BLACKSITE
:
216.73.217.7
:
103.21.58.60 / hariomequipments.com
:
Linux bh-in-4.webhostbox.net 4.19.286-203.ELK.el7.x86_64 #1 SMP Wed Jun 14 04:33:55 CDT 2023 x86_64
:
/
var
/
log
/
Upload File:
files >> //var/log/ea4_migration.log
Updating user sonicaka ... Updating user seidoindia ... Updating user vedicyog ... Updating user leadmin ... Updating user dixitmetal ... Updating user principle ... Updating user virgctl ... Updating user ayushind ... Updating user hefmnew ... Updating user sdmacademy ... Updating user marvel ... Updating user amolvrtk ... Updating user devidaya ... Updating user mcsuncon ... Updating user unhooked ... Updating user kkvp ... Updating user injoule ... Updating user drsanjoymukerjic ... Updating user royalspa ... Updating user geniusglobalscho ... Updating user marvelew ... Updating user helpuhomeservice ... Updating user honestymetal ... Updating user goldencubetradin ... Updating user a1plusentp ... Updating user googuladventure ... Updating user jeoind ... Updating user blogdelhidesignd ... Updating user sftsmedia ... Updating user seommbco ... Updating user valuesgi ... Updating user brisbanelocal ... Updating user srijothi ... Updating user heritagexper ... Updating user vishnoi ... Updating user firstripe ... Updating user dsklogindia ... Updating user paramdha ... Updating user visuax2a ... Updating user swastik ... Updating user riverraf ... Updating user fabrich ... Updating user hotelsahilkatra ... Updating user orbitacademy ... Updating user amfashions ... Updating user venew ... Updating user senadvertising ... Updating user panvaeng ... Updating user platy ... Updating user kingvipnumbers ... Updating user jason1983 ... Updating user completescaffold ... Updating user autodesign ... Updating user yesconnect ... Updating user jpoffices ... Updating user mgcables ... Updating user transplanthair ... Updating user nucleolights ... Updating user birdicyc ... Updating user avrexind ... Updating user astarhostel ... Updating user brpxixqa ... Updating user raiszadeh ... Updating user methodents ... Updating user linushajan ... Updating user wwwleonutrition ... Updating user saleosteel ... Updating user zuverlasse ... Updating user frames25 ... Updating user maharajt ... Updating user alconbeverages ... Updating user dogsnpu ... Updating user livingaexport ... Updating user hmtpozlo ... Updating user modnedel ... Updating user jmdsystem ... Updating user evolicouk77 ... Updating user theshadow ... Updating user systenfr ... Updating user matrixpa ... Updating user prayasgr ... Updating user nishaassociates ... Updating user bharathm ... Updating user chintala ... Updating user egawrfqs ... Updating user jammunewsline ... Updating user eaktadye ... Updating user aphrosof ... Updating user mayur765423 ... Updating user indiabhu ... Updating user plankochi ... Updating user primeall ... Updating user disuro ... Updating user freedomwheels ... Updating user drtomar ... Updating user endue ... Updating user bagvell ... Updating user udaymanav ... Updating user primalexus ... Updating user androidappfirst ... Updating user edupower ... Updating user alpsconstruction ... Updating user vactinte ... Updating user eflash ... Updating user logusinm ... Updating user trywis ... Updating user lfhil ... Updating user mukesh ... Updating user dhruvgalgotia ... Updating user airflow ... Updating user htambala ... Updating user selectotraders ... Updating user themesli ... Updating user eventcon ... Updating user vipulprco ... Updating user srkmanov ... Updating user carwash ... Updating user albadarcentralsc ... Updating user creatsgl ... Updating user artsjewe ... Updating user radiantp ... Updating user dhakawld ... Updating user kalpeshelectric ... Updating user dmmcind ... Updating user vefreesu ... Updating user laxmis ... Updating user studyplsg ... Updating user propexpe ... Updating user techzoy ... Updating user artfotostudios ... Updating user aonestpk ... Updating user memaar99sociates ... Updating user travelme ... Updating user satlore ... Updating user travelmi ... Updating user edenhospitality ... Updating user topicair ... Updating user howtolos ... Updating user marria5 ... Updating user samrock ... Updating user ovationworld ... Updating user himalayandiscove ... Updating user eklingjiatithibh ... Updating user searhmlw ... Updating user searchyoursearch ... Updating user aaoiin ... Updating user website ... Updating user sbalajii ... Updating user leabriter ... Updating user fitlic ... Updating user asiafro ... Updating user yuvathachits ... Updating user reliabgr ... Updating user bookpropeller ... Updating user sunshine ... Updating user wastechco ... Updating user manglmst ... Updating user veuswhey ... Updating user sandhuar ... Updating user stellant ... Updating user tbdesignz ... Updating user sankalp4awarenes ... Updating user papercupsindia ... Updating user panverify ... Updating user parwaz ... Updating user shivner ... Updating user pkvfinance ... Updating user cleaneating ... Updating user fantasyauthors ... Updating user keralainfodirect ... Updating user laxmiblo ... Updating user sanjeetenterpris ... Updating user arhometuitions ... Updating user metrospectrum ... Updating user experth ... Updating user vrpschoo ... Updating user sunilelectricco ... Updating user balajico ... Updating user heartbeatsnow ... Updating user ginza ... Updating user projecti ... Updating user roadtravel ... Updating user indianauthorsbio ... Updating user harimarble ... Updating user crmnordicasia ... Updating user luxurycars ... Updating user muyaradi ... Updating user web1234 ... Updating user inpelle ... Updating user wwwtntrails ... Updating user theteacom ... Updating user workkeralaroadas ... Updating user trapthecoupon ... Updating user stainles ... Updating user gkelfljn ... Updating user wwwrajsa ... Updating user wwwaeiin ... Updating user gaurav ... Updating user veameric ... Updating user selectropanel ... Updating user boscage ... Updating user pcinews ... Updating user pietyenterprises ... Updating user kavyainfra ... Updating user renaissance ... Updating user wwwparamounttext ... Updating user arasnand ... Updating user youthwin ... Updating user indiamachinetool ... Updating user unicorn ... Updating user hans ... Updating user pioneers ... Updating user esteelo ... Updating user rebelyou ... Updating user toffux ... Updating user woodengifts ... Updating user fitwellf ... Updating user apollong ... Updating user arkytekt ... Updating user jetinfom ... Updating user motorpum ... Updating user casaport ... Updating user unhook ... Updating user maimoon ... Updating user karnival ... Updating user cineweb365 ... Updating user sanctumw ... Updating user srsoftso ... Updating user bhaveshelectric ... Updating user apogeesp ... Updating user klexport ... Updating user altecwin ... Updating user xplotica ... Updating user implysol ... Updating user nnrgedu ... Updating user uccalumni ... Updating user dreamz ... Updating user signaturegardens ... Updating user deepamca ... Updating user technologyoctal ... Updating user rekhapri ... Updating user chettina ... Updating user leads2businessso ... Updating user plutusgroup ... Updating user bharatoss ... Updating user exigoent ... Updating user sanin2jc ... Updating user sujaltec ... Updating user greenpwr ... Updating user jaydeepsteelind ... Updating user rajnets ... Updating user signetin ... Updating user bloglotusgreens ... Updating user remitubes ... Updating user badrikedartravel ... Updating user royal ... Updating user jvgroupco ... Updating user icurehealth ... Updating user zephyrme ... Updating user globaltravel ... Updating user dvcable ... Updating user howtobackexloveb ... Updating user itreporting ... Updating user soveregn ... Updating user squareyards ... Updating user advances ... Updating user woodarti ... Updating user wwwrukmoniboards ... Updating user mythicalcreature ... Updating user saimryam ... Updating user ghasi123 ... Updating user piofl ... Updating user exportindianrice ... Updating user unique ... Updating user indianex ... Updating user apnarajya ... Updating user fixathome ... Updating user alertsnew ... Updating user mesxzzlz ... Updating user securiti ... Updating user bloomfieldctd ... Updating user udaipurwebsitede ... Updating user comfairbluestar ... Updating user netmaker ... Updating user docomoco ... Updating user copperen ... Updating user goodfdvb ... Updating user bekleidu ... Updating user thepnthn ... Updating user arunivas ... Updating user jobtn ... Updating user evelynsharma ... Updating user primewa2 ... Updating user stxavierhighscho ... Updating user westgateindia ... Updating user spyrossportsdeve ... Updating user adography ... Updating user terrace9 ... Updating user khearin ... Updating user terrace4 ... Updating user terrace5 ... Updating user wwwvaduvammal ... Updating user poultrye ... Updating user curiocorner ... Updating user liaydoqo ... Updating user palakottudevitem ... Updating user ravimemorial ... Updating user starimpexbeverag ... Updating user thonakal ... Updating user aipsorg ... Updating user randbayu ... Updating user dgtemp ... Updating user teknoflow ... Updating user purpleniwas ... Updating user goldrate ... Updating user raimalikarchitec ... Updating user vritelcorp ... Updating user qualitya ... Updating user rcce899544 ... Updating user eigitest ... Updating user creative ... Updating user spanda1 ... Updating user seosenor ... Updating user xdciekgs ... Updating user asrealho ... Updating user kahanpac ... Updating user sportsnu ... Updating user fhesbzcs ... Updating user marutimetal ... Updating user swarnsamarika ... Updating user pmealtd ... Updating user btagear ... Updating user phunixho ... Updating user rapidezg ... Updating user neelmntr ... Updating user rungtave ... Updating user manikaran ... Updating user tqtantpw ... Updating user ilexled5102 ... Updating user pjriyvsd ... Updating user vqsindia ... Updating user super ... Updating user khadiindia ... Updating user prabhat ... Updating user vitaminnew ... Updating user westcoastpaperba ... Updating user spandan ... Updating user nirmalci ... Updating user huntrco ... Updating user aarshabharath ... Updating user horizon ... Updating user shivadoi ... Updating user eagleinteriorwor ... Updating user panduads ... Updating user bhagwati ... Updating user lhsind ... Updating user relocationexpert ... Updating user kallya ... Updating user webazinee ... Updating user greenhabitatco ... Updating user felixstr ... Updating user vefreela ... Updating user brahmstr ... Updating user emmrcmad ... Updating user snhogszc ... Updating user silversq ... Updating user sycmum ... Updating user desertpearl ... Updating user britsontechnolog ... Updating user sportsn1 ... Updating user officemealbox ... Updating user suyog ... Updating user servfaces ... Updating user day2dayneeds ... Updating user chimanla ... Updating user technopearcouk77 ... Updating user vemart ... Updating user brainersacademy ... Updating user commandoforce ... Updating user aabhaind ... Updating user grillart ... Updating user mechntch ... Updating user maasha ... Updating user akiwsshi ... Updating user websnrllc ... Updating user gurmanma ... Updating user sonipolyplas ... Updating user queensmakeupc ... Updating user yashiinstitute ... Updating user tumblrpic ... Updating user jfasindi ... Updating user samarban ... Updating user huldistr ... Updating user sharafoo ... Updating user healthayurvedict ... Updating user powerloo ... Updating user khadishop ... Updating user vapidiabetica ... Updating user fusionen ... Updating user brewvid ... Updating user shreedha ... Updating user gourmtfv ... Updating user biedelhi ... Updating user khxptyez ... Updating user maheshsteelcorp ... Updating user bigprofit898 ... Updating user wwwantsarchitect ... Updating user silvlght ... Updating user ijptr ... Updating user infrasrc ... Updating user shreesai ... Updating user ememe ... Updating user mediapar ... Updating user jupiter ... Updating user subsist ... Updating user shreesat ... Updating user gurgaongynecolog ... Updating user spectratech ... Updating user thehubho ... Updating user shiv ... Updating user hariomma ... Updating user iportalco ... Updating user weltechfacility ... Updating user stagingbhcsipl ... Updating user drsonabhatia ... Updating user uguzitiy ... Updating user astorion ... Updating user rakshadelhivikas ... Updating user cityprohub ... Updating user fioindia ... Updating user ticom ... Updating user taher ... Updating user angelmrn ... Updating user residentialrenta ... Updating user steelind ... Updating user mediamen ... Updating user mymindmg ... Updating user sksindustriescbe ... Updating user hotelglobalinnud ... Updating user amultr25469 ... Updating user jolieffet ... Updating user kavilmma ... Updating user satyamcollege ... Updating user atamtext ... Updating user pikaso ... Updating user prasanthb ... Updating user chiraghotels ... Updating user itsolutionind ... Updating user icahahxd ... Updating user hoteljaisalpalac ... Updating user unitedff ... Updating user iongroup ... Updating user amazinggifts ... Updating user star777auminium ... Updating user arhament ... Updating user pharmasuit ... Updating user marveloceanicpvt ... Updating user janyodayvikaspar ... Updating user ablissmeditatio ... Updating user vardaco ... Updating user sonicagl ... Updating user twenty20 ... Updating user hamadgro ... Updating user sadesgnc ... Updating user basantme ... Updating user pizzavoucher ... Updating user marcopolo90 ... Updating user sbbusine ... Updating user champnpd ... Updating user corpo ... Updating user smileplu ... Updating user ninetofive ... Updating user drsanghvi ... Updating user purvain ... Updating user marketivemindsco ... Updating user wlmco ... Updating user medianet ... Updating user privateprot ... Updating user bicyclep ... Updating user deuljhar ... Updating user aimmsinstitute ... Updating user tilakpai ... Updating user organicfert ... Updating user veclass ... Updating user shreeji ... Updating user kvcsc ... Updating user kashmiriembroid ... Updating user eshoppers ... Updating user hotelbombayorien ... Updating user shreebadrivishal ... Updating user wfpnet ... Updating user enzioph1 ... Updating user passofeco ... Updating user reviewsb ... Updating user unsenterprise ... Updating user samajshi ... Updating user olivefoo ... Updating user eyelite ... Updating user keysta ... Updating user snapmart ... Updating user hotelpre ... Updating user wwwmangl ... Updating user rajupgxh ... Updating user c1kam9l6 ... Updating user babaagencies ... Updating user travele ... Updating user sonalphotography ... Updating user maha ... Updating user aakrutiexport ... Updating user bhagalpu ... Updating user refairp8rts ... Updating user cidms ... Updating user gitanjalimkt ... Updating user varshnwb ... Updating user vanityindia ... Updating user aabhastech ... Updating user blueleafarchitec ... Updating user carpetsh ... Updating user bravo ... Updating user championworld ... Updating user shreemah ... Updating user everytip ... Updating user aglglazi ... Updating user yxfoqjxi ... Updating user wwwkvbpa ... Updating user sarafgroup ... Updating user eupheusco ... Updating user everytik ... Updating user jcbparts ... Updating user abimtind ... Updating user eurofreshsecurti ... Updating user physicsgranth ... Updating user karuthiy ... Updating user acuitegroup ... Updating user aswamedh ... Updating user raselectrical ... Updating user coffeecr ... Updating user primeway ... Updating user sharec ... Updating user desiilaaj ... Updating user signetso ... Updating user keygurukul ... Updating user emmanueleatery ... Updating user jagdishtravels ... Updating user gdsschoo ... Updating user srimotorsygs ... Updating user himson ... Updating user shivagro ... Updating user ukfitnsc ... Updating user mercycops ... Updating user webseorg ... Updating user craftbui ... Updating user medikolf ... Updating user leebas ... Updating user magnitech ... Updating user profrgan ... Updating user xishatech ... Updating user knrbfinancialser ... Updating user uswheyis ... Updating user parekhex ... Updating user cgaworld ... Updating user aselor ... Updating user muyasoft ... Updating user bjscient ... Updating user pizzaquiz ... Updating user mdpsitc ... Updating user mbwatert ... Updating user shreekan ... Updating user statustr ... Updating user inshrines ... Updating user renovocare ... Updating user unicusho ... Updating user kvrworld ... Updating user stardigi ... Updating user instaqpp ... Updating user mscb ... Updating user anuragdedac ... Updating user eventusbrandlabs ... Updating user remriosis ... Updating user starcoat ... Updating user travel69 ... Updating user prdjsmk9 ... Updating user positive ... Updating user remarkableproduc ... Updating user wwwmahav ... Updating user thetearoad ... Updating user aryasamajdobhri ... Updating user pear1234 ... Updating user thakor ... Updating user fastfoodfair ... Updating user betahealthcare ... Updating user roomproviderco ... Updating user dataaeothrithala ... Updating user ffadmmmk ... Updating user itcoachings ... Updating user knitsind ... Updating user shraddha ... Updating user leoindiarelocati ... Updating user wwwimade ... Updating user hotelneeraj ... Updating user wavesysnsk ... Updating user cxodigest ... Updating user addcheck ... Updating user alliedtrading ... Updating user studentphamplet ... Updating user ecubeinstitute ... Updating user jakperfumes ... Updating user eyespa ... Updating user roadlineskerala ... Updating user jasontech ... Updating user gsexportsco ... Updating user abhinandanhome ... Updating user aumassoc ... Updating user sangamamplastics ... Updating user educationmasters ... Updating user walideqp ... Updating user srivenai ... Updating user devkunj ... Updating user prenterprisein ... Updating user locksworthandsto ... Updating user roadrun1 ... Updating user pranjalshouse ... Updating user winespizza ... Updating user eazeegpn ... Updating user magazine ... Updating user firmzpjr ... Updating user tirumals ... Updating user medtourchennai ... Updating user hemtraders ... Updating user indokemp ... Updating user supremep ... Updating user tirumala ... Updating user glamours ... Updating user eduhub ... Updating user bluemont ... Updating user roadrunn ... Updating user peppermi ... Updating user aquaengg ... Updating user proaudio ... Updating user mcpatel ... Updating user theredpn ... Updating user pavithrans ... Updating user sinoj ... Updating user rohanikshaphase3 ... Updating user sbsteelc ... Updating user wwwselfiehome ... Updating user rluckproduction ... Updating user himal12 ... Updating user aoimumbg ... Updating user globushospital ... Updating user vadapala ... Updating user vanviharlionfarm ... Updating user dataaeoottapalam ... Updating user v4you ... Updating user asianatr ... Updating user gyanchakshuco ... Updating user skments ... Updating user sparkin ... Updating user ewingchr ... Updating user tejlite ... Updating user alphabe ... Updating user mokeubtt ... Updating user gravtinc ... Updating user multifly ... Updating user quicksitedevelop ... Updating user ksrtcin ... Updating user revkart ... Updating user groupalb ... Updating user techdemoco ... Updating user yogifoun ... Updating user karyanao ... Updating user brekstart ... Updating user vistarat ... Updating user fixparties ... Updating user dravidia ... Updating user rokda89 ... Updating user realeye ... Updating user krisprjc ... Updating user sveeindi ... Updating user petrosteelpiping ... Updating user amison ... Updating user protein1 ... Updating user shrimari ... Updating user nisgtotalsecurit ... Updating user staent ... Updating user atrigroup ... Updating user ecobhara ... Updating user swastika ... Updating user saifee ... Updating user swastike ... Updating user prime ... Updating user gsistest ... Updating user alloyste ... Updating user bullishb ... Updating user ascentiq ... Updating user hqonnxey ... Updating user mgresearch ... Updating user fantasyworlds ... Updating user lissaind ... Updating user photogenic8984 ... Updating user midazind ... Updating user lineage ... Updating user malharpu ... Updating user infinityadven ... Updating user ssjobs ... Updating user proteinw ... Updating user theexcel ... Updating user gevyal3f ... Updating user proteins ... Updating user tamsw56 ... Updating user machineindia ... Updating user indtutor ... Updating user smoothi1 ... Updating user grihthtr ... Updating user jackdemo ... Updating user texotech ... Updating user anujacreations ... Updating user sevensigma ... Updating user grampanc ... Updating user ioningroup ... Updating user gxglbscc ... Updating user mofaro9 ... Updating user akalgoc ... Updating user ardurenergy ... Updating user filmyden ... Updating user aafpl ... Updating user nidhigar ... Updating user agrus ... Updating user pournamiagarbath ... Updating user canada ... Updating user vehotelt ... Updating user panditpyarelalji ... Updating user alsahrar ... Updating user gldeepesh ... Updating user cupadmin ... Updating user bowandbrush ... Updating user jbcombindia ... Updating user nspopfor ... Updating user modwarei ... Updating user woodenar ... Updating user decorators ... Updating user magdalenaperfect ... Updating user profic ... Updating user delhiwala ... Updating user citizensparty ... Updating user ultracre ... Updating user dtelesat ... Updating user srkm ... Updating user conquestenmasse ... Updating user krishnav ... Updating user kewswitchgear ... Updating user rasmidas ... Updating user v1cstudi ... Updating user vefree83 ... Updating user indianch ... Updating user vinod555 ... Updating user tokyofin ... Updating user anuragbhatiaco ... Updating user sanghviorg ... Updating user dprasadb ... Updating user kakanad ... Updating user venkatar ... Updating user finrex ... Updating user goldenamoonresor ... Updating user simplema ... Updating user hgmpharm ... Updating user stillmat ... Updating user cybercit ... Updating user jvsstanks ... Updating user infosurfersco ... Updating user wwwgujar ... Updating user support ... Updating user aquamake ... Updating user optimumf ... Updating user realtksf ... Updating user arddcco ... Updating user dispatchlive ... Updating user thesflgr ... Updating user repairgeekspayme ... Updating user zibopapers ... Updating user dartsfed98 ... Updating user kayra ... Updating user rktco ... Updating user fourartdesigns ... Updating user ffprts ... Updating user shivaminterior ... Updating user juniorlegends ... Updating user engineer ... Updating user iaai ... Updating user paarthde ... Updating user dechindia ... Updating user anumodba ... Updating user unflavor ... Updating user waastrologyservi ... Updating user hallmarkinfrastr ... Updating user aluminiu ... Updating user vedirect ... Updating user brandrootz ... Updating user ssepower ... Updating user karekar ... Updating user hometechplumbing ... Updating user sulabhschoolsani ... Updating user oscarblade ... Updating user thememoi ... Updating user sachostm ... Updating user massclev ... Updating user aatreyain ... Updating user herbopha ... Updating user vishal ... Updating user burgercart ... Updating user tatasky ... Updating user unixsol99 ... Updating user kalyaniforge ... Updating user goojtkha ... Updating user ultimtln ... Updating user southban ... Updating user allseasonlife ... Updating user jukrqapd ... Updating user rjlights ... Updating user rkggreenfarm ... Updating user sophia ... Updating user pesh5372 ... Updating user udaipurbikesonre ... Updating user wwwalliedinterna ... Updating user unitedch ... Updating user hostihpc ... Updating user salonisareesudai ... Updating user ratfilms ... Updating user saptosij ... Updating user dipsemi ... Updating user websenor ... Updating user vaidikindiaorgan ... Updating user sunderfo ... Updating user hotelhol ... Updating user mccampers ... Updating user sciencec ... Updating user narankaapharma ... Updating user zoraagrofarms ... Updating user grealthfresh ... Updating user zgxfliwb ... Updating user cocoatrees ... Updating user qubitsol ... Updating user dotcominfotech ... Updating user hotelnawalgar ... Updating user hiboostseoskills ... Updating user designs ... Updating user bluecrst ... Updating user appsdlfmall ... Updating user smestarn ... Updating user tawugnvg ... Updating user cresttrs ... Updating user barescientist ... Updating user sabarima ... Updating user wwwbirdc ... Updating user g2emarathali ... Updating user whkuhnvx ... Updating user sachiyasteel ... Updating user websol ... Updating user america ... Updating user veameri ... Updating user tastech ... Updating user stmargar ... Updating user joyaroma ... Updating user karunasoc ... Updating user t3globe92 ... Updating user rhiaivfm ... Updating user fastrackco ... Updating user nayancapacitor ... Updating user suptech ... Updating user myhomebricks ... Updating user kmsgroup ... Updating user hrcindia ... Updating user hwojrbzg ... Updating user jackbqu2 ... Updating user daljiten ... Updating user jeett5ra ... Updating user indigoau ... Updating user rapidtech ... Updating user claydesigns ... Updating user lakshmiconsultan ... Updating user rajd ... Updating user minaximetal ... Updating user ilfsskillsjk ... Updating user privat832 ... Updating user rkelectricals ... Updating user alexeisoft ... Updating user hitechsurv ... Updating user shantosh ... Updating user riosimvn ... Updating user avoor ... Updating user gudindia ... Updating user g2evolut ... Updating user fzjjplhc ... Updating user oneblued ... Updating user blingevents ... Updating user akgtrust ... Updating user sign56789 ... Updating user rifetech ... Updating user gulfownmobiles ... Updating user wwwgncsc ... Updating user genesisg ... Updating user bluestarshipping ... Updating user bestintd ... Updating user woodbury ... Updating user globalatp ... Updating user atconline ... Updating user remotemployee ... Updating user myinternettroops ... Updating user yxfbdcfq ... Updating user aftinfo ... Updating user mukoque ... Updating user djstradi ... Updating user pmnacrane ... Updating user veda7654 ... Updating user pinnacle ... Updating user powercho ... Updating user abcdelhi ... Updating user kkpack ... Updating user biqrock ... Updating user careerflips ... Updating user eliteelectric ... Updating user gunturweb ... Updating user mhintl ... Updating user arkacs ... Updating user kirloska ... Updating user realstaff142 ... Updating user cmovie83 ... Updating user blogsupertec ... Updating user smilecar ... Updating user prismdco ... Updating user homeboxx ... Updating user photoncareerinst ... Updating user longindi ... Updating user aceinternational ... Updating user journalis ... Updating user wwwpulle ... Updating user vesleypharma ... Updating user probuswt ... Updating user khanedigaddi ... Updating user duropart ... Updating user brandhfo ... Updating user indianba ... Updating user diamonde ... Updating user rjproper ... Updating user pcvisor ... Updating user lubrican ... Updating user timesofladakh ... Updating user chennaimedtour ... Updating user conceptinteriors ... Updating user accruein ... Updating user rajdhani ... Updating user washnwear ... Updating user aadhaari ... Updating user topgrade ... Updating user westerna ... Updating user cremicaf ... Updating user qalallto ... Updating user kandivlp ... Updating user interforminterio ... Updating user vinayak ... Updating user rightservice ... Updating user uccborg ... Updating user hindusta ... Updating user vrintrnational ... Updating user karmamdn ... Updating user infratec ... Updating user wwwarbud ... Updating user cobblestoneco ... Updating user thecuisinefactor ... Updating user shivamrealest ... Updating user slonsys ... Updating user mdsbusiness ... Updating user skfmat ... Updating user intcargo ... Updating user bhservic ... Updating user masuimat ... Updating user jason2014 ... Updating user giantgpc ... Updating user hygeiamn ... Updating user jorawar ... Updating user yavamint ... Updating user pwsgroupco ... Updating user trinitya ... Updating user devnani ... Updating user sampling ... Updating user lykcreations ... Updating user hsapacka ... Updating user dollarclub ... Updating user crimsono ... Updating user ymvt ... Updating user schoolmithra ... Updating user nicetipsnew ... Updating user aadyantc ... Updating user linkinfr ... Updating user rehab723as ... Updating user quansys ... Updating user cjphfftq ... Updating user salonivi ... Updating user dtpindia ... Updating user galaxycc ... Updating user euadmin123 ... Updating user chandramoulisure ... Updating user fantasycastle ... Updating user tropical ... Updating user accurateoutsourc ... Updating user adriseindia ... Updating user fantatrees ... Updating user clapncall ... Updating user senseirajacademy ... Updating user reflex ... Updating user magnumco ... Updating user birizza ... Updating user thebarescientist ... Updating user gacudptin ... Updating user haircolormate ... Updating user maheshparab ... Updating user basantmarbles ... Updating user chamndcr ... Updating user goodmorn ... Updating user unifiedsolution ... Updating user crunchycrush ... Updating user easymrch ... Updating user troverin ... Updating user woodenfl ... Updating user glinksin ... Updating user pathan99 ... Updating user ghartakk ... Updating user cubuil ... Updating user gulfshoppingdeal ... Updating user cloudsharing ... Updating user rajkamalsteelind ... Updating user jkmjewelshub ... Updating user choudharyworld15 ... Updating user pandittulsiram ... Updating user huntr ... Updating user sirisapt ... Updating user priyasnd ... Updating user shirdi ... Updating user manekmet ... Updating user sndppizh ... Updating user shodhsar ... Updating user bikors87oice ... Updating user elliavrram ... Updating user dotnetinfotech ... Updating user supertapp ... Updating user oczufmpg ... Updating user arklgcom ... Updating user snehorg ... Updating user learnermagzine ... Updating user iamdeepumg ... Updating user alphabet ... Updating user axisenterprises ... Updating user aisschoolcbse ... Updating user vonectec ... Updating user kvsprope ... Updating user smartway ... Updating user wheatand ... Updating user alfakhri ... Updating user shreenat ... Updating user ramatourntravels ... Updating user apparels ... Updating user triistar ... Updating user taneja ... Updating user vbitaluni2 ... Updating user kmtindia ... Updating user mahalakshmibuild ... Updating user drkavita ... Updating user pdcclub ... Updating user sddevel ... Updating user cncpro ... Updating user kinger ... Updating user portablecabin ... Updating user rohitent ... Updating user kfpindia ... Updating user zeebrok ... Updating user sinnew ... Updating user modirbrl ... Updating user vishalentco ... Updating user patelaut ... Updating user bulkwhe1 ... Updating user saptosi ... Updating user saptrang ... Updating user eveningbazaar ... Updating user jewelpla ... Updating user degrandriviera ... Updating user graymag ... Updating user pureorganic ... Updating user thehrdst ... Updating user consumercard ... Updating user watpan2017 ... Updating user pmtcouncil ... Updating user startnet ... Updating user ideabyo2 ... Updating user datadeoottapalam ... Updating user savitriagency ... Updating user avirabnqt ... Updating user whzjzold ... Updating user sivamgenver ... Updating user nakalangpipe ... Updating user ruturaj ... Updating user sparklinggoal ... Updating user cheappro ... Updating user tipsonexport ... Updating user digiedu ... Updating user djmanpow ... Updating user techsibha ... Updating user fabcon ... Updating user dhobiservice ... Updating user stressco ... Updating user bulkwhey ... Updating user bhin43na ... Updating user gdworld ... Updating user anmolgroup ... Updating user riajewel ... Updating user cheappr1 ... Updating user bestindianauthor ... Updating user dlccretn ... Updating user hornbillgroup ... Updating user ramble984 ... Updating user jaika6hs ... Updating user laqslumni ... Updating user pgmaxxhe ... Updating user kiroli ... Updating user transitoak ... Updating user drvinnet ... Updating user rakvb ... Updating user deksonmetal ... Updating user fictionalvillain ... Updating user hktopecom ... Updating user vragencies ... Updating user inkredia ... Updating user oofinhrn ... Updating user yogfamily ... Updating user encipami ... Updating user intach ... Updating user bookmytifin ... Updating user mydreamh ... Updating user yogeshcrescent ... Updating user trielec ... Updating user eliteflowerexpor ... Updating user descentw ... Updating user skinnyan ... Updating user gmmeindia ... Updating user s3dxpo ... Updating user altuscom ... Updating user edubabaji ... Updating user sbceco ... Updating user tips4us ... Updating user vibrantplast ... Updating user wwwdigit ... Updating user technowebhosting ... Updating user pendurka ... Updating user blueprintadvisor ... Updating user victoryservice ... Updating user craftshades ... Updating user famousworldastro ... Updating user lotts ... Updating user hariomplastics ... Updating user ethos ... Updating user newswiftinfos ... Updating user bdintl ... Updating user wwwchampionpaper ... Updating user wwwkalat ... Updating user cineaudo ... Updating user megahlir ... Updating user pcsconsultant ... Updating user timtim ... Updating user v2gwrldc ... Updating user confiden ... Updating user selfbiz ... Updating user mubarakd ... Updating user satyamcy ... Updating user glamourgallery ... Updating user sethiinnovations ... Updating user indiasho ... Updating user infocity ... Updating user cadcazyb ... Updating user wwwtheanilgroup ... Updating user sharfods ... Updating user naturetr ... Updating user irisoverseasco ... Updating user pipilika ... Updating user keycerag ... Updating user drjadhav ... Updating user laktas ... Updating user dvvdsbvn ... Updating user ijfresh ... Updating user tallyhub ... Updating user oasishotels ... Updating user shreemdzippers ... Updating user karpagaa ... Updating user rkess ... Updating user indroad ... Updating user zerolapf ... Updating user bzdbcfju ... Updating user wdilaunderers ... Updating user saranggl ... Updating user linunimisha ... Updating user furlrltb ... Updating user sheetlch ... Updating user cablevardhman ... Updating user saicontr ... Updating user wwwamazv ... Updating user vereview ... Updating user begumzarinain ... Updating user g2evodqj ... Updating user lehrabri ... Updating user anoxled ... Updating user indianpu ... Updating user gdshelte ... Updating user blueringrealtech ... Updating user akjariwala ... Updating user tantric ... Updating user mrtell ... Updating user sqcintcom ... Updating user bhagyalakshmi ... Updating user padamplastics ... Updating user royaleaqua ... Updating user gulfocean ... Updating user intimasiaco ... Updating user shrilaxmi88 ... Updating user bunyaad ... Updating user sjngroup ... Updating user tacindnt ... Updating user rclwtulu ... Updating user mirzafoods ... Updating user joyful2 ... Updating user shriram ... Updating user obituaryads ... Updating user mediaove ... Updating user plecosol ... Updating user prabintvs ... Updating user manvkaor ... Updating user prateekv ... Updating user smartexamz ... Updating user rajdyesp ... Updating user prudentcareer ... Updating user unicornsteel ... Updating user seahawkoverseas ... Updating user uttrust ... Updating user welcome123 ... Updating user vazhappilly ... Updating user studiodna ... Updating user simran ... Updating user indiarack ... Updating user mkpoultr ... Updating user oscorp ... Updating user rashi ... Updating user indiazbe ... Updating user rakshaaddela ... Updating user bmelaram ... Updating user gandea ... Updating user axilaw ... Updating user digitjscom ... Updating user elearn ... Updating user planetg ... Updating user hmsexcqv ... Updating user atozcomm ... Updating user splend ... Updating user chinarkart ... Updating user mjacademy ... Updating user jaiindiraagro ... Updating user cranerec ... Updating user realindi ... Updating user americanflyerco ... Updating user mahavirp ... Updating user biosytmst ... Updating user narendraacademy ... Updating user annaiphy ... Updating user ikmt ... Updating user aser882gp ... Updating user healthcare24x7pa ... Updating user orient ... Updating user jvpinformatics ... Updating user ritiiriw ... Updating user wwwcanvasfilms ... Updating user konarkproject ... Updating user grenflds ... Updating user seattleb ... Updating user jethwa ... Updating user ariseprint ... Updating user wwwappliedsmartl ... Updating user vaishpa8988 ... Updating user wheyprot ... Updating user eminee5g ... Updating user vardhmanste ... Updating user dreamsli ... Updating user drjinigupta ... Updating user spexvilla ... Updating user webchennai ... Updating user bktkindi ... Updating user grasimmetal ... Updating user rmcedu ... Updating user guildford ... Updating user hershchad ... Updating user kafetale ... Updating user kshemap ... Updating user centina ... Updating user srisv ... Updating user gongat ... Updating user munishgroups ... Updating user tirumve ... Updating user adab ... Updating user gscontra ... Updating user shikhavi ... Updating user aquaproindia ... Updating user rtscabs ... Updating user bhawangeneral ... Updating user saiscientificins ... Updating user littlekites ... Updating user boyshostelnearup ... Updating user devkinandan55 ... Updating user silverwi ... Updating user sravinde ... Updating user jwrhk ... Updating user carediagnostic ... Updating user paaneshn ... Updating user grconsulting ... Updating user mediatrix ... Updating user ghmt ... Updating user shahestateagency ... Updating user sr565465 ... Updating user sndptsr ... Updating user kssworld ... Updating user ivision ... Updating user netpeoplekart ... Updating user nltradin ... Updating user alfajrcoffee ... Updating user triplexe ... Updating user homecareservicec ... Updating user sanjaypr ... Updating user thesara ... Updating user arvindsteel ... Updating user workvntr ... Updating user premium ... Updating user ekraftsindia ... Updating user unipressholding ... Updating user terrace7 ... Updating user bindaasentertain ... Updating user precisionengg ... Updating user flywithkrrish ... Updating user gayatric ... Updating user susandes ... Updating user wwweswit ... Updating user limrawea ... Updating user nyshaartstudio ... Updating user icaa ... Updating user smaratha ... Updating user pelicant ... Updating user sant ... Updating user pkbrinfotech ... Updating user sjnxmras ... Updating user combineb ... Updating user shub103 ... Updating user sunraysiaco ... Updating user medtechrising ... Updating user jorawart ... Updating user worldaround ... Updating user rajropet ... Updating user muskaanc ... Updating user eatstreets ... Updating user designanddecor ... Updating user ionfoundati ... Updating user dtpco ... Updating user servicesocial ... Updating user flexchai ... Updating user romanpharma ... Updating user truevl ... Updating user agegoupi ... Updating user palakkadedu ... Updating user slelectr ... Updating user steelrepor ... Updating user agripestcontrol ... Updating user sanindia ... Updating user gdpl ... Updating user amrapali ... Updating user srventure ... Updating user jaczo ... Updating user meloorscb ... Updating user manzilmystics ... Updating user ajitcables ... Updating user wipethes ... Updating user phindustanpr ... Updating user crimsonpark ... Updating user lgbxqgss ... Updating user plugandp ... Updating user corporte ... Updating user internet123 ... Updating user rtvbuild ... Updating user intentboxcom ... Updating user kreatizc ... Updating user ranecon ... Updating user udhavaorg ... Updating user moxieeln ... Updating user orchidsvillas ... Updating user amscopegroup77 ... Updating user sriramconstructi ... Updating user ashtarwe ... Updating user shirdisa ... Updating user grocshop ... Updating user govisago ... Updating user thearyam ... Updating user samaf ... Updating user miyajiastrologer ... Updating user argalconsultants ... Updating user dimpipe ... Updating user ascsouth ... Updating user galaxydecor ... Updating user envisbes ... Updating user impeindi ... Updating user devvoyag ... Updating user wlmweoyx ... Updating user dmehrotra ... Updating user qmscorp ... Updating user emseo ... Updating user mahagold ... Updating user thepaws ... Updating user ramaply ... Updating user ruonline ... Updating user organrga ... Updating user neetacfa ... Updating user trijal ... Updating user crewindi ... Updating user kachapp ... Updating user oodizwbm ... Updating user ladycare ... Updating user lakhiaco ... Updating user wwwhealt ... Updating user azielw ... Updating user gravityi ... Updating user ladiesastrologer ... Updating user klzpxcwz ... Updating user risein ... Updating user velsons ... Updating user volvie ... Updating user thefanta ... Updating user sexcsles ... Updating user infracom ... Updating user aahilenp ... Updating user dreamthe ... Updating user makehappygifts ... Updating user sanjarsl ... Updating user multyflylounge ... Updating user vgjtindi ... Updating user mokeupweb ... Updating user temaantr ... Updating user gurukru8 ... Updating user newtechsteelsind ... Updating user exigoe123 ... Updating user nnresstudnts ... Updating user ashadeepclasses ... Updating user dimorain ... Updating user spscomposite ... Updating user eternalp ... Updating user rakshainfrapromo ... Updating user cmrk ... Updating user sscrindia ... Updating user aryavart ... Updating user virarlty ... Updating user worldtek ... Updating user onucgspu ... Updating user cyantemp ... Updating user leisurel ... Updating user visnyesy ... Updating user illustra ... Updating user fhsource ... Updating user vikasnavratan ... Updating user aacarren ... Updating user internationalbea ... Updating user domainpr ... Updating user sphere ... Updating user speakupindia ... Updating user assetzhereandnow ... Updating user srinov78o ... Updating user kgaca ... Updating user abhisjcl ... Updating user smartsol ... Updating user carbongym ... Updating user ivfcentn ... Updating user socia8gt ... Updating user astrology898 ... Updating user sstateme ... Updating user pratham ... Updating user rtgaller ... Updating user goldenageladakh ... Updating user deegee ... Updating user ssasdata ... Updating user iglobetech ... Updating user midasdecor ... Updating user msflanges ... Updating user travalla ... Updating user wanderootholiday ... Updating user naturela7654 ... Updating user demoserenitycrea ... Updating user whatthefashion ... Updating user asquareexhibitio ... Updating user vendoshop ... Updating user alertnew ... Updating user oscarperfumes ... Updating user milanode ... Updating user keepitfr ... Updating user muyatips ... Updating user crystalsignsolut ... Updating user maxusitc ... Updating user estempls ... Updating user hkduropa ... Updating user ggbcmtup ... Updating user supratkb ... Updating user shoppersshop ... Updating user wwwgvatechnocraf ... Updating user kalkiindia ... Updating user tarunsakhi ... Updating user diraga ... Updating user tasant ... Updating user pathakma ... Updating user prestonmetals ... Updating user kedhari ... Updating user vtnadu ... Updating user wwwtulja ... Updating user equators ... Updating user swamicarline5678 ... Updating user runwaylogistics ... Updating user veuswhe ... Updating user funbuzzindia ... Updating user yogashra ... Updating user mercantileele ... Updating user cutis ... Updating user mattress ... Updating user ideogramtech ... Updating user maxfresh ... Updating user darbhang ... Updating user gvijay ... Updating user stmarysalumas ... Updating user gurukrupacctv ... Updating user drvinayj ... Updating user buddhagroup ... Updating user hbikatra ... Updating user cubuilt ... Updating user unitednce ... Updating user omindiai ... Updating user devakiconvention ... Updating user hitcokw ... Updating user lazawal ... Updating user adventur ... Updating user hajjmrh ... Updating user leafnseed ... Updating user softonso ... Updating user ktsfabri ... Updating user speciale ... Updating user vedant142 ... Updating user transcaresolutio ... Updating user picassoshirts ... Updating user saurabhelectric ... Updating user skinter ... Updating user mmeshop ... Updating user artanantya ... Updating user nmailer888 ... Updating user devyesaranam321 ... Updating user paceanalytical ... Updating user campusesolution ... Updating user izzatfoods ... Updating user resolute ... Updating user panchamm ... Updating user adsversify ... Updating user merakimill ... Updating user shreeste ... Updating user fakhreemarbles ... Updating user thegreen ... Updating user asusi ... Updating user easytravelservic ... Updating user cerisecentralpar ... Updating user irisedu ... Updating user zigmak ... Updating user almightyconsulta ... Updating user nimadseeds ... Updating user america8 ... Updating user hotelsciencecity ... Updating user vibranti ... Updating user krishabh ... Updating user akentco ... Updating user nxbev99 ... Updating user print ... Updating user keylineco ... Updating user muyanifit ... Updating user vikashud ... Updating user ssidinte ... Updating user doppler ... Updating user jkenggwo ... Updating user escapeec ... Updating user mediacar ... Updating user civilstestseries ... Updating user dineshimpex ... Updating user khabar8pehar ... Updating user samatha ... Updating user stepupwelfare ... Updating user cloud7he ... Updating user kemindia ... Updating user fogleaf ... Updating user srisaipr ... Updating user harshada ... Updating user happykid ... Updating user intments ... Updating user rahiplaza ... Updating user blogmawanaf ... Updating user luxiaprf ... Updating user everestengg ... Updating user ayelustr ... Updating user celibrary ... Updating user nilkanth ... Updating user judoass8988o ... Updating user ustadshamshadali ... Updating user imrg ... Updating user jkentrpr ... Updating user pathakeu ... Updating user rbcgroup ... Updating user neelkant ... Updating user nzwdolvn ... Updating user octopuspapersltd ... Updating user powercapacitor ... Updating user cads ... Updating user uieindia ... Updating user sabtest2 ... Updating user joodalt ... Updating user locean ... Updating user gmwyibjx ... Updating user vematrim ... Updating user kavitabhatt ... Updating user prajapat ... Updating user kamlashreewelfar ... Updating user amogrpcm ... Updating user seamsfordreams ... Updating user vonecnet ... Updating user hotelsea ... Updating user synopack ... Updating user marriag6 ... Updating user marriag8 ... Updating user mant1234 ... Updating user sattechc ... Updating user atask ... Updating user artofstudying ... Updating user kadambaree ... Updating user corporat ... Updating user cardiaca ... Updating user chalavar ... Updating user arsarey ... Updating user muskaanpo ... Updating user parsvjh6 ... Updating user skdischool ... Updating user pehchaan ... Updating user uuoconqv ... Updating user vallabhkanyakela ... Updating user aipnalagarh ... Updating user thinkbig ... Updating user enrek ... Updating user vishalad ... Updating user buymxdrs ... Updating user cinisys ... Updating user dimycom ... Updating user rsintrrs ... Updating user wwwkirlo ... Updating user lcon ... Updating user wwwtanjoretrails ... Updating user timeswebsite ... Updating user ionenhgs ... Updating user aavissurgical ... Updating user swarnimw ... Updating user nimishmar99 ... Updating user yesweus ... Updating user outdoorc ... Updating user cnclathe ... Updating user thecrown ... Updating user gupshuponchai ... Updating user globalpa ... Updating user pdfaorg ... Updating user pizzawine ... Updating user orphiusgroup ... Updating user meritpoi ... Updating user moolca99 ... Updating user rishabhp ... Updating user bnrco ... Updating user wwwshubh ... Updating user atdecor ... Updating user trellishorticult ... Updating user drashok ... Updating user poshlife ... Updating user rkenter ... Updating user astoncraft ... Updating user unitedindiaexpor ... Updating user hastle ... Updating user wwwvtcka ... Updating user nishnew ... Updating user parmar ... Updating user asteels ... Updating user parasram ... Updating user tradelink ... Updating user call4sit ... Updating user consolidatedcase ... Updating user kalpatarutech ... Updating user myacxprt ... Updating user gnunited ... Updating user midtele ... Updating user trance ... Updating user rslargeconcert ... Updating user nehawate ... Updating user smartspas ... Updating user designbuildblr ... Updating user allisonau ... Updating user tulipind ... Updating user impactint ... Updating user somnath ... Updating user arihantlifters ... Updating user wwwautomaticelec ... Updating user snowfog ... Updating user atpprodu ... Updating user modihindustan ... Updating user realsgrs ... Updating user sapowercontrol ... Updating user venkates ... Updating user sysaiims ... Updating user indartnc ... Updating user waterpr1 ... Updating user peeceet989 ... Updating user yourgood ... Updating user waterpr8 ... Updating user websepkj ... Updating user manvanth ... Updating user ionindia ... Updating user dreamwbs ... Updating user medhatechnologie ... Updating user panwarassoc ... Updating user n1imish89 ... Updating user connectjourney ... Updating user wagadmarket ... Updating user fatfree ... Updating user bonsaiph ... Updating user ragsjunr ... Updating user vapibanquets ... Updating user canitinguru ... Updating user familyad ... Updating user aadhyash ... Updating user blushh ... Updating user rzkveotz ... Updating user newgenni ... Updating user brandcar ... Updating user phulkari ... Updating user choco ... Updating user vijvents ... Updating user carecentre ... Updating user northern ... Updating user targetsa ... Updating user wwwcdscoachingde ... Updating user orchidth ... Updating user ghsskadungapuram ... Updating user vrdiaries ... Updating user smilecuredentalc ... Updating user tamrahalls ... Updating user shopmoreq8 ... Updating user efmindia ... Updating user wwwprimepr ... Updating user oehsindi ... Updating user expectationsbey ... Updating user zavasi ... Updating user gcsameri ... Updating user spaceinterio ... Updating user ahmed ... Updating user karmasecurity ... Updating user awery ... Updating user refleavm ... Updating user basement ... Updating user affordsdubai ... Updating user vedhacad ... Updating user nnrgplacements ... Updating user gptckkm ... Updating user digitali ... Updating user modulark ... Updating user bhcpin1s ... Updating user modularn ... Updating user foresigh ... Updating user harpalss0khi ... Updating user spillco ... Updating user propurban ... Updating user veclassi ... Updating user sanijet ... Updating user digitalmarketian ... Updating user garmentsqualityc ... Updating user wwwcajcs ... Updating user svelectro456 ... Updating user mahavir ... Updating user karshakajwala ... Updating user amtechpo ... Updating user marudharmetal ... Updating user edathanattukara ... Updating user fineedge ... Updating user jitoghat ... Updating user ncleatherhandicr ... Updating user rukmoniimpex ... Updating user mkconven ... Updating user lgpeti ... Updating user rkvideography ... Updating user skinlght ... Updating user methoaceme ... Updating user saiindus ... Updating user anuindustries ... Updating user ioncoin ... Updating user royalservicenet ... Updating user mabutyre ... Updating user latesttr ... Updating user ccfindia ... Updating user delhibylocals ... Updating user bitsandbites ... Updating user mightykitchens ... Updating user vcarephysio ... Updating user marriage ... Updating user simplypa ... Updating user skksumcf ... Updating user unicapitaadvisor ... Updating user achrekgp ... Updating user anunaadpublicsch ... Updating user acoint ... Updating user pathak ... Updating user wwwfaste ... Updating user lizawood ... Updating user wytdress ... Updating user fixallevents ... Updating user dialabus ... Updating user boostseoskills ... Updating user rakshaparadise ... Updating user jmdndtcm ... Updating user sandalcasa ... Updating user hotelnewvivekana ... Updating user indhuorg ... Updating user retent ... Updating user ashnades ... Updating user makenter ... Updating user geetaentpco ... Updating user saffronsteel ... Updating user technics ... Updating user proponweb ... Updating user paintaar ... Updating user billingadmin ... Updating user bhaighan ... Updating user giftmagic ... Updating user oldcask ... Updating user gloryburg ... Updating user celebri ... Updating user bmaquate ... Updating user bjcgylln ... Updating user globalagencies ... Updating user renusurimakeover ... Updating user wwwaharamservice ... Updating user bestdth ... Updating user ursengg ... Updating user peoplesafeco ... Updating user lehragro ... Updating user onelifesh28 ... Updating user designimpexco ... Updating user unitdrfm ... Updating user samyees ... Updating user tran123 ... Updating user virgindl ... Updating user mohanraja ... Updating user liffco ... Updating user api5lpipe ... Updating user finefoodcellar ... Updating user sumaya ... Updating user novelty87ratech ... Updating user unisyshr ... Updating user refrigeration ... Updating user dialaprint ... Updating user krismarc ... Updating user aacoonline ... Updating user wwwshahm ... Updating user sskfs ... Updating user masmara ... Updating user reselafb ... Updating user upendrab ... Updating user bytecook ... Updating user rhstrave ... Updating user prmcmcm ... Updating user gmascuda ... Updating user theloung ... Updating user gypmac ... Updating user smpatra ... Updating user lesliais ... Updating user welcomeadmin ... Updating user reliablh ... Updating user arpsindia ... Updating user ritepickhr ... Updating user jayeshmetal ... Updating user bilt ... Updating user gscpco ... Updating user reliabls ... Updating user energy989 ... Updating user sulochanaente ... Updating user lesicer123 ... Updating user shubhamacademy ... Updating user plushfsh ... Updating user jymindia ... Updating user powervis ... Updating user zebroxi ... Updating user topcareservices ... Updating user thecol ... Updating user ambikagl ... Updating user kdms7 ... Updating user kamlesh ... Updating user shardes ... Updating user ovbmtfuq ... Updating user oscaracademy ... Updating user eclatico ... Updating user siritale ... Updating user vijlumni ... Updating user sandsbluish ... Updating user choosepick ... Updating user leelares ... Updating user arianaso ... Updating user silpa ... Updating user kingsway ... Updating user iberiatech ... Updating user themiraclekidz ... Updating user waterp43 ... Updating user corbetcres898 ... Updating user dataaeoc ... Updating user smrutico ... Updating user peridotc ... Updating user wowinterior ... Updating user dexterslab ... Updating user ekkro ... Updating user sbssmta ... Updating user travelfo ... Updating user ilahimec ... Updating user gmktradi ... Updating user bramlmp ... Updating user succsmtd ... Updating user meublemtl ... Updating user clubrewards ... Updating user hotelsreeanandha ... Updating user investmf ... Updating user hotelmaris ... Updating user joyfulco ... Updating user hatkedukaan66 ... Updating user rutujaen ... Updating user wwnfcoin ... Updating user keralais ... Updating user sandeeps ... Updating user landmarkgroup ... Updating user plastoco ... Updating user pascofur ... Updating user mclinic ... Updating user siemens ... Updating user drusti ... Updating user ladakhtoday ... Updating user wwwkoshy ... Updating user princyelectrical ... Updating user solids ... Updating user kstakerala ... Updating user officialtiger ... Updating user bullswinner ... Updating user amruthas ... Updating user saninfo ... Updating user godhanma ... Updating user infobook ... Updating user sufiskills ... Updating user firstch ... Updating user nishuthoughts ... Updating user sunitascastle ... Updating user askit ... Updating user symbolenterprise ... Updating user giftworld4u ... Updating user sightplu ... Updating user straitsworld ... Updating user whitelistco ... Updating user hotelval ... Updating user koutonssinks ... Updating user muyanew ... Updating user i887vationitco ... Updating user shaadi4u ... Updating user cabsyatr ... Updating user jackb2b ... Updating user jvcindia ... Updating user polymer3 ... Updating user nitinnag ... Updating user visgroup ... Updating user ardpiti ... Updating user pradesht ... Updating user impexwel ... Updating user mmueujlw ... Updating user anticrime ... Updating user calisto ... Updating user worldbazaar88 ... Updating user srirampu ... Updating user raksha45454 ... Updating user ametanew ... Updating user brainmiracle ... Updating user rajmohan ... Updating user eupheuslearning ... Updating user imaginestore ... Updating user portalba ... Updating user web4chennai ... Updating user tipstricks ... Updating user sharenet ... Updating user cheappr2 ... Updating user assetzsoulandsoi ... Updating user abhyu ... Updating user wxopsbcb ... Updating user ssdhco ... Updating user newsonline7 ... Updating user mahalaxmi ... Updating user onezoefirstaid ... Updating user officesp ... Updating user yogeshme ... Updating user offerskq ... Updating user opchainscom ... Updating user igniteindia ... Updating user vikashmetalindus ... Updating user rajgarhi ... Updating user intevents ... Updating user lootmystuff ... Updating user apexemot ... Updating user essemindu ... Updating user indiatraders ... Updating user polymerc ... Updating user theomanvisa ... Updating user holidaynew ... Updating user ohwowadmin ... Updating user udaipurebazar ... Updating user bmssociety ... Updating user sourasht ... Updating user unicables ... Updating user espertopayroll ... Updating user veloxconnect ... Updating user kendriyakaram ... Updating user finorbit ... Updating user sight ... Updating user urmiinfotech ... Updating user bubblkdz ... Updating user wwwinnovativehom ... Updating user tikonaisp ... Updating user schoolli ... Updating user sreejayg ... Updating user viratraimpex ... Updating user dhinakar ... Updating user intlumni ... Updating user ecocarer ... Updating user healthfi ... Updating user yrrequmy ... Updating user kpbf ... Updating user oxyzonhd ... Updating user prakshgr ... Updating user stanlents ... Updating user gamutbuild99 ... Updating user dkindinfra ... Updating user hotelnatraj ... Updating user emptypockettrip ... Updating user fame24xc ... Updating user subbies7654 ... Updating user cegczmhe ... Updating user brandras ... Updating user shivartefacts ... Updating user vmpcompo ... Updating user n88numa ... Updating user clinic7428 ... Updating user siddhivinayakuro ... Updating user hrdayout ... Updating user plots ... Updating user egovern ... Updating user gsccasti ... Updating user tbhwc ... Updating user wildlife ... Updating user blockpanchayat ... Updating user ahcompany ... Updating user eudaipur ... Updating user classicd ... Updating user revolut ... Updating user torrent77 ... Updating user arihantc ... Updating user alzayanconstruct ... Updating user bothrame ... Updating user diligntc ... Updating user wwwvidhiinfotek ... Updating user korattys ... Updating user karshikam ... Updating user bajajbui ... Updating user abiramimarriageh ... Updating user clubswapna ... Updating user cbitcore ... Updating user beausilk ... Updating user pentagon ... Updating user rashtriyaawasdiv ... Updating user saviiour ... Updating user brainprn ... Updating user rmhenterprisesin ... Updating user missico ... Updating user rolibookscom ... Updating user wwwsutar ... Updating user mahamaya ... Updating user fast ... Updating user bigbo7eb ... Updating user shosuga ... Updating user hatchotv ... Updating user stateanalyst ... Updating user elecbhagya ... Updating user justicelovers ... Updating user blogchdd ... Updating user junoesqu ... Updating user aurumgarden ... Updating user atlantis ... Updating user revampst ... Updating user fashionf ... Updating user dinesh ... Updating user photosbysarang ... Updating user cyylvotd ... Updating user krupatra ... Updating user vaidarshi ... Updating user crane ... Updating user eiraindi ... Updating user sulabhcentre ... Updating user herballi ... Updating user saurasrajkot ... Updating user lenyadri77 ... Updating user keilight ... Updating user tapasvigroup ... Updating user wwwtoowoombaurol ... Updating user vinitronic55 ... Updating user vaktekpm ... Updating user bookyogastudio ... Updating user purvakwb ... Updating user uniquesolns ... Updating user tomtips ... Updating user ideaseo ... Updating user isao ... Updating user dmetalfa ... Updating user vesskaly ... Updating user unusua ... Updating user tcjvepzl ... Updating user rejuveyo ... Updating user ettplnet ... Updating user mandoratr ... Updating user shilpaka ... Updating user fgortava ... Updating user travelgr ... Updating user moonlite ... Updating user hoteljagdish ... Updating user aeccs ... Updating user teluguem ... Updating user creentin ... Updating user wwwsunri ... Updating user sasthaoil ... Updating user flostarwires ... Updating user tangenttechnolab ... Updating user accessoriezindia ... Updating user darussalamenglis ... Updating user stechengineers ... Updating user wwwajitp ... Updating user nbhau ... Updating user techinsy ... Updating user govindindustries ... Updating user srivishnu ... Updating user softusa ... Updating user amberent ... Updating user mobiappy ... Updating user sonidesigner ... Updating user onestoco8 ... Updating user rioeasycollect ... Updating user hoteldev ... Updating user modaluci ... Updating user vbitplacemoff ... Updating user pentago ... Updating user modaluce ... Updating user flowmdpr ... Updating user onlidfsv ... Updating user shivshak ... Updating user usaimpor ... Updating user vcaindia ... Updating user redhatrealtyco ... Updating user mythridevelopers ... Updating user skevents ... Updating user yashmoto ... Updating user tandoor ... Updating user meiliayur ... Updating user destinationmah ... Updating user shafatoo ... Updating user wwwrudra ... Updating user wwwbricksdemo ... Updating user drsanjaybhatia ... Updating user gdfoods ... Updating user princeph ... Updating user jclinmed ... Updating user maguscars ... Updating user indiaholiday ... Updating user sahayama ... Updating user gcvkendra ... Updating user munotgrp ... Updating user greenlifeled ... Updating user fantasyquotes ... Updating user chanakyacollegeu ... Updating user mydesigndocket ... Updating user deificco ... Updating user prasangplanner ... Updating user chinnakodur ... Updating user satyajtv ... Updating user jangidgr ... Updating user firstspc ... Updating user hugheseducation ... Updating user navinson98 ... Updating user sissaini ... Updating user lifyhub ... Updating user sdservicesco ... Updating user varsha ... Updating user davja ... Updating user jayasaipg ... Updating user maruthihomeappli ... Updating user greentop ... Updating user ambience ... Updating user technomations ... Updating user assetz63eastco ... Updating user srmrindia ... Updating user uniqueip ... Updating user beachgamesfedera ... Updating user minatrad ... Updating user vecheap ... Updating user predictimarriage ... Updating user electricalunsl ... Updating user velosave ... Updating user prudence ... Updating user eeposco ... Updating user intcedee ... Updating user octaltechnologie ... Updating user inartdes ... Updating user manibhadra ... Updating user impex ... Updating user shreebnd ... Updating user spayaorganics ... Updating user tradain ... Updating user coremiss ... Updating user shreesa ... Updating user maahingu ... Updating user gulmoharbyanupma ... Updating user tusharka ... Updating user hotelredrose ... Updating user enkorindia ... Updating user symtest ... Updating user lawyersv ... Updating user lansingbazaar ... Updating user valiyakadayil192 ... Updating user jasontips ... Updating user indiaexpert ... Updating user pjenggfa ... Updating user techalrt ... Updating user yarab ... Updating user indianyo ... Updating user cncmachi ... Updating user icsm ... Updating user nucleuslifestyle ... Updating user karthikeyapackag ... Updating user windowstechnolog ... Updating user absolups ... Updating user karmaene ... Updating user hipurero ... Updating user jclin ... Updating user iclin ... Updating user erodenationaltra ... Updating user vecheapa ... Updating user cyandemo ... Updating user bdh ... Updating user royalpet ... Updating user paying ... Updating user travecoi ... Updating user jkacnewsportal ... Updating user drshajimri ... Updating user coolinga ... Updating user ptcomplexpmna ... Updating user vikastoo ... Updating user thegadge ... Updating user modernfu ... Updating user mysewa ... Updating user amerilev ... Updating user biocoal ... Updating user gpinsk7654 ... Updating user ssalke ... Updating user shikharn ... Updating user vijayacademy ... Updating user lacasa ... Updating user deliciac ... Updating user ektadeve ... Updating user muyaniworld ... Updating user madhuban ... Updating user srivanie ... Updating user cheapame ... Updating user toletlist ... Updating user thewbdcr ... Updating user shreetra ... Updating user towardsc ... Updating user wwwgreetsavvy ... Updating user anupurthermalpr ... Updating user sportsf1 ... Updating user timeshealth ... Updating user kaimindia ... Updating user metalpressing ... Updating user dsom ... Updating user yogmeru ... Updating user alfarooq ... Updating user interconcepts ... Updating user bikashfa ... Updating user panachewebsite ... Updating user busymind ... Updating user mvarchitects ... Updating user helixgncb ... Updating user thakurenterprise ... Updating user jaybhave444 ... Updating user bonitoresearch ... Updating user dhanoo ... Updating user joganibr ... Updating user ksmb ... Updating user anicoint ... Updating user websenuk ... Updating user wwwdiamondoilind ... Updating user snakeboa ... Updating user royalf ... Updating user sportsfo ... Updating user lrtlogis ... Updating user rakshatowersnoid ... Updating user atmasamm ... Updating user soocoinn ... Updating user lifeguardmed ... Updating user tasainc ... Updating user whatznxt ... Updating user vsccorp ... Updating user regalsignagecity ... Updating user bharatre ... Updating user dharamfa ... Updating user charcoal ... Updating user vijayo ... Updating user vividhseva ... Updating user tujarsharief ... Updating user uscheapp ... Updating user ruma ... Updating user rightliving ... Updating user indiarotoplast ... Updating user avonmarketing ... Updating user yatrizon ... Updating user mssinghandassoci ... Updating user httphopeforheart ... Updating user krubaaassociate ... Updating user kalyaniasso99 ... Updating user protectiveplasti ... Updating user vysyal ... Updating user yapsnbelly ... Updating user akeeo ... Updating user essennov ... Updating user superfin ... Updating user taekwondoindiaco ... Updating user prestoli ... Updating user rstatana ... Updating user nknmecha ... Updating user gravitasin ... Updating user pelicans ... Updating user winntus ... Updating user haiyahcm ... Updating user shreejicrpn ... Updating user sasirate ... Updating user wwwbmsbuilders ... Updating user sharmiladevi ... Updating user dheerajmishra ... Updating user kitskdad ... Updating user bonyanunited ... Updating user guruhost ... Updating user schemat ... Updating user hispeedservices ... Updating user slndailyneeds ... Updating user solankev ... Updating user sharemar ... Updating user saprasarchitects ... Updating user suchitra ... Updating user hotelramanpalace ... Updating user yashiin ... Updating user masterlinu3 ... Updating user quickcom ... Updating user chetanan ... Updating user hitechem ... Updating user matrisur ... Updating user rubbercables ... Updating user srianjaneyam ... Updating user galleria ... Updating user abhinavj ... Updating user usenear ... Updating user geniuski ... Updating user webdelhi ... Updating user wecare4a ... Updating user sbconsul ... Updating user liamtips ... Updating user karikkadtemple ... Updating user karthikcatering ... Updating user ecosafec ... Updating user eupheus ... Updating user dna3654 ... Updating user fitnessempire ... Updating user teerthtravel ... Updating user fishnchi ... Updating user aoihorgo ... Updating user institutekpl ... Updating user lrsm6001club ... Updating user bjscieco ... Updating user hazraeng ... Updating user mfysuc ... Updating user innovativeitsolu ... Updating user lineofcommerce ... Updating user httpsunfoodind ... Updating user ayssvary ... Updating user powerpress ... Updating user vesubmit ... Updating user fansct ... Updating user mumbaies ... Updating user unbrakofasten ... Updating user guesthouse ... Updating user betuloil ... Updating user lavishte ... Updating user drishtijewellers ... Updating user weddingphotodelh ... Updating user fubartec ... Updating user serviceandsmile ... Updating user drpoonam ... Updating user siriango ... Updating user privatlev ... Updating user directi ... Updating user timeoutd ... Updating user