/webmaster.html; webmaster'at'pipeline-search.com)"; content:"pipeLiner/0.3a (PipeLine Spider;http://www.pipeline-search.com/webmaster.html; webmaster'at'pipeline-search.com)"; sid:1002020; ) alert tcp any any -> any any (msg:"Supheli Arac :MSIE-5.13 (larbin@unspecified.mail)"; content:"MSIE-5.13 (larbin@unspecified.mail)"; sid:1002021; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin (samualt9@bigfoot.com)"; content:"larbin (samualt9@bigfoot.com)"; sid:1002022; ) alert tcp any any -> any any (msg:"Supheli Arac :disastrous/1.0.5 (running with Python 2.5.1; http://www.bortzmeyer.org/disastrous.html; archangel77@del.icio.us)"; content:"disastrous/1.0.5 (running with Python 2.5.1; http://www.bortzmeyer.org/disastrous.html; archangel77@del.icio.us)"; sid:1002023; ) alert tcp any any -> any any (msg:"Supheli Arac :LG-LX260 POLARIS-LX260/2.0 MMP/2.0 Profile/MIDP-2.0 Configuration/CLDC-1.1"; content:"LG-LX260 POLARIS-LX260/2.0 MMP/2.0 Profile/MIDP-2.0 Configuration/CLDC-1.1"; sid:1002024; ) alert tcp any any -> any any (msg:"Supheli Arac :SharewarePlazaFileCheckBot/1.0+(+http://www.SharewarePlaza.com)"; content:"SharewarePlazaFileCheckBot/1.0+(+http://www.SharewarePlaza.com)"; sid:1002025; ) alert tcp any any -> any any (msg:"Supheli Arac :JRTwine Software Check Favorites Utility"; content:"JRTwine Software Check Favorites Utility"; sid:1002026; ) alert tcp any any -> any any (msg:"Supheli Arac :online link validator (http://www.dead-links.com/)"; content:"online link validator (http://www.dead-links.com/)"; sid:1002027; ) alert tcp any any -> any any (msg:"Supheli Arac :BlogBot/1.x"; content:"BlogBot/1.x"; sid:1002028; ) alert tcp any any -> any any (msg:"Supheli Arac :Reaper [2.03.10-031204] (http://www.sitesearch.ca/reaper/)"; content:"Reaper [2.03.10-031204] (http://www.sitesearch.ca/reaper/)"; sid:1002029; ) alert tcp any any -> any any (msg:"Supheli Arac :axadine/ (Axadine Crawler; http://www.axada.de/; )"; content:"axadine/ (Axadine Crawler; http://www.axada.de/; )"; sid:1002030; ) alert tcp any any -> any any (msg:"Supheli Arac :PycURL/7.xx.x"; content:"PycURL/7.xx.x"; sid:1002031; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/2.2.8 (crawler@fast.no; http://www.fast.no/faq/faqfastwebsearch/faqfastwebcrawler.html)http://www.fast.no"; content:"FAST-WebCrawler/2.2.8 (crawler@fast.no; http://www.fast.no/faq/faqfastwebsearch/faqfastwebcrawler.html)http://www.fast.no"; sid:1002032; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.6/FirstPage (crawler@fast.no; http://fast.no/support.php?c=faqs/crawler)"; content:"FAST-WebCrawler/3.6/FirstPage (crawler@fast.no; http://fast.no/support.php?c=faqs/crawler)"; sid:1002033; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.2 (vitalbox1@hotmail.com)"; content:"larbin_2.6.2 (vitalbox1@hotmail.com)"; sid:1002034; ) alert tcp any any -> any any (msg:"Supheli Arac :Robot/www.pj-search.com"; content:"Robot/www.pj-search.com"; sid:1002035; ) alert tcp any any -> any any (msg:"Supheli Arac :FeedshowOnline (http://www.feedshow.com)"; content:"FeedshowOnline (http://www.feedshow.com)"; sid:1002036; ) alert tcp any any -> any any (msg:"Supheli Arac :Yanga WorldSearch Bot v1.1/beta (http://www.yanga.co.uk/)"; content:"Yanga WorldSearch Bot v1.1/beta (http://www.yanga.co.uk/)"; sid:1002037; ) alert tcp any any -> any any (msg:"Supheli Arac :OpidooBOT (larbin2.6.3@unspecified.mail)"; content:"OpidooBOT (larbin2.6.3@unspecified.mail)"; sid:1002038; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; FastCrawler3 support-fastcrawler3@fast.no)"; content:"Mozilla/4.0 (compatible; FastCrawler3 support-fastcrawler3@fast.no)"; sid:1002039; ) alert tcp any any -> any any (msg:"Supheli Arac :BeamMachine/0.5 (dead link remover of www.beammachine.net)"; content:"BeamMachine/0.5 (dead link remover of www.beammachine.net)"; sid:1002040; ) alert tcp any any -> any any (msg:"Supheli Arac :Bookmark Renewal Check Agent [http://www.bookmark.ne.jp/]"; content:"Bookmark Renewal Check Agent [http://www.bookmark.ne.jp/]"; sid:1002041; ) alert tcp any any -> any any (msg:"Supheli Arac :BMLAUNCHER"; content:"BMLAUNCHER"; sid:1002042; ) alert tcp any any -> any any (msg:"Supheli Arac :Yahoo-Test/4.0"; content:"Yahoo-Test/4.0"; sid:1002043; ) alert tcp any any -> any any (msg:"Supheli Arac :LeapTag/0.8.1.beta081.r3750 (compatible; Mozilla 4.0; MSIE 5.5; robot@yoriwa.com)"; content:"LeapTag/0.8.1.beta081.r3750 (compatible; Mozilla 4.0; MSIE 5.5; robot@yoriwa.com)"; sid:1002044; ) alert tcp any any -> any any (msg:"Supheli Arac :CheckUrl"; content:"CheckUrl"; sid:1002045; ) alert tcp any any -> any any (msg:"Supheli Arac :CheckWeb"; content:"CheckWeb"; sid:1002046; ) alert tcp any any -> any any (msg:"Supheli Arac :zspider/0.9-dev http://feedback.redkolibri.com/"; content:"zspider/0.9-dev http://feedback.redkolibri.com/"; sid:1002047; ) alert tcp any any -> any any (msg:"Supheli Arac :PHP/4.0.4pl1"; content:"PHP/4.0.4pl1"; sid:1002048; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/2.0 (compatible; NEWT ActiveX; Win32)"; content:"Mozilla/2.0 (compatible; NEWT ActiveX; Win32)"; sid:1002049; ) alert tcp any any -> any any (msg:"Supheli Arac :Favorites Checking (http://campulka.net)"; content:"Favorites Checking (http://campulka.net)"; sid:1002050; ) alert tcp any any -> any any (msg:"Supheli Arac :pd02_1.0.0 pd02_1.0.0@dzimi@post.sk"; content:"pd02_1.0.0 pd02_1.0.0@dzimi@post.sk"; sid:1002051; ) alert tcp any any -> any any (msg:"Supheli Arac :Y!TunnelPro"; content:"Y!TunnelPro"; sid:1002052; ) alert tcp any any -> any any (msg:"Supheli Arac :Y!J-BSC/1.0 (http://help.yahoo.co.jp/help/jp/search/indexing/indexing-15.html)"; content:"Y!J-BSC/1.0 (http://help.yahoo.co.jp/help/jp/search/indexing/indexing-15.html)"; sid:1002053; ) alert tcp any any -> any any (msg:"Supheli Arac :CurryGuide SiteScan 1.1"; content:"CurryGuide SiteScan 1.1"; sid:1002054; ) alert tcp any any -> any any (msg:"Supheli Arac :teomaagent1 [crawler-admin@teoma.com]"; content:"teomaagent1 [crawler-admin@teoma.com]"; sid:1002055; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteRecon+(xx)"; content:"SiteRecon+(xx)"; sid:1002056; ) alert tcp any any -> any any (msg:"Supheli Arac :PubCrawl (pubcrawl.stanford.edu)"; content:"PubCrawl (pubcrawl.stanford.edu)"; sid:1002057; ) alert tcp any any -> any any (msg:"Supheli Arac :R6_FeedFetcher_(www.radian6.com/crawler)"; content:"R6_FeedFetcher_(www.radian6.com/crawler)"; sid:1002058; ) alert tcp any any -> any any (msg:"Supheli Arac :KAIST AITrc Crawler"; content:"KAIST AITrc Crawler"; sid:1002059; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; SpurlBot/0.2)"; content:"Mozilla/5.0 (compatible; SpurlBot/0.2)"; sid:1002060; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Win98; en-US; rv:x.xx) Gecko/20030423 Firebird Browser/0.6"; content:"Mozilla/5.0 (Windows; U; Win98; en-US; rv:x.xx) Gecko/20030423 Firebird Browser/0.6"; sid:1002061; ) alert tcp any any -> any any (msg:"Supheli Arac :Slurp/2.0 (slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; content:"Slurp/2.0 (slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; sid:1002062; ) alert tcp any any -> any any (msg:"Supheli Arac :Sirketcebot/v.01 (http://www.sirketce.com/bot.html)"; content:"Sirketcebot/v.01 (http://www.sirketce.com/bot.html)"; sid:1002063; ) alert tcp any any -> any any (msg:"Supheli Arac :Crawllybot/0.1 (Crawllybot; +http://www.crawlly.com; crawler@crawlly.com)"; content:"Crawllybot/0.1 (Crawllybot; +http://www.crawlly.com; crawler@crawlly.com)"; sid:1002064; ) alert tcp any any -> any any (msg:"Supheli Arac :Catall Spider"; content:"Catall Spider"; sid:1002065; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 [en] (compatible; Gulper Web Bot 0.2.4 www.ecsl.cs.sunysb.edu/~maxim/cgi-bin/Link/GulperBot)"; content:"Mozilla/5.0 [en] (compatible; Gulper Web Bot 0.2.4 www.ecsl.cs.sunysb.edu/~maxim/cgi-bin/Link/GulperBot)"; sid:1002066; ) alert tcp any any -> any any (msg:"Supheli Arac :collage.cgi/1.xx"; content:"collage.cgi/1.xx"; sid:1002067; ) alert tcp any any -> any any (msg:"Supheli Arac :Website eXtractor"; content:"Website eXtractor"; sid:1002068; ) alert tcp any any -> any any (msg:"Supheli Arac :TheRarestParser/0.2a (http://therarestwords.com/)"; content:"TheRarestParser/0.2a (http://therarestwords.com/)"; sid:1002069; ) alert tcp any any -> any any (msg:"Supheli Arac :REL Link Checker Lite x.x"; content:"REL Link Checker Lite x.x"; sid:1002070; ) alert tcp any any -> any any (msg:"Supheli Arac :WinHTTP Example/1.0"; content:"WinHTTP Example/1.0"; sid:1002071; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; BecomeBot/1.23; http://www.become.com/webmasters.html)"; content:"Mozilla/5.0 (compatible; BecomeBot/1.23; http://www.become.com/webmasters.html)"; sid:1002072; ) alert tcp any any -> any any (msg:"Supheli Arac :Twitturly / v0.x"; content:"Twitturly / v0.x"; sid:1002073; ) alert tcp any any -> any any (msg:"Supheli Arac :annotate_google; http://ponderer.org/download/annotate_google.user.js"; content:"annotate_google; http://ponderer.org/download/annotate_google.user.js"; sid:1002074; ) alert tcp any any -> any any (msg:"Supheli Arac :EnaBot/1.x (http://www.enaball.com/crawler.html)"; content:"EnaBot/1.x (http://www.enaball.com/crawler.html)"; sid:1002075; ) alert tcp any any -> any any (msg:"Supheli Arac :CyberSpyder Link Test/2.1.12 (admin@mspennyworth.com)"; content:"CyberSpyder Link Test/2.1.12 (admin@mspennyworth.com)"; sid:1002076; ) alert tcp any any -> any any (msg:"Supheli Arac :Orbiter/T-2.0 (+http://www.dailyorbit.com/bot.htm)"; content:"Orbiter/T-2.0 (+http://www.dailyorbit.com/bot.htm)"; sid:1002077; ) alert tcp any any -> any any (msg:"Supheli Arac :updated/0.1beta (updated.com; http://www.updated.com; crawler@updated.om)"; content:"updated/0.1beta (updated.com; http://www.updated.com; crawler@updated.om)"; sid:1002078; ) alert tcp any any -> any any (msg:"Supheli Arac :holmes/3.9 (onet.pl)"; content:"holmes/3.9 (onet.pl)"; sid:1002079; ) alert tcp any any -> any any (msg:"Supheli Arac :Mail.Ru/1.0"; content:"Mail.Ru/1.0"; sid:1002080; ) alert tcp any any -> any any (msg:"Supheli Arac :Reaper/2.0x (+http://www.sitesearch.ca/reaper)"; content:"Reaper/2.0x (+http://www.sitesearch.ca/reaper)"; sid:1002081; ) alert tcp any any -> any any (msg:"Supheli Arac :HappyFunBot/1.1"; content:"HappyFunBot/1.1"; sid:1002082; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; pmoz.info ODP link checker; +http://pmoz.info/doc/botinfo.htm)"; content:"Mozilla/5.0 (compatible; pmoz.info ODP link checker; +http://pmoz.info/doc/botinfo.htm)"; sid:1002083; ) alert tcp any any -> any any (msg:"Supheli Arac :Spock Crawler (http://www.spock.com/crawler)"; content:"Spock Crawler (http://www.spock.com/crawler)"; sid:1002084; ) alert tcp any any -> any any (msg:"Supheli Arac :Media Player Classic"; content:"Media Player Classic"; sid:1002085; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.04 [en] (X11; I; HP-UX B.10.20 9000/712)"; content:"Mozilla/4.04 [en] (X11; I; HP-UX B.10.20 9000/712)"; sid:1002086; ) alert tcp any any -> any any (msg:"Supheli Arac :Exalead NG/MimeLive Client (convert/http/0.120)"; content:"Exalead NG/MimeLive Client (convert/http/0.120)"; sid:1002087; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; RSS Popper)"; content:"Mozilla/4.0 (compatible; RSS Popper)"; sid:1002088; ) alert tcp any any -> any any (msg:"Supheli Arac :scoutmaster"; content:"scoutmaster"; sid:1002089; ) alert tcp any any -> any any (msg:"Supheli Arac :Iltrovatore-Setaccio/1.2 (It-bot; http://www.iltrovatore.it/bot.html; info@iltrovatore.it)"; content:"Iltrovatore-Setaccio/1.2 (It-bot; http://www.iltrovatore.it/bot.html; info@iltrovatore.it)"; sid:1002090; ) alert tcp any any -> any any (msg:"Supheli Arac :User-Agent: FileHeap! file downloader (http://www.fileheap.com)"; content:"User-Agent: FileHeap! file downloader (http://www.fileheap.com)"; sid:1002091; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.1) Gecko/20061205 Iceweasel/2.0.0.1 (Debian-2.0.0.1+dfsg-2)"; content:"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.1) Gecko/20061205 Iceweasel/2.0.0.1 (Debian-2.0.0.1+dfsg-2)"; sid:1002092; ) alert tcp any any -> any any (msg:"Supheli Arac :WebStat/1.0 (Unix; beta; 20040314)"; content:"WebStat/1.0 (Unix; beta; 20040314)"; sid:1002093; ) alert tcp any any -> any any (msg:"Supheli Arac :Uptimebot"; content:"Uptimebot"; sid:1002094; ) alert tcp any any -> any any (msg:"Supheli Arac :RPT-HTTPClient/0.3-x"; content:"RPT-HTTPClient/0.3-x"; sid:1002095; ) alert tcp any any -> any any (msg:"Supheli Arac :TulipChain/5.xx (http://ostermiller.org/tulipchain/) Java/1.x.1_0x (http://apple.com/) Mac_OS_X/10.2.8"; content:"TulipChain/5.xx (http://ostermiller.org/tulipchain/) Java/1.x.1_0x (http://apple.com/) Mac_OS_X/10.2.8"; sid:1002096; ) alert tcp any any -> any any (msg:"Supheli Arac :mozilla/5.0 (compatible; genevabot http://www.healthdash.com)"; content:"mozilla/5.0 (compatible; genevabot http://www.healthdash.com)"; sid:1002097; ) alert tcp any any -> any any (msg:"Supheli Arac :Advanced Browser (http://www.avantbrowser.com)"; content:"Advanced Browser (http://www.avantbrowser.com)"; sid:1002098; ) alert tcp any any -> any any (msg:"Supheli Arac :Whatsup/x.x"; content:"Whatsup/x.x"; sid:1002099; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.01Gold (X11; I; Linux 2.0.32 i486)"; content:"Mozilla/3.01Gold (X11; I; Linux 2.0.32 i486)"; sid:1002100; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; de-AT; rv:1.8.0.2) Gecko/20060309 SeaMonkey/1.0"; content:"Mozilla/5.0 (X11; U; Linux i686; de-AT; rv:1.8.0.2) Gecko/20060309 SeaMonkey/1.0"; sid:1002101; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.04 (compatible; Dulance bot; +http://www.dulance.com/bot.jsp)"; content:"Mozilla/4.04 (compatible; Dulance bot; +http://www.dulance.com/bot.jsp)"; sid:1002102; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.7 (compatible; http://eidetica.com/spider)"; content:"Mozilla/4.7 (compatible; http://eidetica.com/spider)"; sid:1002103; ) alert tcp any any -> any any (msg:"Supheli Arac :integrity/1.6"; content:"integrity/1.6"; sid:1002104; ) alert tcp any any -> any any (msg:"Supheli Arac :ICCrawler - ICjobs (http://www.icjobs.de/bot.htm)"; content:"ICCrawler - ICjobs (http://www.icjobs.de/bot.htm)"; sid:1002105; ) alert tcp any any -> any any (msg:"Supheli Arac :web2express.org/Nutch-0.9-dev (leveled playing field; http://web2express.org/; info at web2express.org)"; content:"web2express.org/Nutch-0.9-dev (leveled playing field; http://web2express.org/; info at web2express.org)"; sid:1002106; ) alert tcp any any -> any any (msg:"Supheli Arac :PureSight"; content:"PureSight"; sid:1002107; ) alert tcp any any -> any any (msg:"Supheli Arac :PHP/3.x.xx"; content:"PHP/3.x.xx"; sid:1002108; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; Mac_PowerPC)"; content:"Mozilla/4.0 (compatible; MSIE 4.01; Mac_PowerPC)"; sid:1002109; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Crawling jpeg; http://www.yama.info.waseda.ac.jp)"; content:"Mozilla/5.0 (compatible; Crawling jpeg; http://www.yama.info.waseda.ac.jp)"; sid:1002110; ) alert tcp any any -> any any (msg:"Supheli Arac :PSurf15a 11"; content:"PSurf15a 11"; sid:1002111; ) alert tcp any any -> any any (msg:"Supheli Arac :PSurf15a 51"; content:"PSurf15a 51"; sid:1002112; ) alert tcp any any -> any any (msg:"Supheli Arac :PSurf15a VA"; content:"PSurf15a VA"; sid:1002113; ) alert tcp any any -> any any (msg:"Supheli Arac :Mercator-Scrub-1.1"; content:"Mercator-Scrub-1.1"; sid:1002114; ) alert tcp any any -> any any (msg:"Supheli Arac :Sensis Web Crawler (search_comments\at\sensis\dot\com\dot\au)"; content:"Sensis Web Crawler (search_comments\at\sensis\dot\com\dot\au)"; sid:1002115; ) alert tcp any any -> any any (msg:"Supheli Arac :Missigua Locator 1.9"; content:"Missigua Locator 1.9"; sid:1002116; ) alert tcp any any -> any any (msg:"Supheli Arac :DiamondBot"; content:"DiamondBot"; sid:1002117; ) alert tcp any any -> any any (msg:"Supheli Arac :metatagsdir/0.7 (+http://metatagsdir.com/directory/)"; content:"metatagsdir/0.7 (+http://metatagsdir.com/directory/)"; sid:1002118; ) alert tcp any any -> any any (msg:"Supheli Arac :Dumbot(version 0.1 beta - http://www.dumbfind.com/dumbot.html)"; content:"Dumbot(version 0.1 beta - http://www.dumbfind.com/dumbot.html)"; sid:1002119; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; IBP; .NET CLR 1.1.4322)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; IBP; .NET CLR 1.1.4322)"; sid:1002120; ) alert tcp any any -> any any (msg:"Supheli Arac :BarcaPro/1.4.xxxx"; content:"BarcaPro/1.4.xxxx"; sid:1002121; ) alert tcp any any -> any any (msg:"Supheli Arac :ia_archiver/1.6"; content:"ia_archiver/1.6"; sid:1002122; ) alert tcp any any -> any any (msg:"Supheli Arac :gsa-crawler (Enterprise; GIX-02057; dm@enhesa.com)"; content:"gsa-crawler (Enterprise; GIX-02057; dm@enhesa.com)"; sid:1002123; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/6.x (Windows NT 4.0; U) [de]"; content:"Opera/6.x (Windows NT 4.0; U) [de]"; sid:1002124; ) alert tcp any any -> any any (msg:"Supheli Arac :ObjectsSearch/0.0x (ObjectsSearch; http://www.ObjectsSearch.com/bot.html; support@thesoftwareobjects.com)"; content:"ObjectsSearch/0.0x (ObjectsSearch; http://www.ObjectsSearch.com/bot.html; support@thesoftwareobjects.com)"; sid:1002125; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Windows NT 5.0; phpwebbrainBot/0.1 - http://www.monsterli.ch/phpwebbrain/)"; content:"Mozilla/5.0 (compatible; Windows NT 5.0; phpwebbrainBot/0.1 - http://www.monsterli.ch/phpwebbrain/)"; sid:1002126; ) alert tcp any any -> any any (msg:"Supheli Arac :DoCoMo/1.0/Nxxxi/c10/TB"; content:"DoCoMo/1.0/Nxxxi/c10/TB"; sid:1002127; ) alert tcp any any -> any any (msg:"Supheli Arac :Jayde Crawler. http://www.jayde.com"; content:"Jayde Crawler. http://www.jayde.com"; sid:1002128; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.3 (wgao@genieknows.com)"; content:"larbin_2.6.3 (wgao@genieknows.com)"; sid:1002129; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.7 [en](Exabot@exava.com)"; content:"Mozilla/4.7 [en](Exabot@exava.com)"; sid:1002130; ) alert tcp any any -> any any (msg:"Supheli Arac :BlackBerry7520/4.0.