1002181781.yaml

id: firewall
info:
  name: ConfigServer Security & Firewall
  author: nmap,cn-kali-team
  tags: detect,tech,firewall,service
  severity: info
  metadata:
    hostname: $1
    info: blocked
    rarity: 0
tcp:
- name: 'null'
  inputs:
  - data: ''
  host:
  - '{{Hostname}}'
  extractors:
  - name: firewall
    type: regex
    regex:
    - ^Your connection to this server has been blocked in this server's firewall\.\r\nYou need to contact the server owner for further information\.\r\nYour blocked IP address is .*\r\nThis server's hostname is ([\w._-]+)\r\n$