deepast ... Updating user thecar ... Updating user perfect ... Updating user rgmvents ... Updating user kumarmoo ... Updating user kactravels ... Updating user surrogac ... Updating user nutkhat ... Updating user orratorl ... Updating user btxbarte ... Updating user linnovatetech ... Updating user singhnal ... Updating user fcgmiddleeast ... Updating user powerledindia ... Updating user bookaurl ... Updating user greenturn ... Updating user cmrhplc ... Updating user shopxoe ... Updating user gandbemployment ... Updating user silviherbals ... Updating user stanlmni ... Updating user uprisesolutions ... Updating user taxgranth ... Updating user rishtymn ... Updating user medialog ... Updating user kssphoto ... Updating user ionlimited ... Updating user thedispatch ... Updating user locdis ... Updating user mahiportable ... Updating user wwwbabupillows ... Updating user leenaf ... Updating user ravishan ... Updating user nationalfir ... Updating user rgmumni ... Updating user drshacheechildps ... Updating user kalyanam ... Updating user himaniandanjalis ... Updating user wwwmoonlighthote ... Updating user thenicollege ... Updating user samskruthi ... Updating user satya ... Updating user subsaharantech ... Updating user wwwdrvtj ... Updating user tras ... Updating user phoenixgrs ... Updating user shaadim1 ... Updating user pravasis ... Updating user tamilnad ... Updating user kalpnkht ... Updating user ktiinc ... Updating user sevakendr ... Updating user vpnair ... Updating user ultimat ... Updating user brandbboutiques ... Updating user sands ... Updating user infoway ... Updating user ionwt ... Updating user geplmlm ... Updating user thetwist ... Updating user orangeschools ... Updating user lasercnc ... Updating user sianexim ... Updating user kritil ... Updating user pvhrdfc ... Updating user bdminx5h ... Updating user supertechpower ... Updating user sanjoymukerjipsy ... Updating user tapasam ... Updating user alphaservice ... Updating user yashintl ... Updating user ruvanthi ... Updating user infomaster ... Updating user pktubes ... Updating user dieselgenerat ... Updating user brekkiein ... Updating user bulkpro1 ... Updating user annaif ... Updating user octul ... Updating user controltrix ... Updating user dhelvon ... Updating user leagomania ... Updating user offic123 ... Updating user magoverseas ... Updating user sicassa ... Updating user nccionline ... Updating user hashingitout ... Updating user rkenergysmartser ... Updating user aggexpor ... Updating user produnlr ... Updating user zorbadental ... Updating user citymarketing ... Updating user drgurukul ... Updating user wwwsundarin ... Updating user hostelindehradun ... Updating user aveegrou ... Updating user amedo ... Updating user jayantht ... Updating user wonderxindia ... Updating user serenity ... Updating user gcareinc ... Updating user bulkprot ... Updating user spectrumclassesc ... Updating user indiain ... Updating user thereeds ... Updating user dukhbhanjan ... Updating user chitraco ... Updating user pcplgmu2 ... Updating user wwwoshin ... Updating user wwwdivycorporati ... Updating user hsindia ... Updating user sawanfib ... Updating user jazzytipz ... Updating user balajisafetynet ... Updating user reliable ... Updating user disha ... Updating user wheyisol ... Updating user bdfco ... Updating user vplastindia ... Updating user goldchick ... Updating user citybazaarmetro ... Updating user tribusin ... Updating user accent ... Updating user electrocontrol ... Updating user sahityasetu ... Updating user solarit1 ... Updating user ksinstit ... Updating user abaxialorg ... Updating user wwwwater ... Updating user skimedia ... Updating user umerdriv ... Updating user qube3 ... Updating user hifisolutions ... Updating user trade89 ... Updating user hrdco ... Updating user udaipurleatherar ... Updating user udaipurfoodbazar ... Updating user kaybeegroup ... Updating user valuevacations ... Updating user web24jpf ... Updating user rahulcon ... Updating user apexia ... Updating user saferfzcm ... Updating user happywed ... Updating user tounetsu ... Updating user romesh ... Updating user sinohote ... Updating user tresorsystems ... Updating user kaniyan ... Updating user wheyiso2 ... Updating user gokulamb ... Updating user tradersbazzar567 ... Updating user indiantrendzcom ... Updating user shripjos ... Updating user icoreconcretes ... Updating user cbshorfa ... Updating user blogdlfpromenade ... Updating user sbbschool ... Updating user nethoorh ... Updating user annapoorani ... Updating user parkmana ... Updating user univekze ... Updating user thekalakriti ... Updating user smpenterprises ... Updating user earthpoorna ... Updating user faireein ... Updating user dietpalakkad ... Updating user alumniucc ... Updating user startoursudaipur ... Updating user wwwrajeshlenin ... Updating user sondindi ... Updating user roadassist ... Updating user cyanicsolution ... Updating user cosmicalproducti ... Updating user omnipointgt ... Updating user korean ... Updating user dragontypes ... Updating user vniyptuu ... Updating user dreamlehladakh ... Updating user lightech ... Updating user techesbq ... Updating user mallikar ... Updating user vikas ... Updating user privatelabelwhey ... Updating user visprime ... Updating user satymgrp ... Updating user thecam ... Updating user innersec ... Updating user usefqhck ... Updating user msrss56789 ... Updating user mormedic ... Updating user stanartp ... Updating user ucctesting ... Updating user madrascars ... Updating user deccan ... Updating user travelvia845 ... Updating user creamica ... Updating user mavensys ... Updating user vedevb5h ... Updating user random8791 ... Updating user mumbaimedica ... Updating user kadanadscb ... Updating user peeapune ... Updating user quikmail888 ... Updating user waterparkswapna ... Updating user cborg ... Updating user cashcropagro ... Updating user thakerand ... Updating user shahpare ... Updating user stateobserver ... Updating user srutiindia ... Updating user livingoffroad ... Updating user tirthanvalley ... Updating user enablegroup ... Updating user wwwherboflora ... Updating user ssasteel ... Updating user mkplorg ... Updating user izeetek ... Updating user chesaden ... Updating user pcsupporthelp ... Updating user aiectedu ... Updating user tlcrippl ... Updating user yhsw ... Updating user laqsvents ... Updating user hotelambika ... Updating user stmichel ... Updating user charyad ... Updating user opilco ... Updating user kashmirnewsline ... Updating user kushalme ... Updating user hotelshi ... Updating user yadavsamajco ... Updating user secaindi ... Updating user paclcustomers ... Updating user mailszone ... Updating user apoliticalviews ... Updating user tvsfastener ... Updating user suprasteelindia ... Updating user fancyyar ... Updating user komalsarees ... Updating user shadowdt ... Updating user riaconso ... Updating user deepak7654 ... Updating user hkps ... Updating user rhgroup8 ... Updating user ramindia ... Updating user kiroliin ... Updating user ssonlfa1 ... Updating user bigstar ... Updating user sentinelelectic ... Updating user rfsdelhi ... Updating user stanledu ... Updating user wellness ... Updating user techncphr ... Updating user emantra ... Updating user green4in ... Updating user sri396sg ... Updating user blood4u ... Updating user usawheyi ... Updating user veergold ... Updating user zakirs ... Updating user smartbooks ... Updating user utsav876230 ... Updating user aonegrou ... Updating user leotatto ... Updating user royalindiancusto ... Updating user savinsys ... Updating user sriveena ... Updating user karmasgn ... Updating user pmakhari ... Updating user shree2 ... Updating user topdogk9 ... Updating user mokeup ... Updating user classtip ... Updating user jsunfods ... Updating user tokyopla ... Updating user trywi ... Updating user nisascar ... Updating user viplshaw ... Updating user w3squad ... Updating user kinshipindia ... Updating user triptracs ... Updating user wwwinfinityinfra ... Updating user kanakdin ... Updating user indiadigitalmark ... Updating user draqua ... Updating user progress ... Updating user bottlenp ... Updating user mbrwa ... Updating user pranavap ... Updating user latestmensfashio ... Updating user clarktou ... Updating user kkenter ... Updating user dssgroupindia ... Updating user anmolpre ... Updating user vidphotos ... Updating user perfecto ... Updating user cnanfvcl ... Updating user calltaxico ... Updating user precious ... Updating user kitchntn ... Updating user kushmesh254 ... Updating user sstaticglobal ... Updating user wwwpurecrop ... Updating user helpingcitizenco ... Updating user visualsoft888 ... Updating user wwwensol ... Updating user thedenta ... Updating user ssrompka ... Updating user ragnol ... Updating user pillrnvs ... Updating user smoothie ... Updating user auctions ... Updating user msapptec ... Updating user highland ... Updating user prathame ... Updating user glorious ... Updating user hotrisk ... Updating user uniquesi ... Updating user sunlightmetalind ... Updating user emprace ... Updating user sulabhsanitation ... Updating user alumatec ... Updating user sardanalabs ... Updating user nice834u ... Updating user dunhillresear ... Updating user bholaente9898 ... Updating user ietrade ... Updating user sdvlab ... Updating user yashhand ... Updating user doonheri ... Updating user ajapaipmc ... Updating user unitechi ... Updating user venusavr ... Updating user hind7654 ... Updating user reconhyd ... Updating user migrate ... Updating user teamwork ... Updating user vashisht ... Updating user admissioncoordin ... Updating user samratha ... Updating user trinity ... Updating user worldwideshippin ... Updating user stockmar ... Updating user luckyint ... Updating user sknabi ... Updating user homakujr ... Updating user scrutiny ... Updating user makemyblog ... Updating user karneeti ... Updating user znmdholi ... Updating user tailortr ... Updating user vayubodh ... Updating user thexpert ... Updating user t8uvic99gineers ... Updating user shrecklb ... Updating user bloomdys ... Updating user kswsorg ... Updating user sparklgz ... Updating user vrgcrtlw ... Updating user olympusc ... Updating user myspaced ... Updating user hajjmrht ... Updating user vefreedi ... Updating user bhaktaba ... Updating user bajajson ... Updating user ultra ... Updating user khabarlive ... Updating user pharmachemequipm ... Updating user qpoles ... Updating user iolitegr ... Updating user evelynssecrets ... Updating user right2search ... Updating user puthranlogistics ... Updating user tigerhan ... Updating user jayveermetal ... Updating user coating ... Updating user wwwbloomchennai ... Updating user vimenter ... Updating user pearlpetnet ... Updating user automoti ... Updating user oneindia ... Updating user avrexexp ... Updating user mangalms ... Updating user sevenele ... Updating user spicewares ... Updating user tettraaquarium ... Updating user pacificflame ... Updating user ndacoachingdehra ... Updating user siddhasolutions ... Updating user evoli7sk ... Updating user wwwhphou ... Updating user sulabhinternatio ... Updating user rddigital ... Updating user mutualfundinvest ... Updating user jpnceac ... Updating user avihoste ... Updating user mahatma ... Updating user rmglobaltrust ... Updating user manekvk ... Updating user kudorajasthan ... Updating user srishtidesigns ... Updating user fabi ... Updating user cashlessbazaar ... Updating user careerskype ... Updating user wwwdadas ... Updating user pratapg ... Updating user generato ... Updating user altaiclp ... Updating user firstpick ... Updating user mediteksystems ... Updating user tejasentvapi777 ... Updating user onlinestore ... Updating user shivom ... Updating user nirvabvl ... Updating user amanmark ... Updating user yrbabnaq ... Updating user indianmo ... Updating user builder ... Updating user thermocoleindia ... Updating user aglgorakhpur ... Updating user sforce ... Updating user srcdeobi ... Updating user grfarmfresh ... Updating user pmacademyindia ... Updating user kuwaitwebsitedes ... Updating user azioxyne ... Updating user mgheewalametals ... Updating user kangenindia ... Updating user mcintyre ... Updating user thejuswomens ... Updating user sbmbeari ... Updating user blog7mm913 ... Updating user nivipmiv ... Updating user familchs ... Updating user admin123 ... Updating user kavyasolutions ... Updating user cgalumin ... Updating user bapfltd ... Updating user sirjeefa ... Updating user kkkforgi ... Updating user nvoyeducation ... Updating user anmoltek ... Updating user worldb2b ... Updating user domaintodesign ... Updating user frontlinepackwor ... Updating user clapbox98 ... Updating user ssenterp ... Updating user bluezind ... Updating user fitkits ... Updating user ladakhifoods ... Updating user rashtri ... Updating user hotelci1 ... Updating user vedir83 ... Updating user hosiery ... Updating user teamtele ... Updating user fremfarm ... Updating user citizen ... Updating user sanskrit ... Updating user vivekshi ... Updating user paragworldwide ... Updating user thepeynt ... Updating user vasugrou ... Updating user vijayportablecab ... Updating user supremng ... Updating user furnishe ... Updating user kcemporia ... Updating user janakelectric ... Updating user sivaelec ... Updating user readaddi ... Updating user parmars ... Updating user wwwordinaryartco ... Updating user bhakti ... Updating user seedewbn ... Updating user aayushi ... Updating user nirman765 ... Updating user wanderlustyourtr ... Updating user kmoxyzpj ... Updating user glamourpropertie ... Updating user parakkattu ... Updating user vesub83 ... Updating user oxycea ... Updating user vesub89 ... Updating user stmarysplacet ... Updating user cstubesp ... Updating user sightp2 ... Updating user nbspvtld ... Updating user leximwbc ... Updating user cosindia ... Updating user gpspayyoli ... Updating user daralajyal ... Updating user ksuper ... Updating user cbtnt ... Updating user infenion ... Updating user relexindustries ... Updating user uspzone ... Updating user wwwforwa ... Updating user drvjin ... Updating user oakvat ... Updating user liveolivefilms ... Updating user haveahea ... Updating user airporthotelanda ... Updating user vsclegal ... Updating user pushpakholidays ... Updating user doonshik ... Updating user mdcbempl ... Updating user arorandt ... Updating user drslimsp ... Updating user kuttichattan ... Updating user snpadmin ... Updating user coolpuppies ... Updating user wwwpreet ... Updating user fishnc ... Updating user rajesh ... Updating user golgappatravel ... Updating user dhakaren ... Updating user bhaktis ... Updating user mypris ... Updating user craftshza ... Updating user gnresdin ... Updating user civilizate ... Updating user sheetali ... Updating user fabricstore ... Updating user webigrow ... Updating user stairway ... Updating user mkerental ... Updating user mrsteelindia ... Updating user ananthula ... Updating user globalin ... Updating user walidrental ... Updating user luvlancet ... Updating user ccttudaipur ... Updating user sphoolumni ... Updating user sitcotsr ... Updating user shubhams ... Updating user kidsrmcp ... Updating user patracod ... Updating user bharatyatratour ... Updating user gtbtrans ... Updating user scoolshop ... Updating user mjtraders ... Updating user ashirvad ... Updating user universf ... Updating user prakashsteel ... Updating user veuschea ... Updating user universa ... Updating user quickfre ... Updating user mierjs ... Updating user ratheesh ... Updating user go4wbcon ... Updating user sibhatec ... Updating user alikkalg ... Updating user sooryodaya ... Updating user dineatmaroush ... Updating user otscab12345 ... Updating user truevlvi ... Updating user alliance ... Updating user eternal ... Updating user approclick ... Updating user ssinstru ... Updating user bssonlnc ... Updating user reviewam ... Updating user ganeshmn ... Updating user krafdntl ... Updating user yatrapundit ... Updating user vapiurologycentr ... Updating user sventerprise ... Updating user usweight ... Updating user doondefencecoach ... Updating user wssdnllp ... Updating user ncqlrtak ... Updating user artspace ... Updating user neotricp ... Updating user swamysam ... Updating user wendors ... Updating user panachec ... Updating user solarpinnovation ... Updating user imperial ... Updating user uniqueda ... Updating user bscinter ... Updating user ivisiona ... Updating user epsilon99 ... Updating user eliteglo ... Updating user pay4off ... Updating user mdpapad53245 ... Updating user banerjee ... Updating user mananenterprises ... Updating user magnanim ... Updating user legend123 ... Updating user busin3xi ... Updating user reenvacm ... Updating user shriprasad72 ... Updating user mkrt ... Updating user mahekste ... Updating user vsskeral ... Updating user envisbe ... Updating user redarrow ... Updating user rodidabi ... Updating user cuedigit ... Updating user natyanaz ... Updating user rahul ... Updating user jyoticon ... Updating user leehplhr ... Updating user dieseltekservice ... Updating user dadadadihelpfoun ... Updating user dietshak ... Updating user veusawhe ... Updating user kolamindia ... Updating user mpksuites ... Updating user steelgen ... Updating user tcrynot ... Updating user silmcons ... Updating user merrygol ... Updating user aadidiam ... Updating user shreeval ... Updating user jjsales ... Updating user letushir ... Updating user qutbulma ... Updating user pizzamanco ... Updating user usabiopr ... Updating user idhantatek ... Updating user kingston ... Updating user bixyhrsp ... Updating user mokshpromotions ... Updating user xtraindia ... Updating user pushkarin ... Updating user abmtech ... Updating user admorebi ... Updating user mytravlp ... Updating user highcarev ... Updating user cpischool ... Updating user sulnew ... Updating user galaxmsl ... Updating user aaradhanametals ... Updating user svitcott ... Updating user navjee ... Updating user httphotelkailash ... Updating user greenideahunt ... Updating user shop4off ... Updating user visasrus ... Updating user deborend ... Updating user osadeal ... Updating user clicktog ... Updating user vmobibmt ... Updating user skenglish ... Updating user cellsafeind ... Updating user telmatma ... Updating user richsource ... Updating user methodlumni ... Updating user simplocservices ... Updating user fluor ... Updating user hotelrkr ... Updating user florah2o ... Updating user vyasias ... Updating user enhancecreations ... Updating user ishwarbhakti ... Updating user hotelcolumbus ... Updating user sociologyofsanit ... Updating user webinfo ... Updating user knowllcr ... Updating user urmiihnw ... Updating user webdemo ... Updating user aasinasia2018 ... Updating user patricma ... Updating user nikhilmahajan ... Updating user elmsmiercollege ... Updating user dconco ... Updating user httpamilitaryaca ... Updating user wvtelevators ... Updating user time2joy ... Updating user ldarc888 ... Updating user blustal ... Updating user hymndgtl ... Updating statuses of users ... … done. Fix mailman RPM directories … … PID 534069 Fix mailing list perms … … PID 534074 Aligning modsec config to Whostmgr - Whostmgr version 11.64.0.42 - Whostmgr supports conf.d/modsec location - No change necessary Waiting for “httpd” to stop ………finished. infocmp: couldn't open terminfo file /lib/terminfo/u/unknown. The subprocess “/usr/bin/infocmp” reported error number 1 when it ended. at /usr/local/cpanel/Cpanel/Terminal.pm line 119. httpd stopped successfully. (XID ss6nyy) The “httpd” service is disabled. Setting /home permissions to 0711......Done Setting permissions for.....directi … symtest … fabrich … viplshaw … travecoi … corbetcres898 … furnishe … kafetale … quansys … sportsfo … optimumf … spectratech … bdintl … infoashu … kedhari … pizzamanco … krisprjc … vmobibmt … huntrco … saurabhelectric … fidvirefrigerati … approclick … maha … chitraco … jyoticon … gdsschoo … cuedigit … vaidikindiaorgan … rajesh … brandbboutiques … drslimsp … gulfocean … everytik … guruhost … westgateindia … cads … munishgroups … gunturweb … mkrt … predictimarriage … krupatra … dataaeoc … mpksuites … perfecto … lavishte … bestdth … citizen … altecwin … parkmana … letushir … padamplastics … oodizwbm … percypestonji … harshada … oakvat … httpaccrofab … shreebnd … lilbllrn … panwarassoc … jackb2b … purvakwb … bharatoss … hktopecom … laktas … waterp23 … samajshi … admin123 … slelectr … migrate … dimorain … vanityindia … anoxmodular … reliable … engineer … bonsaiph … studiodna … tirupati … maitrima … usefqhck … paramdha … saferfzcm … ashnades … rkenter … tasant … sonicagl … detymon … hindusta … avoor … arddcco … tokyofin … skments … socia8gt … joyful2 … unikntrp … bullishb … confiden … vijayo … izeetek … dmehrotra … boyshostelnearup … rjlights … shannonelectric … offerskq … aipsorg … aser882gp … hemtraders … sirjeefa … carbongym … mdpsitc … sourasht … triptoet … satyamcy … hershchad … wildlife … staent … tropical … sanijet … annaif … wwwleonutrition … unifiedsolution … sibhatec … hiralal … busymind … joinlicindianow … snpadmin … indianex … saptosij … vcaindia … cashlessbazaar … geetaentpco … mydreamh … insolvency78 … green4in … alliance … stellant … pdcclub … ultimate … carpetsh … mokeup … rkvideography … rahul … manikaran … googuladventure … dravidia … travelmi … transplanthair … agripestcontrol … hughed3b … modaluce … maheshparab … hornbillgroup … travelfo … travele … cheappr2 … annapoorani … statustr … amberent … aquaengg … pearlpetnet … opnppositive99 … implysol … drpoonam … cpischool … limrawea … trek … obituaryads … mukesh … wwwselfiehome … rtscabs … affordsdubai … thehubho … sbceco … vesub83 … ghasi123 … arihantlifters … kanakdin … privatlev … lifeelec … landcom … virgindl … laqslumni … airflow … powers … wwwbricksdemo … blogdlfpromenade … vijayacademy … mahalakshmibuild … controltrix … haircolormate … venkatar … rhiaivfm … wwwbabupillows … satlore … dineatmaroush … atozcomm … citybazaarmetro … indianfantasyaut … wwnfcoin … kosmoselectric … dreamlehladakh … sr565465 … bookmytifin … ayssvary … uprisesolutions … thefanta … jorawar … vivekshi … jpnceac … hoteldev … wwwensol … redarrow … phoeadmin … multimed … landmarkgroup … organicfert … privat832 … pcvisor … karyanao … vishalad … fcgmiddleeast … spandan … suptech … c1kam9l6 … dvvdsbvn … rktco … ultimtln … rudrakshclinic … moonlite … kolamindia … flywithkrrish … joganibr … starcoat … bluemoon … krishnav … mythicalcreature … yesconnect … alikkalg … kmtindia … bikashfa … reliabls … sharmiladevi … northern … wwwmyinsuranceex … sissaini … mandoratr … wwwforwa … vsclegal … vematrim … jasontech … bluezind … sjnxmras … priyasnd … hefmnew … fabcon … eflash … mkpoultr … sankalp4awarenes … creamica … infracom … yogeshcrescent … airkingb … aacarren … edathanattukara … websenor … worldbazaar88 … artofstudying … triistar … worldtek … impexwel … greenideahunt … ethos … oscarperfumes … eagleinteriorwor … thenicollege … stechengineers … nanoceut … abhinavj … zigmak … navjee … dtpco … kmoxyzpj … doonshik … advashishshelar … goodmorn … tusharka … mallikar … bullswinner … jkenggwo … produnlr … lehrafue … torrent77 … travelme … maahingu … oscarblade … eventcon … jeoind … rioguildford … akeeo … greenpwr … vbitaluni2 … vasugrou … studentphamplet … picassoshirts … rajupgxh … trance … rgmments … ambience … arsarey … cyantemp … atcorpindia … kmsgroup … devyesaranam321 … troverin … sbmbeari … sanctumw … tettraaquarium … kiosence … kcemporia … kewswitchgear … valuesgi … unisyshr … corpo … smaratha … dechindia … christianbasket … jayveermetal … latestmensfashio … parakkattu … cineaudo … wheyiso2 … gevyal3f … vadapala … shrimari … velosave … rfsdelhi … drtomar … tandoor … cloud7he … wlmweoyx … dhobiservice … stateanalyst … wwwordinaryartco … korattys … calisto … shivamrealest … ktsfabri … eeposco … charyad … mscb … girlswritepost … atpprodu … mohanraja … kaybeegroup … maxfresh … xplotica … oscorp … pentago … rddigital … sharec … ohwow … bhaktaba … eveningbazaar … inkredia … wwwkvbpa … volvie … cupadmin … sivaelec … huldistr … wwwtntrails … piofl … propurban … nandiinfra99 … sanindco … exigoent … smartspas … ariseprint … webigrow … thsacin … hazraeng … fubartec … konarkproject … veameric … kpbf … solarit1 … globusoverseas … rkeplco … myacxprt … indtutor … kalkiindia … tras … trinitya … makenter … vrgcrtlw … nehawate … emediwrite … multyflylounge … hotelredrose … sawanfib … hotelrkr … tapasvigroup … parekhex … jasontips … thecar … radiantp … muyaniworld … korean … vetechi … sulabhinternatio … bhansalimetalsin … chennaimedtour … bicyclep … universa … spicewares … familyad … indianba … waterpr8 … cinisys … boscage … zerolapf … happywed … chetanan … homecareservicec … heartbeatsnow … freightmangalam … gdshelte … genesisg … pavithrans … uttrust … nvoyeducation … leela … qube3 … vijvents … triplexe … revolut … windowstechnolog … resolute … eshoppers … aurumgarden … peppermi … rtvbuild … yashintl … roopal … kecrxwsq … magazine … raksha45454 … krishabh … skevents … anmolpre … vfindsolutions … patracod … uspzone … aeccs … sightplu … cxodigest … erodenationaltra … vecheap … times6tp … ananthula … projectscart … firstspc … prolanx … jazzytipz … buymxdrs … shahpare … plugandp … sriramconstructi … nilkanth … malharpu … bhakti … healingt … worldaround … groupalb … gupshuponchai … pentagon … america … vinod555 … sands … alumatec … jjsales … wwwgujar … mediaove … jwrhk … papercupsindia … huntr … lacasa … unixsol99 … srivenai … accessoriezindia … virgctl … wwwprimepr … indiasho … firstpick … htambala … intentboxcom … seidoindia … pay4off … dietpalakkad … fantasyauthors … bharathm … neotricp … glorious … khadiindia … mercycops … eyespa … exigoe123 … wdilaunderers … indiabul … tikonaisp … rightservice … officesp … cbshorfa … neelkant … sunlightmetalind … infenion … thetwist … bulkpro1 … wwwbloomchennai … orangeschools … lizawood … cablevardhman … kvcsc … wipethes … wwwshubh … transcaresolutio … blogdelhidesignd … oehsindi … pascofur … taher … scrutiny … ohwowadmin … mahamaya … transat … myspaced … djstradi … alertsnew … theexcel … directim … laqsacement … bloomfieldctd … romesh … mfysuc … ivisiona … hotelglobalinnud … muyatips … apricotapps … appsdlfmall … wheyprot … sampsg … foresigh … classtip … rifetech … shantosh … himalayandiscove … canitinguru … pjriyvsd … veuswhey … asiafro … calltaxico … shivaminterior … heersncm … moxieeln … mccampers … ritepickhr … gypmac … venus … brekkiein … ndacoachingdehra … hitanshforex … medianet … ursengg … linnovatetech … oneindia … jcbparts … prateekv … ayelustr … linushajan … kashmirnewsline … fremfarm … wwwvimip … methodents … webhostingregist … leebas … truevlvi … thejuswomens … saviiour … aarshabharath … artfotostudios … galaxydecor … brandras … uswheypr … mediapar … unhooked … primeway … sujaltec … mesxzzlz … polymer3 … essemindu … luxurycars … universf … drkavita … avonmarketing … ideaseo … lykcreations … aakrutiexport … thesflgr … anupurthermalpr … theshadow … indiazbe … satyamcollege … veusawhe … spadmin … dietshak … lineofcommerce … hariomma … espertopayroll … chinainu … vsskeral … websol … cardiaca … indiamachinetool … lzhnwmla … techsibha … careerflips … tomtips … umerdriv … quickfre … riverraf … unipressholding … virocha … klexport … blogmawanaf … ganon … bagvell … joyaroma … organrga … fragssnc … waterpr1 … shraddha … completescaffold … coating … omshakth … skenglish … webdelhi … aatreyain … vgjtindi … shreedha … mumbaies … saleosteel … arabianchicken … vijlumni … hotelnatraj … jorawart … amogrpcm … teknoflow … anoxled … uscheapp … tamilnad … drishtijewellers … onucgspu … bhin43na … gujaratg … princeph … ardurenergy … seattleb … vereview … magnumco … adography … himson … selectropanel … veclass … gstgroup … gotwc5l7 … thetearoad … renovocare … gurukulp … aayushi … royal … swastike … subsaharantech … peridotc … shreemah … thesara … amruthas … axilaw … grealthfresh … crimsono … goldchick … bhagwati … sanjoymukerjipsy … finrex … jackdemo … powercapacitor … shikhavi … vedirect … visgroup … impactint … prathia … eliteelectric … vedir83 … degrandriviera … royalf … vitaminnew … manvanth … envisbe … univekze … wwwrajeshlenin … kiroli … maxcube … innovativeitsolu … godhanma … terrace9 … bhaveshelectric … fixparties … desirema … powervis … sssrujimindu … jbcombindia … taxgranth … vardhmanste … nayancapacitor … parwaz … aveegrou … silmcons … doondefencecoach … arorandt … muskaanc … propexpe … teamtele … wwwmahav … viratraimpex … alloyste … veapwnew … indianmo … silviherbals … swamicarline5678 … encipami … time2joy … hsindia … essennov … bjscieco … gcareinc … silpa … wwwantsarchitect … jaczo … milanode … kakanad … sampling … sandsbluish … aadhyash … profrgan … sphere … sandeeps … guruzodiac … eiraindi … vmpcompo … jayesh … lesicer123 … hotelshi … dharamfa … smks … relexindustries … buddhagroup … kachapp … pushkarin … arkacs … powerloo … arianaso … webinfo … dadadadihelpfoun … wwwdiamondoilind … patelaut … platy … manglmst … wwwrudra … joyfulco … stockmar … iaai … tulipind … sbalajii … grampanc … tips4us … worldb2b … campusesolution … ilfsskillsjk … wwwtanjoretrails … splend … comfairbluestar … watpan2017 … jason1983 … glamourpropertie … visuax2a … thegreen … indianauthorsbio … infosurfersco … tigerhan … bscinter … paltech … nmailer888 … isao … fineedge … vbitplacemoff … sitcotsr … sachiyasteel … cgalumin … shreesa … sahakariconsumer … g2emarathali … speakupindia … tran123 … principle … apwfitne … argalconsultants … automoti … jamai … jclinmed … askit … indroad … vistarat … pearlnut … vrdiaries … wlizjdyq … anticrime … illustra … gkelfljn … nirmalci … rohitent … pristin … varicoseandmore … glamourgallery … delhiwala … ascsouth … machineindia … hiboostseoskills … tilakpai … aadhaari … shivagro … crimsonpark … shivner … vritelcorp … temaantr … sumangalihomes … rajropet … filmyden … hallmarkinfrastr … satya … mypris … tcjvepzl … lfhil … wwwoshin … olsco … iolitegr … wwwsundarin … kalpatarutech … ayushind … usweight … drvjin … janakelectric … evoli7sk … nnrgedu … samarban … trijal … ettplnet … chamndcr … mdccholdings … yuvathachits … ememe … thinkbig … ashirvad … globushospital … winntus … pmealtd … digitalw … sinoj … avrexind … gayatrie … nivipmiv … electricalunsl … solarindia … evolicouk77 … sysaiims … roadrun1 … vefreesu … uniqueda … ilahimec … rekhapri … apparels … vesub89 … bowandbrush … diraga … davja … intlumni … supertechpower … nikunjsh … wwwkirlo … ksinstit … quintnv … palakottudevitem … tentongo … maasha … vcarephysio … chettina … wwwpaide … unitedff … unhook … anuragdedac … ardpiti … sulnew … unbrakofasten … sbbschool … v1cstudi … rakshaaddela … primewa2 … ionapp … koutonssinks … jethwa … swami … simplema … smileplu … progress … prudence … neetacfa … herballi … hrdayout … creentin … yhsw … ietrade … knitsind … microiud … websepkj … fictionalvillain … dialaprint … clapncall … tapasam … sicassa … gayatric … designbuildblr … multifly … birizza … ssasteel … magnitech … cheappr1 … cranerec … dhelvon … karunasoc … jvsstanks … cadcazyb … nidhigar … savitriagency … vashisht … waterparkswapna … ladycare … ecubeinstitute … choosepick … wwwpulle … trywis … khabar8pehar … indigoau … shreesat … cnanfvcl … indiain … bigstar … shubhams … methodlumni … ultimat … greenhabitatco … sriarusuvaiarasu … shivom … mediatrix … prathame … rzkveotz … everytip … orchidth … ionlimited … taekwondoindiaco … ticom … raiszadeh … fioindia … neelmntr … guesthouse … pktubes … omindiai … nikhilmahajan … dezonein … kswsorg … topgrade … profic … combineb … urvashii … nethoorh … pebblega … bloglotusgreens … kshemap … srkm … stanlmni … itbaniya … dragontypes … vardaco … annaiphy … veloxconnect … leadmin … drvjcoin … thedenta … jeettravel … shivshak … laxmis … dotcominfotech … leafnseed … wwwinnovativehom … bothrame … yarab … stardigi … doonheri … jaybhave444 … tradain … ladakhifoods … atlantis … domainpr … shijozac … nicegems … decorind … plecosol … phulkari … riaconso … marriag8 … ragnol … sycmum … vibranti … aryavart … silvlght … shiv … daralajyal … civilizate … ratheesh … octopuspapersltd … midtele … amazinggifts … marvel … dhanoo … usabiopr … sign56789 … shopmoreq8 … nikhilpl … edenhospitality … ssdhco … amison … iglobetech … mscarren … shahingr … reconhyd … chesaden … keralais … wwwtimes … mant1234 … swastik … orchidsvillas … devnani … ssrompka … dna3654 … infrasrc … edupower … ginza … fantasyworlds … bhawangeneral … hrdco … expectationsbey … fitlic … jfasindi … shreekan … jeett5ra … vefreedi … fhsource … bestindianauthor … ssjobs … kavitabhatt … betuloil … targetsa … riteshclasses … junoesqu … smilecuredentalc … aafpl … ncqlrtak … pratham … jangidgr … vedicyog … zavasi … biqrock … ionfoundati … matrisur … unicusho … flostarwires … mastanai … horizon … bloomdys … kalyanam … wwwomste … shikharn … skyrskin … devidaya … pharmachemequipm … rtgaller … masmara … khadishop … stmichel … lrtlogis … webchennai … lekshmia … securiti … plastoco … wfpnet … rajd … pendurka … ninetofive … lavanyai … gsccasti … indiantrendzcom … maruthihomeappli … newtechpower … marcopolo90 … mdsbusiness … healthcare24x7pa … gdgroup … ideogramtech … sonipolyplas … fastrackco … portalba … upendrab … shreejicrpn … hmukerji … ohwowsalon … sant … remitubes … btagear … noparkingboard … craftshades … unflavor … intcedee … armediac … thepaws … aceinternational … jencosteel … smrutico … manibhadra … choco … ravishan … fixathome … hitechsurv … ahmed … cheapame … shantekco … paragworldwide … avihoste … methoaceme … taindia … massclev … dhinakar … linkinfr … modwarei … varsha … teluguem … bodycons … sportsn1 … sanjeetenterpris … instaqpp … vefree83 … celebri … indiaexpert … fishnc … yogmeru … fantasycastle … snapmart … djmanpow … brekstart … stmarysplacet … cubuil … nnrgplacements … mhintl … drusti … ssidinte … indiavis … offic123 … blog7mm913 … retent … nbspvtld … premium … hoteltam … shreebui … revampst … jclinme … southban … workkeralaroadas … enablegroup … citymarketing … veameri … tastech … agrus … brandcar … aftinfo … saicontr … thonakal … dreamsli … vinayak … webseorg … kingston … jayasaipg … wwwtoowoombaurol … yrbabnaq … rajnets … topdogk9 … jolieffet … disha … sight … glamours … mobiappy … galleria … opilco … blueringrealtech … ikmt … sanin2jc … uccborg … thekalakriti … myprofil … ionindia … fluor … lansingbazaar … magnanim … royalpet … lissaind … galaxycc … sforce … designs … bhservic … lotustra … wwwkoshy … veuswhe … riajewel … senadvertising … stmarysevsm … rajgarhi … msflanges … qualitya … snakeboa … shosuga … blustal … exportindianrice … lakhiaco … crunchycrush … easymrch … quickcom … vqsindia … kgaca … rioeasycollect … wwwherboflora … schoolli … aiectedu … absolups … thememoi … pcinews … jvpinformatics … octaltechnologie … legend123 … wwwsurya … woodarti … silversq … jmdndtcm … bmaquate … gmascuda … shreesai … duropart … orient … jayantht … geniusglobalscho … galler … androidappfirst … highcarev … mjtraders … deuljhar … abuzzcon … vsccorp … sasthaoil … makehappygifts … castiron … snowfog … stainles … burgercart … plushfsh … judoass8988o … ssonlfa1 … laqsvents … karthikeyapackag … vikastoo … srianjaneyam … youthwin … comjuniorlegend … bdminx5h … mavensys … manekmet … gyanchakshuco … refrigeration … unicorn … nisascar … vesubmit … shrikhet … wellness … susandes … claydesigns … fantatrees … swapnasrushtires … rotaryclub … valuevacations … thehrdst … seedewbn … bazmrehm … squareyards … hotelmaris … siritale … purvain … runwaylogistics … tradeagencies … rjproper … lakpadco … endue … hkps … leoindiarelocati … paintaar … hoteljagdish … mirzafoods … rbcgroup … fantasyt … polymerc … pikaso … mediconz … kaimindia … vonectec … privateprot … olivefoo … prabinmo … sadesgnc … joodalt … leenaf … pipilika … srirampu … amscopegroup77 … vaighai … globalagencies … balajico … wwwshahm … bigprofit898 … qalallto … tlcrippl … wwwcajcs … thegadge … pushpakholidays … ultra … studioprintplaza … omnipointgt … luckyint … pehchaan … bulkwhe1 … imperial … lehragro … mgheewalametals … laxmiblo … amanmark … fantasyquotes … akentco … marutimetal … ecosafec … sstateme … esteelo … powerpress … makemyblog … alphaservice … bikors87oice … rmhenterprisesin … drvinnet … mkpt … nvorganics … uniquesi … jclin … sjngroup … sanjaypr … cleveo87 … wwwdigit … srisaipr … mtsports … deegee … gscpco … homeboxx … ludhiana … apexia … panchamm … cremicaf … mbwatert … learnermagzine … roadlineskerala … fancyyar … kalpeshelectric … infoway … wwwimade … safetraders … spectrumclassesc … sriveena … akalgoc … creatsgl … itreporting … visprime … novacycl … avrexexp … bhagyalakshmi … wwwvaduvammal … thecuisinefactor … kssphoto … harmonyeldercare … amtechpo … clubswapna … zalakent … prayasgr … marveloceanicpvt … shafatoo … juveriya … karmasecurity … gargfurn … intach … adab … randbayu … mjacademy … vijacements … shirdi … hotelsahilkatra … inhomes … sabarima … qutbulma … corporte … cheappro … businyis … seommbco … ruma … bharatyatratour … kavyainfra … tradersbazzar567 … kkenter … badrikedartravel … woodenfl … wwwparamounttext … thakor … deepamca … computro … laxmiass … stmargar … refleavm … nknmecha … boostseoskills … vikas … billingadmin … weddingphotodelh … arihantc … care … oscaracademy … goldenageladakh … brainmiracle … ramatourntravels … jobtn … trywi … pizzawine … whatznxt … consumercard … crane … mofaro9 … proaudio … whatthefashion … ruvanthi … pacificflame … karshikam … techncphr … yogeshme … texotech … khearin … jvcindia … furlrltb … anuindustries … thecam … albadarcentralsc … rluckproduction … precious … gacudptin … muyanifit … maharajt … timesofladakh … paceanalytical … shreeelectric … rajdyesp … polytech … savoyfarmstay … icsm … ruturaj … aacoonline … topicair … eallamco … interforminterio … jagdishtravels … dimpipe … felixstr … saimryam … roadassist … ucctesting … grandminerwa … liffco … crystalsignsolut … msapptec … wowinterior … hotelsea … sphoolumni … prasannata … shriram … brainprn … kushalme … fast … ssepower … craftbui … intimationcargom … octul … sulochanaente … acuitegroup … akgtrust … btxbarte … smestarn … deksonmetal … cyanicsolution … ruchihou … jetinfom … coolinga … mediamen … dreamz … zerozoneenterpri … fastfoodfair … gdfoods … proginst … renaissance … sahityasetu … innsol … prestoli … institutekpl … prajapat … domaintodesign … keysta … yavamint … maimoon … graymag … opchainscom … itaxjobs … emprace … wlmco … sparkin … teamwork … arkytekt … ymvt … wwwvtcka … zgxfliwb … parmar … ieeemietjammu … rodidabi … equators … rashtri … vpnair … prasanthb … balajisafetynet … gloryburg … ramaply … thexpert … trade89 … admorebi … ktiinc … sportsnu … wecare4a … krafdntl … gcsameri … wvtelevators … stagingbhcsipl … sciencec … gscontra … gurukrupacctv … trinity … bulkwhey … rajininews … sightp2 … reviewsb … swastika … pmakhari … aryasamajdobhri … stxavierhighscho … hotelci1 … deepast … atmasamm … richsource … palakkadedu … relocationexpert … vactinte … addcheck … jason2014 … bigbo7eb … lhsind … shivhostel … hsapacka … technologyoctal … sphooaceme … godwinre … bapasita … qpoles … omwaterr … bluestarshipping … sonalphotography … naviva … digitali … hotelpre … skinnyan … paragmac … busin3xi … sdvlab … websenuk … escapeec … servfaces … alphabet … dheerajmishra … rgmumni … shivartefacts … gdpl … muyasoft … mediacar … hotelambika … travel69 … maidmedia … enzioph1 … travelgr … rebelyou … devakiconvention … sanindia … chillertechwll … weddingo … spbakingstudio … teerthtravel … fawc … mahavir … janyodayvikaspar … knowllcr … hotrisk … smiledel … brpxixqa … dipsemi … urmiihnw … classicd … terrace5 … aphrosof … hbikatra … washnwear … wheyisol … inpelle … meloorscb … keycerag … otscab12345 … missico … portacab … cineweb365 … vrajlink … prabhatenggco … mclinic … amerilev … smartway … netmaker … sandhuar … cbtnt … clicktog … zeebrok … nsrfarmfresh … dssgroupindia … somnath … suchitra … bilt … liamtips … vimenter … itsolutionind … chiraghotels … peteblfe … mymindmg … skimedia … leotatto … meritpoi … parsvjh6 … tatasky … shreeji … spscomposite … yxfbdcfq … wwwlinen … imrg … skilltouchsalon … royalalm … saninfo … sethiinnovations … jackbqu2 … aabhaind … modularn … shreeval … eternal … bktkindi … ratfilms … drsanjoymukerjic … indhuorg … svitcott … pointinternetser … pinnacle … savinsys … web1234 … sphoovents … bdfco … realtksf … suyog … thearyam … biocoal … hans … livingoffroad … shaadim1 … pcplands … geniuski … asusi … dialabus … nutkhat … truevl … cybercit … mcintyre … rubbercables … imaginestore … royaleaqua … gokulamb … brahmstr … sharemar … biedelhi … alsahrar … tradelink … mattress … medialog … wwwhphou … artanantya … sbsteelc … probuswt … plankochi … gulfshoppingdeal … walideqp … marvelew … blogchdd … princyelectrical … cncpro … oldcask … surrogac … wwwsandf … axisenterprises … mangalms … fatehnagarnews … znmdholi … reservat … skinter … rakshaparadise … vapidiabetica … call4sit … thakerand … irisedu … waterp43 … airporthotelanda … swarnimw … naturetr … mormedic … leads2businessso … wwwtulja … tirumala … saranggl … wwwhario … ascentiq … techinsy … siemens … lagin … karthikcatering … darbaarevents … wwwmakei … connectjourney … lawyersv … signetin … ranecon … nnresstudnts … supertapp … vemart … stanartp … astorion … blueprintadvisor … winespizza … fogleaf … quikmail888 … smilecar … balashri … candctr8988 … phoenixgrs … projecti … cbitcore … salonivi … dieseltekservice … wwwarbud … devvoyag … sasirate … paying … tbhwc … dhakaren … sanskrit … tenent … qubitsol … ioncoin … gudindia … iclin … chinnakodur … smoothi1 … bunyaad … energy989 … wwwwater … stressco … abiramimarriageh … wwwgncsc … rasmidas … web4chennai … mokeubtt … kirloska … peeapune … tantric … timeswebsite … chandramoulisure … hotelhol … gsexportsco … matrixpa … prime … advances … privatenew … sandalcasa … weightsp … leadaward … proteins … rakshainfrapromo … wwwautomaticelec … siriango … cheapam6 … nbhau … altuscom … woodbury … print … hatchotv … shripjos … vanviharlionfarm … nishnew … grillart … ghmt … vidphotos … howtolos … kingsway … calciyzw … sirisapt … serenity … shreenat … hkduropa … sksindustriescbe … elearn … siddhien … tacindnt … bharatre … decorators … rungtave … emseo … sinohote … furniturekwality … igniteindia … anicoint … suffeeco … arhometuitions … veclassi … webcrzjw … shardes … abmtech … visualsoft888 … pournamiagarbath … abhyu … hotelneeraj … sangamamplastics … blconstruction … fitwellf … nirvabvl … pillrnvs … steelgen … intcargo … centina … cyandemo … techzoy … merrygol … bhagalpu … thetekfactory … stepupwelfare … mabutyre … pjenggfa … sharenet … agrishpn … winnerbull … usaimpor … thepeynt … usawheyi … rmcedu … sreejayg … brewvid … akjariwala … spaceinterio … rstatana … freedomwheels … bansalma … thermocoleindia … apoliticalviews … allisonau … silverwi … kudorajasthan … vividhseva … vaishpa8988 … cbadmin … bulkprot … ccfindia … cocoatrees … brandrootz … vazhappilly … gotr89lglobal … hariomplastics … sddevel … oofinhrn … realeye … maheshsteelcorp … steelrepor … vplastindia … jaika6hs … udaipurebazar … rutujaen … sventerprise … pathak … reliablh … hatch … uguzitiy … lesliais … orratorl … unicapitaadvisor … terrace4 … cstubesp … unitedindiaexpor … vehotelt … dartsfed98 … govindindustries … sattechc … bottlenp … phindustanpr … haiyahcm … nucleolights … sndppizh … bluemont … anmolgroup … charcoal … chalavar … deliciac … uniqueip … solankev … canada … bethany … lrsm6001club … sardanalabs … tawugnvg … wwwvidhiinfotek … fatfree … olympusc … natyanaz … wwwsunri … ksmb … marriage … zebroxi … positive … bssedelh … gptckkm … birdicyc … bravo … hariom … gtbtrans … alfakhri … themesli … bhaighan … ewingchr … technics … rsintrrs … blushh … cjtfzebd … sri396sg … marria5 … rishabhp … kritil … aadidiam … hotelnawalgar … kumarmoo … shenalfo … tasainc … sapowers … midas … cncmachi … mailszone … misumeet … admissioncoordin … maris … sevenele … nspopfor … privatelabelwhey … grfarmfresh … venusavr … pizzavoucher … saptosi … karneeti … pdfaorg … muyanew … delhibylocals … hefmservices … gandea … sianexim … glinksin … gnunited … mythridevelopers … magn898alth … infocity … amrapali … drshacheechildps … coreiife … roshniindia … jgdtec … celibrary … bmelaram … raselectrical … westerna … wwwamazv … travelvia845 … krismarc … carsco … icurehealth … nccionline … technopearcouk77 … bhaktis … myhomebricks … aggexpor … newgenni … ionenhgs … drjadhav … shop4off … lehrabri … mbnmkqts … bhcpin1s … smpenterprises … sophia … apexemot … minatrad … venew … vrinfras … akiwsshi … ramble984 … wwwajitp … guildford … kiroliin … rgmvents … officialtiger … samratha … inartdes … ssasdata … subsist … aavissurgical … eminee5g … pear1234 … alpha2112 … goldrate … meiliayur … twenty20 … sentinelelectic … allseasonlife … dmmcind … tirumals … healthfi … modulark … sheetali … udhavaorg … hotelramanpalace … cobblestoneco … wwwbirdc … shamshic … ivision … fishnchi … roomaddr … unicables … tokyopla … hashingitout … eclattech … thejussigns … jammunewsline … indianyo … grasimmetal … tirumve … kstakerala … themiraclekidz … stateobserver … dkindinfra … w3squad … shreeste … eternalp … karuthiy … leisurel … tangenttechnolab … reviewam … realsgrs … samrock … smpatra … asianatr … navrangj … cinnamo … repairgeekspayme … finorbit … littlela … g2evodqj … newtechsteelsind … searchyoursearch … pelicans … siddhivinayakuro … johnart … rakshawealth … indartnc … sumaya … florah2o … alphabe … sunilelectricco … yogifoun … dvcable … generato … saprasarchitects … flexchai … dinesh … aswamedh … wwwcampu … nzwdolvn … mkconven … hotelsciencecity … fixallevents … pearlpla … udaymanav … snhogszc … fame24xc … rajdhani … hajjmrht … dprasadb … commandoforce … iongroup … daljiten … hugheseducation … kemindia … mahekste … blogsobhac … oneblued … anumodba … kahanpac … fakhreemarbles … interconcepts … seahawkoverseas … hifisolutions … ektadeve … weltechfacility … prabintvs … veuschea … verican … panachec … swamysam … nisgtotalsecurit … latesttr … aquaproindia … sufiskills … prabhat … ashtarwe … shreebadrivishal … phunixho … quicksitedevelop … tbdesignz … star777auminium … gurmanma … evelynssecrets … slonsys … srivishnu … kallya … auctions … shirdisa … infinityadven … tcrynot … samskruthi … anunaadpublicsch … sondindi … emmrcmad … super … startnet … karikkadtemple … tekmatic … parmars … bajajbui … herbopha … uswheyis … acoint … nicetipsnew … roadrunn … bitsandbites … iberiatech … simran … indiangl … longindi … geplmlm … sapowercontrol … holidaynew … valuatio … elettroindia … dudejaspest … newswiftinfos … poshlife … choudharyworld15 … pranavap … passofeco … rajmohan … marriag6 … visnyesy … spillco … maxusitc … globaltravel … manekvk … shreetra … boskindi … sinnew … srcdeobi … infobook … aumassoc … ideabyo2 … vayubodh … ajapaipmc … gvijay … kitskdad … amerivel … coremiss … firstch … unique … wwweswit … jaiindiraagro … atask … maguscars … smartsol … hostelindehradun … hmsexcqv … outdoorc … rtowala … sulabhcentre … simplypa … jewelpla … zakirs … ssinstru … tresorsystems … yogashra … bdh … pizzaquiz … aselor … techesbq … mcpatel … egovern … asist … hotelsreeanandha … fairinv789 … hauser89 … jupiter … reflex … sunderfo … wssdnllp … romanpharma … sulabhsanitation … sivabala … woodenar … indiarotoplast … synemadq … leabriter … wonderxindia … sravinde … yellow … harpalss0khi … web24jpf … cabsyatr … mahatma … bajajson … alliedtrading … spanda1 … komalsarees … aceinox … earthnews … citroenswitch … skfmat … solids … protectiveplasti … tounetsu … kalyaniasso99 … artspace … visasrus … tvsfastener … medhatechnologie … greentop … softusa … banerjee … stmarysalumas … ridersco … globalin … madhuban … alfajrcoffee … indokemp … veergold … citizensparty … drvinayj … statesangam … basement … accruein … megahlir … paarthde … yesweus … stanledu … drashok … rejuveyo … chennaiweb … taplindi … vishal … wwwmangl … mbrwa … softonso … lcon … wwwhealt … dgtemp … refairp8rts … abcdelhi … ffprts … keilight … giantgpc … blood4u … vrpschoo … sskfs … shilpaka … cnclathe … hastle … vedevb5h … gurujeen … everestengg … wwwdadas … doppler … sahayama … haveahea … ritiiriw … tipstricks … xtraindia … netpeoplekart … tallyhub … yogaorg … icoreconcretes … readaddi … frames25 … technowebhosting … wwwrajsa … karmamdn … snehorg … meublemtl … karshakajwala … residentialrenta … techdemoco … bnrco … alandal … abimtind … protein1 … wanderlustyourtr … aasinasia2018 … onlinetechmentor … taneja … uccalumni … riosimvn … wwwkalat … dunhillresear … vefreela … sbssmta … masterlinu3 … nethorit … tipsonexport … kashmiriembroid … sbbusine … prmcmcm … mrtell … jayeshmetal … kkkforgi … mahagold … lgpeti … logusinm … indiarack … justicelovers … sbconsul … aspirssr … gmktradi … narankaapharma … timtim … experth … neozhgz2 … wwwgvatechnocraf … metal … casaport … america8 … bytecoo … travalla … smilwavd … bookaurl … tribusin … ijfresh … pratapg … sudhirkumbhar … bjscient … unusua … mdcbempl … lineage … ovbmtfuq … fabricstore … saifee … sarangmahajan … patricma … wwwsutar … pravasis … mahavirp … parasram … actualhomeocare … bapfltd … dtpindia … zephyrme … ssalke … builder … eliteflowerexpor … globalpa … pathakeu … eliteglo … impex … sndptsr … nucleuslifestyle … ecobhara … smoothie … royalspa … msrss56789 … stanlents … bookyogastudio … alfarooq … santam … uieindia … bixyhrsp … gaurav … azielw … merchantschamber … tqtantpw … thermocl … zorbadental … panduads … yashhand … dotnetinfotech … modaluci … elmsmiercollege … vecheapa … signetso … sejalptl … sklumni … wwwaharamservice … proteinw … g2evolut … vikashud … samatha … srivanie … mukoque … superfin … cosindia … hostihpc … roadtravel … ambikagl … creative … vonecnet … yashmoto … bytecook … leelares … enrek … intments … skinlght … panverify … keepitfr … timeoutd … amruss … yatrizon … terrace7 … hajjmrh … nice834u … dtelesat … gcvkendra … telmatma … journalis … bozguwgm … thecrown … heavenhillstours … seairfrg … himal12 … aglglazi … envisbes … cubuilt … wwwfaste … yourgood … jambojobs … yatrapundit … schemat … sveeindi … primalexus … darbhang … babaagencies … tejlite … infomaster … synopack … kavyasolutions … apogeesp … walidrental … cmrhplc … indianpu … jaincosu … sportsf1 … salonisareesudai … drarun77 … accent … srinov78o … hometechplumbing … reselafb … stillmat … brandhfo … docomoco … destinationmah … yashnms … vedhacad … alertnew … wwwpreet … nitinnag … srsoftso … eduhub … elecbhagya … kvsprope … smartexamz … mahalaxmi … gongat … ecocarer … rahulcon … kawwakerala … chandane … fusionen … kamlesh … fedopete … rapidezg … ekkro … nltradin … crmnordicasia … rapidtech … mvarchitects … vesskaly … vaktekpm … rashi … asrealho … pathakma … trielec … secaindi … unitedsh … gravityi … dieselgenerat … lightech … hamadgro … yadavsamajco … perfect … pkbrinfotech … muyaradi … aonegrou … intevents … srimotorsygs … midazind … kssworld … conquestenmasse … newsonline7 … shrecklb … vyasias … atdecor … niraivu … speciale … karmaene … unitechi … sukanya … lubrican … primeall … machinet … pwsgroupco … novelty87ratech … ghartakk … mierjs … hitechem … venkates … wwwdrvtj … trophyboat … deccan … dogsnpu … juniorlegends … alumniucc … ahcompany … bubblkdz … hotelcolumbus … vragencies … theloung … osadeal … sskalyan … soveregn … technost … cresttrs … pcplgmu2 … basantme … jaishreesteels … dixitmetal … acpchapterindia … ioningroup … aimmsinstitute … nimblee989 … idhantatek … kkpack … precisionengg … karekar … shree2 … samaspiranmasjid … sunshine … innersec … ladakhtoday … fgortava … emmanueleatery … kitchntn … evelynsharma … tamsw56 … arhament … smartbooks … wwwinfinityinfra … karnival … dsom … ametanew … wwwdivycorporati … rightliving … aaradhanametals … amultr25469 … akanayan … drshajimri … vapiurologycentr … rolibookscom … rahiplaza … servicefurniture … minaximetal … hotelval … vaidarshi … sabtest2 … toletlist … eaktadye … velsons … cerisecentralpar … varshnwb … astrology898 … carwash … spyrossportsdeve … sftsmedia … bholaente9898 … photogenic8984 … kadambaree … prdjsmk9 … purpleniwas … tejasentvapi777 … goldenamoonresor … mediteksystems … uniquesolns … aaravbuildcon … eupheus … eupheuslearning … cloudsharing … wwwtoshhospitals … deepak7654 … aabhastech … eupheusco … euadmin123 … swarnsamarika … transitoak … naturela7654 … shaadi4u … eklingjiatithibh … sonicaka … firmzpjr … electrocontrol … nimadseeds … mahiportable … atamtext … kinshipindia … timeshealth … ilexled5102 … gpinsk7654 … peeceet989 … wwwcdscoachingde … anugrahainc … greenlifeled … mananenterprises … eclatico … sscrindia … pranjalshouse … straitsworld … vniyptuu … eyelite … gmmeindia … helpuhomeservice … abaxialorg … anujacreations … peoplesafeco … rashtriyaawasdiv … tujarsharief … selectotraders … metalpressing … yrrequmy … atypicalweek … firstripe … goojtkha … revkart … ivfcentn … dataaeothrithala … finefoodcellar … srisv … mansitraders … officemealbox … modnedel … rkelectricals … rkggreenfarm … metrospectrum … sooryodaya … karmasgn … hygeiamn … tailortr … saptrang … cmovie83 … webdemo … navinson98 … bonyanunited … udaipurwebsitede … wwwappliedsmartl … sharfods … wxopsbcb … ovationworld … iportalco … orbitacademy … gldeepesh … spayaorganics … darussalamenglis … wwwrukmoniboards … arvindsteel … powercho … mercantileele … infratec … tumblrpic … azioxyne … kuttichattan … worldsocialservi … servicesocial … blogsupertec … cgaworld … gitanjalimkt … seosenor … indiadigitalmark … cborg … blockpanchayat … kinger … portablecabin … hqonnxey … yogfamily … fashionf … stairway … supremep … dlccretn … wwwbmsbuilders … vibrantplast … fhesbzcs … sdmacademy … fzjjplhc … jymindia … khxptyez … mmueujlw … egawrfqs … bzdbcfju … nqkithct … fqwdevij … efmindia … srishtidesigns … skksumcf … cegczmhe … rclwtulu … whkuhnvx … artsjewe … thereeds … poultrye … kdms7 … technomations … arasnand … designanddecor … mokeupweb … heritagexper … globalatp … golgappatravel … zuverlasse … yapsnbelly … webazinee … sehgalschool … autodesign … manzilmystics … barescientist … ragsjunr … mumbaimedica … unicornsteel … jaydeepsteelind … medicale … pavingst … datadeoottapalam … welcomeadmin … welcome123 … internet123 … aisschoolcbse … liveolivefilms … rishtymn … excelcln … dmetalfa … almightyconsulta … mightykitchens … aluminiu … udaipurfoodbazar … vendorltd … yashiinstitute … icahahxd … shopxoe … abhisjcl … gravtinc … anmoltek … gmwyibjx … chimanla … clarktou … yashiin … onlidfsv … lifyhub … bindaasentertain … lasercnc … deificco … ptcomplexpmna … bhangraarena … eigitest … nishuthoughts … royalservicenet … symbolenterprise … prasangplanner … solarpinnovation … ghcr … frontlinepackwor … alconbeverages … cosmicalproducti … wwwgreetsavvy … triptracs … digiedu … wheatand … schoolmithra … medtechrising … queensmakeupc … right2search … carediagnostic … asteels … adventur … cidms … gsistest … shahestateagency … madrascars … gsisschool … dollarclub … betahealthcare … lazawal … gdworld … accurateoutsourc … faireein … ablissmeditatio … copperen … corporat … shubhamacademy … vrintrnational … crewindi … hwojrbzg … dconco … gurgaongynecolog … n88numa … wastechco … ishwarbhakti … eazeegpn … jkacnewsportal … karpagaa … ggbcmtup … skdischool … zoraagrofarms … homakujr … mysewa … mokshornm … bmssociety … bonitoresearch … panachewebsite … avirabnqt … wwwcanvasfilms … kendriyakaram … orphiusgroup … ionwt … searhmlw … kidsrmcp … gpspayyoli … toffux … zibopapers … lotts … indiaholiday … hispeedservices … cellsafeind … pharmasuit … somhospt … khanedigaddi … prenterprisein … sulabhschoolsani … alexeisoft … veda7654 … nimbion … shree5372 … pesh5372 … sharafoo … kadanadscb … atconline … jignavor … fitnessempire … highland … americanflyerco … wwwpurecrop … sparklinggoal … scoolshop … sstaticglobal … motorpum … wwwchampionpaper … devkunj … nimishmar99 … n1imish89 … wwwmoonlighthote … random8791 … pioneers … nakalangpipe … magoverseas … khabarlive … leximwbc … injoule … xdciekgs … conceptinteriors … helixgncb … risein … chintala … aoimumbg … marudharmetal … pathan99 … epsilon99 … ramindia … diligntc … vipulprco … aahilenp … elliavrram … t3globe92 … learningbylocals … dispatchlive … dimycom … ustadshamshadali … ellisway … aaoiin … trellishorticult … amolvrtk … summerlandtravel … shivodham … sqcintcom … vvsecurityforces … v2gwrldc … sevakendr … ssenterp … thedispatch … govisago … towardsc … panvaeng … angelmrn … achrekgp … gravitasin … sanjarsl … signaturegardens … mayur765423 … himaniandanjalis … impeindi … mkplorg … nationalfir … techalrt … techalts … proponweb … dockanddoor … keygurukul … utsav876230 … aonestpk … whitflhs … prismdco … astoncraft … mssinghandassoci … udaipurbikesonre … oasishotels … rakvb … hrcindia … theteacom … iamdeepumg … ksrtcin … shadowdt … kavilmma … descentw … pgmaxxhe … leagomania … goldencubetradin … medikolf … merakimill … pietyenterprises … rokda89 … powerledindia … nyshaartstudio … harimarble … wwwaeiin … kuwaitwebsitedes … wwwalliedinterna … systenfr … izzatfoods … sspicoin … saiindus … website … samyees … locean … vikasnavratan … ladiesastrologer … famousworldastro … sulabhwtd2017 … fabi … thepnthn … planetg … rmglobaltrust … myrisingstar … fansct … tatalist … deborend … shodhsar … hmtpozlo … wwwtheanilgroup … cmrk … vallabhkanyakela … saurasrajkot … photosbysarang … agegoupi … asquareexhibitio … basantmarbles … estempls … hoteljaisalpalac … krubaaassociate … thewbdcr … pmtcouncil … mytravlp … httpsunfoodind … renusurimakeover … locdis … onezoefirstaid … ghsskadungapuram … arunivas … httphopeforheart … garmentsqualityc … modihindustan … westcoastpaperba … biosytmst … wendors … narendraacademy … digitjscom … rukmoniimpex … supratkb … chinarkart … vikashmetalindus … sachostm … whitelistco … dineshimpex … eurofreshsecurti … vishnoi … shreemdzippers … cashcropagro … satyajtv … dhakawld … amedo … studiokumar … clubrewards … beeingsc … theredpn … icaa … senseirajacademy … leehplhr … mcsuncon … midasdecor … plutusgroup … pandittulsiram … theomanvisa … gulmoharbyanupma … grconsulting … amfashions … lakshmiconsultan … bekleidu … day2dayneeds … ashadeepclasses … srkmanov … s3dxpo … ganeshmn … keylineco … sexcsles … hitcokw … alzayanconstruct … wwwtradeonesg … funbuzzindia … dataaeoottapalam … rehab723as … succsmtd … slndailyneeds … mgcables … nestorass … paclcustomers … premium72 … championworld … pnoestate … rakshatowersnoid … ukfitnsc … waastrologyservi … keralainfodirect … bmsk9 … rslargeconcert … atishenterprises … bjcgylln … v4you … reliabgr … draqua … panditpyarelalji … locksworthandsto … fourartdesigns … rcce899544 … assetzsoulandsoi … assetz63eastco … assetzhereandnow … srventure … miyajiastrologer … bssonlnc … royalindiancusto … luxiaprf … rmeexpharma … mubarakd … jvgroupco … muskaanpo … dreamwbs … plots … basantenterprise … ksuper … selfbiz … vysyal … adminpham … luvlancet … investmf … rohanikshaphase3 … drsanghvi … lifeguardmed … prakshgr … subbies7654 … hind7654 … sanghviorg … victoryservice … jmdsystem … suprasteelindia … pvhrdfc … cityprohub … topcareservices … cutis … vijayportablecab … hadisind … galaxmsl … beachgamesfedera … shremglb … remriosis … redhatrealtyco … lootmystuff … udaipurleatherar … coolpuppies … cyylvotd … ravimemorial … bitb … careerskype … kkvp … sknabi … thakurenterprise … urmiinfotech … thecol … wytdress … flowmdpr … unitednce … usenear … srijothi … dreamthe … realindi … mygddntm … earthpoorna … littlekites … danacoaching … klzpxcwz … kayra … alpsconstruction … mutualfundinvest … steelind … davschoolsarsawa … shriprasad72 … xishatech … anuragbhatiaco … grihthtr … shreyasai … wagadmarket … spexvilla … rahuldrip72 … mdpapad53245 … modernfu … unitedch … dsklogindia … sunitascastle … adsversify … kangenindia … insurancekharido … prakashsteel … nxbev99 … starimpexbeverag … ccttudaipur … kvrworld … shrilaxmi88 … hatkedukaan66 … pcsupporthelp … ijptr … onestoco8 … indiatraders … myinternettroops … emantra … desiilaaj … chanakyacollegeu … drsanjaybhatia … drsonabhatia … vesleypharma … pmacademyindia … jukrqapd … coffeecr … hgmpharm … mokshpromotions … sdservicesco … vtnadu … saiscientificins … sunkidz … pradesht … kactravels … vendoshop … httphotelkailash … api5lpipe … honestymetal … drjinigupta … innopak … enhancecreations … eudaipur … itcoachings … brisbanelocal … intimasiaco … gourmtfv … jaishipping … siddhasolutions … digitalmarketian … satymgrp … ajitcables … mechntch … adriseindia … gulfownmobiles … a1plusentp … regalsignagecity … jkentrpr … altaiclp … consolidatedcase … disuro … techno … sonidesigner … rajkamalsteelind … jazaayurveda … greenturn … cleaneating … drgurukul … aipnalagarh … ekraftsindia … gurukru8 … blueleafarchitec … hipurero … hoppinn … bookpropeller … pushpnfl … easytravelservic … giftmagic … manvkaor … rakshadelhivikas … desertpearl … srutiindia … arpsindia … wavesysnsk … ffadmmmk … qmscorp … emptypockettrip … mishlptg … memaar99sociates … dexterslab … vinodhrs … astarhostel … marketivemindsco … shub103 … singhnal … mgresearch … svelectro456 … grenflds … hotelnewvivekana … labtecnc … aglgorakhpur … shivadoi … gnresdin … craftshza … aayusbio … tirthanvalley … pelicant … nirman765 … bestintd … krishnaalloys … aoihorgo … lenyadri77 … drkansrk … kolamvikassansth … hotelbombayorien … edubabaji … t8uvic99gineers … onlinestore … enkorindia … bluecyst … bluecrst … ldarc888 … pkvfinance … bakewizer … physicsgranth … britsonllc … kingvipnumbers … photoncareerinst … startoursudaipur … prestonmetals … thebarescientist … eventusbrandlabs … sparklgz … carecentre … gamutbuild99 … websnrllc … munotgrp … roomproviderco … petrosteelpiping … familchs … rhstrave … healthayurvedict … gandbemployment … apnarajya … kaniyan … onelifesh28 … dhruvgalgotia … studyplsg … medtourchennai … jakperfumes … trapthecoupon … arfurnitureonlin … designimpexco … mmeshop … arklgcom … mrsteelindia … oraclfcr … modirbrl … sheetlch … kreatizc … dolphncm … irisoverseasco … go4wbcon … mydesigndocket … champnpd … vedant142 … oxyzonhd … sivamgenver … jpoffices … aadyantc … indianch … vishalentco … linunimisha … lgbxqgss … rkess … knrbfinancialser … realstaff142 … windindiaenergy … soocoinn … uandurs … parkexotica … vinitronic55 … remotemployee … hosiery … srmrindia … cjphfftq … swapnapr … rhgroup8 … pranaholistic … kamlashreewelfar … jsunfods … kfpindia … vikashde … giftworld4u … httpamilitaryaca … diamonde … pmnacrane … happykid … gxglbscc … moolca99 … boazh444 … fitkits … rkenergysmartser … clapbox98 … inshrines … oxycea … serviceandsmile … tamrahalls … whzjzold … saffronsteel … clinic7428 … devkinandan55 … woodengifts … vijaypumpsco … liaydoqo … begumzarinain … curiocorner … airgunfederation … internationalbea … raimalikarchitec … primsplc … kalpnkht … unitdrfm … valiyakadayil192 … humangos … apollong … abhinandanhome … chitrani … virarlty … aquamake … remarkableproduc … vapibanquets … simplocservices … helpingcitizenco … pureorganic … sevensigma … masuimat … brainersacademy … goodfdvb … indiabhu … pcsconsultant … bramlmp … kalyaniforge … mwccoinm … uacqmihd … sunraysiaco … jitoghat … alliedservicesco … puthranlogistics … worldwideshippin … ultracre … samaf … reenvacm … beausilk … nishaassociates … i887vationitco … workvntr … eatstreets … grocshop … seamsfordreams … jkmjewelshub … supremng … howtobackexloveb … atrigroup … hymndgtl … livingaexport … yxfoqjxi … kandivlp … sociologyofsanit … fluidvew … ncleatherhandicr … blingevents … paaneshn … tarunsakhi … ruonline … magdalenaperfect … shoppersshop … awery … prudentcareer … mkerental … numbermarbles … wanderootholiday … demoserenitycrea … sarafgroup … unsenterprise … britsontechnolog … ...Done Verifying : 1:ea-apache24-mod_remoteip-2.4.33-5.el6.cloudlinux.5.x86 1/13 Verifying : 1:ea-apache24-mod_version-2.4.33-5.el6.cloudlinux.5.x86_ 2/13 Verifying : 1:ea-apache24-mod_watchdog-2.4.33-5.el6.cloudlinux.5.x86 3/13 Verifying : 1:ea-apache24-mod_proxy_connect-2.4.33-5.el6.cloudlinux. 4/13 Verifying : 1:ea-apache24-mod_proxy_scgi-2.4.33-5.el6.cloudlinux.5.x 5/13 Verifying : 1:ea-apache24-mod_lbmethod_heartbeat-2.4.33-5.el6.cloudl 6/13 Verifying : 1:ea-apache24-mod_proxy_ftp-2.4.33-5.el6.cloudlinux.5.x8 7/13 Verifying : 1:ea-apache24-mod_cloudflare-1.2.0-1.el6.cloudlinux.x86_ 8/13 Verifying : 1:ea-apache24-mod_sed-2.4.33-5.el6.cloudlinux.5.x86_64 9/13 Verifying : 1:ea-apache24-mod_proxy_ajp-2.4.33-5.el6.cloudlinux.5.x8 10/13 Verifying : 1:ea-apache24-mod_heartmonitor-2.4.33-5.el6.cloudlinux.5 11/13 Verifying : 1:ea-apache24-mod_http2-2.4.33-5.el6.cloudlinux.5.x86_64 12/13 Verifying : 1:ea-apache24-mod_proxy_balancer-2.4.33-5.el6.cloudlinux 13/13 Installed: ea-apache24-mod_cloudflare.x86_64 1:1.2.0-1.el6.cloudlinux ea-apache24-mod_http2.x86_64 1:2.4.33-5.el6.cloudlinux.5 ea-apache24-mod_proxy_ajp.x86_64 1:2.4.33-5.el6.cloudlinux.5 ea-apache24-mod_proxy_balancer.x86_64 1:2.4.33-5.el6.cloudlinux.5 ea-apache24-mod_proxy_connect.x86_64 1:2.4.33-5.el6.cloudlinux.5 ea-apache24-mod_proxy_ftp.x86_64 1:2.4.33-5.el6.cloudlinux.5 ea-apache24-mod_proxy_scgi.x86_64 1:2.4.33-5.el6.cloudlinux.5 ea-apache24-mod_remoteip.x86_64 1:2.4.33-5.el6.cloudlinux.5 ea-apache24-mod_sed.x86_64 1:2.4.33-5.el6.cloudlinux.5 ea-apache24-mod_version.x86_64 1:2.4.33-5.el6.cloudlinux.5 Dependency Installed: ea-apache24-mod_heartmonitor.x86_64 1:2.4.33-5.el6.cloudlinux.5 ea-apache24-mod_lbmethod_heartbeat.x86_64 1:2.4.33-5.el6.cloudlinux.5 ea-apache24-mod_watchdog.x86_64 1:2.4.33-5.el6.cloudlinux.5 Complete! Preparing... ################################################## ea-apache24-mod_pagespeed ################################################## 08-06-2018 16:16:24 : 3202 : Setting up mod_lsapi [Fri Jun 08 16:16:24.488944 2018] [so:warn] [pid 543632:tid 139656201799648] AH01574: module version_module is already loaded, skipping Built /etc/apache2/conf/httpd.conf OK Reconfiguration completed [92mInstruction: [94mhttp://docs.cloudlinux.com/index.html?apache_mod_lsapi.html[0m 08-06-2018 16:29:47 : 3202 : Enabling mod_lsapi globally [Fri Jun 08 16:29:47.624420 2018] [so:warn] [pid 654616:tid 139740156020704] AH01574: module version_module is already loaded, skipping Using force-yes option... mod_lsapi switched to turning on and off through the MultiPHP Manager(/Home/Software/MultiPHP Manager) You are using enabled globally mod_lsapi. Do you want to enable mod_lsapi through MultiPHP Manager? Current PHP will be switched to lsapi handler: ea-php54 SAPI: cgi ea-php55 SAPI: cgi ea-php56 SAPI: cgi If you type N then mod_lsapi will be disabled and you can enable it again from MultiPHP Manager. Setting ea-php54 to lsapi handler... Setting ea-php55 to lsapi handler... Setting ea-php56 to lsapi handler... [92mInstruction: [94mhttp://docs.cloudlinux.com/index.html?apache_mod_lsapi.html[0m `/usr/local/scripts/EA4/lsapi.conf' -> `/etc/apache2/conf.d/lsapi.conf' cp: cannot stat `/usr/local/apache/conf/userdata/std/2/*': No such file or directory --- data: featurelist: disabled invalid_features: [] updated_features: ea-php54: 0 metadata: command: update_featurelist reason: OK result: 1 version: 1 --- data: featurelist: disabled invalid_features: [] updated_features: ea-php55: 0 metadata: command: update_featurelist reason: OK result: 1 version: 1 --- data: featurelist: disabled invalid_features: [] updated_features: ea-php56: 0 metadata: command: update_featurelist reason: OK result: 1 version: 1 --- data: featurelist: disabled invalid_features: [] updated_features: multiphp: 0 metadata: command: update_featurelist reason: OK result: 1 version: 1 --- data: featurelist: disabled invalid_features: [] updated_features: multiphp_ini_editor: 0 metadata: command: update_featurelist reason: OK result: 1 version: 1 08-06-2018 16:30:16 : 3202 : Inside rebuild_and_restart Built /etc/apache2/conf/httpd.conf OK [Fri Jun 08 16:30:36.798956 2018] [so:warn] [pid 675956:tid 140655209428960] AH01574: module version_module is already loaded, skipping [Fri Jun 08 16:30:36.842132 2018] [so:warn] [pid 675956:tid 140655209428960] AH01574: module lsapi_module is already loaded, skipping AH00112: Warning: DocumentRoot [/home/karyanao/public_html/images/icon] does not exist AH00112: Warning: DocumentRoot [/home/mokeubtt/public_html/webmart] does not exist AH00112: Warning: DocumentRoot [/home/karyanao/public_html/images/2] does not exist Starting haproxy: [ OK ] Shutting down system logger: [ OK ] Starting system logger: [ OK ] 08-06-2018 16:30:47 : 3202 : Exiting rebuild_and_restart function 08-06-2018 16:30:47 : 3202 : Running puppet Removed lockfile (/var/lib/puppet/state/puppetdlock) % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 165 0 174 --:--:-- --:--:-- --:--:-- 174 0 80 0 80 0 165 66 137 --:--:-- 0:00:01 --:--:-- 0 0 80 0 80 0 165 66 137 --:--:-- 0:00:01 --:--:-- 0 {"event":"success","description":"event successfully queued to the event queue"}[0;32minfo: Retrieving plugin[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/aws.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/cpanel_version_serverid.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/fpm_ports.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/gmond_head_node.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/facter_dot_d.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/libvirt.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/modsec_version.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/backup_server.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/home_type.