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 UP.Browser/5.0.3.3 UP.Link/5.1.2.12 (Google WAP Proxy/1.0)"; content:"BlackBerry7520/4.0.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 UP.Browser/5.0.3.3 UP.Link/5.1.2.12 (Google WAP Proxy/1.0)"; sid:1002131; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter_bh0-3.0.3"; content:"Scooter_bh0-3.0.3"; sid:1002132; ) alert tcp any any -> any any (msg:"Supheli Arac :SlimBrowser"; content:"SlimBrowser"; sid:1002133; ) alert tcp any any -> any any (msg:"Supheli Arac :ZyBorg/1.0 (ZyBorg@WISEnut.com; http://www.WISEnut.com)"; content:"ZyBorg/1.0 (ZyBorg@WISEnut.com; http://www.WISEnut.com)"; sid:1002134; ) alert tcp any any -> any any (msg:"Supheli Arac :yoono/1.0 web-crawler/1.0"; content:"yoono/1.0 web-crawler/1.0"; sid:1002135; ) alert tcp any any -> any any (msg:"Supheli Arac :KSbot/1.0 (KnowledgeStorm crawler; http://www.knowledgestorm.com/resources/content/crawler/index.html; crawleradmin@knowledgestorm.com)"; content:"KSbot/1.0 (KnowledgeStorm crawler; http://www.knowledgestorm.com/resources/content/crawler/index.html; crawleradmin@knowledgestorm.com)"; sid:1002136; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Vagabondo/1.1 MT; webcrawler@NOSPAMwise-guys.nl; http://webagent.wise-guys.nl/)"; content:"Mozilla/3.0 (Vagabondo/1.1 MT; webcrawler@NOSPAMwise-guys.nl; http://webagent.wise-guys.nl/)"; sid:1002137; ) alert tcp any any -> any any (msg:"Supheli Arac :smartwit.com"; content:"smartwit.com"; sid:1002138; ) alert tcp any any -> any any (msg:"Supheli Arac :ICC-Crawler(Mozilla-compatible; http://kc.nict.go.jp/icc/crawl.html; icc-crawl(at)ml(dot)nict(dot)go(dot)jp)"; content:"ICC-Crawler(Mozilla-compatible; http://kc.nict.go.jp/icc/crawl.html; icc-crawl(at)ml(dot)nict(dot)go(dot)jp)"; sid:1002139; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.72C-CCK-MCD Caldera Systems OpenLinux [en] (X11; U; Linux 2.2.14 i686)"; content:"Mozilla/4.72C-CCK-MCD Caldera Systems OpenLinux [en] (X11; U; Linux 2.2.14 i686)"; sid:1002140; ) alert tcp any any -> any any (msg:"Supheli Arac :Googlebot/2.1 ( http://www.googlebot.com/bot.html)"; content:"Googlebot/2.1 ( http://www.googlebot.com/bot.html)"; sid:1002141; ) alert tcp any any -> any any (msg:"Supheli Arac :JetBrains Omea Reader 1.0.x (http://www.jetbrains.com/omea_reader/)"; content:"JetBrains Omea Reader 1.0.x (http://www.jetbrains.com/omea_reader/)"; sid:1002142; ) alert tcp any any -> any any (msg:"Supheli Arac :SoftBank/1.0/812SH/SHJ001 Browser/NetFront/3.3 Profile/MIDP-2.0 Configuration/CLDC-1.1"; content:"SoftBank/1.0/812SH/SHJ001 Browser/NetFront/3.3 Profile/MIDP-2.0 Configuration/CLDC-1.1"; sid:1002143; ) alert tcp any any -> any any (msg:"Supheli Arac :Kapere (http://www.kapere.com)"; content:"Kapere (http://www.kapere.com)"; sid:1002144; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0_(compatible;_MSIE_5.0;_Windows_95)_TrueRobot/1.4 libwww/5.2.8"; content:"Mozilla/4.0_(compatible;_MSIE_5.0;_Windows_95)_TrueRobot/1.4 libwww/5.2.8"; sid:1002145; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.7.0 +http://www.greaterera.com/)"; content:"Mozilla/5.0 (compatible; heritrix/1.7.0 +http://www.greaterera.com/)"; sid:1002146; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Y!J; for robot study; keyoshid)"; content:"Mozilla/4.0 (compatible; Y!J; for robot study; keyoshid)"; sid:1002147; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler 6 used by Sensis.com.au Web Crawler (search_comments\at\sensis\dot\com\dot\au)"; content:"FAST Enterprise Crawler 6 used by Sensis.com.au Web Crawler (search_comments\at\sensis\dot\com\dot\au)"; sid:1002148; ) alert tcp any any -> any any (msg:"Supheli Arac :envolk/1.7 (+http://www.envolk.com/envolkspiderinfo.php)"; content:"envolk/1.7 (+http://www.envolk.com/envolkspiderinfo.php)"; sid:1002149; ) alert tcp any any -> any any (msg:"Supheli Arac :WebImages 0.3 ( http://herbert.groot.jebbink.nl/?app=WebImages )"; content:"WebImages 0.3 ( http://herbert.groot.jebbink.nl/?app=WebImages )"; sid:1002150; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler 6 used by Singapore Press Holdings (crawler@sphsearch.sg)"; content:"FAST Enterprise Crawler 6 used by Singapore Press Holdings (crawler@sphsearch.sg)"; sid:1002151; ) alert tcp any any -> any any (msg:"Supheli Arac :BlogVibeBot-v1.1 (spider@blogvibe.nl)"; content:"BlogVibeBot-v1.1 (spider@blogvibe.nl)"; sid:1002152; ) alert tcp any any -> any any (msg:"Supheli Arac :htdig/3.1.6 (http://computerorgs.com)"; content:"htdig/3.1.6 (http://computerorgs.com)"; sid:1002153; ) alert tcp any any -> any any (msg:"Supheli Arac :Java1.3.0rc1"; content:"Java1.3.0rc1"; sid:1002154; ) alert tcp any any -> any any (msg:"Supheli Arac :Program Shareware 1.0.2"; content:"Program Shareware 1.0.2"; sid:1002155; ) alert tcp any any -> any any (msg:"Supheli Arac :Bitacle bot/1.1"; content:"Bitacle bot/1.1"; sid:1002156; ) alert tcp any any -> any any (msg:"Supheli Arac :GrigorBot 0.8 (http://www.grigor.biz/bot.html)"; content:"GrigorBot 0.8 (http://www.grigor.biz/bot.html)"; sid:1002157; ) alert tcp any any -> any any (msg:"Supheli Arac :Barca/2.0.xxxx"; content:"Barca/2.0.xxxx"; sid:1002158; ) alert tcp any any -> any any (msg:"Supheli Arac :Syndirella/0.91pre"; content:"Syndirella/0.91pre"; sid:1002159; ) alert tcp any any -> any any (msg:"Supheli Arac :Popdexter/1.0"; content:"Popdexter/1.0"; sid:1002160; ) alert tcp any any -> any any (msg:"Supheli Arac :Twotrees Reactive Filter V2.0"; content:"Twotrees Reactive Filter V2.0"; sid:1002161; ) alert tcp any any -> any any (msg:"Supheli Arac :Iria/1.xxa"; content:"Iria/1.xxa"; sid:1002162; ) alert tcp any any -> any any (msg:"Supheli Arac :exooba crawler/exooba crawler (crawler for exooba.com; http://www.exooba.com/; info at exooba dot com)"; content:"exooba crawler/exooba crawler (crawler for exooba.com; http://www.exooba.com/; info at exooba dot com)"; sid:1002163; ) alert tcp any any -> any any (msg:"Supheli Arac :Yahoo-MMAudVid/1.0 (mms dash mmaudvidcrawler dash support at yahoo dash inc dot com)"; content:"Yahoo-MMAudVid/1.0 (mms dash mmaudvidcrawler dash support at yahoo dash inc dot com)"; sid:1002164; ) alert tcp any any -> any any (msg:"Supheli Arac :RoboPal (http://www.findpal.com/)"; content:"RoboPal (http://www.findpal.com/)"; sid:1002165; ) alert tcp any any -> any any (msg:"Supheli Arac :xirq/0.1-beta (xirq; http://www.xirq.com; xirq@xirq.com)"; content:"xirq/0.1-beta (xirq; http://www.xirq.com; xirq@xirq.com)"; sid:1002166; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST Enterprise Crawler 6 used by Cobra Development (admin@fastsearch.com)"; content:"FAST Enterprise Crawler 6 used by Cobra Development (admin@fastsearch.com)"; sid:1002167; ) alert tcp any any -> any any (msg:"Supheli Arac :iGetter/1.x (Macintosh;G;PPC)"; content:"iGetter/1.x (Macintosh;G;PPC)"; sid:1002168; ) alert tcp any any -> any any (msg:"Supheli Arac :Web-Bot V1.03"; content:"Web-Bot V1.03"; sid:1002169; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5"; content:"Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5"; sid:1002170; ) alert tcp any any -> any any (msg:"Supheli Arac :Big Fish v1.0"; content:"Big Fish v1.0"; sid:1002171; ) alert tcp any any -> any any (msg:"Supheli Arac :Feedable/0.1 (compatible; MSIE 6.0; Windows NT 5.1)"; content:"Feedable/0.1 (compatible; MSIE 6.0; Windows NT 5.1)"; sid:1002172; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/1.1 (compatible; MSPIE 2.0; Windows CE)"; content:"Mozilla/1.1 (compatible; MSPIE 2.0; Windows CE)"; sid:1002173; ) alert tcp any any -> any any (msg:"Supheli Arac :favo.eu crawler/0.6 (http://www.favo.eu)"; content:"favo.eu crawler/0.6 (http://www.favo.eu)"; sid:1002174; ) alert tcp any any -> any any (msg:"Supheli Arac :Microsoft URL Control - 6.00.8xxx"; content:"Microsoft URL Control - 6.00.8xxx"; sid:1002175; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; grub-client-0.3.x; Crawl your own stuff with http://grub.org)"; content:"Mozilla/4.0 (compatible; grub-client-0.3.x; Crawl your own stuff with http://grub.org)"; sid:1002176; ) alert tcp any any -> any any (msg:"Supheli Arac :Zeusbot/0.07 (Ulysseek's web-crawling robot; http://www.zeusbot.com; agent@zeusbot.com)"; content:"Zeusbot/0.07 (Ulysseek's web-crawling robot; http://www.zeusbot.com; agent@zeusbot.com)"; sid:1002177; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.76 [en] (X11; U; FreeBSD 4.4-STABLE i386)"; content:"Mozilla/4.76 [en] (X11; U; FreeBSD 4.4-STABLE i386)"; sid:1002178; ) alert tcp any any -> any any (msg:"Supheli Arac :WebTrafficExpress/x.0"; content:"WebTrafficExpress/x.0"; sid:1002179; ) alert tcp any any -> any any (msg:"Supheli Arac :ASAHA Search Engine Turkey V.001 (http://www.asaha.com/)"; content:"ASAHA Search Engine Turkey V.001 (http://www.asaha.com/)"; sid:1002180; ) alert tcp any any -> any any (msg:"Supheli Arac :ExtractorPro"; content:"ExtractorPro"; sid:1002181; ) alert tcp any any -> any any (msg:"Supheli Arac :IconSurf/2.0 favicon finder (see http://iconsurf.com/robot.html)"; content:"IconSurf/2.0 favicon finder (see http://iconsurf.com/robot.html)"; sid:1002182; ) alert tcp any any -> any any (msg:"Supheli Arac :FeedChecker/0.01"; content:"FeedChecker/0.01"; sid:1002183; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; archive.org_bot/1.10.0 +http://www.loc.gov/minerva/crawl.html)"; content:"Mozilla/5.0 (compatible; archive.org_bot/1.10.0 +http://www.loc.gov/minerva/crawl.html)"; sid:1002184; ) alert tcp any any -> any any (msg:"Supheli Arac :Baiduspider+(+http://www.baidu.com/search/spider.htm)"; content:"Baiduspider+(+http://www.baidu.com/search/spider.htm)"; sid:1002185; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.04 (compatible;QNX Voyager 2.03B ;Photon)"; content:"Mozilla/3.04 (compatible;QNX Voyager 2.03B ;Photon)"; sid:1002186; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Vagabondo/2.0 MT; webcrawler@NOSPAMexperimental.net; http://aanmelden.ilse.nl/?aanmeld_mode=webhints)"; content:"Mozilla/3.0 (Vagabondo/2.0 MT; webcrawler@NOSPAMexperimental.net; http://aanmelden.ilse.nl/?aanmeld_mode=webhints)"; sid:1002187; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; HP Web PrintSmart 04b0 1.0.1.34)"; content:"Mozilla/3.0 (compatible; HP Web PrintSmart 04b0 1.0.1.34)"; sid:1002188; ) alert tcp any any -> any any (msg:"Supheli Arac :ConveraCrawler/0.2"; content:"ConveraCrawler/0.2"; sid:1002189; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 wgao@genieknows.com"; content:"Mozilla/5.0 wgao@genieknows.com"; sid:1002190; ) alert tcp any any -> any any (msg:"Supheli Arac :Internet Ninja x.0"; content:"Internet Ninja x.0"; sid:1002191; ) alert tcp any any -> any any (msg:"Supheli Arac :Slurpy Verifier/1.0"; content:"Slurpy Verifier/1.0"; sid:1002192; ) alert tcp any any -> any any (msg:"Supheli Arac :MiracleAlphaTest"; content:"MiracleAlphaTest"; sid:1002193; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; SAFEXPLORER TL)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; SAFEXPLORER TL)"; sid:1002194; ) alert tcp any any -> any any (msg:"Supheli Arac :Ultraseek"; content:"Ultraseek"; sid:1002195; ) alert tcp any any -> any any (msg:"Supheli Arac :CazoodleBot/CazoodleBot-0.1 (CazoodleBot Crawler; http://www.cazoodle.com/cazoodlebot; cazoodlebot@cazoodle.com)"; content:"CazoodleBot/CazoodleBot-0.1 (CazoodleBot Crawler; http://www.cazoodle.com/cazoodlebot; cazoodlebot@cazoodle.com)"; sid:1002196; ) alert tcp any any -> any any (msg:"Supheli Arac :Plagger/0.x.xx (http://plagger.org/)"; content:"Plagger/0.x.xx (http://plagger.org/)"; sid:1002197; ) alert tcp any any -> any any (msg:"Supheli Arac :Demo Bot Z 16b"; content:"Demo Bot Z 16b"; sid:1002198; ) alert tcp any any -> any any (msg:"Supheli Arac :Amiga-AWeb/3.4.167SE"; content:"Amiga-AWeb/3.4.167SE"; sid:1002199; ) alert tcp any any -> any any (msg:"Supheli Arac :DoCoMo/2.0 P900iV(c100;TB;W24H11)"; content:"DoCoMo/2.0 P900iV(c100;TB;W24H11)"; sid:1002200; ) alert tcp any any -> any any (msg:"Supheli Arac :GurujiImageBot/1.0 (+http://www.guruji.com/en/WebmasterFAQ.html)"; content:"GurujiImageBot/1.0 (+http://www.guruji.com/en/WebmasterFAQ.html)"; sid:1002201; ) alert tcp any any -> any any (msg:"Supheli Arac :DataFountains/Dmoz Downloader (http://ivia.ucr.edu/useragents.shtml)"; content:"DataFountains/Dmoz Downloader (http://ivia.ucr.edu/useragents.shtml)"; sid:1002202; ) alert tcp any any -> any any (msg:"Supheli Arac :Wget/1.x.x+cvs"; content:"Wget/1.x.x+cvs"; sid:1002203; ) alert tcp any any -> any any (msg:"Supheli Arac :gsa-crawler (Enterprise; GIX-0xxxx; enterprise-training@google.com)"; content:"gsa-crawler (Enterprise; GIX-0xxxx; enterprise-training@google.com)"; sid:1002204; ) alert tcp any any -> any any (msg:"Supheli Arac :kinja-imagebot (http://www.kinja.com/)"; content:"kinja-imagebot (http://www.kinja.com/)"; sid:1002205; ) alert tcp any any -> any any (msg:"Supheli Arac :MQbot metaquerier.cs.uiuc.edu/crawler"; content:"MQbot metaquerier.cs.uiuc.edu/crawler"; sid:1002206; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; www.galaxy.com)"; content:"Mozilla/4.0 (compatible; www.galaxy.com)"; sid:1002207; ) alert tcp any any -> any any (msg:"Supheli Arac :Port Huron Labs"; content:"Port Huron Labs"; sid:1002208; ) alert tcp any any -> any any (msg:"Supheli Arac :Poirot"; content:"Poirot"; sid:1002209; ) alert tcp any any -> any any (msg:"Supheli Arac :MegaSheep v1.0 (www.searchuk.com internet sheep)"; content:"MegaSheep v1.0 (www.searchuk.com internet sheep)"; sid:1002210; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; BecomeBot/2.0beta; http://www.become.com/webmasters.html)"; content:"Mozilla/5.0 (compatible; BecomeBot/2.0beta; http://www.become.com/webmasters.html)"; sid:1002211; ) alert tcp any any -> any any (msg:"Supheli Arac :LinkProver 2.1"; content:"LinkProver 2.1"; sid:1002212; ) alert tcp any any -> any any (msg:"Supheli Arac :QuepasaCreep ( crawler@quepasacorp.com )"; content:"QuepasaCreep ( crawler@quepasacorp.com )"; sid:1002213; ) alert tcp any any -> any any (msg:"Supheli Arac :FTB-Bot http://www.findthebest.co.uk/"; content:"FTB-Bot http://www.findthebest.co.uk/"; sid:1002214; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; NetCaptor 6.5.0RC1)"; content:"Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; NetCaptor 6.5.0RC1)"; sid:1002215; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Synoobot/0.9; http://www.synoo.com/search/bot.html)"; content:"Mozilla/5.0 (compatible; Synoobot/0.9; http://www.synoo.com/search/bot.html)"; sid:1002216; ) alert tcp any any -> any any (msg:"Supheli Arac :ActiveBookmark 1.x"; content:"ActiveBookmark 1.x"; sid:1002217; ) alert tcp any any -> any any (msg:"Supheli Arac :SWSBot-Images/1.2 http://www.smartwaresoft.com/swsbot12.html"; content:"SWSBot-Images/1.2 http://www.smartwaresoft.com/swsbot12.html"; sid:1002218; ) alert tcp any any -> any any (msg:"Supheli Arac :Allesklar/0.1 libwww-perl/5.46"; content:"Allesklar/0.1 libwww-perl/5.46"; sid:1002219; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; Windows NT; MS Search 4.0 Robot) Microsoft"; content:"Mozilla/4.0 (compatible; MSIE 4.01; Windows NT; MS Search 4.0 Robot) Microsoft"; sid:1002220; ) alert tcp any any -> any any (msg:"Supheli Arac :Webverzeichnis.de - Telefon: 01908 / 26005"; content:"Webverzeichnis.de - Telefon: 01908 / 26005"; sid:1002221; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; DNS-Digger-Explorer/1.0; +http://www.dnsdigger.com)"; content:"Mozilla/5.0 (compatible; DNS-Digger-Explorer/1.0; +http://www.dnsdigger.com)"; sid:1002222; ) alert tcp any any -> any any (msg:"Supheli Arac :traazibot/testengine (+http://www.traazi.de)"; content:"traazibot/testengine (+http://www.traazi.de)"; sid:1002223; ) alert tcp any any -> any any (msg:"Supheli Arac :RssReader/1.0.xx.x (http://www.rssreader.com) Microsoft Windows NT 5.1.2600.0"; content:"RssReader/1.0.xx.x (http://www.rssreader.com) Microsoft Windows NT 5.1.2600.0"; sid:1002224; ) alert tcp any any -> any any (msg:"Supheli Arac :FirstGov.gov Search - POC:firstgov.webmasters@gsa.gov"; content:"FirstGov.gov Search - POC:firstgov.webmasters@gsa.gov"; sid:1002225; ) alert tcp any any -> any any (msg:"Supheli Arac :Ad Muncher v4.xx.x"; content:"Ad Muncher v4.xx.x"; sid:1002226; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; MuscatFerret/1.5.4; claude@euroferret.com)"; content:"Mozilla/3.0 (compatible; MuscatFerret/1.5.4; claude@euroferret.com)"; sid:1002227; ) alert tcp any any -> any any (msg:"Supheli Arac :i1searchbot/2.0 (i1search web crawler; http://www.i1search.com; crawler@i1search.com)"; content:"i1searchbot/2.0 (i1search web crawler; http://www.i1search.com; crawler@i1search.com)"; sid:1002228; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.4/Megaupload x.0"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.4/Megaupload x.0"; sid:1002229; ) alert tcp any any -> any any (msg:"Supheli Arac :SyncBot"; content:"SyncBot"; sid:1002230; ) alert tcp any any -> any any (msg:"Supheli Arac :SynoBot"; content:"SynoBot"; sid:1002231; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; N_o_k_i_a)"; content:"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; N_o_k_i_a)"; sid:1002232; ) alert tcp any any -> any any (msg:"Supheli Arac :Helix/1.x ( http://www.sitesearch.ca/helix/)"; content:"Helix/1.x ( http://www.sitesearch.ca/helix/)"; sid:1002233; ) alert tcp any any -> any any (msg:"Supheli Arac :BeebwareDirectory/v0.01"; content:"BeebwareDirectory/v0.01"; sid:1002234; ) alert tcp any any -> any any (msg:"Supheli Arac :Jambot/0.2.1 (Jambot; http://www.jambot.com/blog/static.php?page=webmaster-robot; crawler@jambot.com)"; content:"Jambot/0.2.1 (Jambot; http://www.jambot.com/blog/static.php?page=webmaster-robot; crawler@jambot.com)"; sid:1002235; ) alert tcp any any -> any any (msg:"Supheli Arac :AnswerBus (http://www.answerbus.com/)"; content:"AnswerBus (http://www.answerbus.com/)"; sid:1002236; ) alert tcp any any -> any any (msg:"Supheli Arac :MetaGer-LinkChecker"; content:"MetaGer-LinkChecker"; sid:1002237; ) alert tcp any any -> any any (msg:"Supheli Arac :MSProxy/2.0"; content:"MSProxy/2.0"; sid:1002238; ) alert tcp any any -> any any (msg:"Supheli Arac :bdcindexer_2.6.2 (research@bdc)"; content:"bdcindexer_2.6.2 (research@bdc)"; sid:1002239; ) alert tcp any any -> any any (msg:"Supheli Arac :geckobot"; content:"geckobot"; sid:1002240; ) alert tcp any any -> any any (msg:"Supheli Arac :Cuam Ver0.050bx"; content:"Cuam Ver0.050bx"; sid:1002241; ) alert tcp any any -> any any (msg:"Supheli Arac :W3C_Validator/1.xxx libwww-perl/5.xx"; content:"W3C_Validator/1.xxx libwww-perl/5.xx"; sid:1002242; ) alert tcp any any -> any any (msg:"Supheli Arac :Journster.com RSS/Atom aggregator 0.5 (http://www.journster.com/bot.phtml)"; content:"Journster.com RSS/Atom aggregator 0.5 (http://www.journster.com/bot.phtml)"; sid:1002243; ) alert tcp any any -> any any (msg:"Supheli Arac :Vagabondo/2.0 MT (webagent@NOSPAMwise-guys.nl)"; content:"Vagabondo/2.0 MT (webagent@NOSPAMwise-guys.nl)"; sid:1002244; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; LemSpider 0.1)"; content:"Mozilla/5.0 (compatible; LemSpider 0.1)"; sid:1002245; ) alert tcp any any -> any any (msg:"Supheli Arac :Vagabondo/1.x MT (webagent@wise-guys.nl)"; content:"Vagabondo/1.x MT (webagent@wise-guys.nl)"; sid:1002246; ) alert tcp any any -> any any (msg:"Supheli Arac :blogsearchbot-pumpkin-3"; content:"blogsearchbot-pumpkin-3"; sid:1002247; ) alert tcp any any -> any any (msg:"Supheli Arac :Mo College 1.9"; content:"Mo College 1.9"; sid:1002248; ) alert tcp any any -> any any (msg:"Supheli Arac :NetSprint -- 2.0"; content:"NetSprint -- 2.0"; sid:1002249; ) alert tcp any any -> any any (msg:"Supheli Arac :PortalBSpider/2.0 (spider@portalb.com)"; content:"PortalBSpider/2.0 (spider@portalb.com)"; sid:1002250; ) alert tcp any any -> any any (msg:"Supheli Arac :Onet.pl SA- http://szukaj.onet.pl"; content:"Onet.pl SA- http://szukaj.onet.pl"; sid:1002251; ) alert tcp any any -> any any (msg:"Supheli Arac :fileboost.net/1.0 (+http://www.fileboost.net)"; content:"fileboost.net/1.0 (+http://www.fileboost.net)"; sid:1002252; ) alert tcp any any -> any any (msg:"Supheli Arac :Flapbot/0.7.2 (Flaptor Crawler; http://www.flaptor.com; crawler at flaptor period com)"; content:"Flapbot/0.7.2 (Flaptor Crawler; http://www.flaptor.com; crawler at flaptor period com)"; sid:1002253; ) alert tcp any any -> any any (msg:"Supheli Arac :MagicWML/1.0 (forcewml)"; content:"MagicWML/1.0 (forcewml)"; sid:1002254; ) alert tcp any any -> any any (msg:"Supheli Arac :Nutch crawler/Nutch-0.9 (picapage.com; admin@picapage.com)"; content:"Nutch crawler/Nutch-0.9 (picapage.com; admin@picapage.com)"; sid:1002255; ) alert tcp any any -> any any (msg:"Supheli Arac :CipinetBot (http://www.cipinet.com/bot.html)"; content:"CipinetBot (http://www.cipinet.com/bot.html)"; sid:1002256; ) alert tcp any any -> any any (msg:"Supheli Arac :Aplix HTTP/1.0.1"; content:"Aplix HTTP/1.0.1"; sid:1002257; ) alert tcp any any -> any any (msg:"Supheli Arac :SBL-BOT (http://sbl.net)"; content:"SBL-BOT (http://sbl.net)"; sid:1002258; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera/9.0 (Windows NT 5.1; U; en)"; content:"Opera/9.0 (Windows NT 5.1; U; en)"; sid:1002259; ) alert tcp any any -> any any (msg:"Supheli Arac :asked/Nutch-0.8 (web crawler; http://asked.jp; epicurus at gmail dot com)"; content:"asked/Nutch-0.8 (web crawler; http://asked.jp; epicurus at gmail dot com)"; sid:1002260; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 7.0; Win32) Link Commander 4.0"; content:"Mozilla/4.0 (compatible; MSIE 7.0; Win32) Link Commander 4.0"; sid:1002261; ) alert tcp any any -> any any (msg:"Supheli Arac :AmiTCP Miami (AmigaOS 2.04)"; content:"AmiTCP Miami (AmigaOS 2.04)"; sid:1002262; ) alert tcp any any -> any any (msg:"Supheli Arac :BookmarkBase(2/;http://bookmarkbase.com)"; content:"BookmarkBase(2/;http://bookmarkbase.com)"; sid:1002263; ) alert tcp any any -> any any (msg:"Supheli Arac :Exabot-Test/1.0"; content:"Exabot-Test/1.0"; sid:1002264; ) alert tcp any any -> any any (msg:"Supheli Arac :W3C-checklink/4.x [4.xx] libwww-perl/5.xxx"; content:"W3C-checklink/4.x [4.xx] libwww-perl/5.xxx"; sid:1002265; ) alert tcp any any -> any any (msg:"Supheli Arac :search.ch V1.4"; content:"search.ch V1.4"; sid:1002266; ) alert tcp any any -> any any (msg:"Supheli Arac :ExperimentalHenrytheMiragoRobot"; content:"ExperimentalHenrytheMiragoRobot"; sid:1002267; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST FirstPage retriever (compatible; MSIE 5.5; Mozilla/4.0)"; content:"FAST FirstPage retriever (compatible; MSIE 5.5; Mozilla/4.0)"; sid:1002268; ) alert tcp any any -> any any (msg:"Supheli Arac :http://www.timelyweb.com/"; content:"http://www.timelyweb.com/"; sid:1002269; ) alert tcp any any -> any any (msg:"Supheli Arac :UP.Browser/3.01-IG01 UP.Link/3.2.3.4"; content:"UP.Browser/3.01-IG01 UP.Link/3.2.3.4"; sid:1002270; ) alert tcp any any -> any any (msg:"Supheli Arac :INFOMINE/8.0 VLCrawler (http://infomine.ucr.edu/useragents)"; content:"INFOMINE/8.0 VLCrawler (http://infomine.ucr.edu/useragents)"; sid:1002271; ) alert tcp any any -> any any (msg:"Supheli Arac :Crawler V 0.2.x admin@crawler.de"; content:"Crawler V 0.2.x admin@crawler.de"; sid:1002272; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; heritrix/1.12.1 +http://www.page-store.com) [email:paul@page-store.com]"; content:"Mozilla/5.0 (compatible; heritrix/1.12.1 +http://www.page-store.com) [email:paul@page-store.com]"; sid:1002273; ) alert tcp any any -> any any (msg:"Supheli Arac :SiteTaggerBot (http://www.sitetagger.com/bot.htm)"; content:"SiteTaggerBot (http://www.sitetagger.com/bot.htm)"; sid:1002274; ) alert tcp any any -> any any (msg:"Supheli Arac :FDM 1.x"; content:"FDM 1.x"; sid:1002275; ) alert tcp any any -> any any (msg:"Supheli Arac :FDM 2.x"; content:"FDM 2.x"; sid:1002276; ) alert tcp any any -> any any (msg:"Supheli Arac :IIITBOT/1.1 (Indian Language Web Search Engine; http://webkhoj.iiit.net; pvvpr at iiit dot ac dot in)"; content:"IIITBOT/1.1 (Indian Language Web Search Engine; http://webkhoj.iiit.net; pvvpr at iiit dot ac dot in)"; sid:1002277; ) alert tcp any any -> any any (msg:"Supheli Arac :Scooter/3.3.vscooter"; content:"Scooter/3.3.vscooter"; sid:1002278; ) alert tcp any any -> any any (msg:"Supheli Arac :FAST-WebCrawler/3.7/FirstPage (atw-crawler at fast dot no;http://fast.no/support/crawler.asp)"; content:"FAST-WebCrawler/3.7/FirstPage (atw-crawler at fast dot no;http://fast.no/support/crawler.asp)"; sid:1002279; ) alert tcp any any -> any any (msg:"Supheli Arac :Tagword (http://tagword.com/dmoz_survey.php)"; content:"Tagword (http://tagword.com/dmoz_survey.php)"; sid:1002280; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6_basileocaml (basile.starynkevitch@cea.fr)"; content:"larbin_2.6_basileocaml (basile.starynkevitch@cea.fr)"; sid:1002281; ) alert tcp any any -> any any (msg:"Supheli Arac :silk/1.0 (+http://www.slider.com/silk.htm)/3.7"; content:"silk/1.0 (+http://www.slider.com/silk.htm)/3.7"; sid:1002282; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.2.2_guillaume (guillaume@liafa.jussieu.fr)"; content:"larbin_2.2.2_guillaume (guillaume@liafa.jussieu.fr)"; sid:1002283; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Orange 8.0; GTB6.3; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; Embedded Web Browser from: http://bsalsa.com/; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618; OfficeLiveConnector.1.3; OfficeLivePatch.1.3)"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Orange 8.0; GTB6.3; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; Embedded Web Browser from: http://bsalsa.com/; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618; OfficeLiveConnector.1.3; OfficeLivePatch.1.3)"; sid:1002284; ) alert tcp any any -> any any (msg:"Supheli Arac :Skimpy/0.x (http://www.skaffe.com/skampy-info.html)"; content:"Skimpy/0.x (http://www.skaffe.com/skampy-info.html)"; sid:1002285; ) alert tcp any any -> any any (msg:"Supheli Arac :silk/1.0"; content:"silk/1.0"; sid:1002286; ) alert tcp any any -> any any (msg:"Supheli Arac :Java/1.4.1_01"; content:"Java/1.4.1_01"; sid:1002287; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Compatible;Viking/1.8)"; content:"Mozilla/3.0 (Compatible;Viking/1.8)"; sid:1002288; ) alert tcp any any -> any any (msg:"Supheli Arac :Norbert the Spider(Burf.com)"; content:"Norbert the Spider(Burf.com)"; sid:1002289; ) alert tcp any any -> any any (msg:"Supheli Arac :ExactSeek Crawler/0.1"; content:"ExactSeek Crawler/0.1"; sid:1002290; ) alert tcp any any -> any any (msg:"Supheli Arac :Kazehakase/0.x.x.