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/gmond_head_node_name.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/puppet_vardir.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/haproxy_status.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/puppet-cron.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/branded_ips.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/rbl_blacklist_check.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/iptables_persistent_version.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/apache_server_version.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/services.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/ssh_client_version.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/cagefs_check.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/ssh_server_version.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/mysqlversion.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/default_php_version.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/gmond_version.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/easyapache_version.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/private_ip.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/ipaddresses.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/slowroll.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/concat_basedir.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/branding.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/cpanel_demo_siteuser.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/root_home.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/mail_routed.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/jmx_port.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/iptables_version.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/tomcat.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/kernelmod.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/diskdrives.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/backend_status.rb[0m [0;32minfo: Loading facts in /var/lib/puppet/lib/facter/ip6tables_version.rb[0m /bin/df: `/tmp/SECUPD': Input/output error /bin/df: `/tmp/SECUPD': Input/output error [0;32minfo: Caching catalog for bh-in-4.webhostbox.net[0m [0;32minfo: Applying configuration version '1528457247'[0m [0;36mnotice: /Stage[pre]/Yum/File[/etc/yum.conf]/content: --- /etc/yum.conf 2018-06-08 14:03:10.711980441 +0000 +++ /tmp/puppet-file20180608-681918-dpptw8-0 2018-06-08 16:31:33.860621879 +0000 @@ -19,4 +19,4 @@ # in /etc/yum.repos.d # Exclude the following packages as they are going to be managed by cPanel: -Exclude= apache* bind-chroot courier* dovecot* exim* httpd* mod_ssl* mysql* nsd* perl php* proftpd* pure-ftpd* spamassassin* squirrelmail* Percona* ruby ruby-libs.x86_64 ruby-devel.x86_64 rubygems rubygem-rspec augeas-libs ruby-augeas ruby-shadow rubygem-stomp bind* caching-nameserver* postgresql* srvadmin* dell* libsmal0 libcmpiCppImpl0* puppet* facter* grub* +Exclude= apache* bind-chroot courier* dovecot* exim* httpd* mod_ssl* mysql* nsd* perl php* proftpd* pure-ftpd* spamassassin* squirrelmail* Percona* ruby ruby-libs.x86_64 ruby-devel.x86_64 rubygems rubygem-rspec augeas-libs ruby-augeas ruby-shadow rubygem-stomp bind* caching-nameserver* postgresql* srvadmin* dell* libsmal0 cyrus-sasl* libcmpiCppImpl0* puppet* facter* grub* [0m [0;32minfo: FileBucket adding {md5}980fabf0de92fdc582d7c24619a11987[0m [0;32minfo: /Stage[pre]/Yum/File[/etc/yum.conf]: Filebucketed /etc/yum.conf to puppet with sum 980fabf0de92fdc582d7c24619a11987[0m [0;36mnotice: /Stage[pre]/Yum/File[/etc/yum.conf]/content: content changed '{md5}980fabf0de92fdc582d7c24619a11987' to '{md5}50caf5c2a64d56e9a6948628d131d819'[0m [0;32minfo: FileBucket adding {md5}036ace1cbe66b6100e3e4abf1f5dc355[0m [0;32minfo: /File[/etc/yum.repos.d/cloudlinux-ea4.repo]: Filebucketed /etc/yum.repos.d/cloudlinux-ea4.repo to puppet with sum 036ace1cbe66b6100e3e4abf1f5dc355[0m [0;36mnotice: /File[/etc/yum.repos.d/cloudlinux-ea4.repo]/ensure: removed[0m [0;32minfo: FileBucket adding {md5}1816f02df761ed4b3d0528552efdecd4[0m [0;32minfo: /File[/etc/yum.repos.d/cloudlinux-ea4-testing.repo]: Filebucketed /etc/yum.repos.d/cloudlinux-ea4-testing.repo to puppet with sum 1816f02df761ed4b3d0528552efdecd4[0m [0;36mnotice: /File[/etc/yum.repos.d/cloudlinux-ea4-testing.repo]/ensure: removed[0m [0;32minfo: FileBucket adding {md5}1e3ec58bf4b8e620c50f372463e06a2a[0m [0;32minfo: /File[/etc/yum.repos.d/EA4.repo]: Filebucketed /etc/yum.repos.d/EA4.repo to puppet with sum 1e3ec58bf4b8e620c50f372463e06a2a[0m [0;36mnotice: /File[/etc/yum.repos.d/EA4.repo]/ensure: removed[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/preupcp]/content: --- /scripts/preupcp 2018-06-08 14:31:27.324323059 +0000 +++ /tmp/puppet-file20180608-681918-sqlagb-0 2018-06-08 16:31:35.135618171 +0000 @@ -1,6 +1,6 @@ #!/bin/bash + if [ ! -f /var/tmp/preupcp-cpanel.version ]; then # noting cpanel version, will be used by postupcp to apply patches /usr/local/cpanel/cpanel -V > /var/tmp/preupcp-cpanel.version fi -/usr/share/l.v.e-manager/cpanel/hooks/l.v.e-manager_preupcp_hook.sh #l.v.e-manager [0m [0;32minfo: FileBucket adding {md5}6987765ccbf373c82ce2ed81b681a694[0m [0;32minfo: /Stage[main]/Cpanel::Hooks/File[/scripts/preupcp]: Filebucketed /scripts/preupcp to puppet with sum 6987765ccbf373c82ce2ed81b681a694[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/preupcp]/content: content changed '{md5}6987765ccbf373c82ce2ed81b681a694' to '{md5}3e529715e87d0813761f6db7cb6201f2'[0m [1;35merr: /Stage[main]/Cpanel::Config/File[/opt/cloudlinux/share/ImageMagick-6.5.4/config/policy.xml]/ensure: change from absent to file failed: Could not set 'file on ensure: No such file or directory - /opt/cloudlinux/share/ImageMagick-6.5.4/config/policy.xml.puppettmp_4184 at /etc/puppet/modules/cpanel/manifests/config.pp:145[0m [0;36mnotice: /Stage[main]/Cpanel::Config/File[/etc/cpupdate.conf]/content: --- /etc/cpupdate.conf 2018-06-08 15:01:53.595293724 +0000 +++ /tmp/puppet-file20180608-681918-1juine5-0 2018-06-08 16:32:10.640514889 +0000 @@ -1,5 +1,4 @@ CPANEL=11.64.0.42 RPMUP=manual SARULESUP=daily -STAGING_DIR=/usr/local/cpanel UPDATES=manual [0m [0;32minfo: FileBucket got a duplicate file {md5}a4df6cbd99c04135feb6c445694bb6e6[0m [0;32minfo: /Stage[main]/Cpanel::Config/File[/etc/cpupdate.conf]: Filebucketed /etc/cpupdate.conf to puppet with sum a4df6cbd99c04135feb6c445694bb6e6[0m [0;36mnotice: /Stage[main]/Cpanel::Config/File[/etc/cpupdate.conf]/content: content changed '{md5}a4df6cbd99c04135feb6c445694bb6e6' to '{md5}bd447fa26e26516b86f92fd081b5ed4e'[0m [0;36mnotice: /Stage[main]/Cpanel::Exim/File[/etc/spammeripblocks]/group: group changed 'mail' to 'root'[0m [0;36mnotice: /Stage[main]/Cpanel::Exim/File[/etc/spammeripblocks]/mode: mode changed '0640' to '0644'[0m [0;36mnotice: /Stage[main]/Cpanel-common/File[/etc/httpd/conf.d/includes/errordocument.conf]/content: --- /etc/httpd/conf.d/includes/errordocument.conf 2018-05-29 12:26:34.000000000 +0000 +++ /tmp/puppet-file20180608-681918-cm8s8r-0 2018-06-08 16:32:15.513500710 +0000 @@ -1,3 +1,4 @@ +Alias /errors/ /opt/www/errors/ # 400 - Bad Request ErrorDocument 400 /400.shtml @@ -8,10 +9,10 @@ ErrorDocument 402 /402.shtml # 403 - Forbidden -ErrorDocument 403 /403.shtml +ErrorDocument 403 /errors/rh-403.html # 404 - Not Found -ErrorDocument 404 /404.shtml +ErrorDocument 404 /errors/rh-404.html # 405 - Method Not Allowed ErrorDocument 405 /405.shtml @@ -62,7 +63,7 @@ ErrorDocument 424 /424.shtml # 500 - Internal Server Error -ErrorDocument 500 /500.shtml +ErrorDocument 500 /errors/rh-500.html # 501 - Not Implemented ErrorDocument 501 /501.shtml @@ -80,11 +81,4 @@ ErrorDocument 505 /505.shtml # 506 - Variant Also Negotiates -ErrorDocument 506 /506.shtml - -# 507 - Insufficient Storage -ErrorDocument 507 /507.shtml - -# 510 - Not Extended -ErrorDocument 510 /510.shtml - +ErrorDocument 506 /506.shtml [0m [0;32minfo: FileBucket adding {md5}4d2707f2c85c57ca0d81400f00f0048a[0m [0;32minfo: /Stage[main]/Cpanel-common/File[/etc/httpd/conf.d/includes/errordocument.conf]: Filebucketed /etc/httpd/conf.d/includes/errordocument.conf to puppet with sum 4d2707f2c85c57ca0d81400f00f0048a[0m [0;36mnotice: /Stage[main]/Cpanel-common/File[/etc/httpd/conf.d/includes/errordocument.conf]/content: content changed '{md5}4d2707f2c85c57ca0d81400f00f0048a' to '{md5}579c7d0a048b1d512d5cab16ec34f7e7'[0m [0;36mnotice: /Stage[main]/Cpanel-common/File[/etc/httpd/conf.d/includes/errordocument.conf]/mode: mode changed '0640' to '0644'[0m [0;36mnotice: /Stage[main]/Cpanel::Pure-ftpd/File[/etc/pure-ftpd.conf]/content: --- /etc/pure-ftpd.conf 2018-06-08 15:07:01.972314357 +0000 +++ /tmp/puppet-file20180608-681918-5t69yo-0 2018-06-08 16:32:16.726497179 +0000 @@ -300,7 +300,7 @@ # fw.c9x.org - jedi [13/Dec/1975:19:36:39] "GET /ftp/linux.tar.bz2" 200 21809338 # This log file can then be processed by www traffic analyzers. -AltLog xferlog:/etc/apache2/logs/domlogs/ftpxferlog +AltLog xferlog:/usr/local/apache/domlogs/ftpxferlog [0m [0;32minfo: FileBucket adding {md5}0e0fbe8753aeb09e72ae8380f2c42cc6[0m [0;32minfo: /Stage[main]/Cpanel::Pure-ftpd/File[/etc/pure-ftpd.conf]: Filebucketed /etc/pure-ftpd.conf to puppet with sum 0e0fbe8753aeb09e72ae8380f2c42cc6[0m [0;36mnotice: /Stage[main]/Cpanel::Pure-ftpd/File[/etc/pure-ftpd.conf]/content: content changed '{md5}0e0fbe8753aeb09e72ae8380f2c42cc6' to '{md5}abead08c96fa20c7570a5a3e0a999337'[0m [0;32minfo: /Stage[main]/Cpanel::Pure-ftpd/File[/etc/pure-ftpd.conf]: Scheduling refresh of Service[pure-ftpd][0m [0;36mnotice: /Stage[main]/Cpanel::Pure-ftpd/Service[pure-ftpd]: Triggered 'refresh' from 1 events[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/postwwwacct]/content: --- /scripts/postwwwacct 2018-06-08 14:31:27.339323009 +0000 +++ /tmp/puppet-file20180608-681918-h6sejo-0 2018-06-08 16:32:19.981487708 +0000 @@ -1,4 +1,4 @@ #!/bin/bash +/usr/share/l.v.e-manager/cpanel/hooks/l.v.e-manager_postwwwacct_hook.pl "$@" #l.v.e-manager /usr/share/cagefs/cpanel/cagefs_postwwwacct_hook.pl "$@" #CageFS Version 2.0 /usr/local/scripts/admin_tools/hook_postwwwact.pl "$@" #Custom Reseller Child Account perm hook -/usr/share/l.v.e-manager/cpanel/hooks/l.v.e-manager_postwwwacct_hook.py "$@" #l.v.e-manager [0m [0;32minfo: FileBucket adding {md5}bffae4a1c7959e915b8c77ef3159f3d8[0m [0;32minfo: /Stage[main]/Cpanel::Hooks/File[/scripts/postwwwacct]: Filebucketed /scripts/postwwwacct to puppet with sum bffae4a1c7959e915b8c77ef3159f3d8[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/postwwwacct]/content: content changed '{md5}bffae4a1c7959e915b8c77ef3159f3d8' to '{md5}7205c387859e59d9d80a18985b6a21f1'[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/before_apache_make]/content: --- /scripts/before_apache_make 2018-06-08 15:50:54.908020927 +0000 +++ /tmp/puppet-file20180608-681918-x2jreg-0 2018-06-08 16:32:20.855485164 +0000 @@ -1,6 +1,8 @@ #!/bin/bash -/usr/share/alt-mod-passenger-5.1.12-1.el6.cloudlinux/hooks/clearconf.hook #mod_passenger version 5.1.12 + + status="notpatched" + if [ -d /home/cpeasyapache ]; then /usr/bin/patch -s -N /home/cpeasyapache/src/httpd-*/server/core.c < /usr/local/scripts/patches/FollowSymLinks_to_OwnerMatch.patch && status="patched" @@ -8,38 +10,52 @@ /usr/bin/patch -s -N /home/cpeasyapache/src/mod_bw/mod_bw.c < /usr/local/scripts/patches/modbw.patch fi fi + if [ -d /usr/home/cpeasyapache ]; then + /usr/bin/patch -s -N /usr/home/cpeasyapache/src/httpd-*/server/core.c < /usr/local/scripts/patches/FollowSymLinks_to_OwnerMatch.patch && status="patched" if [ -f /usr/home/cpeasyapache/src/mod_bw/mod_bw.c ]; then /usr/bin/patch -s -N /usr/home/cpeasyapache/src/mod_bw/mod_bw.c < /usr/local/scripts/patches/modbw.patch fi fi + if [ "$status" = "notpatched" ]; then + cat << EOF | /usr/sbin/sendmail -f easyapache@`hostname` apac-sysarch-cpanel-alerts@endurance.com To: apac-sysarch-cpanel-alerts@endurance.com From: easyapache@`hostname` Subject: FollowSymLinks_to_OwnerMatch patch failed to apply EOF + #else ## add symlink patched info to httpd -V # /usr/bin/patch -s -N /home/cpeasyapache/src/httpd-*/server/main.c < /usr/local/scripts/patches/httpd_info_symlink.patch fi + # Modify bw module hard coded limit status="notpatched" + egrep -q '^#define MAX_VHOSTS [0-9][0-9]* ' /usr/home/cpeasyapache/src/mod_bw/mod_bw.c && sed -i 's/^#define MAX_VHOSTS [0-9][0-9]*/#define MAX_VHOSTS 25600/' /usr/home/cpeasyapache/src/mod_bw/mod_bw.c && egrep -q '^#define MAX_BUF [0-9][0-9]* ' /usr/home/cpeasyapache/src/mod_bw/mod_bw.c && sed -i 's/^#define MAX_BUF [0-9][0-9]*/#define MAX_BUF 25600/' /usr/home/cpeasyapache/src/mod_bw/mod_bw.c && status="patched" + egrep -q '^#define MAX_VHOSTS [0-9][0-9]* ' /home/cpeasyapache/src/mod_bw/mod_bw.c && sed -i 's/^#define MAX_VHOSTS [0-9][0-9]*/#define MAX_VHOSTS 25600/' /home/cpeasyapache/src/mod_bw/mod_bw.c && egrep -q '^#define MAX_BUF [0-9][0-9]* ' /home/cpeasyapache/src/mod_bw/mod_bw.c && sed -i 's/^#define MAX_BUF [0-9][0-9]*/#define MAX_BUF 25600/' /home/cpeasyapache/src/mod_bw/mod_bw.c && status="patched" + if [ "$status" = "notpatched" ]; then + cat << EOF | /usr/sbin/sendmail -f easyapache@`hostname` apac-sysarch-cpanel-alerts@endurance.com To: apac-sysarch-cpanel-alerts@endurance.com From: easyapache@`hostname` Subject: mod_bw patch failed to apply EOF + fi + + + [0m [0;32minfo: FileBucket adding {md5}ca03be7d3e6c2f646c88e70ea36dece0[0m [0;32minfo: /Stage[main]/Cpanel::Hooks/File[/scripts/before_apache_make]: Filebucketed /scripts/before_apache_make to puppet with sum ca03be7d3e6c2f646c88e70ea36dece0[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/before_apache_make]/content: content changed '{md5}ca03be7d3e6c2f646c88e70ea36dece0' to '{md5}970b4cc2f249eb48d82cecfb6c2ce5aa'[0m [0;36mnotice: /Stage[main]/Cpanel::Exim/File[/etc/mailips]/content: --- /etc/mailips 2018-06-08 16:16:19.000000000 +0000 +++ /tmp/puppet-file20180608-681918-kk12e9-0 2018-06-08 16:32:21.119484396 +0000 @@ -0,0 +1 @@ +*: 103.21.58.60 \ No newline at end of file [0m [0;32minfo: FileBucket got a duplicate file {md5}d41d8cd98f00b204e9800998ecf8427e[0m [0;32minfo: /Stage[main]/Cpanel::Exim/File[/etc/mailips]: Filebucketed /etc/mailips to puppet with sum d41d8cd98f00b204e9800998ecf8427e[0m [0;36mnotice: /Stage[main]/Cpanel::Exim/File[/etc/mailips]/content: content changed '{md5}d41d8cd98f00b204e9800998ecf8427e' to '{md5}343c043f1aad2f26d156f9c7d1c3feed'[0m [0;36mnotice: /Stage[main]/Cpanel::Config/File[/var/cpanel/rpm.versions.d/local.versions]/content: --- /var/cpanel/rpm.versions.d/local.versions 2018-06-08 15:04:06.724869352 +0000 +++ /tmp/puppet-file20180608-681918-lwtll6-0 2018-06-08 16:32:21.968481925 +0000 @@ -1,5 +1,5 @@ ---- -file_format: +--- +file_format: version: 2 install_targets: {} @@ -11,14 +11,11 @@ srpm_versions: {} -target_settings: +target_settings: MySQL51: unmanaged MySQL55: unmanaged MySQL56: unmanaged - analog: uninstalled clamav: installed - dovecot: unmanaged easy-tomcat7: uninstalled - webalizer: uninstalled + dovecot: unmanaged url_templates: {} - [0m [0;32minfo: FileBucket adding {md5}963598a5cc1f08a43e0a53f7e66aa2f1[0m [0;32minfo: /Stage[main]/Cpanel::Config/File[/var/cpanel/rpm.versions.d/local.versions]: Filebucketed /var/cpanel/rpm.versions.d/local.versions to puppet with sum 963598a5cc1f08a43e0a53f7e66aa2f1[0m [0;36mnotice: /Stage[main]/Cpanel::Config/File[/var/cpanel/rpm.versions.d/local.versions]/content: content changed '{md5}963598a5cc1f08a43e0a53f7e66aa2f1' to '{md5}ab9f082326f51e89f6c1560345868fbf'[0m [0;32minfo: /Stage[main]/Cpanel::Config/File[/var/cpanel/rpm.versions.d/local.versions]: Scheduling refresh of Exec[/scripts/check_cpanel_rpms --fix][0m [0;36mnotice: /Stage[main]/Cpanel::Config/Exec[/scripts/check_cpanel_rpms --fix]: Triggered 'refresh' from 1 events[0m [0;36mnotice: /Stage[main]/Cpanel-sl/Mysql::Percona::Grant_max_user_connection[root_max_user_connection]/Exec[grant-root@localhost-max-connection-15]/returns: executed successfully[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/before_httpd_restart_tests]/content: --- /scripts/before_httpd_restart_tests 2018-06-08 15:50:54.932020853 +0000 +++ /tmp/puppet-file20180608-681918-1ix24gb-0 2018-06-08 16:34:05.575180152 +0000 @@ -1,6 +1,8 @@ #!/bin/bash + echo "Downloadnig mod_fcgid 2.3.9" /usr/bin/wget http://apache.mirrors.hoobly.com//httpd/mod_fcgid/mod_fcgid-2.3.9.tar.gz -O /root/mod_fcgid-2.3.9.tar.gz && + echo "Compiling and installing mod_fcgid 2.3.9" cd /root && tar -zxvf /root/mod_fcgid-2.3.9.tar.gz && cd mod_fcgid-2.3.9/ && @@ -9,8 +11,11 @@ mv /usr/local/apache/modules/mod_fcgid.so /usr/local/apache/modules/mod_fcgid.so_2.3.6 && make install INSTALL_STATUS=$? + echo "Cleaning up mod_fcgid 2.3.9 source" rm -rf /root/mod_fcgid-2.3.9.tar.gz /root/mod_fcgid-2.3.9 + + if [ "$INSTALL_STATUS" -eq 0 ] && [ -f /usr/local/apache/modules/mod_fcgid.so ] then echo "Successfully installed mod_fcgid 2.3.9 via /scripts/after_apache_make_install hook" @@ -18,5 +23,4 @@ echo "Problem installing mod_fcgid 2.3.9 via /scripts/after_apache_make_install hook" exit 2 fi -/usr/share/alt-mod-passenger-5.1.12-1.el6.cloudlinux/hooks/modinstall.hook #mod_passenger Version 5.1.12 mod_passenger module installation -/usr/share/alt-mod-passenger-5.1.12-1.el6.cloudlinux/hooks/cpanelpostupcp.hook #mod_passenger Version 5.1.12 Rebuild Apache config hook + [0m [0;32minfo: FileBucket adding {md5}f76c9f2d10d9449835b915752352b16f[0m [0;32minfo: /Stage[main]/Cpanel::Hooks/File[/scripts/before_httpd_restart_tests]: Filebucketed /scripts/before_httpd_restart_tests to puppet with sum f76c9f2d10d9449835b915752352b16f[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/before_httpd_restart_tests]/content: content changed '{md5}f76c9f2d10d9449835b915752352b16f' to '{md5}4dcfede65b5fe9f632af3a257833d25a'[0m [0;36mnotice: /Stage[main]/Files-cpanel-shared/File[/usr/local/apache/conf/conf.d/]/ensure: created[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/postkillacct]/content: --- /scripts/postkillacct 2018-06-08 14:31:27.384322861 +0000 +++ /tmp/puppet-file20180608-681918-rwszl4-0 2018-06-08 16:34:10.809164896 +0000 @@ -1,3 +1,47 @@ -#!/bin/bash -/scripts/postkillacct.l.v.e-manager.bak "$@" -/usr/share/l.v.e-manager/cpanel/hooks/l.v.e-manager_postkillacct_hook.py "$@" #l.v.e-manager +#!/usr/bin/perl +# cpanel - postkillacct +# for deleting accounts with immutable files + +my %OPTS = @ARGV; + +# delete only if username is not whitespace and username directory exists +if ($OPTS{'user'}=~/[A-Za-z0-9].*/){ + + # Delete the home directory, which would be "/home(1|2|3)?" + `if [ -d /home/$OPTS{'user'} ] + then + /usr/bin/chattr -iR /home/$OPTS{'user'} + /bin/rm -rf /home/$OPTS{'user'} + fi + + if [ -d /home1/$OPTS{'user'} ] + then + /usr/bin/chattr -iR /home1/$OPTS{'user'} + /bin/rm -rf /home1/$OPTS{'user'} + fi + + if [ -d /home2/$OPTS{'user'} ] + then + /usr/bin/chattr -iR /home2/$OPTS{'user'} + /bin/rm -rf /home2/$OPTS{'user'} + fi + + if [ -d /home3/$OPTS{'user'} ] + then + /usr/bin/chattr -iR /home3/$OPTS{'user'} + /bin/rm -rf /home3/$OPTS{'user'} + fi`; + + + # Delete the username from fw related files + + `/bin/sed -i "/ $OPTS{'user'}\$/d" /etc/fw/user_port_block.conf`; + `/bin/rm -rf /opt/blocked_users/$OPTS{'user'}`; + + # Delete symbolic link if any + `if [ -L "/home/$OPTS{'user'}" ] + then + /bin/rm -rf /home/$OPTS{'user'} + fi`; + +} [0m [0;32minfo: FileBucket adding {md5}816dd26f60079e1367d96b40714a3f71[0m [0;32minfo: /Stage[main]/Cpanel::Hooks/File[/scripts/postkillacct]: Filebucketed /scripts/postkillacct to puppet with sum 816dd26f60079e1367d96b40714a3f71[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/postkillacct]/content: content changed '{md5}816dd26f60079e1367d96b40714a3f71' to '{md5}1568c63eb6d8fe53b92cb408ef55999d'[0m [0;36mnotice: /Stage[main]/Files-cpanel-shared/File[/usr/local/apache/conf/conf.d/lsapi.conf]/ensure: defined content as '{md5}1cbd2e29ac844d3e67106e2aa0910c69'[0m [1;35merr: /Stage[main]/Core::Dell-omsa/Package[yum-dellsysid]/ensure: change from absent to present failed: Execution of '/usr/bin/yum -d 0 -e 0 -y install yum-dellsysid' returned 1: There are unfinished transactions remaining. You might consider running yum-complete-transaction first to finish them. Error: Package: libstdc++-devel-4.4.7-17.el6.x86_64 (@cloudlinux-x86_64-server-6) Requires: libstdc++(x86-64) = 4.4.7-17.el6 Removing: libstdc++-4.4.7-17.el6.x86_64 (@anaconda-CloudLinux-201605200915.x86_64/6.8) libstdc++(x86-64) = 4.4.7-17.el6 Updated By: libstdc++-4.4.7-18.el6_9.2.x86_64 (cloudlinux-x86_64-server-6) libstdc++(x86-64) = 4.4.7-18.el6_9.2 Removing: libstdc++-4.4.7-18.el6.x86_64 (installed) libstdc++(x86-64) = 4.4.7-18.el6 Updated By: libstdc++-4.4.7-18.el6_9.2.x86_64 (cloudlinux-x86_64-server-6) libstdc++(x86-64) = 4.4.7-18.el6_9.2 Available: libstdc++-4.4.5-6.el6.x86_64 (cloudlinux-x86_64-server-6) libstdc++(x86-64) = 4.4.5-6.el6 Available: libstdc++-4.4.6-3.el6.x86_64 (cloudlinux-x86_64-server-6) libstdc++(x86-64) = 4.4.6-3.el6 Available: libstdc++-4.4.6-4.el6.x86_64 (cloudlinux-x86_64-server-6) libstdc++(x86-64) = 4.4.6-4.el6 Available: libstdc++-4.4.7-3.el6.x86_64 (cloudlinux-x86_64-server-6) libstdc++(x86-64) = 4.4.7-3.el6 Available: libstdc++-4.4.7-4.el6.x86_64 (cloudlinux-x86_64-server-6) libstdc++(x86-64) = 4.4.7-4.el6 Available: libstdc++-4.4.7-11.el6.x86_64 (cloudlinux-x86_64-server-6) libstdc++(x86-64) = 4.4.7-11.el6 Available: libstdc++-4.4.7-16.el6.x86_64 (cloudlinux-x86_64-server-6) libstdc++(x86-64) = 4.4.7-16.el6 You could try using --skip-broken to work around the problem ** Found 105 pre-existing rpmdb problem(s), 'yum check' output follows: ImageMagick-6.7.2.7-6.el6.x86_64 is a duplicate with ImageMagick-6.7.2.7-5.el6_8.x86_64 ImageMagick-perl-6.7.2.7-6.el6.x86_64 is a duplicate with ImageMagick-perl-6.7.2.7-5.el6_8.x86_64 acl-2.2.49-7.el6.x86_64 is a duplicate with acl-2.2.49-6.el6.x86_64 alt-libicu-57.1-1.el6.x86_64 is a duplicate with alt-libicu-50.1.2-1.el6.x86_64 alt-libssh2-1.8.0-2.el6.x86_64 is a duplicate with alt-libssh2-1.8.0-1.el6.x86_64 alt-python27-2.7.13-4.el6.x86_64 is a duplicate with alt-python27-2.7.11-7.el6.x86_64 alt-python27-libs-2.7.13-4.el6.x86_64 is a duplicate with alt-python27-libs-2.7.11-7.el6.x86_64 audit-libs-2.4.5-6.el6.x86_64 is a duplicate with audit-libs-2.4.5-3.el6.x86_64 avahi-libs-0.6.25-17.el6.x86_64 is a duplicate with avahi-libs-0.6.25-15.el6_8.1.x86_64 bash-4.1.2-48.el6.x86_64 is a duplicate with bash-4.1.2-41.el6_8.x86_64 binutils-2.20.51.0.2-5.47.el6_9.1.x86_64 is a duplicate with binutils-2.20.51.0.2-5.44.el6.x86_64 cloudlinux-release-6-6.9.3.x86_64 is a duplicate with cloudlinux-release-6-6.8.0.x86_64 compat-db42-4.2.52-17.el6.x86_64 is a duplicate with compat-db42-4.2.52-15.el6.cloudlinux.x86_64 compat-db43-4.3.29-17.el6.x86_64 is a duplicate with compat-db43-4.3.29-15.el6.cloudlinux.x86_64 coreutils-8.4-46.el6.x86_64 is a duplicate with coreutils-8.4-43.el6.x86_64 coreutils-libs-8.4-46.el6.x86_64 is a duplicate with coreutils-libs-8.4-43.el6.x86_64 cpio-2.10-13.el6.x86_64 is a duplicate with cpio-2.10-12.el6_5.x86_64 1:cups-libs-1.4.2-78.el6_9.x86_64 is a duplicate with 1:cups-libs-1.4.2-74.el6.x86_64 db4-4.7.25-22.el6.x86_64 is a duplicate with db4-4.7.25-20.el6_8.1.x86_64 db4-cxx-4.7.25-22.el6.x86_64 is a duplicate with db4-cxx-4.7.25-20.el6_8.1.x86_64 db4-utils-4.7.25-22.el6.x86_64 is a duplicate with db4-utils-4.7.25-20.el6_8.1.x86_64 device-mapper-1.02.117-12.el6.x86_64 is a duplicate with device-mapper-1.02.117-7.el6_8.1.x86_64 device-mapper-libs-1.02.117-12.el6.x86_64 is a duplicate with device-mapper-libs-1.02.117-7.el6_8.1.x86_64 12:dhcp-common-4.1.1-53.P1.el6.centos.x86_64 is a duplicate with 12:dhcp-common-4.1.1-51.P1.el6.centos.x86_64 e2fsprogs-libs-1.41.12-23.el6.x86_64 is a duplicate with e2fsprogs-libs-1.41.12-22.el6.x86_64 efibootmgr-0.5.4-15.el6.x86_64 is a duplicate with efibootmgr-0.5.4-13.el6.x86_64 gdb-7.2-92.el6.x86_64 is a duplicate with gdb-7.2-90.el6.x86_64 ghostscript-8.70-23.el6_9.2.x86_64 is a duplicate with ghostscript-8.70-21.el6_8.1.x86_64 glib2-2.28.8-9.el6.x86_64 is a duplicate with glib2-2.28.8-5.el6.x86_64 gmp-4.3.1-12.el6.x86_64 is a duplicate with gmp-4.3.1-10.el6.x86_64 grep-2.20-6.el6.x86_64 is a duplicate with grep-2.20-5.el6_8.x86_64 initscripts-9.03.58-1.el6_9.1.x86_64 is a duplicate with initscripts-9.03.53-1.el6_8.2.x86_64 iputils-20071127-24.el6.x86_64 is a duplicate with iputils-20071127-21.el6.x86_64 jasper-libs-1.900.1-21.el6_9.x86_64 is a duplicate with jasper-libs-1.900.1-16.el6_6.3.x86_64 1:kernel-firmware-2.6.32-673.26.1.lve1.4.30.el6.noarch is a duplicate with 1:kernel-firmware-2.6.32-673.26.1.lve1.4.23.el6.noarch 1:kernel-headers-2.6.32-673.26.1.lve1.4.30.el6.x86_64 is a duplicate with 1:kernel-headers-2.6.32-673.26.1.lve1.4.23.el6.x86_64 kpartx-0.4.9-100.el6.x86_64 is a duplicate with kpartx-0.4.9-93.el6.x86_64 krb5-libs-1.10.3-65.el6.x86_64 is a duplicate with krb5-libs-1.10.3-57.el6.x86_64 lftp-4.0.9-14.el6.x86_64 is a duplicate with lftp-4.0.9-6.el6_8.4.x86_64 libX11-1.6.4-3.el6.x86_64 is a duplicate with libX11-1.6.3-2.el6.x86_64 libX11-common-1.6.4-3.el6.noarch is a duplicate with libX11-common-1.6.3-2.el6.noarch libXfixes-5.0.3-1.el6.x86_64 is a duplicate with libXfixes-5.0.1-2.1.el6.x86_64 libXi-1.7.8-1.el6.x86_64 is a duplicate with libXi-1.7.4-1.el6.x86_64 libXrender-0.9.10-1.el6.x86_64 is a duplicate with libXrender-0.9.8-2.1.el6_8.1.x86_64 libacl-2.2.49-7.el6.x86_64 is a duplicate with libacl-2.2.49-6.el6.x86_64 libblkid-2.17.2-12.28.el6.x86_64 is a duplicate with libblkid-2.17.2-12.24.el6_8.3.x86_64 libcom_err-1.41.12-23.el6.x86_64 is a duplicate with libcom_err-1.41.12-22.el6.x86_64 libcurl-7.19.7-53.el6_9.x86_64 is a duplicate with libcurl-7.19.7-52.el6.x86_64 libgcc-4.4.7-18.el6.x86_64 is a duplicate with libgcc-4.4.7-17.el6.x86_64 libgfortran-4.4.7-18.el6.x86_64 is a duplicate with libgfortran-4.4.7-17.el6.x86_64 libgomp-4.4.7-18.el6.x86_64 is a duplicate with libgomp-4.4.7-17.el6.x86_64 libss-1.41.12-23.el6.x86_64 is a duplicate with libss-1.41.12-22.el6.x86_64 libstdc++-4.4.7-18.el6.x86_64 is a duplicate with libstdc++-4.4.7-17.el6.x86_64 libstdc++-devel-4.4.7-18.el6.x86_64 is a duplicate with libstdc++-devel-4.4.7-17.el6.x86_64 libtirpc-0.2.1-13.el6_9.x86_64 is a duplicate with libtirpc-0.2.1-11.el6_8.x86_64 libuuid-2.17.2-12.28.el6.x86_64 is a duplicate with libuuid-2.17.2-12.24.el6_8.3.x86_64 libxcb-1.12-4.el6.x86_64 is a duplicate with libxcb-1.11-2.el6.x86_64 mdadm-3.3.4-8.el6.x86_64 is a duplicate with mdadm-3.3.4-1.el6_8.5.x86_64 module-init-tools-3.9-26.el6.x86_64 is a duplicate with module-init-tools-3.9-25.el6.x86_64 1:net-snmp-libs-5.5-60.el6.x86_64 is a duplicate with 1:net-snmp-libs-5.5-57.el6_8.1.x86_64 1:net-snmp-utils-5.5-60.el6.x86_64 is a duplicate with 1:net-snmp-utils-5.5-57.el6_8.1.x86_64 net-tools-1.60-114.el6.x86_64 is a duplicate with net-tools-1.60-110.el6_2.x86_64 newt-0.52.11-4.el6.x86_64 is a duplicate with newt-0.52.11-3.el6.x86_64 newt-python-0.52.11-4.el6.x86_64 is a duplicate with newt-python-0.52.11-3.el6.x86_64 nspr-4.13.1-1.el6.x86_64 is a duplicate with nspr-4.11.0-1.el6.x86_64 nss-3.28.4-3.el6_9.x86_64 is a duplicate with nss-3.21.3-2.el6_8.x86_64 nss-sysinit-3.28.4-3.el6_9.x86_64 is a duplicate with nss-sysinit-3.21.3-2.el6_8.x86_64 nss-tools-3.28.4-3.el6_9.x86_64 is a duplicate with nss-tools-3.21.3-2.el6_8.x86_64 nss-util-3.28.4-1.el6_9.x86_64 is a duplicate with nss-util-3.21.3-1.el6_8.x86_64 openldap-2.4.40-16.el6.x86_64 is a duplicate with openldap-2.4.40-12.el6.x86_64 pam-1.1.1-24.el6.x86_64 is a duplicate with pam-1.1.1-22.el6.x86_64 4:perl-5.10.1-144.el6.x86_64 is a duplicate with 4:perl-5.10.1-141.el6_7.1.x86_64 perl-Compress-Raw-Bzip2-2.021-144.el6.x86_64 is a duplicate with perl-Compress-Raw-Bzip2-2.021-141.el6_7.1.x86_64 1:perl-Compress-Raw-Zlib-2.021-144.el6.x86_64 is a duplicate with 1:perl-Compress-Raw-Zlib-2.021-141.el6_7.1.x86_64 1:perl-Digest-SHA-5.47-144.el6.x86_64 is a duplicate with 1:perl-Digest-SHA-5.47-141.el6_7.1.x86_64 perl-IO-Compress-Base-2.021-144.el6.x86_64 is a duplicate with perl-IO-Compress-Base-2.021-141.el6_7.1.x86_64 1:perl-Module-Pluggable-3.90-144.el6.x86_64 is a duplicate with 1:perl-Module-Pluggable-3.90-141.el6_7.1.x86_64 1:perl-Pod-Escapes-1.04-144.el6.x86_64 is a duplicate with 1:perl-Pod-Escapes-1.04-141.el6_7.1.x86_64 1:perl-Pod-Simple-3.13-144.el6.x86_64 is a duplicate with 1:perl-Pod-Simple-3.13-141.el6_7.1.x86_64 4:perl-Time-HiRes-1.9721-144.el6.x86_64 is a duplicate with 4:perl-Time-HiRes-1.9721-141.el6_7.1.x86_64 perl-Time-Piece-1.15-144.el6.x86_64 is a duplicate with perl-Time-Piece-1.15-141.el6_7.1.x86_64 4:perl-libs-5.10.1-144.el6.x86_64 is a duplicate with 4:perl-libs-5.10.1-141.el6_7.1.x86_64 3:perl-version-0.77-144.el6.x86_64 is a duplicate with 3:perl-version-0.77-141.el6_7.1.x86_64 plymouth-0.8.3-29.el6.cloudlinux.x86_64 is a duplicate with plymouth-0.8.3-27.el6_5.1.cloudlinux.x86_64 plymouth-core-libs-0.8.3-29.el6.cloudlinux.x86_64 is a duplicate with plymouth-core-libs-0.8.3-27.el6_5.1.cloudlinux.x86_64 plymouth-scripts-0.8.3-29.el6.cloudlinux.x86_64 is a duplicate with plymouth-scripts-0.8.3-27.el6_5.1.cloudlinux.x86_64 procps-3.2.8-45.el6_9.1.x86_64 is a duplicate with procps-3.2.8-36.el6.x86_64 psmisc-22.6-24.el6.x86_64 is a duplicate with psmisc-22.6-19.el6_5.x86_64 python-backports-ssl_match_hostname-3.4.0.2-5.el6.noarch is a duplicate with python-backports-ssl_match_hostname-3.4.0.2-4.el6.centos.noarch python-dmidecode-3.10.15-1.el6.x86_64 is a duplicate with python-dmidecode-3.10.13-3.el6_4.x86_64 python-ethtool-0.6-6.el6.x86_64 is a duplicate with python-ethtool-0.6-5.el6.x86_64 python-jinja2-2.2.1-3.el6.x86_64 is a duplicate with python-jinja2-2.2.1-2.el6_5.x86_64 ruby-1.8.7.374-5.el6.x86_64 is a duplicate with ruby-1.8.7.374-4.el6_6.x86_64 ruby-libs-1.8.7.374-5.el6.x86_64 is a duplicate with ruby-libs-1.8.7.374-4.el6_6.x86_64 setup-2.8.14-23.el6.noarch is a duplicate with setup-2.8.14-20.el6_4.1.noarch sos-3.2-54.el6.cloudlinux.noarch is a duplicate with sos-3.2-40.el6.cloudlinux.noarch stunnel-4.29-7.el6.x86_64 is a duplicate with stunnel-4.29-6.el6.x86_64 tzdata-2017b-1.el6.noarch is a duplicate with tzdata-2017a-1.el6.noarch unzip-6.0-5.el6.x86_64 is a duplicate with unzip-6.0-4.el6.x86_64 util-linux-ng-2.17.2-12.28.el6.x86_64 is a duplicate with util-linux-ng-2.17.2-12.24.el6_8.3.x86_64 virt-what-1.11-1.3.el6.x86_64 is a duplicate with virt-what-1.11-1.2.el6.x86_64 wget-1.12-10.el6.x86_64 is a duplicate with wget-1.12-8.el6.x86_64 xorg-x11-drv-ati-firmware-7.6.1-3.el6_9.noarch is a duplicate with xorg-x11-drv-ati-firmware-7.6.1-2.el6.noarch xorg-x11-proto-devel-7.7-14.el6.noarch is a duplicate with xorg-x11-proto-devel-7.7-13.el6.noarch yum-3.2.29-81.el6.cloudlinux.noarch is a duplicate with yum-3.2.29-75.el6_8.cloudlinux.noarch [0m [0;36mnotice: /Stage[main]/Core::Dell-omsa/Exec[restart-srvadmin]: Dependency Package[yum-dellsysid] has failures: true[0m [0;33mwarning: /Stage[main]/Core::Dell-omsa/Exec[restart-srvadmin]: Skipping because of failed dependencies[0m [0;36mnotice: /Stage[main]/Cpanel::Kernelcare/Package[kernelcare]/ensure: ensure changed '2.14-4' to '0:2.14-10'[0m [0;36mnotice: /Stage[main]/Cp-bulk/File[/var/cpanel/features/disabled]/content: --- /var/cpanel/features/disabled 2018-06-08 16:30:16.064847973 +0000 +++ /tmp/puppet-file20180608-681918-1ibgj35-0 2018-06-08 16:35:31.740928815 +0000 @@ -1,18 +1,15 @@ api_shell=0 bbs=0 +emailarchive=0 chat=0 +logaholic=0 cpanelpro_support=0 -ea-php54=0 -ea-php55=0 -ea-php56=0 -emailarchive=0 emailtrace=0 fantastico=0 modules-ruby=0 -multiphp=0 -multiphp_ini_editor=0 -phppgadmin=0 -postgres=0 ror=0 searchsubmit=0 +postgres=0 +enduserlve=1 +phppgadmin=0 theme-switch=0 [0m [0;32minfo: FileBucket adding {md5}2e21b81db8090108a14ad4c73c7e2a49[0m [0;32minfo: /Stage[main]/Cp-bulk/File[/var/cpanel/features/disabled]: Filebucketed /var/cpanel/features/disabled to puppet with sum 2e21b81db8090108a14ad4c73c7e2a49[0m [0;36mnotice: /Stage[main]/Cp-bulk/File[/var/cpanel/features/disabled]/content: content changed '{md5}2e21b81db8090108a14ad4c73c7e2a49' to '{md5}405ba6ca47253dbf11ba647ea415a12e'[0m [0;36mnotice: /Stage[main]/Cpanel-common/Yum::Repo[hosting-custom-x86_64]/File[/etc/yum.repos.d/hosting-custom-x86_64.repo]/content: --- /etc/yum.repos.d/hosting-custom-x86_64.repo 2018-06-08 14:03:10.690980510 +0000 +++ /tmp/puppet-file20180608-681918-sqzsy3-0 2018-06-08 16:35:32.189927504 +0000 @@ -1,7 +1,7 @@ [hosting-custom-rhl6-86_64] name=hosting-custom-rhl6-86_64 baseurl=https://pulp.tx1-tx.colo/pulp/repos/hosting.pw/rhel6/x86_64/ -enabled=0 +enabled=1 priority=99 gpgcheck=0 sslverify=false [0m [0;32minfo: FileBucket adding {md5}0344dcdfdc3e35fb8a835c89101b7833[0m [0;32minfo: /Stage[main]/Cpanel-common/Yum::Repo[hosting-custom-x86_64]/File[/etc/yum.repos.d/hosting-custom-x86_64.repo]: Filebucketed /etc/yum.repos.d/hosting-custom-x86_64.repo to puppet with sum 0344dcdfdc3e35fb8a835c89101b7833[0m [1;35merr: /Stage[main]/Cpanel-common/Yum::Repo[hosting-custom-x86_64]/File[/etc/yum.repos.d/hosting-custom-x86_64.repo]/content: change from {md5}0344dcdfdc3e35fb8a835c89101b7833 to {md5}60b7471e4126705fa3e1bcb0c361ec5a failed: Could not rename temporary file /etc/yum.repos.d/hosting-custom-x86_64.repo.puppettmp_8502 to /etc/yum.repos.d/hosting-custom-x86_64.repo: Operation not permitted - /etc/yum.repos.d/hosting-custom-x86_64.repo.puppettmp_8502 or /etc/yum.repos.d/hosting-custom-x86_64.repo at /etc/puppet/modules/yum/manifests/init.pp:58[0m [0;36mnotice: /Stage[main]/Files-cpanel-shared/File[/etc/container/php.handler]/content: --- /etc/container/php.handler 2018-06-08 16:16:36.540350731 +0000 +++ /tmp/puppet-file20180608-681918-3vbiu1-0 2018-06-08 16:35:34.386921092 +0000 @@ -6,33 +6,3 @@ application/x-lsphp56 /opt/alt/php56/usr/bin/lsphp application/x-lsphp70 /opt/alt/php70/usr/bin/lsphp application/x-lsphp71 /opt/alt/php71/usr/bin/lsphp -application/x-httpd-alt-php44___lsphp /opt/cloudlinux/alt-php44/root/usr/bin/lsphp -application/x-httpd-alt-php51___lsphp /opt/cloudlinux/alt-php51/root/usr/bin/lsphp -application/x-httpd-alt-php52___lsphp /opt/cloudlinux/alt-php52/root/usr/bin/lsphp -application/x-httpd-alt-php53___lsphp /opt/cloudlinux/alt-php53/root/usr/bin/lsphp -application/x-httpd-alt-php54___lsphp /opt/cloudlinux/alt-php54/root/usr/bin/lsphp -application/x-httpd-alt-php55___lsphp /opt/cloudlinux/alt-php55/root/usr/bin/lsphp -application/x-httpd-alt-php56___lsphp /opt/cloudlinux/alt-php56/root/usr/bin/lsphp -application/x-httpd-alt-php70___lsphp /opt/cloudlinux/alt-php70/root/usr/bin/lsphp -application/x-httpd-alt-php71___lsphp /opt/cloudlinux/alt-php71/root/usr/bin/lsphp -application/x-httpd-alt-php72___lsphp /opt/cloudlinux/alt-php72/root/usr/bin/lsphp -application/x-httpd-ea-php44-lsphp /opt/cpanel/ea-php44/root/usr/bin/lsphp -application/x-httpd-ea-php51-lsphp /opt/cpanel/ea-php51/root/usr/bin/lsphp -application/x-httpd-ea-php52-lsphp /opt/cpanel/ea-php52/root/usr/bin/lsphp -application/x-httpd-ea-php53-lsphp /opt/cpanel/ea-php53/root/usr/bin/lsphp -application/x-httpd-ea-php54-lsphp /opt/cpanel/ea-php54/root/usr/bin/lsphp -application/x-httpd-ea-php55-lsphp /opt/cpanel/ea-php55/root/usr/bin/lsphp -application/x-httpd-ea-php56-lsphp /opt/cpanel/ea-php56/root/usr/bin/lsphp -application/x-httpd-ea-php70-lsphp /opt/cpanel/ea-php70/root/usr/bin/lsphp -application/x-httpd-ea-php71-lsphp /opt/cpanel/ea-php71/root/usr/bin/lsphp -application/x-httpd-ea-php72-lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp -application/x-httpd-ea-php44___lsphp /opt/cpanel/ea-php44/root/usr/bin/lsphp -application/x-httpd-ea-php51___lsphp /opt/cpanel/ea-php51/root/usr/bin/lsphp -application/x-httpd-ea-php52___lsphp /opt/cpanel/ea-php52/root/usr/bin/lsphp -application/x-httpd-ea-php53___lsphp /opt/cpanel/ea-php53/root/usr/bin/lsphp -application/x-httpd-ea-php54___lsphp /opt/cpanel/ea-php54/root/usr/bin/lsphp -application/x-httpd-ea-php55___lsphp /opt/cpanel/ea-php55/root/usr/bin/lsphp -application/x-httpd-ea-php56___lsphp /opt/cpanel/ea-php56/root/usr/bin/lsphp -application/x-httpd-ea-php70___lsphp /opt/cpanel/ea-php70/root/usr/bin/lsphp -application/x-httpd-ea-php71___lsphp /opt/cpanel/ea-php71/root/usr/bin/lsphp -application/x-httpd-ea-php72___lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp [0m [0;32minfo: FileBucket adding {md5}9ea10d42ad761d5a6f7d83339c9e3024[0m [0;32minfo: /Stage[main]/Files-cpanel-shared/File[/etc/container/php.handler]: Filebucketed /etc/container/php.handler to puppet with sum 9ea10d42ad761d5a6f7d83339c9e3024[0m [0;36mnotice: /Stage[main]/Files-cpanel-shared/File[/etc/container/php.handler]/content: content changed '{md5}9ea10d42ad761d5a6f7d83339c9e3024' to '{md5}19408b6cb2b43e153c89869040dca867'[0m [0;36mnotice: /Stage[main]/Cpanel-common/Cpanel::Backup::Assign[cp-backup-in-13.webhostbox.net]/Exec[mysql-remove-unsafe-grants]/returns: executed successfully[0m [0;36mnotice: /Stage[main]/Cpanel::Dovecot/File[/etc/init.d/dovecot]/content: --- /etc/init.d/dovecot 2017-04-12 23:01:23.000000000 +0000 +++ /tmp/puppet-file20180608-681918-1f33man-0 2018-06-08 16:35:36.567914723 +0000 @@ -1,6 +1,6 @@ #!