[x]"; content:"Kazehakase/0.x.x.[x]"; sid:1002291; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (research@mediatrec.com)"; content:"Mozilla/5.0 (research@mediatrec.com)"; sid:1002292; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPS; 240x320)"; content:"Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPS; 240x320)"; sid:1002293; ) alert tcp any any -> any any (msg:"Supheli Arac :BurstFindCrawler/1.1 (crawler.burstfind.com; http://crawler.burstfind.com; crawler@burstfind.com)"; content:"BurstFindCrawler/1.1 (crawler.burstfind.com; http://crawler.burstfind.com; crawler@burstfind.com)"; sid:1002294; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (wgao@genieknows.com)"; content:"Mozilla/5.0 (wgao@genieknows.com)"; sid:1002295; ) alert tcp any any -> any any (msg:"Supheli Arac :Zeus xxxxx Webster Pro V2.9 Win32"; content:"Zeus xxxxx Webster Pro V2.9 Win32"; sid:1002296; ) alert tcp any any -> any any (msg:"Supheli Arac :NutchCVS/0.06-dev (Nutch; http://www.nutch.org/docs/en/bot.html; nutch-agent@lists.sourceforge.net)"; content:"NutchCVS/0.06-dev (Nutch; http://www.nutch.org/docs/en/bot.html; nutch-agent@lists.sourceforge.net)"; sid:1002297; ) alert tcp any any -> any any (msg:"Supheli Arac :http://www.monogol.de"; content:"http://www.monogol.de"; sid:1002298; ) alert tcp any any -> any any (msg:"Supheli Arac :PycURL"; content:"PycURL"; sid:1002299; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 compatible ZyBorg/1.0 for Homepage (ZyBorg@WISEnutbot.com; http://www.WISEnutbot.com)"; content:"Mozilla/4.0 compatible ZyBorg/1.0 for Homepage (ZyBorg@WISEnutbot.com; http://www.WISEnutbot.com)"; sid:1002300; ) alert tcp any any -> any any (msg:"Supheli Arac :miniRank/1.6 (Website ranking; www.minirank.com; robot)"; content:"miniRank/1.6 (Website ranking; www.minirank.com; robot)"; sid:1002301; ) alert tcp any any -> any any (msg:"Supheli Arac :ELinks/0.x.x (textmode; NetBSD 1.6.2 sparc; 132x43)"; content:"ELinks/0.x.x (textmode; NetBSD 1.6.2 sparc; 132x43)"; sid:1002302; ) alert tcp any any -> any any (msg:"Supheli Arac :Labrador/0.2; http://ir.dcs.gla.ac.uk/labrador; craigm@dcs.gla.ac.uk"; content:"Labrador/0.2; http://ir.dcs.gla.ac.uk/labrador; craigm@dcs.gla.ac.uk"; sid:1002303; ) alert tcp any any -> any any (msg:"Supheli Arac :DIIbot/1.2"; content:"DIIbot/1.2"; sid:1002304; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible: AstraSpider V.2.1 : astrafind.com)"; content:"Mozilla/4.0 (compatible: AstraSpider V.2.1 : astrafind.com)"; sid:1002305; ) alert tcp any any -> any any (msg:"Supheli Arac :tricosMetaCheck 1.2216-08-1999 (http://www.tricos.com/metacheck)"; content:"tricosMetaCheck 1.2216-08-1999 (http://www.tricos.com/metacheck)"; sid:1002306; ) alert tcp any any -> any any (msg:"Supheli Arac :NetResearchServer(http://www.look.com)"; content:"NetResearchServer(http://www.look.com)"; sid:1002307; ) alert tcp any any -> any any (msg:"Supheli Arac :REBOL View 1.x.x.x.x"; content:"REBOL View 1.x.x.x.x"; sid:1002308; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla (libwhisker/2.4)"; content:"Mozilla (libwhisker/2.4)"; sid:1002309; ) alert tcp any any -> any any (msg:"Supheli Arac :obidos-bot (just looking for books.)"; content:"obidos-bot (just looking for books.)"; sid:1002310; ) alert tcp any any -> any any (msg:"Supheli Arac :PluckFeedCrawler/2.0 (compatible; Mozilla 4.0; MSIE 5.5; http://www.pluck.com; 1 subscribers)"; content:"PluckFeedCrawler/2.0 (compatible; Mozilla 4.0; MSIE 5.5; http://www.pluck.com; 1 subscribers)"; sid:1002311; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (Liberate DTV 1.1)"; content:"Mozilla/3.0 (Liberate DTV 1.1)"; sid:1002312; ) alert tcp any any -> any any (msg:"Supheli Arac :Visicom Toolbar"; content:"Visicom Toolbar"; sid:1002313; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1; aggregator:Spinn3r (Spinn3r 3.1); http://spinn3r.com/robot) Gecko/20021130"; content:"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1; aggregator:Spinn3r (Spinn3r 3.1); http://spinn3r.com/robot) Gecko/20021130"; sid:1002314; ) alert tcp any any -> any any (msg:"Supheli Arac :WeBoX/0.xx"; content:"WeBoX/0.xx"; sid:1002315; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; Opera/3.0; Windows 4.10) 3.51 [en]"; content:"Mozilla/4.0 (compatible; Opera/3.0; Windows 4.10) 3.51 [en]"; sid:1002316; ) alert tcp any any -> any any (msg:"Supheli Arac :Yeti/1.0 (NHN Corp.; http://help.naver.com/robots/)"; content:"Yeti/1.0 (NHN Corp.; http://help.naver.com/robots/)"; sid:1002317; ) alert tcp any any -> any any (msg:"Supheli Arac :kuloko-bot/0.x"; content:"kuloko-bot/0.x"; sid:1002318; ) alert tcp any any -> any any (msg:"Supheli Arac :swbot/0.9c libwww/5.3.1"; content:"swbot/0.9c libwww/5.3.1"; sid:1002319; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; AOL 4.0; Windows 98)"; content:"Mozilla/4.0 (compatible; MSIE 4.01; AOL 4.0; Windows 98)"; sid:1002320; ) alert tcp any any -> any any (msg:"Supheli Arac :newsearchengine (ThisUser@unspecified.mail)"; content:"newsearchengine (ThisUser@unspecified.mail)"; sid:1002321; ) alert tcp any any -> any any (msg:"Supheli Arac :WebRACE/1.1 (University of Cyprus- Distributed Crawler)"; content:"WebRACE/1.1 (University of Cyprus- Distributed Crawler)"; sid:1002322; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Jim +http://www.hanzoarchives.com)"; content:"Mozilla/5.0 (compatible; Jim +http://www.hanzoarchives.com)"; sid:1002323; ) alert tcp any any -> any any (msg:"Supheli Arac :Snarfer/0.x.x (http://www.snarfware.com/)"; content:"Snarfer/0.x.x (http://www.snarfware.com/)"; sid:1002324; ) alert tcp any any -> any any (msg:"Supheli Arac :Snoopy v1.xx"; content:"Snoopy v1.xx"; sid:1002325; ) alert tcp any any -> any any (msg:"Supheli Arac :DeleGate/9.0.5-fix1"; content:"DeleGate/9.0.5-fix1"; sid:1002326; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit/xx (KHTML like Gecko) OmniWeb/v5xx.xx"; content:"Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit/xx (KHTML like Gecko) OmniWeb/v5xx.xx"; sid:1002327; ) alert tcp any any -> any any (msg:"Supheli Arac :IBrowse/2.2 (Windows 3.1)"; content:"IBrowse/2.2 (Windows 3.1)"; sid:1002328; ) alert tcp any any -> any any (msg:"Supheli Arac :Wget/1.x+cvs-stable (Red Hat modified)"; content:"Wget/1.x+cvs-stable (Red Hat modified)"; sid:1002329; ) alert tcp any any -> any any (msg:"Supheli Arac :Links (0.9x; Linux 2.4.7-10 i686)"; content:"Links (0.9x; Linux 2.4.7-10 i686)"; sid:1002330; ) alert tcp any any -> any any (msg:"Supheli Arac :archive.org_bot"; content:"archive.org_bot"; sid:1002331; ) alert tcp any any -> any any (msg:"Supheli Arac :Python-urllib/2.0a1"; content:"Python-urllib/2.0a1"; sid:1002332; ) alert tcp any any -> any any (msg:"Supheli Arac :IrssiUrlLog/0.2"; content:"IrssiUrlLog/0.2"; sid:1002333; ) alert tcp any any -> any any (msg:"Supheli Arac :Superdownloads Spiderman"; content:"Superdownloads Spiderman"; sid:1002334; ) alert tcp any any -> any any (msg:"Supheli Arac :eCatch/3.0"; content:"eCatch/3.0"; sid:1002335; ) alert tcp any any -> any any (msg:"Supheli Arac :EBrowse 1.4b"; content:"EBrowse 1.4b"; sid:1002336; ) alert tcp any any -> any any (msg:"Supheli Arac :YTunnelPro"; content:"YTunnelPro"; sid:1002337; ) alert tcp any any -> any any (msg:"Supheli Arac :Blaiz-Bee/1.0 (+http://www.blaiz.net)"; content:"Blaiz-Bee/1.0 (+http://www.blaiz.net)"; sid:1002338; ) alert tcp any any -> any any (msg:"Supheli Arac :WorQmada/1.0"; content:"WorQmada/1.0"; sid:1002339; ) alert tcp any any -> any any (msg:"Supheli Arac :Moreoverbot/x.00 (+http://www.moreover.com)"; content:"Moreoverbot/x.00 (+http://www.moreover.com)"; sid:1002340; ) alert tcp any any -> any any (msg:"Supheli Arac :Progressive Download"; content:"Progressive Download"; sid:1002341; ) alert tcp any any -> any any (msg:"Supheli Arac :gamekitbot/1.0 (+http://www.uchoose.de/crawler/gamekitbot/)"; content:"gamekitbot/1.0 (+http://www.uchoose.de/crawler/gamekitbot/)"; sid:1002342; ) alert tcp any any -> any any (msg:"Supheli Arac :Mindjet MindManager"; content:"Mindjet MindManager"; sid:1002343; ) alert tcp any any -> any any (msg:"Supheli Arac :RedCarpet/1.2 (http://www.redcarpet-inc.com/robots.html)"; content:"RedCarpet/1.2 (http://www.redcarpet-inc.com/robots.html)"; sid:1002344; ) alert tcp any any -> any any (msg:"Supheli Arac :Java1.3.x"; content:"Java1.3.x"; sid:1002345; ) alert tcp any any -> any any (msg:"Supheli Arac :Java1.4.0"; content:"Java1.4.0"; sid:1002346; ) alert tcp any any -> any any (msg:"Supheli Arac :Inktomi Search"; content:"Inktomi Search"; sid:1002347; ) alert tcp any any -> any any (msg:"Supheli Arac :Fooky.com/ScorpionBot/ScoutOut; http://www.fooky.com/scorpionbots"; content:"Fooky.com/ScorpionBot/ScoutOut; http://www.fooky.com/scorpionbots"; sid:1002348; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Slurp/si; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; content:"Mozilla/5.0 (Slurp/si; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; sid:1002349; ) alert tcp any any -> any any (msg:"Supheli Arac :JBH Agent 2.0"; content:"JBH Agent 2.0"; sid:1002350; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Google Wireless Transcoder;)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Google Wireless Transcoder;)"; sid:1002351; ) alert tcp any any -> any any (msg:"Supheli Arac :Favcollector/2.0 (info@favcollector.com http://www.favcollector.com/)"; content:"Favcollector/2.0 (info@favcollector.com http://www.favcollector.com/)"; sid:1002352; ) alert tcp any any -> any any (msg:"Supheli Arac :AltaVista V2.0B crawler@evreka.com"; content:"AltaVista V2.0B crawler@evreka.com"; sid:1002353; ) alert tcp any any -> any any (msg:"Supheli Arac :Cuasarbot/0.9b http://www.cuasar.com/spider_beta/"; content:"Cuasarbot/0.9b http://www.cuasar.com/spider_beta/"; sid:1002354; ) alert tcp any any -> any any (msg:"Supheli Arac :EyeCatcher (Download-tipp.de)/1.0"; content:"EyeCatcher (Download-tipp.de)/1.0"; sid:1002355; ) alert tcp any any -> any any (msg:"Supheli Arac :AnzwersCrawl/2.0 (anzwerscrawl@anzwers.com.au;Engine)"; content:"AnzwersCrawl/2.0 (anzwerscrawl@anzwers.com.au;Engine)"; sid:1002356; ) alert tcp any any -> any any (msg:"Supheli Arac :WWWC/1.0x"; content:"WWWC/1.0x"; sid:1002357; ) alert tcp any any -> any any (msg:"Supheli Arac :CloakDetect/0.9 (+http://fulltext.seznam.cz/)"; content:"CloakDetect/0.9 (+http://fulltext.seznam.cz/)"; sid:1002358; ) alert tcp any any -> any any (msg:"Supheli Arac :Netprospector JavaCrawler"; content:"Netprospector JavaCrawler"; sid:1002359; ) alert tcp any any -> any any (msg:"Supheli Arac :DittoSpyder"; content:"DittoSpyder"; sid:1002360; ) alert tcp any any -> any any (msg:"Supheli Arac :Web-Robot/5.0 (en-US; web-robot.com/policy.html) Web-Robot Crawler/2.0.3"; content:"Web-Robot/5.0 (en-US; web-robot.com/policy.html) Web-Robot Crawler/2.0.3"; sid:1002361; ) alert tcp any any -> any any (msg:"Supheli Arac :sohu-search"; content:"sohu-search"; sid:1002362; ) alert tcp any any -> any any (msg:"Supheli Arac :VLC media player - version 0.8.5 Janus - (c) 1996-2006 the VideoLAN team"; content:"VLC media player - version 0.8.5 Janus - (c) 1996-2006 the VideoLAN team"; sid:1002363; ) alert tcp any any -> any any (msg:"Supheli Arac :SearchGuild_DMOZ_Experiment (chris@searchguild.com)"; content:"SearchGuild_DMOZ_Experiment (chris@searchguild.com)"; sid:1002364; ) alert tcp any any -> any any (msg:"Supheli Arac :JRTS Check Favorites Utility"; content:"JRTS Check Favorites Utility"; sid:1002365; ) alert tcp any any -> any any (msg:"Supheli Arac :mozilla/5.0 (compatible; heritrix/1.3.0 http://archive.crawler.org)"; content:"mozilla/5.0 (compatible; heritrix/1.3.0 http://archive.crawler.org)"; sid:1002366; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.7 (compatible; Whizbang)"; content:"Mozilla/4.7 (compatible; Whizbang)"; sid:1002367; ) alert tcp any any -> any any (msg:"Supheli Arac :larbin_2.6.2 (tom@lemurconsulting.com)"; content:"larbin_2.6.2 (tom@lemurconsulting.com)"; sid:1002368; ) alert tcp any any -> any any (msg:"Supheli Arac :nsyght.com/Nutch-1.0-dev (nsyght.com; Nsyght.com)"; content:"nsyght.com/Nutch-1.0-dev (nsyght.com; Nsyght.com)"; sid:1002369; ) alert tcp any any -> any any (msg:"Supheli Arac :LotusDiscovery/x.0 (compatible; Mozilla 4.0; MSIE 4.01; Windows NT)"; content:"LotusDiscovery/x.0 (compatible; Mozilla 4.0; MSIE 4.01; Windows NT)"; sid:1002370; ) alert tcp any any -> any any (msg:"Supheli Arac :PlantyNet_WebRobot_V1.9 dhkang@plantynet.com"; content:"PlantyNet_WebRobot_V1.9 dhkang@plantynet.com"; sid:1002371; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; iOpus-I-M)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; iOpus-I-M)"; sid:1002372; ) alert tcp any any -> any any (msg:"Supheli Arac :ichiro/x.0 (http://help.goo.ne.jp/door/crawler.html)"; content:"ichiro/x.0 (http://help.goo.ne.jp/door/crawler.html)"; sid:1002373; ) alert tcp any any -> any any (msg:"Supheli Arac :PADLibrary Spider"; content:"PADLibrary Spider"; sid:1002374; ) alert tcp any any -> any any (msg:"Supheli Arac :maxomobot/dev-20051201 (maxomo; http://67.102.134.34:4047/MAXOMO/MAXOMObot.html; maxomobot@maxomo.com)"; content:"maxomobot/dev-20051201 (maxomo; http://67.102.134.34:4047/MAXOMO/MAXOMObot.html; maxomobot@maxomo.com)"; sid:1002375; ) alert tcp any any -> any any (msg:"Supheli Arac :QueryN Metasearch"; content:"QueryN Metasearch"; sid:1002376; ) alert tcp any any -> any any (msg:"Supheli Arac :UCWEB5.1"; content:"UCWEB5.1"; sid:1002377; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)"; content:"Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)"; sid:1002378; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)"; content:"Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)"; sid:1002379; ) alert tcp any any -> any any (msg:"Supheli Arac :Infoaxe./Nutch-0.9"; content:"Infoaxe./Nutch-0.9"; sid:1002380; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; PalmeraBot; http://www.links24h.com/help/palmera) Version 0.001"; content:"Mozilla/5.0 (compatible; PalmeraBot; http://www.links24h.com/help/palmera) Version 0.001"; sid:1002381; ) alert tcp any any -> any any (msg:"Supheli Arac :CHttpClient by Open Text Corporation"; content:"CHttpClient by Open Text Corporation"; sid:1002382; ) alert tcp any any -> any any (msg:"Supheli Arac :The Expert HTML Source Viewer (http://www.expert-html.com)"; content:"The Expert HTML Source Viewer (http://www.expert-html.com)"; sid:1002383; ) alert tcp any any -> any any (msg:"Supheli Arac :SpiderKU/0.x"; content:"SpiderKU/0.x"; sid:1002384; ) alert tcp any any -> any any (msg:"Supheli Arac :YahooSeeker/1.1 (compatible; Mozilla 4.0; MSIE 5.5; http://help.yahoo.com/help/us/shop/merchant/)"; content:"YahooSeeker/1.1 (compatible; Mozilla 4.0; MSIE 5.5; http://help.yahoo.com/help/us/shop/merchant/)"; sid:1002385; ) alert tcp any any -> any any (msg:"Supheli Arac :X-Crawler"; content:"X-Crawler"; sid:1002386; ) alert tcp any any -> any any (msg:"Supheli Arac :Custom Spider www.bisnisseek.com /1.0"; content:"Custom Spider www.bisnisseek.com /1.0"; sid:1002387; ) alert tcp any any -> any any (msg:"Supheli Arac :AxmoRobot - Crawling your site for better indexing on www.axmo.com search engine."; content:"AxmoRobot - Crawling your site for better indexing on www.axmo.com search engine."; sid:1002388; ) alert tcp any any -> any any (msg:"Supheli Arac :Xaldon WebSpider"; content:"Xaldon WebSpider"; sid:1002389; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; BuzzRankingBot/1.0; +http://www.buzzrankingbot.com/)"; content:"Mozilla/5.0 (compatible; BuzzRankingBot/1.0; +http://www.buzzrankingbot.com/)"; sid:1002390; ) alert tcp any any -> any any (msg:"Supheli Arac :Mouse-House/7.4 (spider_monkey spider info at www.mobrien.com/sm.shtml)"; content:"Mouse-House/7.4 (spider_monkey spider info at www.mobrien.com/sm.shtml)"; sid:1002391; ) alert tcp any any -> any any (msg:"Supheli Arac :ClariaBot/1.0"; content:"ClariaBot/1.0"; sid:1002392; ) alert tcp any any -> any any (msg:"Supheli Arac :csci_b659/0.13"; content:"csci_b659/0.13"; sid:1002393; ) alert tcp any any -> any any (msg:"Supheli Arac :Slurp/2.0-KiteWeekly (slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; content:"Slurp/2.0-KiteWeekly (slurp@inktomi.com; http://www.inktomi.com/slurp.html)"; sid:1002394; ) alert tcp any any -> any any (msg:"Supheli Arac :MSRBOT"; content:"MSRBOT"; sid:1002395; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"; content:"Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"; sid:1002396; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Charlotte/1.0b; charlotte@betaspider.com)"; content:"Mozilla/5.0 (compatible; Charlotte/1.0b; charlotte@betaspider.com)"; sid:1002397; ) alert tcp any any -> any any (msg:"Supheli Arac :CentiverseBot"; content:"CentiverseBot"; sid:1002398; ) alert tcp any any -> any any (msg:"Supheli Arac :moget/x.x (moget@goo.ne.jp)"; content:"moget/x.x (moget@goo.ne.jp)"; sid:1002399; ) alert