/bin/bash # -# /etc/rc.d/init.d/dovecot +# /etc/rc.d/init.d/dovecot # # Starts the dovecot daemon # @@ -17,7 +17,7 @@ # Required-Stop: $local_fs $network # Should-Start: $remote_fs # Should-Stop: $remote_fs -# Default-Start: +# Default-Start: # Default-Stop: 0 1 2 3 4 5 6 # Short-Description: start and stop Dovecot Imap server # Description: Dovecot is an IMAP server for Linux/UNIX-like systems, @@ -32,6 +32,8 @@ if [ -f /etc/sysconfig/dovecot -a $UID -eq 0 ]; then . /etc/sysconfig/dovecot fi +##Added to fix sni dovecot error +/scripts/build_mail_sni --rebuild_dovecot_sni_conf --rebuild_map_file RETVAL=0 prog="Dovecot Imap" @@ -46,9 +48,9 @@ REGEX='(?:^|\s+|\/)dovecot$' start() { - [ $UID -eq 0 ] || exit 4 - [ -x $exec ] || exit 5 - [ -f $config ] || exit 6 + [ $UID -eq 0 ] || exit 4 + [ -x $exec ] || exit 5 + [ -f $config ] || exit 6 already_running $USER $SERVICE $PIDFILE $REGEX; RUNNING=$? if [ 0 = $RUNNING ]; then @@ -61,56 +63,57 @@ } stop() { - [ $UID -eq 0 ] || exit 4 - echo -n $"Stopping $prog: " - /usr/sbin/dovecot_cpshutdown - rm -f $lockfile - echo + [ $UID -eq 0 ] || exit 4 + echo -n $"Stopping $prog: " + killproc -p $pidfile $exec + RETVAL=$? + [ $RETVAL -eq 0 ] && rm -f $lockfile + /usr/local/cpanel/etc/init/safekill dovecot dovecot-auth dovecot/pop3-login dovecot/imap-login dovecot/anvil dovecot/log dovecot/config dovecot/auth dovecot-wrap >/dev/null 2>&1 + echo } reload() { - [ $UID -eq 0 ] || exit 4 - echo -n $"Reloading $prog: " - killproc -p $pidfile $exec -HUP - RETVAL=$? - echo + [ $UID -eq 0 ] || exit 4 + echo -n $"Reloading $prog: " + killproc -p $pidfile $exec -HUP + RETVAL=$? + echo } # -# See how we were called. +# See how we were called. # case "$1" in start) - start - ;; + start + ;; stop) - stop - ;; + stop + ;; reload) - reload - ;; + reload + ;; force-reload|restart) - stop - sleep 1 - start - RETVAL=$? - ;; + stop + sleep 1 + start + RETVAL=$? + ;; condrestart|try-restart) - if [ -f $lockfile ]; then - stop - sleep 3 - start - fi - ;; + if [ -f $lockfile ]; then + stop + sleep 3 + start + fi + ;; status) - status -p $pidfile $exec - RETVAL=$? - ;; + status -p $pidfile $exec + RETVAL=$? + ;; *) - echo $"Usage: $0 {condrestart|try-restart|start|stop|restart|reload|force-reload|status}" - RETVAL=2 - [ "$1" = 'usage' ] && RETVAL=0 + echo $"Usage: $0 {condrestart|try-restart|start|stop|restart|reload|force-reload|status}" + RETVAL=2 + [ "$1" = 'usage' ] && RETVAL=0 esac exit $RETVAL - [0m [0;32minfo: FileBucket adding {md5}c5b2a99fea5dbb2ca60b163d5278c06c[0m [0;32minfo: /Stage[main]/Cpanel::Dovecot/File[/etc/init.d/dovecot]: Filebucketed /etc/init.d/dovecot to puppet with sum c5b2a99fea5dbb2ca60b163d5278c06c[0m [0;36mnotice: /Stage[main]/Cpanel::Dovecot/File[/etc/init.d/dovecot]/content: content changed '{md5}c5b2a99fea5dbb2ca60b163d5278c06c' to '{md5}75c4253405d204e3c7ac4404cc38a6e7'[0m [0;32minfo: /Stage[main]/Cpanel::Dovecot/File[/etc/init.d/dovecot]: Scheduling refresh of Exec[builddovecotconf][0m [0;36mnotice: /Stage[main]/Cpanel::Exim/Core::Log_stats[exim_log_stats]/File[/opt/scripts/loglines_per_sec_stats.sh]/mode: mode changed '0775' to '0755'[0m [0;36mnotice: /Stage[main]/Cpanel-common/Yum::Repo[sysad-x86_64]/File[/etc/yum.repos.d/sysad-x86_64.repo]/content: --- /etc/yum.repos.d/sysad-x86_64.repo 2018-06-08 14:03:10.690980510 +0000 +++ /tmp/puppet-file20180608-681918-1scu17o-0 2018-06-08 16:35:58.333851178 +0000 @@ -1,7 +1,7 @@ [sysad] name=Directi sysad repository gpgcheck=0 -enabled=0 +enabled=1 baseurl=https://pulp.gpx-mum.colo/pulp/repos/sysad/yum/rhel6/x86_64/ metadata_expire=1800 sslverify=false [0m [0;32minfo: FileBucket adding {md5}0cf1120f871dd887dfe52e15e66ae37e[0m [0;32minfo: /Stage[main]/Cpanel-common/Yum::Repo[sysad-x86_64]/File[/etc/yum.repos.d/sysad-x86_64.repo]: Filebucketed /etc/yum.repos.d/sysad-x86_64.repo to puppet with sum 0cf1120f871dd887dfe52e15e66ae37e[0m [1;35merr: /Stage[main]/Cpanel-common/Yum::Repo[sysad-x86_64]/File[/etc/yum.repos.d/sysad-x86_64.repo]/content: change from {md5}0cf1120f871dd887dfe52e15e66ae37e to {md5}6cb679935bd1f879c47702ade4a0a4fa failed: Could not rename temporary file /etc/yum.repos.d/sysad-x86_64.repo.puppettmp_9377 to /etc/yum.repos.d/sysad-x86_64.repo: Operation not permitted - /etc/yum.repos.d/sysad-x86_64.repo.puppettmp_9377 or /etc/yum.repos.d/sysad-x86_64.repo at /etc/puppet/modules/yum/manifests/init.pp:58[0m [0;36mnotice: /Stage[main]/Cpanel::Rails19/File[/usr/local/apache/conf/includes/pre_main_3.conf]/ensure: defined content as '{md5}0a1817f2c56d69624e89008e7f835f3c'[0m [0;36mnotice: /Stage[main]/Cpanel-common/Sshkeys::Set_authorized_keys[spamtrac]/Ssh_authorized_key[spamtrac]/ensure: created[0m [0;32minfo: FileBucket got a duplicate file {md5}c9fd68f6e5723a1b43405a8a40b18f41[0m [0;36mnotice: /Stage[main]/Cpanel::Dovecot/Exec[builddovecotconf]: Triggered 'refresh' from 1 events[0m [1;35merr: /Stage[main]/Cpanel::Mod_security/Package[mod_sed]/ensure: change from absent to present failed: Execution of '/usr/bin/yum -d 0 -e 0 -y install mod_sed' returned 1: Error: Nothing to do [0m [0;32minfo: FileBucket adding {md5}c85368660de9cd1da78ec588357caa5c[0m [0;32minfo: /Stage[main]/Crons-cpanel/File[/etc/cron.d/kcare-cron]: Filebucketed /etc/cron.d/kcare-cron to puppet with sum c85368660de9cd1da78ec588357caa5c[0m [0;36mnotice: /Stage[main]/Crons-cpanel/File[/etc/cron.d/kcare-cron]/ensure: removed[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/postupcp]/content: --- /scripts/postupcp 2018-06-08 15:50:54.951020794 +0000 +++ /tmp/puppet-file20180608-681918-dd83mo-0 2018-06-08 16:36:22.417780841 +0000 @@ -1,8 +1,10 @@ #!/bin/bash postupcp_version=$(/usr/local/cpanel/cpanel -V) preupcp_version=$(cat /var/tmp/preupcp-cpanel.version) + if [ "$postupcp_version" != "$preupcp_version" ]; #seems like we updated then + #patch accounts.html file, with ftp banner #/usr/local/scripts/patches/ftp_accounts_banner.sh @@ -10,15 +12,17 @@ #/usr/local/scripts/patches/cron_entries_tmpl.sh chmod 755 /usr/local/scripts/firstboot/10-apply-patches.sh /usr/local/scripts/firstboot/10-apply-patches.sh + #check if lvemanager is installed and fix cpanel stats interface if [ -f /usr/share/l.v.e-manager/cpanel/hooks/l.v.e-manager_postupcp_hook.sh ]; then chmod 755 /usr/share/l.v.e-manager/cpanel/hooks/l.v.e-manager_postupcp_hook.sh /usr/share/l.v.e-manager/cpanel/hooks/l.v.e-manager_postupcp_hook.sh fi + #run our testsuite #/usr/local/scripts/testsuite/run_test_suite.sh fi + #edit upcp --cron in crontab sed -i 's/upcp --cron *$/upcp --cron >\/dev\/null 2>\&1/' /var/spool/cron/root cd /var/tmp/;rm -f preupcp-cpanel.version -/usr/share/alt-mod-passenger-5.1.12-1.el6.cloudlinux/hooks/cpanelpostupcp.hook #mod_passenger Version 5.1.12 Rebuild Apache config hook [0m [0;32minfo: FileBucket adding {md5}770e3890e8e69466eb18979caf378b44[0m [0;32minfo: /Stage[main]/Cpanel::Hooks/File[/scripts/postupcp]: Filebucketed /scripts/postupcp to puppet with sum 770e3890e8e69466eb18979caf378b44[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/scripts/postupcp]/content: content changed '{md5}770e3890e8e69466eb18979caf378b44' to '{md5}efa9159cabdc05f9422ee590db4ecf66'[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/usr/local/cpanel/scripts/postmodifyacct]/content: --- /usr/local/cpanel/scripts/postmodifyacct 2018-06-08 14:31:27.398322815 +0000 +++ /tmp/puppet-file20180608-681918-1hxmzfq-0 2018-06-08 16:36:23.385778012 +0000 @@ -1,3 +1,16 @@ -#!/bin/bash -/scripts/postmodifyacct.l.v.e-manager.bak "$@" -/usr/share/l.v.e-manager/cpanel/hooks/lvemanager_postmodifyacct_hook.py "$@" #l.v.e-manager +#!/usr/local/bin/perl +my %OPTS = @ARGV; +my $USER = "$OPTS{'newuser'}"; +if ( $OPTS{'newuser'} ne "root" ) +{ +my $cagefs = `rpm -q cagefs`; +if ( $cagefs =~ /^cagefs.*/ ) +{ +$cagefsstatus = `/usr/sbin/cagefsctl --cagefs-status`; +} +$_ = $cagefsstatus; +if ( m/Enabled/ ) +{ +system("/usr/sbin/cagefsctl --remount $USER 2>&1"); +} +} [0m [0;32minfo: FileBucket adding {md5}9a6c77370ce95b197d00a579e76f383d[0m [0;32minfo: /Stage[main]/Cpanel::Hooks/File[/usr/local/cpanel/scripts/postmodifyacct]: Filebucketed /usr/local/cpanel/scripts/postmodifyacct to puppet with sum 9a6c77370ce95b197d00a579e76f383d[0m [0;36mnotice: /Stage[main]/Cpanel::Hooks/File[/usr/local/cpanel/scripts/postmodifyacct]/content: content changed '{md5}9a6c77370ce95b197d00a579e76f383d' to '{md5}2a3485127df718faa0b1836f9d12acf7'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/var/cpanel/conf/apache/local]/content: --- /var/cpanel/conf/apache/local 2017-03-21 16:35:10.481999864 +0000 +++ /tmp/puppet-file20180608-681918-lapsxc-0 2018-06-08 16:36:29.107761298 +0000 @@ -7,22 +7,16 @@ "options": 'ExecCGI FollowSymLinks IncludesNOEXEC Indexes SymLinksIfOwnerMatch' "fileetag": "item": - "fileetag": 'None' + "fileetag": 'All' "keepalive": "item": "keepalive": 'On' "keepalivetimeout": "item": - "keepalivetimeout": 5 - "maxclients": - "item": - "maxclients": 150 + "keepalivetimeout": 3 "maxkeepaliverequests": "item": - "maxkeepaliverequests": 100 - "maxrequestsperchild": - "item": - "maxrequestsperchild": 10000 + "maxkeepaliverequests": 30 "maxspareservers": "item": "maxspareservers": 10 @@ -39,15 +33,12 @@ "Indexes": 1 "MultiViews": 0 "SymLinksIfOwnerMatch": 1 - "serverlimit": - "item": - "serverlimit": 256 "serversignature": "item": "serversignature": 'Off' "servertokens": "item": - "servertokens": 'ProductOnly' + "servertokens": 'Full' "sslciphersuite": "item": "sslciphersuite": 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA' @@ -59,7 +50,7 @@ "startservers": 5 "timeout": "item": - "timeout": 300 + "timeout": 10 "traceenable": "item": - "traceenable": 'Off' + "traceenable": 'On' [0m [0;32minfo: FileBucket adding {md5}a1762cf42a7b14a15d3ab03aa5c456ef[0m [0;32minfo: /Stage[main]/Cpanel::Easyapache4/File[/var/cpanel/conf/apache/local]: Filebucketed /var/cpanel/conf/apache/local to puppet with sum a1762cf42a7b14a15d3ab03aa5c456ef[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/var/cpanel/conf/apache/local]/content: content changed '{md5}a1762cf42a7b14a15d3ab03aa5c456ef' to '{md5}7be9315a21012cbf287bdbcb327570e4'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/includes/pre_virtualhost_global.conf]/content: --- /etc/apache2/conf.d/includes/pre_virtualhost_global.conf 2018-06-08 16:07:47.342959142 +0000 +++ /tmp/puppet-file20180608-681918-1glwfss-0 2018-06-08 16:36:29.371760525 +0000 @@ -19,12 +19,13 @@ ThreadsPerChild 25 </IfModule> -ServerLimit 20 -MaxClients 500 +ServerLimit 40 +MaxRequestWorkers 500 +ThreadsPerChild 25 MaxRequestsPerChild 10000 RLimitCPU 12 12 RLimitMem 157286400 157286400 -RLimitNPROC 10 10 +RLimitNPROC 100 100 BufferedLogs On [0m [0;32minfo: FileBucket adding {md5}0c6940ac165a680672653e41ea42a40b[0m [0;32minfo: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/includes/pre_virtualhost_global.conf]: Filebucketed /etc/apache2/conf.d/includes/pre_virtualhost_global.conf to puppet with sum 0c6940ac165a680672653e41ea42a40b[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/includes/pre_virtualhost_global.conf]/content: content changed '{md5}0c6940ac165a680672653e41ea42a40b' to '{md5}da96a93c3aa9e19991bb9a30fd370d6f'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/includes/pre_virtualhost_global.conf]/mode: mode changed '0644' to '0600'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/var/cpanel/templates/apache2_4/vhost.local]/ensure: defined content as '{md5}f18ac3ce09e12c70d51314ce6a4ff614'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/modsec/modsec2.cpanel.conf]/content: --- /etc/apache2/conf.d/modsec/modsec2.cpanel.conf 2018-06-08 16:10:16.213507796 +0000 +++ /tmp/puppet-file20180608-681918-2arjpz-0 2018-06-08 16:36:29.856759110 +0000 @@ -17,7 +17,7 @@ ## ModSecurity manageable global configuration directives ## -SecAuditEngine "RelevantOnly" +SecAuditEngine "Off" SecRuleEngine "On" ## [0m [0;32minfo: FileBucket adding {md5}99cfe5a32f043880f485cc01cc843230[0m [0;32minfo: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/modsec/modsec2.cpanel.conf]: Filebucketed /etc/apache2/conf.d/modsec/modsec2.cpanel.conf to puppet with sum 99cfe5a32f043880f485cc01cc843230[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/modsec/modsec2.cpanel.conf]/content: content changed '{md5}99cfe5a32f043880f485cc01cc843230' to '{md5}e1fddec5b89ace2161268fd898fd3c48'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/modsec/modsec2.cpanel.conf]/mode: mode changed '0600' to '0644'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.modules.d/360_mod_remoteip.conf]/ensure: defined content as '{md5}cf6175ef999e399d8977756d239547c1'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/var/cpanel/templates/apache2_4/ssl_vhost.local]/ensure: defined content as '{md5}3072a945b57aba0725c3a87fd76e82a3'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/includes/pre_main_global.conf]/mode: mode changed '0644' to '0600'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/usr/local/lib/php.ini]/content: --- /usr/local/lib/php.ini 2018-05-08 22:27:54.115411339 +0000 +++ /tmp/puppet-file20180608-681918-enppi5-0 2018-06-08 16:36:30.696756655 +0000 @@ -68,7 +68,7 @@ ; Enable the PHP scripting language engine under Apache. engine = On -; Allow the <? tag. Otherwise, only <?php and <script> tags are recognized. +; Allow the <? tag. Otherwise, only <?php and <script> tags are recognized. ; NOTE: Using short tags should be avoided when developing applications or ; libraries that are meant for redistribution, or deployment on PHP ; servers which are not under your control, because short tags may not @@ -84,7 +84,7 @@ ; Enforce year 2000 compliance (will cause problems with non-compliant browsers) y2k_compliance = On -date.timezone="Etc/GMT" + ; Output buffering allows you to send header lines (including cookies) even ; after you send body content, at the price of slowing PHP's output layer a ; bit. You can enable output buffering during runtime by calling the output @@ -100,18 +100,18 @@ ; Setting any output handler automatically turns on output buffering. ; Note: People who wrote portable scripts should not depend on this ini ; directive. Instead, explicitly set the output handler using ob_start(). -; Using this ini directive may cause problems unless you know what script +; Using this ini directive may cause problems unless you know what script ; is doing. ; Note: You cannot use both "mb_output_handler" with "ob_iconv_handler" -; and you cannot use both "ob_gzhandler" and "zlib.output_compression". +; and you cannot use both "ob_gzhandler" and "zlib.output_compression". ;output_handler = ; Transparent output compression using the zlib library ; Valid values for this option are 'off', 'on', or a specific buffer size ; to be used for compression (default is 4KB) -; Note: Resulting chunk size may vary due to nature of compression. PHP -; outputs chunks that are few hundreds bytes each as a result of -; compression. If you prefer a larger chunk size for better +; Note: Resulting chunk size may vary due to nature of compression. PHP +; outputs chunks that are few hundreds bytes each as a result of +; compression. If you prefer a larger chunk size for better ; performance, enable output_buffering in addition. ; Note: You need to use zlib.output_handler instead of the standard ; output_handler, or otherwise the output will be corrupted. @@ -134,7 +134,7 @@ ; which should be instanciated. ; A warning appears if the specified function is not defined, or if the ; function doesn't include/implement the missing class. -; So only set this entry, if you really want to implement such a +; So only set this entry, if you really want to implement such a ; callback-function. unserialize_callback_func= @@ -143,16 +143,16 @@ ; are decoded with unserialize, the data will remain the same. serialize_precision = 100 - - - - - - - - - - +; Whether to enable the ability to force arguments to be passed by reference +; at function call time. This method is deprecated and is likely to be +; unsupported in future versions of PHP/Zend. The encouraged method of +; specifying which arguments should be passed by reference is in the function +; declaration. You're encouraged to try and turn this option Off and make +; sure your scripts work properly with it in order to ensure they will work +; with future versions of the language (you will receive a warning each time +; you use this feature, and the argument will be passed by value instead of by +; reference). +allow_call_time_pass_reference = On ; Safe Mode ; @@ -167,7 +167,7 @@ ; including files from this directory and its subdirectories. ; (directory must also be in include_path or full path must ; be used when including) -safe_mode_include_dir = +safe_mode_include_dir = ; When safe_mode is on, only executables located in the safe_mode_exec_dir ; will be allowed to be executed via the exec family of functions. @@ -229,7 +229,7 @@ ;;;;;;;;;;;;;;;;;;; max_execution_time = 30 ; Maximum execution time of each script, in seconds -max_input_time = 60 ; Maximum amount of time each script may spend parsing request data +max_input_time = 60 ; Maximum amount of time each script may spend parsing request data memory_limit = 256M ; Maximum amount of memory a script may consume (32MB) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; @@ -268,7 +268,7 @@ ; ; - Show all errors except for notices ; -error_reporting = E_ALL & ~E_NOTICE & ~E_DEPRECATED +error_reporting = E_ALL & ~E_NOTICE & ~E_DEPRECATED ; Print out errors (as a part of the output). For production web sites, ; you're strongly encouraged to turn this feature off, and use error logging @@ -295,13 +295,13 @@ ; line until ignore_repeated_source is set true. ignore_repeated_errors = Off -; Ignore source of message when ignoring repeated messages. When this setting +; Ignore source of message when ignoring repeated messages. When this setting ; is On you will not log errors with repeated messages from different files or ; sourcelines. ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on -; stdout or in the log). This has only effect in a debug compile, and if +; stdout or in the log). This has only effect in a debug compile, and if ; error reporting includes E_WARNING in the allowed list report_memleaks = On @@ -310,16 +310,16 @@ ; Disable the inclusion of HTML tags in error messages. ;html_errors = Off - -; If html_errors is set On PHP produces clickable error messages that direct + +; If html_errors is set On PHP produces clickable error messages that direct ; to a page describing the error or function causing the error in detail. -; You can download a copy of the PHP manual from http://www.php.net/docs.php +; You can download a copy of the PHP manual from http://www.php.net/docs.php ; and change docref_root to the base URL of your local copy including the -; leading '/'. You must also specify the file extension being used including +; leading '/'. You must also specify the file extension being used including ; the dot. ;docref_root = "/phpmanual/" ;docref_ext = .html - + ; String to output before an error message. ;error_prepend_string = "<font color=ff0000>" @@ -340,11 +340,11 @@ ; Note - track_vars is ALWAYS enabled as of PHP 4.0.3 ; The separator used in PHP generated URLs to separate arguments. -; Default is "&". +; Default is "&". ;arg_separator.output = "&" ; List of separator(s) used by PHP to parse input URLs into variables. -; Default is "&". +; Default is "&". ; NOTE: Every character in this directive is considered as separator! ;arg_separator.input = ";&" @@ -380,10 +380,10 @@ ; ; Magic quotes for incoming GET/POST/Cookie data. -;magic_quotes_gpc = On +magic_quotes_gpc = On ; Magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc. -magic_quotes_runtime = Off +magic_quotes_runtime = Off ; Use Sybase-style magic quotes (escape ' with '' instead of \'). magic_quotes_sybase = Off @@ -408,7 +408,7 @@ ; Paths and Directories ; ;;;;;;;;;;;;;;;;;;;;;;;;; -; UNIX: "/path1:/path2" +; UNIX: "/path1:/path2" include_path = ".:/usr/lib/php:/usr/local/lib/php" ; ; Windows: "\path1;\path2" @@ -426,27 +426,24 @@ user_dir = ; Directory in which the loadable extensions (modules) reside. -extension_dir = "/usr/local/lib/php/extensions/no-debug-non-zts-20100525" -zend_extension="/usr/local/IonCube/ioncube_loader_lin_5.4.so" - -; DISABLED EACCELERATOR AS IT HAS ISSUES WITH PHP 5.4. WILL RE ENABLE IT ONCE THE ISSUE IS FIXED. - -;extension="eaccelerator.so" +extension_dir = "/usr/local/lib/php/extensions/no-debug-non-zts-20060613" +zend_extension="/usr/local/IonCube/ioncube_loader_lin_5.2.so" +extension="eaccelerator.so" ; BELOW VALUE CHANGED BY SIDDHARTH TO SOLVE PROBLEM OF /tmp GETTING FILLED UP: -;;eaccelerator.cache_dir="/tmp/eaccelerator" -;eaccelerator.cache_dir="/var/php/eaccelerator" -;eaccelerator.check_mtime="1" -;eaccelerator.compress="1" -;eaccelerator.compress_level="9" -;eaccelerator.debug="0" -;eaccelerator.enable="1" -;eaccelerator.filter="" -;eaccelerator.optimizer="1" -;eaccelerator.shm_max="0" -;eaccelerator.shm_only="0" -;eaccelerator.shm_prune_period="0" -;eaccelerator.shm_size="16" -;eaccelerator.shm_ttl="0" +;eaccelerator.cache_dir="/tmp/eaccelerator" +eaccelerator.cache_dir="/var/php/eaccelerator" +eaccelerator.check_mtime="1" +eaccelerator.compress="1" +eaccelerator.compress_level="9" +eaccelerator.debug="0" +eaccelerator.enable="1" +eaccelerator.filter="" +eaccelerator.optimizer="1" +eaccelerator.shm_max="0" +eaccelerator.shm_only="0" +eaccelerator.shm_prune_period="0" +eaccelerator.shm_size="16" +eaccelerator.shm_ttl="0" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically @@ -463,7 +460,7 @@ ; every request. ; cgi.nph = 1 -; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape +; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. @@ -489,8 +486,8 @@ ; is supported by Apache. When this option is set to 1 PHP will send ; RFC2616 compliant header. ; Default is zero. -;cgi.rfc2616_headers = 0 - +;cgi.rfc2616_headers = 0 + ;;;;;;;;;;;;;;;; ; File Uploads ; @@ -548,7 +545,7 @@ ; ; extension=msql.so ; -; Note that it should be the name of the module only; no directory information +; Note that it should be the name of the module only; no directory information ; needs to go here. Specify the location of the extension with the ; extension_dir directive above. @@ -616,19 +613,19 @@ ; For Win32 only. ;SMTP = localhost smtp_port = 25 -mail.add_x_header = On -mail.log = "/opt/phpmail.log" ; For Win32 only. -;sendmail_from = me@example.com +;sendmail_from = me@localhost.com ; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). sendmail_path = "/usr/sbin/sendmail -t -i" +mail.add_x_header = On +mail.log = "/opt/phpmail.log" [Java] ;java.class.path = .\php_java.jar ;java.home = c:\jdk -;java.library = c:\jdk\jre\bin\hotspot\jvm.dll +;java.library = c:\jdk\jre\bin\hotspot\jvm.dll ;java.library.path = .\ [SQL] @@ -649,16 +646,16 @@ odbc.max_persistent = -1 ; Maximum number of links (persistent + non-persistent). -1 means no limit. -odbc.max_links = -1 +odbc.max_links = -1 ; Handling of LONG fields. Returns number of bytes to variables. 0 means ; passthru. -odbc.defaultlrl = 4096 +odbc.defaultlrl = 4096 ; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. ; See the documentation on odbc_binmode and odbc_longreadlen for an explanation ; of uodbc.defaultlrl and uodbc.defaultbinmode -odbc.defaultbinmode = 1 +odbc.defaultbinmode = 1 [MySQL] ; Allow or prevent persistent links. @@ -715,7 +712,7 @@ pgsql.allow_persistent = On ; Detect broken persistent links always with pg_pconnect(). Need a little overhead. -pgsql.auto_reset_persistent = Off +pgsql.auto_reset_persistent = Off ; Maximum number of persistent links. -1 means no limit. pgsql.max_persistent = -1 @@ -830,13 +827,13 @@ session.save_handler = files ; Argument passed to save_handler. In the case of files, this is the path -; where data files are stored. Note: Windows users have to change this +; where data files are stored. Note: Windows users have to change this ; variable in order to use PHP's session functions. ; As of PHP 4.0.1, you can define the path as: session.save_path = "N;/path" -; where N is an integer. Instead of storing all the session files in -; /path, what this will do is use subdirectories N-levels deep, and -; store the session data in those directories. This is useful if you -; or your OS have problems with lots of files in one directory, and is +; where N is an integer. Instead of storing all the session files in +; /path, what this will do is use subdirectories N-levels deep, and +; store the session data in those directories. This is useful if you +; or your OS have problems with lots of files in one directory, and is ; a more efficient layout for servers that handle lots of sessions. ; NOTE 1: PHP will not create this directory structure automatically. ; You can use the script in the ext/session dir for that purpose. @@ -885,8 +882,8 @@ ; NOTE: If you are using the subdirectory option for storing session files ; (see session.save_path above), then garbage collection does *not* -; happen automatically. You will need to do your own garbage -; collection through a shell script, cron entry, or some other method. +; happen automatically. You will need to do your own garbage +; collection through a shell script, cron entry, or some other method. ; For example, the following script would is the equivalent of ; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; cd /path/to/sessions; find -cmin +24 | xargs rm @@ -923,7 +920,7 @@ session.cache_expire = 180 ; trans sid support is disabled by default. -; Use of trans sid may risk your users security. +; Use of trans sid may risk your users security. ; Use this option with caution. ; - User may send URL contains active session ID ; to other person via. email/irc/etc. @@ -1045,7 +1042,7 @@ [com] ; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs -;com.typelib_file = +;com.typelib_file = ; allow Distributed-COM calls ;com.allow_dcom = true ; autoregister constants of a components typlib on com_load() @@ -1074,7 +1071,7 @@ ; registered as output buffer to function ;mbstring.http_output = SJIS -; enable automatic encoding translation accoding to +; enable automatic encoding translation accoding to ; mbstring.internal_encoding setting. Input chars are ; converted to internal encoding by setting this to On. ; Note: Do _not_ use automatic encoding translation for @@ -1082,7 +1079,7 @@ ;mbstring.encoding_translation = Off ; automatic encoding detection order. -; auto means +; auto means ;mbstring.detect_order = auto ; substitute_character used when character cannot be converted @@ -1102,7 +1099,7 @@ [FrontBase] ;fbsql.allow_persistent = On ;fbsql.autocommit = On -;fbsql.default_database = +;fbsql.default_database = ;fbsql.default_database_password = ;fbsql.default_host = ;fbsql.default_password = @@ -1120,15 +1117,15 @@ ; crack.default_dictionary = "c:\php\lib\cracklib_dict" [exif] -; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. +; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. ; With mbstring support this will automatically be converted into the encoding -; given by corresponding encode setting. When empty mbstring.internal_encoding -; is used. For the decode settings you can distinguish between motorola and +; given by corresponding encode setting. When empty mbstring.internal_encoding +; is used. For the decode settings you can distinguish between motorola and ; intel byte order. A decode setting cannot be empty. ;exif.encode_unicode = ISO-8859-15 ;exif.decode_unicode_motorola = UCS-2BE ;exif.decode_unicode_intel = UCS-2LE -;exif.encode_jis = +;exif.encode_jis = ;exif.decode_jis_motorola = JIS ;exif.decode_jis_intel = JIS @@ -1136,9 +1133,8 @@ ; tab-width: 4 ; End: extension=pdo.so +extension=sqlite.so extension=pdo_sqlite.so extension=pdo_mysql.so extension=imagick.so -extension=raphf.so -extension=propro.so -extension=ixed.5.4.lin +extension=mssql.so [0m [0;32minfo: FileBucket adding {md5}997aa8939ffb3af0b139d5744572a6de[0m [0;32minfo: /Stage[main]/Cpanel::Easyapache4/File[/usr/local/lib/php.ini]: Filebucketed /usr/local/lib/php.ini to puppet with sum 997aa8939ffb3af0b139d5744572a6de[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/usr/local/lib/php.ini]/content: content changed '{md5}997aa8939ffb3af0b139d5744572a6de' to '{md5}6f5a3c5c550b2288545e078b58884543'[0m [0;32minfo: /Stage[main]/Cpanel::Easyapache4/File[/usr/local/lib/php.ini]: Scheduling refresh of Exec[cagefsctl_forceupdate][0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/var/mod_pagespeed/]/owner: owner changed 'root' to 'nobody'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/var/mod_pagespeed/]/group: group changed 'root' to 'nobody'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/var/mod_pagespeed/cache/]/owner: owner changed 'root' to 'nobody'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/var/mod_pagespeed/cache/]/group: group changed 'root' to 'nobody'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/var/cpanel/templates/apache2_4/ea4_main.local]/ensure: defined content as '{md5}bc3f5cdb9d9d2c5cb3c94db55faff6a3'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/init.d/httpd]/content: --- /etc/init.d/httpd 2018-05-08 22:33:50.934139835 +0000 +++ /tmp/puppet-file20180608-681918-tui1y2-0 2018-06-08 16:36:30.934755960 +0000 @@ -1,101 +1,77 @@ -#!/bin/sh +#!/bin/bash # -# -# Startup script for the Apache Web Server +# httpd Startup script for the Apache HTTP Server # # chkconfig: - 85 15 -# description: Apache is a World Wide Web server. It is used to serve \ -# HTML files and CGI. +# description: The Apache HTTP Server is an efficient and extensible \ +# server implementing the current HTTP standards. # processname: httpd -# pidfile: /usr/local/apache/logs/httpd.pid -# config: /usr/local/apache/conf/httpd.conf +# config: /etc/httpd/conf/httpd.conf +# config: /etc/sysconfig/httpd +# pidfile: /var/run/httpd/httpd.pid +# +### BEGIN INIT INFO +# Provides: httpd +# Required-Start: $local_fs $remote_fs $network $named +# Required-Stop: $local_fs $remote_fs $network +# Should-Start: distcache +# Short-Description: start and stop Apache HTTP Server +# Description: The Apache HTTP Server is an extensible server +# implementing the current HTTP standards. +### END INIT INFO -graphite_url='graphite.metrics.directi.com 2003' +# Source function library. +. /etc/rc.d/init.d/functions -ulimit -n 1024 -ulimit -n 4096 -ulimit -n 8192 -ulimit -n 16384 -DOMAIN_COUNT=$(wc -l /etc/userdomains 2>/dev/null | awk '{print $1}' 2>/dev/null) -if [ $DOMAIN_COUNT -gt 5500 ]; then - ulimit -n 20480 - ulimit -n 24576 +if [ -f /etc/sysconfig/httpd ]; then + . /etc/sysconfig/httpd fi -ulimit -u 1024 -ulimit -v 4096000 -ulimit -m 4096000 -# -# Licensed to the Apache Software Foundation (ASF) under one or more -# contributor license agreements. See the NOTICE file distributed with -# this work for additional information regarding copyright ownership. -# The ASF licenses this file to You under the Apache License, Version 2.0 -# (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# -# Apache control script designed to allow an easy command line interface -# to controlling Apache. Written by Marc Slemko, 1997/08/23 -# -# The exit codes returned are: -# XXX this doc is no longer correct now that the interesting -# XXX functions are handled by httpd -# 0 - operation completed successfully -# 1 - -# 2 - usage error -# 3 - httpd could not be started -# 4 - httpd could not be stopped -# 5 - httpd could not be started during a restart -# 6 - httpd could not be restarted during a restart -# 7 - httpd could not be restarted during a graceful restart -# 8 - configuration syntax error -# -# When multiple arguments are given, only the error from the _last_ -# one is reported. Run "apachectl help" for usage info -# -ARGV="$@" -# -# |||||||||||||||||||| START CONFIGURATION SECTION |||||||||||||||||||| -# -------------------- -------------------- -# -# the path to your httpd binary, including options if necessary -if [ -e "/etc/chroothttpd" ]; then - HTTPD=/usr/local/cpanel/bin/chroothttpd +# Increase the maximum number of file descriptors to +# facilitate all the log files on overloaded systems +MIN_FD_LIMIT=4096 +DOMAIN_COUNT=$(wc -l /etc/userdomains 2>/dev/null | awk '{print $1}' 2>/dev/null) +if [ $DOMAIN_COUNT -le 5500 ]; then + MAX_FD_LIMIT=16384 else - HTTPD=/usr/local/apache/bin/httpd + MAX_FD_LIMIT=24576 fi -# -# pick up any necessary environment variables -if test -f /usr/local/apache/bin/envvars; then - . /usr/local/apache/bin/envvars -fi -# -# a command that outputs a formatted text version of the HTML at the -# url given on the command line. Designed for lynx, however other -# programs may work. + +while [ $MIN_FD_LIMIT -lt $MAX_FD_LIMIT ]; do + MIN_FD_LIMIT=$(($MIN_FD_LIMIT + 4096)) + ulimit -H -n $MIN_FD_LIMIT 2>/dev/null + ulimit -S -n $MIN_FD_LIMIT 2>/dev/null +done + +# Start httpd in the C locale by default. +HTTPD_LANG=${HTTPD_LANG-"C"} + +# This will prevent initlog from swallowing up a pass-phrase prompt if +# mod_ssl needs a pass-phrase from the user. +INITLOG_ARGS="" + +# Set HTTPD=/usr/sbin/httpd.worker in /etc/sysconfig/httpd to use a server +# with the thread-based "worker" MPM; BE WARNED that some modules may not +# work correctly with a thread-based MPM; notably PHP will refuse to start. + +# Path to the apachectl script, server binary, and short-form for messages. +apachectl=/usr/sbin/apachectl +httpd=${HTTPD-/usr/sbin/httpd} +prog=httpd +pidfile=${PIDFILE-/var/run/apache2/httpd.pid} +lockfile=${LOCKFILE-/var/lock/subsys/httpd} +RETVAL=0 +STOP_TIMEOUT=${STOP_TIMEOUT-10} + +# The semantics of these two functions differ from the way apachectl does +# things -- attempting to start while running is a failure, and shutdown +# when not running is also a failure. So we just do it the way init scripts +# are expected to behave here. + LYNX="lynx -dump" -# -# the URL to your server's mod_status status page. If you do not -# have one, then status and fullstatus will not work. -PORT="$(grep 'apache_port=' /var/cpanel/cpanel.config 2>/dev/null | sed -e 's/.*=\([.0-9]*:\)\{0,1\}//;' -e 's/[^0-9]*//g' 2>/dev/null)" STATUSURL="http://localhost:${PORT:-80}/whm-server-status" -# -# Set this variable to a command that increases the maximum -# number of file descriptors allowed per child process. This is -# critical for configurations that use many file descriptors, -# such as mass vhosting, or a multithreaded server. -ULIMIT_MAX_FILES="ulimit -S -n `ulimit -H -n`" -# -------------------- -------------------- -# Function to send slant event via api + function send_slant_event { #curl https://slant.ops.directi.com/api -d "server=`hostname`&service=HTTP&severity=9&source=init-script&date=`date '+%Y-%m-%d %H:%M:%S'`&event_type=INFO&description=$ARGV&additional_info=$ARGV" @@ -104,52 +80,82 @@ } -# |||||||||||||||||||| END CONFIGURATION SECTION |||||||||||||||||||| - -# Set the maximum number of file descriptors allowed per child process. -if [ "x$ULIMIT_MAX_FILES" != "x" ] ; then - $ULIMIT_MAX_FILES -fi - -ERROR=0 -if [ "x$ARGV" = "x" ] ; then - ARGV="-h" -fi +start() { + echo -n $"Starting $prog: " + LANG=$HTTPD_LANG daemon --pidfile=${pidfile} $httpd $OPTIONS + RETVAL=$? + echo + [ $RETVAL = 0 ] && touch ${lockfile} + return $RETVAL +} -# Send event to slant -#[ "$ARGV" != "configtest" ] && send_slant_event +# When stopping httpd, a delay (of default 10 second) is required +# before SIGKILLing the httpd parent; this gives enough time for the +# httpd parent to SIGKILL any errant children. +stop() { + echo -n $"Stopping $prog: " + killproc -p ${pidfile} -d ${STOP_TIMEOUT} $httpd + RETVAL=$? + echo + [ $RETVAL = 0 ] && rm -f ${lockfile} ${pidfile} +} +reload() { + echo -n $"Reloading $prog: " + if ! LANG=$HTTPD_LANG $httpd $OPTIONS -t >&/dev/null; then + RETVAL=6 + echo $"not reloading due to configuration syntax error" + failure $"not reloading $httpd due to configuration syntax error" + else + # Force LSB behaviour from killproc + LSB=1 killproc -p ${pidfile} $httpd -HUP + RETVAL=$? + if [ $RETVAL -eq 7 ]; then + failure $"httpd shutdown" + fi + fi + echo +} -case $ARGV in -start|stop|restart|graceful|graceful-stop) - $HTTPD -k $ARGV -DSSL - ERROR=$? - send_slant_event - ## we send our events to graphite - echo "hosting.$(hostname -s).http.events.${ARGV} 1 $(date +%s)" | nc $graphite_url & - ;; -startssl|sslstart|start-SSL) - # echo The startssl option is no longer supported. - # echo Please edit httpd.conf to include the SSL configuration settings - # echo and then use "apachectl start". - # ERROR=2 - # ;; - $HTTPD -k start -DSSL - ERROR=$? - send_slant_event - ;; -configtest) - $HTTPD -t - ERROR=$? - ;; -status) - $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } ' - ;; +# See how we were called. +case "$1" in + start) + start + send_slant_event + ;; + stop) + stop + send_slant_event + ;; + status) + status -p ${pidfile} $httpd + $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } ' + RETVAL=$? + ;; + restart) + stop + start + send_slant_event + ;; + condrestart|try-restart) + if status -p ${pidfile} $httpd >&/dev/null; then + stop + start + send_slant_event + fi + ;; + force-reload|reload) + reload + ;; + graceful|help|configtest|fullstatus) + $apachectl $@ + RETVAL=$? + ;; fullstatus) $LYNX $STATUSURL ;; -*) - $HTTPD $ARGV - ERROR=$? + *) + echo $"Usage: $prog {start|stop|restart|condrestart|try-restart|force-reload|reload|status|fullstatus|graceful|help|configtest}" + RETVAL=2 esac -exit $ERROR +exit $RETVAL [0m [0;32minfo: FileBucket adding {md5}5e79b49853340ef1d0c5c5aefe9c90b9[0m [0;32minfo: /Stage[main]/Cpanel::Easyapache4/File[/etc/init.d/httpd]: Filebucketed /etc/init.d/httpd to puppet with sum 5e79b49853340ef1d0c5c5aefe9c90b9[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/init.d/httpd]/content: content changed '{md5}5e79b49853340ef1d0c5c5aefe9c90b9' to '{md5}cc065350dddf3e3b5165c29332a4f532'[0m [0;36mnotice: /Stage[main]/Cpanel-common/Exec[apache_graceful]/returns: executed successfully[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.modules.d/456_pagespeed.conf]/content: --- /etc/apache2/conf.modules.d/456_pagespeed.conf 2017-05-08 08:29:27.000000000 +0000 +++ /tmp/puppet-file20180608-681918-18cctkl-0 2018-06-08 16:36:38.393734167 +0000 @@ -1,13 +1,14 @@ +## <IfModule !mod_version.c> LoadModule version_module modules/mod_version.so </IfModule> -<IfVersion < 2.4> - LoadModule pagespeed_module modules/mod_pagespeed.so -</IfVersion> -<IfVersion >= 2.4.2> - LoadModule pagespeed_module modules/mod_pagespeed_ap24.so -</IfVersion> +#<IfVersion < 2.4> +# LoadModule pagespeed_module modules/mod_pagespeed.so +#</IfVersion> +#<IfVersion >= 2.4.2> +# LoadModule pagespeed_module modules/mod_pagespeed_ap24.so +#</IfVersion> <IfModule pagespeed_module> # Turn on mod_pagespeed. To completely disable mod_pagespeed, you @@ -129,6 +130,9 @@ # You can use a different location by adding the ModPagespeedBeaconUrl # directive; see the documentation on add_instrumentation. <Location /mod_pagespeed_beacon> + Allow from localhost + Allow from 127.0.0.1 + Allow from 115.254.83.21/30 115.114.17.146/30 115.114.59.180/30 115.249.14.64/30 115.114.106.8 SetHandler mod_pagespeed_beacon </Location> @@ -146,7 +150,9 @@ # statistics. This might be appropriate in an experimental setup or # if the Apache server is protected by a reverse proxy that will # filter URLs in some fashion. - Allow from localhost + Allow from localhost + Allow from 127.0.0.1 + Allow from 115.254.83.21/30 115.114.17.146/30 115.114.59.180/30 115.249.14.64/30 115.114.106.8 SetHandler mod_pagespeed_statistics </Location> </IfModule> [0m [0;32minfo: FileBucket adding {md5}39a011b6a3cd2f2811dc3a41900f99a3[0m [0;32minfo: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.modules.d/456_pagespeed.conf]: Filebucketed /etc/apache2/conf.modules.d/456_pagespeed.conf to puppet with sum 39a011b6a3cd2f2811dc3a41900f99a3[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.modules.d/456_pagespeed.conf]/content: content changed '{md5}39a011b6a3cd2f2811dc3a41900f99a3' to '{md5}bc6f419af50a0f13a290de1ba761d15a'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.modules.d/456_pagespeed.conf]/mode: mode changed '0640' to '0644'[0m [1;35merr: /Stage[main]/Cpanel::Config/File[/usr/local/cpanel/3rdparty/etc/ImageMagick-6/policy.xml]/ensure: change from absent to file failed: Could not set 'file on ensure: No such file or directory - /usr/local/cpanel/3rdparty/etc/ImageMagick-6/policy.xml.puppettmp_2143 at /etc/puppet/modules/cpanel/manifests/config.pp:121[0m [0;36mnotice: /Stage[main]/Mcollective::Server2/File[/etc/mcollective/facts.yaml]/content: --- /etc/mcollective/facts.yaml 2018-05-30 19:28:06.120803575 +0000 +++ /tmp/puppet-file20180608-681918-9cgvg9-0 2018-06-08 16:36:40.862726954 +0000 @@ -1,5 +1,5 @@ --- - apache_version: "2.2.34" + apache_version: "2.4.33" architecture: "x86_64" augeasversion: "1.0.0" aws_connectivity: "Not connected" @@ -22,7 +22,7 @@ default_network_interface: "eth1" default_network_interface_ip: "103.21.58.60" default_network_interface_skenzo: "eth1" - default_php_version: "5.4" + default_php_version: "5.6" dellbios_node_interleaving: "Disabled" dellbios_os_watchdog_timer: "Disabled" dellmem_0_connector_name: "DIMM_B5" @@ -86,7 +86,6 @@ disktype_sdb: "scsi" disktype_sr0: "scsi" domain: "webhostbox.net" - easyapache_version: "3.34" environment: "production" extlookup_datadir: "/etc/puppet/manifests/production/extdata" extlookup_precedence: ["%{project}_%{colo}_%{hostname}", "%{project}_%{hostname}", "%{project}_%{colo}_%{class}_%{hostname}", "%{project}_%{class}_%{hostname}", "%{project}_%{colo}_%{class}", "%{project}_%{class}", "%{project}_%{colo}", "%{project}_%{class}_%{subclass}", "%{project}", "common"] @@ -272,6 +271,7 @@ title: "mcollective::server2" type: "Rack Mount Chassis" uniqueid: "15673c3a" + upgrade_to_ea4: "yes" use_clamd_2_for_scan: "yes" virt_libvirt: "false" virtual: "physical" [0m [0;32minfo: FileBucket adding {md5}1ad85915a6169ca2a1ccd206eed8d31c[0m [0;32minfo: /Stage[main]/Mcollective::Server2/File[/etc/mcollective/facts.yaml]: Filebucketed /etc/mcollective/facts.yaml to puppet with sum 1ad85915a6169ca2a1ccd206eed8d31c[0m [0;36mnotice: /Stage[main]/Cpanel::Cagefs/File[/etc/cagefs/cagefs.mp]/content: --- /etc/cagefs/cagefs.mp 2018-06-08 15:59:09.403521963 +0000 +++ /tmp/puppet-file20180608-681918-1s9t1w-0 2018-06-08 16:36:41.550724945 +0000 @@ -1,28 +1,22 @@ # Lines, which start with "/", specify mounts, that are common for all users: /var/lib/mysql -/var/www/cgi-bin -/opt /dev/shm -/var/www/html -/var/passenger /dev/pts /usr/local/apache/domlogs /proc -/var/lib/proxyexec/cagefs.sock -/var/spool/at -/var/run/dbus -/usr/local/cpanel/var -/var/run/nscd -/usr/share/l.v.e-manager/cl.nodejs +/var/run/proxyexec/cagefs.sock +/opt + # You can add personal (individual) mounts for users, like below. # Please, start line with "@" symbol, and then specify path and permissions (comma separated). # These directories will be virtualized for each user. @/var/spool/cron,700 @/var/run/screen,777 -@/var/run/cagefs,700 @/var/cache/php-eaccelerator,777 -@/root,700 -@/var/php/apm/db,777 +@/var/php/eaccelerator,777 +@/var/cache/eaccelerator,777 +@/var/cache/eaccelerator54,777 + # Please add exclamation sign at the beginning of the line if you want to mount path read-only, like below. !/lib !/usr/lib @@ -38,28 +32,14 @@ !/usr/local/cpanel/3rdparty/perl !/usr/local/cpanel/3rdparty/share !/usr/local/cpanel/3rdparty/php -# Please add "%" sign at the beginning of the line if you want to "split" mount by username, like below. -%/var/cpanel/userdata - -!/usr/local/cpanel/3rdparty/bin -!/var/lib/spamassassin -!/usr/local/cpanel/sys_cpanel/boxtrapper-message +# Symlinks needed for PHP selector @/opt/alt/php52/link,700 -@/opt/alt/php52/var/lib/php/session,700 @/opt/alt/php53/link,700 -@/opt/alt/php53/var/lib/php/session,700 -@/opt/alt/php56/link,700 -@/opt/alt/php56/var/lib/php/session,700 @/opt/alt/php54/link,700 -@/opt/alt/php54/var/lib/php/session,700 @/opt/alt/php55/link,700 -@/opt/alt/php55/var/lib/php/session,700 +@/opt/alt/php56/link,700 @/opt/alt/php70/link,700 -@/opt/alt/php70/var/lib/php/session,700 @/opt/alt/php71/link,700 -@/opt/alt/php71/var/lib/php/session,700 -@/var/cpanel/php/sessions/ea-php55,700 -@/var/cpanel/php/sessions/ea-php54,700 -@/var/cpanel/php/sessions/ea3,700 -@/var/cpanel/php/sessions/ea-php56,700 + +/usr/local/cpanel/whostmgr/docroot/cgi/softaculous [0m [0;32minfo: FileBucket adding {md5}4d50efe8357a3bd7da02852edb2ed7d2[0m [0;32minfo: /Stage[main]/Cpanel::Cagefs/File[/etc/cagefs/cagefs.mp]: Filebucketed /etc/cagefs/cagefs.mp to puppet with sum 4d50efe8357a3bd7da02852edb2ed7d2[0m [0;36mnotice: /Stage[main]/Cpanel::Cagefs/File[/etc/cagefs/cagefs.mp]/content: content changed '{md5}4d50efe8357a3bd7da02852edb2ed7d2' to '{md5}a0b20c4374e1f1bb29b9fc147512db05'[0m [0;36mnotice: /Stage[main]/Cpanel::Cagefs/File[/etc/cagefs/cagefs.mp]/mode: mode changed '0600' to '0644'[0m [0;32minfo: /Stage[main]/Cpanel::Cagefs/File[/etc/cagefs/cagefs.mp]: Scheduling refresh of Exec[cagefsctl_forceupdate][0m [0;32minfo: /Stage[main]/Cpanel::Cagefs/File[/etc/cagefs/cagefs.mp]: Scheduling refresh of Exec[cagefsctl_forceupdate][0m [0;36mnotice: /Stage[main]/Cpanel::Cpanel_plugins/Mysql::Percona::Grant[cpanel_plugins]/Exec[grant-cpanel_plugins-localhost-db]/returns: executed successfully[0m [1;35merr: /Stage[main]/Cpanel::Cagefs_forceupdate/Exec[cagefsctl_forceupdate]: Failed to call refresh: Command exceeded timeout at /etc/puppet/modules/cpanel/manifests/cagefs_forceupdate.pp:6[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/modsec/modsec2.user.conf]/content: --- /etc/apache2/conf.d/modsec/modsec2.user.conf 2018-05-10 13:24:46.000000000 +0000 +++ /tmp/puppet-file20180608-681918-7p08ds-0 2018-06-08 16:41:48.774825284 +0000 @@ -0,0 +1,1352 @@ +##Date 7.29.2011 +## Wordpress Rules +##Date 8.10.2011 +## WP-FileManager / PHPFm +##Date 8.18.2011 +#Images/Stories Block +##Date 8.24.2011 +## Apache DDOS Rules +##Date 8.26.2011 +## Apache DDOS Update +##Date 8.30.2011 +## timThumb scanning +##Date 9.22.2011 +## 1-flash-gallery Upload PHPext +##Date 10.12.2011 +## 1-flash-gallery Upload PATH POST block +##Date 10.19.2011 +## Updated osCommerce rule. Added configuration.php +## Added block for Mass malware sm3.php +##Date 10.20.2011 +## OSC showimg&cookies backdoor rule +##Date 11.10.2011 +## Zen-Cart Ajax File Manager Exploit +##Date 11.21.2011 +#TimeThumb /cache/32 char php file block +##Date 12.6.2011 +#Joomla No Refferer password reset block +##Date 1.10.2012 +#Joomla Component OzioGallery WritetoFile block +##Date 2.6.2011 +#Whitelist cpanel. for RFI Rule: 1234234 +##Date 2.8.2012 +## WP-Brute +##Date 2.15.2012 +# Exploiting UA / No UA blocks. +##Date 2.21.2012 +#osDate RFI :: Trackback spam injection +##Date 3.9.2012 +##Two UA rules. SQL Comment block +##Date 3.15. FF 3.6.3 RU Post / No REF :: Brute Attempt :: Transaction cleanup +##Date 3.23. NoNumber Exploit Block +##Date 3.26. Chillkat UA block +##Date 4.11 Com_Fabrik / SQL Comment Update +##Date 5.4 PHP-CGI Exploit :: CVE-2012-1823 +##DAte 5.16:20 Upload* No Referer POST (Logging Only) *UPDATE* +##Date 7.2 VB Info Disclosure +##Date 7.27 inc/upload +##Date 8.7 No UA Joomla Edit / JCE Bot UA +##Date 8.16 DDOS Script. Self Spawning +##Date 9.10 VB Template EDIT no UA/Ref +##Date 9.17 Joomla admin/index.php w/ bing ua +##Date 11.1 HTTP_CMD Header block +##Date 11.12 Wordpress WSO Request Attempt +##Date 11.16 PHP DDOS +##Date 11.26 PHP Execution w/ Comments + Eval|Base64_Decode +##Date 11.27 Automated Wordpress Exploit Attempt +##Date 12.03 PHP Automated Mailer attempt +##Date 12.4.12 Automated Exploitation Attempt +##Date 12.7.12 DDOS Args +##DAte 12.12 Disabled Ineffective Mozilla Block :: Akismet WSO Block :: Com_Ag_block +##Date 12.31 Fake Mozilla Agent +##Date 1.3 BROBOT UA DDOS BLOCK +##Date 1.3 UCP.php StopForumSPAM add +##Date 1.4 WHMCS 5.x Auth bypass http://packetstormsecurity.com/files/119234/whmcs5-bypass.txt +##Date 1.4 C_ID & Comment BASE64 Encoded data backdoor attempt +##Date 1.4 JCE Exploit attempts +##Date 1.11 K2 Modification :: IE6 Block on wplogin/joomla admin/k2 spam +##Date 1.15 Malicous Mailer 7c32 and Mispelled LICESNE.php block +##Date 1.22 mt-upgrade Behavior block +##Date 1.28 BBPRess SPAM Blocks +##Date 1.29 js/swfupload/js/upload.php BLOCK +##Date 1.31 Wordpress direct path 404 theme page POST +##Date 2.19 Wordpress BING wp-admin request during brute request +##Date 3.20 DVMessages bloc :: UA Block +##Date 3.22 Joomla/WP Brute and SPAM UA block and Double valid ua block +##Date 3.26 Whitelist SeoGears for Mozilla/5.0 && BroBOT Brute BLOCKS +##Date 4.2 Havij Block +##Date 4.3 Fake plugins mailer +##Date 4.4 Brute Joomla/UA blocks +##Date 4.19 XMLRPC No UA/Referrer block +##Date 4.23 WP-Brute rule :: 1.0 FF18/19 && Com_civicrm OpelFlashChart Unsecured Upload +###Date 5.13 Commented OUT :: Cloudflare PROXY forwards vis 1.0 http attack +##Date 5.17 Joomla JCE Exploit (new UA) +##Date 5.23 Wordpress Brute Moz18 w/ Close +##Date 6.6 Wordpress BAD UA :: +##Date 6.10 Wordpress EDITOR http:1.0 +##Date 6.12 NGG Gallery 1.9.12 Upload exploit +##Date 6.14 Wordpress Brute Block +##Date 6.17 Script ser-Agent settings Broke +##DAte 6.21 WHMCS Paypal SQL Injection +##Date 7.3 BadBot block via EIG report +##Date 7.16 Com_JCE new UA block +##Date 7.17 XMLRPC Logging Rule for NO UA/REF Block +##Date 7.23 BroBOT UA Blocks +##Date 7.30 AhrefsBOt +##Date 7.31 BAD CHROME UA / Brutes +##Date 8.08 POST FakeGoogleBOT wp-login +##Date 8.09 OpenX Backdoor http://forum.openx.org/index.php?showtopic=503521628 +##Date 8.12 WP-Brute/XML-RPC Abuse +##Date 8.13 PHP Shell Upload +##Date 8.16 Wordpress Brutes +##Date 8.20 Spam UA Attempts (Random names) +##Date 8.20 SQL Injection Attempt +##DATE 8.22 SPAM RULE TEMP +##Date 8.29 Collector :: Com_jce +##Date 9.25 Wordpress Brute :: MSIE 8.0 (Fake :: LWP Request) +##Date 9.26 OFC Unsecured Upload Vuln +##Date 9.27 XMLRPC Amp Attack +##Date 10.3 WHMCS SQLInjection +##Date 11.4 WP-Login No Accept w/ close block +##Date 12.1 Wordpress Theme Uploaders :: Comment Spam :: POST Upload blocks :: Fake UAs :: Spam Scripts +##Date 1.29 Joomla Brute 1.0 Header Order w/o Cooke +##Date 3.17 XMLRPC Brute +##Date 4.1 STeelrat block +##Date 4.4 OpenFlashChat UPLOAD Vlock +##Date 4.22 Fake ZH UA :: Spambot +##Date 6.24 TinyMCE RCE +##Date 7.17 Wordpress Brutes +##Date 7.23 WP-Plugins Readme.txt block (Metasploit checks for this to see if plugin exists in many modules) +##Date 8.5 SQL Google Ref Request +##DAte 10.1 Bad WP Brute Random UA Var +##DAte 10.16 Drupal SQL I (No UA or Ref w/POST) +##Date 10.26 Wordpress Brutes, Exploit Scanner, Joomla Com_contenthistory, Brute Force Backdoor +##Date 01.17 Wordpress 4.7+ API post vulnerability ID 900501 900502 + + +SecRule REQUEST_HEADERS:Host "@beginsWith cpanel\." "id:900035,phase:2,t:none,t:lowercase,pass,nolog" +SecRule REMOTE_ADDR "@ipMatch 66.29.189.11,66.29.162.115,66.29.162.116" "id:900118,nolog,pass,phase:1,t:none,ctl:ruleEngine=off" +SecRule Request_Headers:User-Agent "PayPal IPN \( ?https:\/\/www\.paypal\.com\/ipn ?\)" "id:900191,phase:1,t:none,pass,nolog,ctl:ruleRemoveById=900177" +SecRule REQUEST_HEADERS "\(\) \{" "phase:1,deny,id:900261,t:urlDecode,status:406,log,msg:'CVE-2014-6271 - Bash Attack'" + +# wordpress-groupdocs-assembly 2016-11-17 ASOSD-1248 +SecRule REQUEST_URI "/wp-content/plugins/groupdocs-assembly/js/.*\.php" "id:9990031,rev:1,severity:2,log,deny,status:406,msg:'wordpress-groupdocs-assembly compromised'" + +# Logging Joomla POSTS for UN-12236 +SecRule REQUEST_URI "/administrator/(index\.php)?$" "id:900402,t:none,log,pass,phase:5,chain,msg:'Joomla administrator POST logging',logdata:%{RESPONSE_STATUS}" +SecRule REQUEST_METHOD "POST" + +# Logging wp-comments-post POSTS for UN-12352 +SecRule REQUEST_URI "/wp-comments-post.php$" "id:900404,t:none,log,pass,phase:5,chain,msg:'wp-comments-post POST logging',logdata:%{RESPONSE_STATUS}" +SecRule REQUEST_METHOD "POST" + +# Logging xmlrpc POSTS for UN-12352 + SecRule REQUEST_URI "/xmlrpc.php$" "id:900405,t:none,log,pass,phase:5,chain,msg:'xmlrpc POST logging',logdata:%{RESPONSE_STATUS}" + SecRule REQUEST_METHOD "POST" + +# Logging wp-login POSTS for UN-12352 + SecRule REQUEST_URI "/wp-login.php$" "id:900406,t:none,log,pass,phase:5,chain,msg:'wp-login POST logging',logdata:%{RESPONSE_STATUS}" + SecRule RESPONSE_STATUS "^(200|406|503)" chain + SecRule REQUEST_METHOD "POST" + +# 4.1.2015 Spam Blocks / Wordpress Exploitation Attempts +SecRule REQUEST_PROTOCOL "^HTTP/1\.0" "id:900290,phase:1,status:406,deny,log,chain,msg:'1.0 Post Request :: Spam Blocks'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,chain" +SecRule REQUEST_HEADERS:Content-Type "multipart\/form-data" chain +SecRule REQUEST_METHOD "POST" + +## 5.24 WP RBL +SecRule REQUEST_URI "/(wp-login.php|wp-comments.php|xmlrpc.php|administrator)" "phase:1,deny,status:406,chain,log,id:900407,msg:'Wordpress and Joomla Brute RBL: wprbl.websitewelcome.com'" +SecRule REMOTE_ADDR "@rbl wprbl.websitewelcome.com" + +## XMLRPC No Content Header 10/26 +SecRule REQUEST_URI "/xmlrpc\.php" "id:900322,t:none,log,deny,status:406,chain,msg:'XMLRPC Header Request anomaly' +SecRule REQUEST_METHOD "POST" chain +SecRule &REQUEST_HEADERS:content-length "@eq 0" "t:none" +## Broke Exploit Scanner 10/26 +SecRule ARGS_NAMES "abdullkarem" "id:900324,t:none,log,deny,status:406,msg:'abdullkarem argument name'" +## Joomla Com_Content History Sql Injection 10/26 +SecRule REQUEST_FILENAME "/index.php" "id:900325,t:none,t:lowercase,log,chain,deny,status:406,msg:'Joomla ComContent SQLi'" +SecRule ARGS:option "com_contenthistory" chain +SecRule ARGS:view "history" chain +SecRule ARGS "select" "t:lowercase,chain" +SecRule ARGS "concat(_ws)?" "t:lowercase" +## Joomla Com_Content History SQL Injection 12/3 +SecRule REQUEST_URI "/administrator/index.php" "id:900330,phase:1,deny,log,status:406,chain,msg:'Joomla Com_Content SQL Injection POST'" +SecRule REQUEST_METHOD "POST" "t:none,chain" +SecRule REQUEST_HEADERS:Referer "http://search\.yahoo" +## +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.\d+;( WOW64;)? rv:\d+\.\d+\) Gecko\/20100101 Firefox\/\d+\.\d+" "id:900331,phase:1,deny,log,status:406,chain,msg:'Joomla Com_Content SQL Injection POST'" +SecRule REQUEST_METHOD "POST" "t:none,chain" +SecRule &REQUEST_HEADERS:Accept-Language "@eq 0" "t:none" + +# 10.7.2015 +SecRule REQUEST_URI "/wp-(admin|login\.php)" "id:900309,log,deny,phase:1,status:406,chain,msg:'Mozilla Fake Connection :: Brute Force'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 (Windows NT 6\.0; rv:34\.0) Gecko\/20100101 Firefox\/34\.0" chain +SecRule REQUEST_METHOD "POST" "t:none,chain" +SecRule REQUEST_HEADERS_NAMES "accept*" "t:lowercase,chain" +SecRule MATCHED_VAR "@strmatch accept" "t:lowercase" + +# 10.14.2015 Block WP-Brutes / Exploit +SecRule REQUEST_COOKIES:D "base64_decode" "id:900323,t:none,log,deny,status:406,msg:'COOKIE Value - Base64'" + +# 11.9.2015 Joomla POST SQL Injection +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; WOW64\) AppleWebKit\/537\.36 \(KHTML, like Gecko\) Chrome\/44\.0\.2403\.125 Safari\/537\.36" "id:900326,phase:1,t:none,log,deny,status:406,chain,msg:'Joomla SQL POST Injection xYzZy: Nothing happens'" +SecRule REQUEST_METHOD "POST" "t:none,chain" +SecRule REQUEST_HEADERS:Content-type "multipart\/form-data; boundary\=xYzZY" + +SecRule REQUEST_URI "/index.php/admin" "id:900327,phase:1,t:none,log,deny,status:406,chain,msg:'Magento ADMIN Login Brute Attempt'" +SecRule REQUEST_METHOD "POST" "t:none,chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none,chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" + +SecRule Request_Headers:User-Agent "@pm base64_decode JDatabaseDriverMysqli" "id:900328,t:none,phase:1,status:406,deny,log,msg:'Joomla RCE'" + +# 2015-03-27 RevSlider < 4.2 Content Injection - http://pastebin.com/eUUtgAtQ +SecRule REQUEST_URI "wp-admin/admin-ajax\.php" "id:900291,rev:2,severity:2,log,deny,status:406,msg:'RevSlider Exploit - get_captions_css Vector',chain" +SecRule ARGS:action|ARGS:client_action "^revslider_ajax_action$" chain +SecRule &ARGS:nonce ^0$ + +# 2015-04-01 jdownload Unsecured Upload :: http://1923turk.org/showthread.php?t=7&langid=1 +SecRule REQUEST_URI "/images/jdownloads/screenshots/" "id:900292,phase:1,status:406,deny,log,chain,msg:'jDownload screenshot POST attempt'" +SecRule REQUEST_METHOD "POST" + +# 2015-04-01 jdownload Unsecured Upload :: http://1923turk.org/showthread.php?t=7&langid=1 +SecRule REQUEST_URI "/index\.php\?option\=com_jdownloads\&Itemid\=0\&view\=upload" "id:900293,phase:1,status:406,deny,log,chain,msg:'jDownload upload attempt'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none" + +# 2015-04-01 com_media exploiter upload attempt +SecRule REQUEST_URI "index.php?option=com_media&view=images&tmpl=component&fieldid=&e_name=jform_articletext&asset=com_content&author=&" "id:900294,phase:1,status:406,deny,log,chain,msg:'Joomla com_media unsecured upload attempt'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none" + +# 2015-04-01 Neoloris Level 7 Mobile App DDOS tool UA Block - UN-3777 +SecRule REQUEST_HEADERS:User-Agent "Neoloris" "id:900295,phase:1,status:406,deny,log,msg:'Neoloris DDOS Tool UA Block'" + +# 2015-04-01 Gravity Forms unsecured upload vulnerability - CVE-2014-6446 - UN-3767 +SecRule ARGS:gf_page "upload" "id:900296,phase:1,deny,log,status:406,chain,msg:'Gravity Forms Unsecured Upload Attempt'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none" + +# 2015-04-19 Magento RCE +SecRule REQUEST_URI "/cms_wysiwyg/" "id:900297,phase:1,status:406,deny,chain,t:lowercase,log,msg:'Magento RCE :: SUPEE-5344'" +SecRule ARGS:forwarded "1" + +# 2015-04-22 +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; rv:12\.0\) Gecko\/20130101 Firefox\/10\.0" "id:900298,phase:1,status:406,deny,log,msg:'Bad Useragent'" +SecRule REQUEST_URI "/admin/cms_wysiwyg/directive" "id:900299,phase:2,chain,status:406,deny,t:lowercase,log,msg:'Magento RCE :: SUPEE-5344'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule &REQUEST_COOKIES_NAMES:adminhtml "@eq 0" + +# 2015-5-8 Wordpress DOM XSS +SecRule REQUEST_URI "/genericons/example\.html" "id:900400,phase:1,status:406,deny,log,msg:'Wordpress example.html DOM XSS Block'" +# 2015-5-8 Simple Ads manager +SecRule REQUEST_URI "/wp-content/plugins/simple-ads-manager/sam-ajax-admin.php" "id:900307,phase:1,deny,t:none,chain,status:406,msg:'Simple Ads Manager Exploit'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule REQUEST_HEADERS:x-requested-with "xmlhttprequest" "t:none" +SecRule REQUEST_URI "/lib/scripts/dl-skin.php" "id:900302,phase:1,deny,t:none,chain,status:406,msg:'Unsecured Downlaod Vuln'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none" +SecRule REQUEST_URI "/admin/scripts/FileUploader/php.php" "id:900304,phase:1,deny,t:none,chain,status:406,msg:'Unsecured Upload Vuln'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none" + +# 2014-08-20 : Fake IE6 User Agent. multi-digit minor version for MSIE. +SecRule REQUEST_HEADERS:User-Agent "^Mozilla\/4\.0 \(compatible; MSIE 6\.0\d+; Windows NT 5\.1; SV1\)$" "id:900254,phase:2,t:none,status:406,log,deny,msg:'Bad UA :: Fake IE6 Agent'" +SecRule REQUEST_URI "/plugins/custom-contact-forms/import/[^.]+\.sql(\.php)?" "id:900255,phase:1,status:406,deny,log,msg:'Contact Forms Import Exploit'" +SecRule REQUEST_URI "/wp-config\.php(?:\W[a-z]*|bak)" "id:900256,phase:1,status:406,deny,log,msg:'Wp-Config Backup/edit file request'" +SecRule REQUEST_URI "/uploadify/upload" "id:900257,phase:1,status:406,deny,log,chain,msg:'Uploadify Block for libwww-perl'" +SecRule REQUEST_HEADERS:User-Agent "libwww-perl" +SecRule REQUEST_URI "/wp-admin/admin-ajax\.php\?action\=(revslider|kbslider)_show_image\&img\=.*?\.php" "id:900258,t:urlDecode,status:406,phase:1,log,deny,msg:'Slider LFI Exploit'" + +## 2014-10-1 Random UA for WP Brute +SecRule REQUEST_URI "/wp-login\.php" "id:900262,chain,phase:1,t:none,status:406,deny,msg:'Wordpress Brute Force :: Failed Random UA variable'" +SecRule Request_Headers:User-Agent "\[\% tools\.ua\.random\(\) \%\]" + +SecRule REQUEST_URI "/wp-content/plugins/(revslider|showbiz)/temp/update_extract/" "id:900277,phase:1,deny,status:406,msg:'RevSlider Upload Exploit Attempt'" + +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows; U; Windows NT 5\.1; en-US; rv:1\.8\.1\.\d+\) Gecko\/20\d+ Firefox\/" "id:900278,phase:1,status:406,deny,log,msg:'Old FireFOX UA Used in exploits'" +SecRule REQUEST_URI "/wp-admin/images/" "id:900279,phase:1,status:406,deny,log,chain,msg:'WP-Admin Images POST Attempt'" +SecRule REQUEST_METHOD "^POST$" "t:none" + +SecRule REQUEST_PROTOCOL "^HTTP/1\.0" "id:900281,log,deny,status:406,chain,phase:1,t:none,msg:'Possible Malicous HTTP 1.0 REQ :: Spam / Brutes'" +SecRule REQUEST_HEADERS:Accept-Encoding "^identity$" chain +SecRule REQUEST_METHOD "^POST$" "t:none" +SecRule REQUEST_HEADERS:Referer "\$stylevar\[\$\{\$\{" "id:900282,t:none,status:406,phase:1,log,deny,msg:'vbSEO referer php injection exploit CVE-2014-9463'" + +#Steelrat spam block +SecRule &REQUEST_HEADERS:Referer "@eq 0" "id:900237,phase:1,deny,status:406,log,t:none,chain,msg:'Spam-Steelrat Block'" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none,chain" +SecRule REQUEST_HEADERS:Content-Type "application\/x-www-form-urlencoded" chain +SecRule REQUEST_URI "/(main|faq|xmlrpc|ssl|ticket|signout|return|login|list|getinfo|statistics|seo|news|banner|themes|signup|robots|cookie|abook|stat|info|install|config|rss|popup|index|guestbook|sitemap|wishlist|sitemap|poll|account|mobile|schedule|checkout|logoff)[A-Za-z0-9]+\.php" +#SecRule REQUEST_URI "[a-z]+[A-Z0-9]+[a-z0-9A-Z]+\.php" + +#OFC Upload Block +SecRule REQUEST_URI "/openflashchart/tmp-upload-images/" "id:900239,phase:1,deny,status:406,log,chain,msg:'OpenFlashChart POST Block'" +SecRule REQUEST_METHOD "^POST$" "t:none" + +## Pageline Register Settings :: No Referrer +SecRule REQUEST_URI "\/wp-admin\/admin-post\.php\?action\=pagelines_register_settings" "id:900310,phase:1,chain,log,deny,status:406,msg:'PageLines Register Settings'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none" +## Fancybox for wordpress vuln :: UN-4859 +SecRule REQUEST_URI "/wp-admin/admin-post\.php\?page\=fancybox-for-wordpress" "id:900306,status:406,phase:1,t:none,log,chain,deny,msg:'Fancybox options exploit'" +SecRule REQUEST_METHOD "^POST$" "t:none" + + +##2.27.2015 WP Brutes :: No Cookie +SecRule REQUEST_URI "/wp-login\.php" "id:900285,phase:1,status:406,deny,log,chain,msg:'Wordpress Brute Attempts'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule REQUEST_HEADERS:Accept-Language "^ru-RU" chain +SecRule &REQUEST_COOKIES_NAMES:wordpress_test_cookie "@eq 0" + +##3.1.15 OFC Upload Scan +SecRule REQUEST_URI "/ofc_upload_image.php" "id:900286,phase:1,status:406,deny,log,chain,msg:'Wordpress OFC Unsecured upload exploit attempt'" +SecRule REQUEST_PROTOCOL "^HTTP/1\.0" chain +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" +##3.5.15 WP Brute :: FF 32 Cookie issue +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 5\.1; rv:32\.0\) Gecko\/20100101 Firefox\/32\.0" "id:900287,phase:1,status:406,deny,log,chain,msg:'Wordpress Brute'" +SecRule REQUEST_METHOD "POST" chain +SecRule REQUEST_URI "/wp-login\.php" chain +SecRule REQUEST_COOKIES_NAMES "@pm wordpress_test_cookie path" chain +SecRule &REQUEST_COOKIES_NAMES "@eq 2" +## WP Brute :: FF 32 Cookie Issue GET Request +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 5\.1; rv:32\.0\) Gecko\/20100101 Firefox\/32\.0" "id:900288,phase:1,status:406,deny,log,chain,msg:'Wordpress Brute'" +SecRule REQUEST_URI "/wp-login.php" chain +SecRule &REQUEST_COOKIES_NAMES "@eq 0" + + +##.SQL File request with Google Referrer +SecRule REQUEST_BASENAME "@rx .sql$" "id:900253,status:406,chain,phase:1,log,deny,msg:'SQL File Request'" +SecRule REQUEST_HEADERS:Referer "http:\/\/www.google.com\/" + +##3.29 +SecRule REQUEST_URI "/xmlrpc\.php" "id:900235,phase:1,log,chain,msg:'XMLRPC Brute Force/DDOS Attempts'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.2; WOW64; rv:25\.0\) Gecko\/20100101 Firefox/25\.0" chain +SecRule &Request_headers "@eq 5" +##4.22 Fake ZH Ua + +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows; U; Windows NT 5\.1; zh-CN; rv:1.7\.6\)" "id:900240,phase:1,deny,status:406,log,msg:'Fake UA::Spambot'" + +SecRule ARGS_GET:y "/home" "id:900248,phase:1,chain,log,t:none,t:lowercase,status:406,msg:'WSO Shell Block'" +SecRule ARGS_GET:x|ARGS_GET:edit|ARGS_GET:view "(edit|view|upload|mass|configs|php|symlink|sec|domains|mysql|boom)" "t:none,t:lowercase" + +##10.16 Drupal SQL Injection +SecRule REQUEST_URI "node(\&|\?)destination=node" "id:900270,phase:1,deny,log,chain,msg:'Possible Drupal SQL Injection Attempt'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule &REQUEST_HEADERS:User-Agent|&REQUEST_HEADERS:Referer "@eq 0" + + + +#Hostdata POST +SecRule REQUEST_URI "/hostdata.php" "id:900259,phase:1,deny,status:406,log,chain,msg:'Hostdata POST Block'" +SecRule REQUEST_METHOD "^POST$" "t:none" + +SecRule REQUEST_URI "/plugin_googlemap2_proxy.php" "id:900269,phase:1,deny,status:406,msg:'Bad UA'" +##1.29 +#SecRule REQUEST_URI "/wp-login\.php" "id:900222,t:none,chain,log,deny,phase:1,status:406,msg:'Wordpress Brute Force HTTP1.0 w/o Cookie and bad headers'" +#SecRule &REQUEST_HEADERS:Cookie "@eq 0" chain +#SecRule REQUEST_HEADERS:Referer "@endsWith wp-login.php" chain +#SecRule REQUEST_HEADERS_NAMES ".*" "chain,setvar:'tx.header_order=%{tx.header_order}, %{matched_var}'" +# SecRule TX:HEADER_ORDER ", Host, Keep-Alive, Connection, User-Agent, Content-Type, Content-Length, Referer" + +##2.2 Emailer +SecRule REQUEST_URI "/extension/coreupdate" "id:900223,t:none,log,deny,phase:1,status:406,msg:'Joomla Mailer'" +#11.26 PHP Execution w/ Comments + Eval|Base64_Decode +SecRule REQUEST_URI "\?<\?\/\*[^\*]+\*\/(eval|base64_decode)\/\*" "id:900077,phase:1,t:none,t:lowercase,log,deny,msg:'PHP Execution w/ Comments in URI'" + +SecRule REQUEST_URI "(?:(?:sk|get)?_licen(?:ce|sing)|(?:backlink-|test_|wishlistcast_)?api|background_(?:processes|post)|run\d|_async|bootstrap|blogroll|ajax_process_download|remote-click-track|(?:xcommenter_background_|au_)?post(?:_register)?