tcp any any -> any any (msg:"Supheli Arac :dirb"; content:"dirb"; sid:1002400; ) alert tcp any any -> any any (msg:"Supheli Arac :python-requests"; content:"python-requests"; sid:1002401; ) alert tcp any any -> any any (msg:"Supheli Arac :DAV.pm/v0.49"; content:"DAV.pm/v0.49"; sid:1002402; ) alert tcp any any -> any any (msg:"Supheli Arac :sqlmap"; content:"sqlmap"; sid:1002403; ) alert tcp any any -> any any (msg:"Supheli Arac :cadaver"; content:"cadaver"; sid:1002404; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"; sid:1002405; ) alert tcp any any -> any any (msg:"Supheli Arac :DirBuster-1.0-RC1 (http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project)"; content:"DirBuster-1.0-RC1 (http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project)"; sid:1002406; ) alert tcp any any -> any any (msg:"Supheli Arac :DirBuster-1.0-RC1"; content:"DirBuster-1.0-RC1"; sid:1002407; ) alert tcp any any -> any any (msg:"Supheli Arac :Wfuzz"; content:"Wfuzz"; sid:1002408; ) alert tcp any any -> any any (msg:"Supheli Arac :Wfuzz/3.0.1"; content:"Wfuzz/3.0.1"; sid:1002409; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko"; content:"Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko"; sid:1002410; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"; content:"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"; sid:1002411; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072"; sid:1002412; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)"; sid:1002413; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 5.0; Win32)"; content:"Mozilla/4.0 (compatible; MSIE 5.0; Win32)"; sid:1002414; ) alert tcp any any -> any any (msg:"Supheli Arac :Moziea/4.0 (c"; content:"Moziea/4.0 (c"; sid:1002415; ) alert tcp any any -> any any (msg:"Supheli Arac :Opera Internet Browser"; content:"Opera Internet Browser"; sid:1002416; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"; content:"Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"; sid:1002417; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"; content:"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"; sid:1002418; ) alert tcp any any -> any any (msg:"Supheli Arac :User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"; content:"User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"; sid:1002419; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)"; sid:1002420; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)"; content:"Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)"; sid:1002421; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1)"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1)"; sid:1002422; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)"; sid:1002423; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)"; content:"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)"; sid:1002424; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)"; content:"Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)"; sid:1002425; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0"; content:"Mozilla/5.0"; sid:1002426; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)"; content:"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)"; sid:1002427; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko"; content:"Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko"; sid:1002428; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)"; content:"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)"; sid:1002429; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)"; sid:1002430; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3"; content:"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3"; sid:1002431; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Win32)"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Win32)"; sid:1002432; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)"; content:"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)"; sid:1002433; ) alert tcp any any -> any any (msg:"Supheli Arac :WinHTTP Example/1.0"; content:"WinHTTP Example/1.0"; sid:1002434; ) alert tcp any any -> any any (msg:"Supheli Arac :Moz&Wie;#t/6T!2yW29ab@ad%Df324V$Yd"; content:"Moz&Wie;#t/6T!2yW29ab@ad%Df324V$Yd"; sid:1002435; ) alert tcp any any -> any any (msg:"Supheli Arac :User-Agent: webclient"; content:"User-Agent: webclient"; sid:1002436; ) alert tcp any any -> any any (msg:"Supheli Arac :User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200"; content:"User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200"; sid:1002437; ) alert tcp any any -> any any (msg:"Supheli Arac :Tiger324{"; content:"Tiger324{"; sid:1002438; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (Compatible; MSIE 6.0;)"; content:"Mozilla/4.0 (Compatible; MSIE 6.0;)"; sid:1002439; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729"; content:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729"; sid:1002440; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/3.0 (compatible; Indy Library)"; content:"Mozilla/3.0 (compatible; Indy Library)"; sid:1002441; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"; content:"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"; sid:1002442; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozillar/"; content:"Mozillar/"; sid:1002443; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozillar/5.0"; content:"Mozillar/5.0"; sid:1002444; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7"; content:"Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7"; sid:1002445; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"; sid:1002446; ) alert tcp any any -> any any (msg:"Supheli Arac :Netscape"; content:"Netscape"; sid:1002447; ) alert tcp any any -> any any (msg:"Supheli Arac :dMozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.0; .NET CLR 1.1.4322)"; content:"dMozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.0; .NET CLR 1.1.4322)"; sid:1002448; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0)"; content:"Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0)"; sid:1002449; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 Firefox/50.0"; content:"Mozilla/5.0 Firefox/50.0"; sid:1002450; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0"; content:"Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0"; sid:1002451; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0"; content:"Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0"; sid:1002452; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; SLCC1; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.5."; content:"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; SLCC1; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.5."; sid:1002453; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon)"; sid:1002454; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; TERA:"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; TERA:"; sid:1002455; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36"; content:"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36"; sid:1002456; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)"; content:"Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)"; sid:1002457; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)"; content:"Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)"; sid:1002458; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0"; content:"Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0"; sid:1002459; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"; content:"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"; sid:1002460; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)"; content:"Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)"; sid:1002461; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)"; content:"Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)"; sid:1002462; ) alert tcp any any -> any any (msg:"Supheli Arac :Yahoo! Slurp"; content:"Yahoo! Slurp"; sid:1002463; ) alert tcp any any -> any any (msg:"Supheli Arac :MSIE 9"; content:"MSIE 9"; sid:1002464; ) alert tcp any any -> any any (msg:"Supheli Arac :Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"; content:"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"; sid:1002465; ) alert tcp any any -> any any (msg:"Supheli Arac :Nessus"; content:"Nessus"; sid:1002466; ) alert tcp any any -> any any (msg:"Supheli Arac :Netsparker"; content:"Netsparker"; sid:1002467; ) alert tcp any any -> any any (msg:"Supheli Arac :netsparker"; content:"netsparker"; sid:1002468; ) alert tcp any any -> any any (msg:"Supheli Arac :Acunetix"; content:"Acunetix"; sid:1002469; ) alert tcp any any -> any any (msg:"Supheli Arac :acunetix"; content:"acunetix"; sid:1002470; ) alert tcp any any -> any any (msg:"Supheli Arac :nessus"; content:"nessus"; sid:1002471; )