|gallerysprout-webservice|umo_server_get_key_id)\.php|feed\d\.xml" "id:900186,phase:1,t:none,pass,nolog,ctl:ruleRemoveById=900183-900185" + +SecRule REQUEST_URI "/(cache|css|components|images|includes|js|modules|plugins|templates|themes|wp-admin|wp-content|language|log|logs|libraries|media|wp-includes)/" "id:900183,chain,phase:1,t:none,status:406,deny,msg:'UA Spam POST http 1.1 :: Steelrat'" +SecRule &REQUEST_HEADERS "@eq 4" "chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none,chain" +SecRule REQUEST_METHOD "^POST$" "t:none" + +SecRule REQUEST_URI "/(cache|css|components|images|includes|js|modules|plugins|templates|themes|wp-admin|wp-content|language|log|logs|libraries|media|wp-includes)/" "id:900185,chain,phase:1,t:none,status:406,deny,msg:'UA Spam POST http 1.1 :: Steelrat '" +SecRule &REQUEST_HEADERS "@eq 5" "chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none,chain" +SecRule REQUEST_HEADERS:Expect "100-continue" "t:none,chain" +SecRule REQUEST_METHOD "^POST$" "t:none" + +##6.24 TimThumb WebShots RCE Vuln +SecRule REQUEST_URI "/(tim)?thumb.php" "id:900260,status:406,phase:1,chain,deny,log,msg:'TimThumb WebShots RCE vuln'" +SecRule ARGS_GET:webshot "1" chain +SecRule ARGS_GET:src "$" "t:urlDecode" + + +##2.5 SPam +SecRule REQUEST_HEADERS:Via "1\.0 tinyproxy \(tinyproxy\/1\.8\.2\)" "id:900224,chain,phase:1,status:406,deny,log,msg:'VIA form POST :: Spam inspired'" +SecRule REQUEST_HEADERS:Content-Type "application\/x-www-form-urlencoded" chain +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none" + +SecRule REQUEST_HEADERS:Via "1.1 \d+.\d+.\d+.\d+ \(Mikrotik HttpProxy\)" "id:900225,chain,phase:1,status:406,deny,log,msg:'VIA form POST :: Spam inspired'" +SecRule REQUEST_HEADERS:Content-Type "application\/x-www-form-urlencoded" chain +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none" + + +SecRule REQUEST_URI "/(wp-login\.php|administrator/|wp-comments-post\.php)" "id:900228,chain,phase:1,t:none,status:406,deny,msg:'Wordpress Brute Force :: Firefox 8'" +SecRule Request_Headers:User-Agent "Mozilla\/5\.0 \(Windows; U; Windows NT 5\.1; ru; rv:1\.9\.0\.2\) Gecko\/2008091620 Firefox\/3\.0\.2" +SecRule REQUEST_URI "/(wp-login\.php|administrator/|wp-comments-post\.php)" "id:900219,chain,phase:1,t:none,status:406,deny,msg:'Wordpress Brute Force :: Firefox 8'" +SecRule Request_Headers:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; WOW64; rv:8\.0\.1\) Gecko\/20100101 Firefox\/8\.0\.1" + + + +SecRule REQUEST_URI "/(wp-login\.php|administrator/|wp-comments-post\.php)" "id:900220,chain,status:406,phase:1,t:none,log,deny,msg:'Request Cookie Ordering Alert: Potential Brute Tool'" +SecRule Request_Headers:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; WOW64\) AppleWebKit\/537\.36 \(KHTML, like Gecko\) Chrome\/31\.0\.1623\.0 Safari\/537\.36" chain +SecRule REQUEST_HEADERS_NAMES ".*" "chain,setvar:'tx.header_order=%{tx.cookie_order}, %{matched_var}'" + SecRule TX:HEADER_ORDER ", User-Agent, Connection, Accept-Encoding, Content-Length, Host, Content-Type, Referer" + +SecRule REQUEST_URI "/(wp-login\.php|administrator/|wp-comments-post\.php)" "id:900226,t:none,chain,log,deny,phase:1,status:406,msg:'Request Cookie Ordering Alert: Potential Brute Tool'" +SecRule &REQUEST_HEADERS:Cookie "@eq 0" chain +SecRule REQUEST_HEADERS:Referer "@endsWith wp-login.php" chain +SecRule REQUEST_HEADERS_NAMES ".*" "chain,setvar:'tx.header_order=%{tx.header_order}, %{matched_var}'" + SecRule TX:HEADER_ORDER ", X-Real-IP, X-Forwarded-For, Host, X-Http-Proto, Connection, User-Agent, Content-Type, Content-Length, Referer" + +SecRule REQUEST_URI "/wp-login\.php" "id:900230,t:none,chain,log,deny,phase:1,status:406,msg:'Wordpress brute form-data block'" +SecRule REQUEST_HEADERS:Content-Type "@beginsWith multipart/form-data;" + +SecRule Request_Headers:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; rv:12\.0\) Gecko\/20130101 Firefox\/10\.0" "id:900231,status:406,phase:1,chain,deny,log,msg:'ComExplorer Explot Attempt'" +SecRule REQUEST_URI "/administrator/components/com_extplorer/" "t:normalisePath" + + +SecRule Request_uri "/administrator/" "id:900232,status:406,deny,log,chain,phase:1,t:normalisePath,msg:'Joomle Brute :: 4 header / wget'" +SecRule &Request_headers "@eq 4" chain +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none" + +SecRule Request_uri "/administrator/" "id:900233,status:406,deny,log,chain,phase:1,t:normalisePath,msg:'Joomle Brute :: 1 header'" +SecRule &Request_headers "@eq 1" chain +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none" + + +##11.4 WP No Accept w/ close +SecRule REQUEST_URI "/wp-login\.php" "id:900202,chain,phase:1,t:none,status:406,deny,msg:'Wordpress Brute Force :: 1.1 No Close w/o Accept'" +SecRule REQUEST_PROTOCOL "^HTTP/1\.1" chain +SecRule &REQUEST_HEADERS:Accept "@eq 0" chain +SecRule REQUEST_HEADERS:connection "close" "t:lowercase" + +#SecRule REQUEST_URI "/wp-login\.php" "id:900203,chain,phase:1,t:none,status:406,deny,msg:'Wordpress Brute Force :: 1.1 No Close w/o Accept-Encoding'" +#SecRule REQUEST_PROTOCOL "^HTTP/1\.1" chain +#SecRule &REQUEST_HEADERS:Accept-Encoding "@eq 0" chain +#SecRule REQUEST_HEADERS:connection "close" "t:lowercase" + +SecRule REQUEST_URI "/(wp-login\.php|administrator/|wp-comments-post\.php)" "id:900204,chain,phase:1,t:none,status:406,deny,msg:'Wordpress Brute Force :: MSIE 6.0 w/ Accept-Encoding Identify'" +SecRule Request_Headers:User-Agent "Mozilla\/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)" chain +SecRule REQUEST_HEADERS:Accept-Encoding "identity" + +#SecRule REQUEST_FILENAME "/xmlrpc\.php" "id:900205,log,deny,status:406,phase:1,t:none,chain,log,msg:'XMLRPC Request UA used in DDOS'" +SecRule REQUEST_HEADERS:User-Agent "^Mozilla\/4\.0 \(compatible:" "id:900205,log,deny,status:406,phase:1,t:none,log,msg:'XMLRPC Request UA used in DDOS'" + +SecRule REQUEST_URI "/(wp-login\.php|wp-admin/|administrator/|wp-comments-post\.php)" "id:900206,chain,phase:1,t:none,status:406,deny,msg:'Wordpress Brute Force :: 1.0 Fake Opera'" +SecRule REQUEST_PROTOCOL "^HTTP/1\.0" chain +SecRule REQUEST_HEADERS:User-Agent "Opera\/9\.80 \(Windows NT 6\.1; U; ru\) Presto\/2\.8\.131 Version\/11\.10" + +##12.1 sys09725838 type mailer +SecRule REQUEST_URI "/sys\d+(-\d+)?\.php" "id:900207,phase:1,deny,status:406,chain,log,msg:'Sys[0-9]+ Mailer'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none" +##12.1 Spam Script/shells POST to Wordpress Uploads dir +SecRule REQUEST_URI "^/wp-content/uploads/20\d+/\d+/" "id:900208,deny,status:406,log,chain,msg:'POST to wp-content/uploads/YYYY/MM/ block'" +SecRule REQUEST_METHOD "^POST$" "t:none" +##12.1 Spam Scripts/shells Block POST /wp-content/themes/[^/]+/uploads/ +SecRule REQUEST_URI "^/wp-content/themes/[^/]+/uploads/" "id:900209,deny,status:406,chain,log,msg:'POST to Wordpress THEME uploads dir'" +SecRule REQUEST_METHOD "^POST$" "t:none" +##12.1 Fake UA :: Unsecured Upload form exploits +SecRule REQUEST_HEADERS:User-Agent "^IE:Mozilla\/5\.0 \(compatible" "id:900210,deny,status:406,log,msg:'Fake UA :: Exploit Attempts'" + +SecRule REQUEST_URI "/wp-content/uploads/optpress/[^\.]+\.php" "id:900211,deny,status:406,log,msg:'Optpress Upload PHP File Access Attempt'" +SecRule REQUEST_URI "/wp-content/uploads/optpress/[^\.]+\.phtml" "id:900241,deny,status:406,log,msg:'Optpress Upload PHP File Access Attempt'" +SecRule REQUEST_URI "/lib/admin/media-upload\.php" "id:900212,deny,status:406,chain,log,msg:'OptPress Unsecured Uploader Block'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none" + + +SecRule REQUEST_HEADERS:User-Agent "@beginsWith User-Agent: " "id:900242,status:406,phase:1,log,deny,msg:'Fake UA :: User-Agent at start of UA'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Macintosh; U; Intel Mac OS X 10\.6; fr; rv:1\.9\.2\.8\) Gecko\/20100722 Firefox\/3\.6\.8" "id:900243,status:406,phase:1,log,deny,chain,msg:'Wordpress Brute Force'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php)" + +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(X11; Ubuntu; Linux x86_64; rv:23\.0\) Gecko\/20100101 Firefox\/23\.0" "id:900244,status:406,phase:1,log,deny,chain,msg:'FF23 NoCookie'" +SecRule &REQUEST_COOKIES "@eq 0" + +Secrule REQUEST_HEADERS:User-Agent "Mozilla\/4\.0 \(compatible; MSIE 9\.0; Windows NT 6\.1; 125LA; \.NET CLR 2\.0\.50727; \.NET CLR 3\.0\.04506\.648; \.NET CLR 3\.5\.21022" "id:900245,status:406,phase:1,log,deny,chain,msg:'MSIE 9.0 No Cookie'" +SecRule &REQUEST_COOKIES "@eq 0" + +SecRule REQUEST_URI "/wp-content/uploads/optpress/images_optbuttons/" "id:900246,phase:1,status:406,log,deny,chain,msg:'OptPress Image Upload POST'" +SecRule REQUEST_METHOD "^POST$" "t:none" + +#UN-13015 +SecRule REQUEST_URI "/wp-content/plugins/[^/]+/readme\.txt" "id:900247,phase:1,chain,log,deny,msg:'Wordpress Plugin README.txt file access attempt'" + +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none" +SecRule REQUEST_URI "/wp-content/uploads/wysija/themes/" "id:900251,phase:1,status:406,log,deny,chain,msg:'Wordpress MailPoet Upload File Attempt'" +SecRule REQUEST_METHOD "^POST$" "t:none" +SecRule REQUEST_URI "/wp-admin/admin\.php\?page\=wysija_campaigns\&action\=themes" "id:900252,phase:1,status:406,log,deny,chain,msg:'Wordpress MailPoet Newsletter Exploit Attempt'" +SecRule &REQUEST_COOKIES "@eq 0" +SecRule REQUEST_URI "/themify-ajax\.php\?upload\=1" "id:900213,deny,status:406,chain,log,msg:'Themify Unsecured Uploader Block'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none" + +SecRule REQUEST_URI "/upload-handler\.php" "id:900214,deny,status:406,chain,log,msg:'Unsecured Wordpress Theme Uploader Block'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none" + +SecRule REQUEST_URI "/upload-handler\.php" "id:900215,deny,status:406,chain,log,msg:'Unsecured Wordpress Theme Uploader Block'" +SecRule REQUEST_HEADERS:Referer "http:\/\/www\.google\.com" "t:none" + +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php|wp-comments-post\.php)" "id:900216,phase:1,t:none,status:406,deny,chain,log,msg:'Wordpress Brute Force'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Macintosh; Intel Mac OS X 10\.8; rv:24\.0\) Gecko\/20100101 Firefox\/24\.0" chain +SecRule REQUEST_HEADERS:Cookie2 "\$Version=\"1\"" + +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php|wp-comments-post\.php)" "id:900217,phase:1,t:none,status:406,deny,chain,log,msg:'Wordpress Brute Force'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.2; WOW64\) AppleWebKit\/537\.36 \(KHTML, like Gecko\)" chain +SecRule REQUEST_HEADERS:Cookie2 "\$Version=\"1\"" + +Secrule REQUEST_URI "/guestbook\.cgi" "id:900218,phase:1,t:none,deny,log,msg:'Guestbook CGI Block for PCI scans'" + +SecRule request_uri "index\.php\?option\=com_jce\&task\=plugin\&plugin\=imgmanager\&file\=imgmanager\&method\=form" "id:900187,status:406,phase:1,t:none,log,chain,deny,msg:'JCE Exploit Attempt'" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" + +SecRule request_uri "index\.php\?option\=com_jce\&task\=plugin\&plugin\=imgmanager\&file\=imgmanager\&version\=\d+\&cid\=\d+" "id:900188,status:406,phase:1,t:none,log,chain,deny,msg:'JCE Exploit Attempt CHECK'" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" + +##Date 8.29 +SecRule REQUEST_FILENAME "/collector\.php" "id:900189,status:406,phase:1,t:none,log,chain,deny,msg:'PHP Mailer :: Collector'" +SecRule REQUEST_METHOD "^POST$" "t:none" + +SecRule REQUEST_FILENAME "/xmlrpc\.php" "id:900161,log,deny,status:406,phase:1,t:none,chain,log,msg:'XMLRPC Request with no UA/Ref'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none" +##9.27 XMLRPC Wordpress Amp Attack +SecRule REQUEST_FILENAME "/xmlrpc\.php" "id:900195,log,deny,status:406,phase:1,t:none,chain,log,msg:'XMLRPC Request UA used in BF'" +SecRule REQUEST_HEADERS:User-Agent "Internal Wordpress RPC connection" + +#Ahrefsbot 7/31 +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(compatible; AhrefsBot\/\d\.\d; \+http:\/\/ahrefs\.com\/robot\/\)" "id:900165,log,deny,status:406,phase:1,t:none,log,msg:'AhrefsBot BOT Request'" +#Bad Chrome +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 5\.\d\) AppleWebKit\/537\.36 \(KHTML, like Gecko\) Chrome\/28\.0\.1500\.7[12] Safari\/537\.36" "id:900166,chain,log,deny,status:406,phase:1,t:none,log,msg:'Fake CHROME Browser request :: Botnet / Brute Force'" +SecRule &REQUEST_HEADERS:Origin "@eq 0" "t:none,chain" +SecRule REQUEST_METHOD "^POST$" "t:none" +#SecRule REQUEST_HEADERS:Accept-Encoding "!gzip,deflate,sdch\." "t:none" +##MJ12 Block +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(compatible; MJ12bot\/v\d+.\d+\.\d+; http:\/\/(www\.majestic12\.co\.uk\/bot\.php\?\+|mj12bot\.com\/)\)" "id:900167,phase:1,deny,t:none,status:406,log,msg:'MJ12Bot Crawler'" +##8.8 FakeGooglebot Brute +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php)" "id:900168,phase:1,chain,status:406,deny,log,msg:'Brute Force Attempt :: POST wp-login Googlebot'" +SecRule REQUEST_METHOD "POST" "t:none,chain" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(compatible; Googlebot\/2\.1; \+http:\/\/www\.google\.com\/bot\.html\)" "t:none" +##8.9 OpenX Backdoor +SecRule REQUEST_URI "\/fc\.php\?script\=deliveryLog:vastServeVideoPlayer:player\&file_to_serve\=flowplayer\/3\.1\.1\/flowplayer-3\.1\.1\.min\.js" "id:900169,phase:1,status:406,deny,log,msg:'Backdoor Attempt Openx Source 2.8.11'" +##8.12 WP-Brute +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(X11; U; Linux i686; pt-BR; rv:1\.9\.0\.15\) Gecko\/2009102815 Ubuntu\/9\.04 \(jaunty\) Firefox\/3\.0\.15$" "id:900170,chain,phase:1,deny,t:none,status:406,log,msg:'WP-Brute-Force :: UA'" +SecRule REQUEST_URI "/(wp-login\.php|administrator|wp-admin/)" + +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Parsley NT 1\.0; rv:1\.0\) Parsley\/1\.0\.0\.\d" "id:900171,chain,phase:1,deny,t:none,status:406,log,msg:'WP-Brute-Force :: UA'" +SecRule REQUEST_URI "/(wp-login\.php|administrator|wp-admin/)" +##Date 8.13 PHP WebShell Upload +SecRule REQUEST_URI "php\?y\=\/home[^\&]+\&x\=upload" "id:900174,phase:1,t:none,t:urlDecode,status:406,deny,msg:'PHP WebShell Upload Attempt'" +SecRule REQUEST_URI "php\?x\=f\&f\=[^\&]+\&ft\=" "id:900175,phase:1,t:none,t:urlDecode,status:406,deny,msg:'PHP WebShell Edit Attempt'" +##8.12 Fake Googlebot XMLRPC +SecRule REQUEST_FILENAME "/xmlrpc\.php" "id:900172,log,deny,status:406,phase:1,t:none,chain,log,msg:'XMLRPC Request fake Googlebot'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule REQUEST_HEADERS:User-Agent "GoogleBot\/1\.0$" +##8.20 Spam UA HTTP 1.0 w/ connection close + base64 encoding +SecRule REQUEST_PROTOCOL "^HTTP/1\.0" "id:900178,chain,phase:1,t:none,status:406,deny,msg:'UA Spam POST http 1.0 w/ close '" +SecRule REQUEST_HEADERS:Content-Transfer-Encoding "base64" chain +SecRule REQUEST_HEADERS:connection "close" "t:lowercase,chain" +SecRule REQUEST_METHOD "^POST$" "t:none" +##8.20 SQL +secrule args "\)\)[<=>]\d+ and [\'\"]x[\'\"]=[\'\"]x" "id:900182,phase:1,t:none,t:urlDecodeUni,t:lowercase,status:406,deny,msg:'SQL Information Disclosure Attempt'" +SecRule REQUEST_URI "from[ \`\'\"]+information_schema" "id:900179,phase:1,t:none,t:lowercase,t:urlDecodeUni,status:406,deny,msg:'SQL Injection Attempt'" +secrule args "(?:con(?:vert|cat)|select) ?\(\b(case|char|int)\b" "id:900181,phase:1,t:none,t:lowercase,t:urlDecodeUni,status:406,deny,msg:'SQL Information Disclosure Attempt'" +SecRule REQUEST_URI "(?:/mod_topic/|/akicmet/|/rus-to-lat/)collector\.php" "id:900180,phase:1,t:none,status:406,deny,msg:'Malicous PHP Mailer'" + + + +SecRule REQUEST_FILENAME "/xmlrpc\.php" "id:900162,log,phase:1,status:406,t:none,chain,deny,log,msg:'XMLRPC Request with no UA/Ref'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,chain" +SecRule REQUEST_HEADERS:User-Agent "PHP\/5\.2\.10" "t:none" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; rv:21\.0\) Gecko\/20100101 Firefox\/21\.0 \[xUSAx\]" "id:900163,log,phase:1,status:406,t:none,deny,log,msg:'Known BAD Ua :: Brute Force'" +#SecRule REQUEST_URI "/modules/gateways/callback/paypal\.php" "id:900158,chain,deny,status:403,log,msg:'PayPAL WHMCS Access Attemp for IP other than Paypal notify.paypal.com'" +#SecRule REMOTE_ADDR "!(173\.0\.81\.1|173\.0\.81\.33|66\.211\.170\.66)" + + +##7.23 Brobot UA Blocks +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows; U; Windows NT 6\.0; en-US; rv:1\.9\.0\.3\) Gecko\/2008092417 Firefox\/3\.0\.3$" "id:900164,log,phase:1,status:406,t:none,chain,deny,log,msg:'BroBOT UA Block :: Wordpress/Joomla Exploitation Attempt'" +SecRule REQUEST_URI "/(wp-login\.php|administrator|wp-admin/)" + + +SecRule REQUEST_FILENAME "/\.qidb/" "id:900150,status:406,deny,msg:'QIDB Request'" +##7.3 Badbot Block +#SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(compatible; SemrushBot\/\d\.\d+\.\d+; \+http:\/\/www\.semrush\.com\/bot\.html\)" "id:900159,deny,status:406,log,msg:'SemrushBOT Block :: Bad Behavior'" +SecRule REQUEST_HEADERS:User-Agent "@pm SemrushBot" "id:900159,deny,status:406,log,msg:'SemrushBOT Block :: Bad Behavior'" +##10.7 Blexbot +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(compatible; BLEXBot\/\d\.\d+; \+http:\/\/webmeup-crawler\.com\/\)" "id:900197,deny,status:406,log,msg:'Blexbot Block :: Bad Behavior'" +##6.10 Wordpress EDITOR Access w/ HTTP Version1.0 +#SecRule REQUEST_URI "/wp-admin/[^-]+-editor\.php" "id:900151,chain,deny,status:406,t:none,msg:'HTTP 1.0 Wordpress EDITOR Access'" +#SecRule REQUEST_PROTOCOL "^HTTP/1\.0" +##6.11 PHPBB Forum Block for Bots w/ HTTP Version1.0 +#SecRule REQUEST_URI "/(posting|ucp|viewtopic|guestbook)\.php" "id:900152,chain,deny,status:406,t:none,msg:'HTTP 1.0 PHPBB Access'" +#SecRule REQUEST_PROTOCOL "^HTTP/1\.0" +##6.13 +secrule ARGS_NAMES "nggupload" "id:900153,status:406,chain,deny,msg:'NGG GALERY 1.9.12 or lower exploit attempt - CVE-2013-3684'" +secrule REQUEST_FILENAME "!/wp-admin/" +##6.13 +SecRule REQUEST_URI "/wp-(admin|login\.php)" "id:900154,deny,status:406,chain,phase:1,log,msg:'WP Brute UA block'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/4\.0 \(compatible; MSIE 8\.0; Windows NT 6\.0; Trident\/4\.0; Mozilla\/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1; SV1\); \.NET CLR 3\.5\.30729\)" +SecRule REQUEST_URI "/wp-(admin|login\.php|wp-comments-post\.php)" "id:900155,deny,status:406,phase:1,chain,log,msg:'WP Brute UA block'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(compatible; MSIE 10\.0; Windows NT 6\.1; Trident\/6\.0\)" chain +SecRule &REQUEST_HEADERS:Accept "@eq 0" +##6.17 +SecRule REQUEST_HEADERS:User-Agent "User-Agent: Mozilla\/\d\.0 \(compatible;" "id:900156,deny,status:406,log,msg:'Script Error for User-Agent Setting :: Spam/Malware Abuse'" + +##7.16 Com_JCE GTB 7.1 +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows; U; Windows NT 5\.1; ru; rv:1\.9\.2\.3\) Gecko\/20100401 Firefox\/3\.6\.3 GTB7\.1$" "id:900160,phase:1,t:none,status:406,chain,log,deny,msg:'Bad UA :: Known for Brute Forcing and Spam'" +SecRule REQUEST_URI "(\/administrator\/|wp-login\.php|wp-comments-post\.php|submit\.php|index\.php\?option\=com_jce)" + +# Drupal fckeditor Exploit +#SecRule REQUEST_URI "/index\.php\?q\=fckeditor\/xss" "id:900138,phase:1,t:none,deny,status:406,msg:'FCKEditor Exploit Attempt'" +# Joomla Brute +SecRule REQUEST_FILENAME "\/administrator\/" "id:900139,t:none,chain,log,deny,phase:1,status:406,msg:'Wordpress Brute Force HTTP1.0 w/ HOST'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; (WOW64; )?rv:1[89]\.0\) Gecko\/20100101 Firefox\/1[89]\.0" chain +SecRule REQUEST_PROTOCOL "^HTTP/1\.0" chain +SecRule &REQUEST_HEADERS:Host "@eq 1" +# +## Cloudflare PASSTHRU Brutes +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1;(WOW64;)? rv:1[89]\.0\) Gecko\/20100101 Firefox\/1[89]\.0" "id:900176,phase:1,t:none,chain,status:406,deny,msg:'Cloudflare WP-Brute block'" +SecRule &REQUEST_HEADERS:CF-Connecting-IP "@eq 1" + +SecRule REQUEST_URI "\/wp-content\/plugins\/hello\.php" "id:900140,t:none,phase:1,,chain,log,deny,status:406,msg:'Wordpress hello.php POST attempt'" +SecRule REQUEST_METHOD "^POST$" "t:none" +# +SecRule REQUEST_HEADERS:User-Agent "; MRSPUTNIK 2, 4," "id:900141,phase:1,t:none,chain,log,deny,status:406,msg:'Wordpress / Joomla Brute Attempt :: UA contains MRSPUTNIK'" +SecRule REQUEST_URI "/(wp-login\.php|administrator/?)" +# +SecRule REQUEST_URI "/wp-content/.*/mod_system\.php" "id:900144,t:none,log,deny,status:406,msg:'Wordpress WRO Shell Attempt'" +##Date 5.23 Mozilla 18 w/ Close +SecRule REQUEST_URI "/wp-(admin|login\.php)" "id:900148,log,deny,phase:1,status:406,chain,msg:'Mozilla Header w/ Connection Close'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; WOW64; rv:18\.0\) Gecko\/20100101 Firefox\/18" chain +SecRule REQUEST_HEADERS:connection "close" "t:lowercase" + +#SecRule REQUEST_URI "\/(?:themes|plugins|wp-admin|includes|admin|images)\/.*/a\w{2,4}\.html$" "id:900142,t:none,log,deny,status:406,msg:'Exploited HTML File '" + +#SecRule REQUEST_FILENAME "\/wp-login\.php$" "id:900146,t:none,chain,log,deny,status:406,msg:'Wordpress Brute Force Cloudflare Proxyed'" +#SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; (WOW64; )?rv:1[89]\.0\) Gecko\/20100101 Firefox\/1[89]\.0" chain +#SecRule REQUEST_HEADERS_NAMES "^X-Forwarded-For" + +############3 +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Macintosh; Intel Mac OS X 10_8_2\) AppleWebKit\/537\.17 \(KHTML, like Gecko\) Chrome\/24\.0\.1309\.0 Safari\/537\.17" "id:900131,phase:1,t:none,deny,chain,status:406,msg:'Fake UA :: Used in Wordpress bruteforce'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php)" + +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.2; Win64; x64; rv:16\.0\.1\) Gecko\/20121011 Firefox\/16\.0\.1" "id:900132,phase:1,t:none,deny,chain,status:406,msg:'Fake UA :: Used in Wordpress bruteforce'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php)" + +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.2; WOW64\) AppleWebKit\/537\.14 \(KHTML, like Gecko\) Chrome\/24\.0\.1292\.0 Safari\/537\.14" "id:900134,phase:1,t:none,deny,chain,status:406,msg:'Fake UA :: Used in Wordpress bruteforce'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php)" +########################## + +##4.23 +SecRule REQUEST_FILENAME "\/wp-login\.php$" "id:900135,t:none,chain,log,deny,phase:1,status:406,msg:'Wordpress Brute Force HTTP1.0 w/ HOST'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; (WOW64; )?rv:1[89]\.0\) Gecko\/20100101 Firefox\/1[89]\.0" chain +SecRule REQUEST_PROTOCOL "^HTTP/1\.0" chain +SecRule &REQUEST_HEADERS:Host "@eq 1" +##4.23 Civicrm milworm:20676 +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; WOW64; rv:15\.0\) Gecko\/20100101 Firefox\/15\.0\.1" "id:900136,t:none,chain,log,deny,status:406,msg:'Com_Civicrm Unsecured Upload attempt'" +SecRule REQUEST_URI "administrator\/components\/com_civicrm\/civicrm\/packages\/OpenFlashChart" +##Date 8.16 Wordpress BRUTE HTTP 1.0 w/o Accept header +SecRule REQUEST_URI "/(wp-login\.php|administrator|wp-admin/)" "id:900177,chain,phase:1,t:none,status:406,deny,msg:'Brute Force Attempt HTTP 1.0 w/o Accept Header'" +SecRule REQUEST_PROTOCOL "^HTTP/1\.0" chain +SecRule &REQUEST_HEADERS:Accept "@eq 0" +##10.7 WP FF25 1.0 +SecRule REQUEST_FILENAME "/wp-login\.php" "id:900199,t:none,chain,log,deny,phase:1,status:406,msg:'Wordpress Brute Force HTTP1.0 w/ HOST'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5.0 \(Windows NT 6.1; Win64; x64; rv:25.0\) Gecko\/20100101 Firefox\/25\.0" chain +SecRule REQUEST_PROTOCOL "HTTP/1\.0" chain +SecRule &REQUEST_HEADERS:Host "@eq 1" + + +##Date 9.25 +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php|wp-comments-post\.php)" "id:900192,phase:1,t:none,status:406,deny,chain,log,msg:'Wordpress Brute Force'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/4\.0 \(compatible; MSIE 8\.0; Windows NT 6\.0; Trident\/4\.0\)" chain +SecRule REQUEST_HEADERS:Cookie2 "\$Version=\"1\"" + +##10.7 Cookie Order Brute +SecRule REQUEST_URI "/administrator/" "id:900200,chain,status:406,phase:1,t:none,log,deny,msg:'Request Cookie Ordering Alert: Potential Brute Tool'" +SecRule REQUEST_COOKIES_NAMES ".*" "chain,setvar:'tx.cookie_order=%{tx.cookie_order}, %{matched_var}'" + SecRule TX:COOKIE_ORDER ", CHECK, humans, beget" + +##4.19 XMLRPC +#SecRule REQUEST_FILENAME "\/xmlrpc\.php$" "id:900134,t:none,chain,log,status:406,deny,msg:'Wordpress XMLRPC Request with no ua/refferer'" +#SecRule REQUEST_METHOD "^POST$" "t:none,chain" +#SecRule &REQUEST_HEADERS:Referer "@eq 0" "chain" +#SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none" + + +##11.27 Automated Wordpress Exploit Attempt +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/3\.0 \(compatible; Indy Library\)" "id:900078,t:none,chain,phase:1,log,status:406,deny,msg:'Automated Exploit Attempt INDY'" +SecRule REQUEST_METHOD "^POST$" "t:none" +#SecRule REQUEST_URI "/wp-login\.php" + +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/3\.0 \(compatible; Indy Library\)" "id:900079,t:none,chain,log,status:406,deny,msg:'Automated Wordpress Exploit Attempt INDY'" +SecRule REQUEST_URI "/wp-admin/" + +##11.30 Automated WP-Login Bad UA +Secrule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(X11; U; Linux i686; pt-BR; rv:1\.9\.0\.15\) Gecko\/2009102815 Ubuntu\/9\.04 \(jaunty\) Firefox\/3\.0\.15" "id:900085,phase:2,t:none,status:406,log,drop,chain,msg:'Bad UA :: Brute Force Attempt'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" +#SecRule REQUEST_HEADERS:Referer "^$" + +##3.20 Bad UA for Joomla Brute/WP Brute and dvmessages install +SecRule REQUEST_URI "(\/administrator\/|wp-login\.php)" "id:900113,phase:1,t:none,status:406,chain,log,deny,msg:'Bad UA :: Known for Brute Forcing'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows; U; Windows NT 6\.0; en-US; rv:1\.9\.0\.3\) Gecko\/2008092417 Firefox\/3\.0\.3$" + +##3.22 Joomla/WP Brute and SPAM UA block +SecRule REQUEST_URI "(\/administrator\/|wp-login\.php|wp-comments-post\.php|submit\.php|index\.php\?option\=com_jce)" "id:900115,phase:1,t:none,status:406,chain,log,deny,msg:'Bad UA :: Known for Brute Forcing and Spam'" +SecRule REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer "Mozilla\/5\.0 \(Windows; U; Windows NT 5\.1; en-US; rv:1\.9\.1\.3\) Gecko\/20090824 Firefox\/3\.5\.3 GTB5$" +##3.26 BroBOT Brute UA +SecRule REQUEST_URI "(\/administrator\/|wp-login\.php|wp-comments-post\.php|submit\.php)" "id:900117,phase:1,t:none,status:406,chain,log,deny,msg:'Bad UA :: Known for Brute Forcing and Spam'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows; U; Windows NT 6\.0; en-US; rv:1\.9\.0\.3\) Gecko\/2008092417 Firefox\/3\.0\.3" +##4.2 +SecRule REQUEST_Headers:User-Agent "@endsWith Havij" "id:900119,deny,t:none,phase:1,status:406,msg:'Havik SQL Injection rool'" +##4.4 +SecRule REQUEST_URI "/modules/mod_gogle/" "id:900143,phase:1,deny,status:406,msg:'Malicous Joomla Component :: Hacked :: Spam'" +Secrule REQUEST_URI "/modules/mod_dbrestore/" "id:900198,deny,status:406,log,msg:'Malicous Joomla Component :: Hacked :: Spam'" +#SecRule REQUEST_HEADERS "Mozilla\/\d\.\d \(compatible; MSIE \d\.\d; Windows NT \d\.\d; [^\(]+Mozilla\/\d\.\d \(compatible;" "id:900116,phase:2,t:none,status:406,log,deny,msg:'Bad UA :: Two valid UAs combined'" +##Date 11.30 Joomla +##jform[groups][]=7 +##index.php?option=com_users&view=registration +SecRule REQUEST_URI "index\.php" "chain,id:392664,log,deny,rev:1,severity:1,msg:'Joomla Privilige Escalation Vulnerability',t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase" +SecRule ARGS:option "com_users" chain +SecRule ARGS:view "registration" chain +SecRule ARGS:/^jform\[groups\]\[\]$/ "^7$" + +#12.3 PHP Mailer attempt "POST /.6e49.php HTTP/1.1" 200 - "-" "-" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "id:900080,chain,deny,phase:1,log,t:none,msg:'PHP Mailer Access Attempt'" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "chain" +SecRule REQUEST_URI "/\.[a-z0-9]{4}\.php" + +#12.3 WHMCS GoogleCheckout SQL Injection attempt +SecRule REQUEST_URI "/modules/gateways/callback/googlecheckout\.php" "id:900081,log,chain,deny,phase:1,msg:'WHMCS Google Checkout SQL Injection Attempt'" +SecRule REQUEST_HEADERS:User-Agent "!(Google Checkout Notification Agent \d\.\d)" + +##Date 12.4.12 Automated Exploitation Attempt +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/4\.0 \(compatible; Synapse\)" "id:900082,log,deny,chain,status:406,phase:2,msg:'Automated Exploitation Tool'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule REQUEST_URI "/(templates|administrator|wp-login\.php)" + +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/3\.0 \(compatible; Indy Library\)" "id:900083,t:none,chain,log,status:406,deny,msg:'Automated Joomla Exploit Attempt INDY'" +SecRule REQUEST_URI "/(templates|administrator)/" + +##Date 12.7 PHP DDOS +SecRule REQUEST_URI "\.php(?:\?|\&)act\=phptools(?:\?|\&)host\=" "id:900112,log,deny,phase:1,deny,msg:'PHP Tools DDOS Attempt'" + +#12.5 Wordpress BING UA +SecRule REQUEST_URI "/wp-(login\.php|admin/)" "id:900084,phase:1,t:none,t:lowercase,chain,status:406,log,deny,chain,msg:'Wordpress BRUTE w/ Bing UA'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(compatible; bingbot\/2\.0; \+http:\/\/www\.bing\.com\/bingbot\.htm\)" "t:none" + +##Date 12.11 +SecRule ARGS:pass "FgYuD@37" "id:900086,phase:1,drop,log,msg:'Brobot w/ known password'" +SecRule ARGS:cms "jjoplmh" "id:900145,phase:2,drop,log,msg:'Backdoor Hacked Wordpress Plugin'" + +##Date 12.12 +#/components/com_ag_google_analytics2/ +SecRule REQUEST_URI "/components/com_ag_google_analytics2/" "id:900087,phase:2,chain,deny,log,msg:'Exploited Joomla Shell Access Attempt'" +SecRule REQUEST_METHOD "^POST$" "t:none" +##Date 12.12 Akismet WSO Shell +SecRule REQUEST_URI "/wp-content/plugins/akismet/" "id:900088,phase:2,chain,deny,status:406,chain,log,msg:'Wordpress COMP Akismet Attempt'" +SecRule REQUEST_METHOD "^POST$" "t:none" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/4\.0 \(compatible; ICS\)" "id:900121,phase:1,t:none,deny,status:406,msg:'Fake UA :: Used in mailers/brute'" +##Date 4.2 +SecRule REQUEST_URI "/wp-content/plugins/mod_gogle/" "id:900120,phase:2,t:none,deny,status:406,msg:'Fake Plugins MAILER attempt'" + +#date 12.12 Fake UA USed in Exploits EX: 1xx.1xx.2xx.1xx - - [xx/Dec/2012:13:10:14 -0600] "POST /components/com_ag_google_analytics2/pollQ7P2.php HTTP/1.1" 200 36 "-" "Mozilla/5.0" +##SecRule REQUEST_HEADERS:User-Agent "^Mozilla\/[345]$" "id:900089,phase:1,deny,status:406,log,msg:'Fake Mozzila UA'" + +# +SecRule REQUEST_URI "component/users/\?(?:task|view)=registration" "chain,id:392665,rev:1,severity:1,msg:'Joomla Privilige Escalation Vulnerability',t:none,t:urlDecodeUni,t:compressWhiteSpace,t:lowercase" +SecRule ARGS:/^jform\[groups\]\[\]$/ "^7$" + +##DAte 12.14 +SecRule REQUEST_URI "/monetize/general/upload(-file)?\.php" "id:900090,phase:1,deny,status:406,log,msg:'Exploited THEME Upload attempt'" +SecRule REQUEST_URI "/monetize/upload/upload(-file)?\.php" "id:900157,phase:1,deny,status:406,log,msg:'Exploited THEME Upload attempt'" +SecRule REQUEST_URI "/themes/mantra/admin/upload(-file)?\.php" "id:900091,phase:1,deny,status:406,log,msg:'Exploited THEME Upload attempt'" +#9.17 Joomla BF w/ Bing UA +SecRule REQUEST_URI "\/administrator\/" "id:900072,phase:1,t:none,t:lowercase,chain,log,status:406,deny,chain,msg:'Joomla Admin BRUTE w/ Bing UA'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(compatible; bingbot\/2\.0; \+http:\/\/www\.bing\.com\/bingbot\.htm\)" "t:none" + +##12.26 Wordpress GSM :: 1.2.13 update eval mod +SecRule REQUEST_URI "wp-content/plugins/[^/]+/gsm.php" "id:900092,deny,phase:2,log,status:406,msg:'GSM.PHP Shell access attempt'" +SecRule ARGS:act "^eval$" "id:900093,deny,log,phase:2,status:406,msg:'PHP Shell eval action attempt'" + +##12.31 BroBOT blocks/Brute blocks :: WL Seogears IP 3.26 +Secrule REQUEST_HEADERS:User-Agent "Mozilla\/[456]\.0$" "id:900095,phase:2,t:none,status:406,log,chain,deny,msg:'Bad UA :: Fake Mozilla Agent'" +SecRule REQUEST_FILENAME "!(cron\.php)" chain +SecRule Request_URI "!@beginsWith /?automatorsecretkey" +##1.3 168.167.249.98 - - [03/Jan/2013:16:55:57 -0600] "POST /plugins/system/dvmessages.php HTTP/1.1" 200 10 "-" "Mozilla/5.0 Firefox/3.6.12" +Secrule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 Firefox\/\d\.\d\.\d+$" "id:900096,phase:2,t:none,status:406,log,deny,msg:'Bad UA :: Fake Mozilla Agent'" +##6.6 Explots +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows\)$" "id:900149,phase:2,t:none,status:406,log,deny,msg:'Bad UA :: Fake Mozilla Agent'" +##1.4 WHMCS 5.x Auth bypass http://packetstormsecurity.com/files/119234/whmcs5-bypass.txt +SecRule REQUEST_URI "login\.php\?correct\&cache\=1\?login\=getpost\{\}" "id:900097,phase:2,t:none,log,deny,msg:'WHMCS 5.x Admin Bypass via Cache exploit'" +##1.4 c_id and comment ARGS backdoor attempt (Brobot) +SecRule args:c_id|args:comment "@beginsWith JGJhc2UgPSBkaXJuYW1lKF9fRklMRV9fKS4iLyI7DQp1bmxp" "id:900098,phase:2,t:none,log,deny,msg:'BroBOT DDOS c_id arg backdoor attempt'" +SecRule args:c_id|args:comment "@beginsWith ZWNo" "id:900099,phase:2,t:none,log,deny,msg:'BroBOT DDOS comment arg backdoor attempt'" +##1.4 JCE exploit attempts +SecRule request_uri "index\.php\?option\=com_jce\&task\=plugin\&plugin\=imgmanager\&file\=imgmanager\&method\=form" "id:900100,phase:2,t:none,log,chain,deny,msg:'JCE Exploit Attempt'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" +SecRule request_uri "index\.php\?option\=com_jce\&task\=plugin\&plugin\=imgmanager\&file\=imgmanager\&method\=form" "id:900147,phase:2,t:none,log,chain,deny,msg:'JCE Exploit Attempt'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)" "t:none" +SecRule request_uri "index\.php\?option\=com_jce\&task\=plugin\&plugin\=imgmanager\&file\=imgmanager\&version\=\d+\&cid\=\d+" "id:900101,phase:2,t:none,log,chain,deny,msg:'JCE Exploit Attempt CHECK'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" + +##1.11 IE6 Block for brute force/spam prevention +SecRule REQUEST_HEADERS:User-Agent "^Mozilla\/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1; SV1;?\)$" "id:900102,chain,status:406,deny,t:none,msg:'IE6 UA Block to prevent brute force and comment spam'" +SecRule REQUEST_URI "/(wp-(login|comments-post)\.php|administrator/|components/k2/|index\.php\?option\=com_(?:k2|user)|index\.php\?action\=|index\.php\?title\=Special:UserLogin|user/|posting\.php|ucp\.php|signup|login|upload-handler\.php)" + +##1.15 Mailer / Fake LICESNE.php access attempt +SecRule REQUEST_URI "/7c32\.php" "id:900103,status:406,deny,t:none,msg:'Malicous Mailer Access Attempt'" +SecRule REQUEST_URI "/LICESNE\.php" "id:900104,status:406,deny,t:none,msg:'Misspelled Licesne access attempt. WSO Shell'" + +##1.22 mt-upgrade Behavior block +SecRule REQUEST_FILENAME "/mt-upgrade\.cgi$" "id:900105,status:406,chain,deny,phase:2,msg:'MovableType MT-Upgrade Remote Command Exe Attempt'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" +##1.23 mt-upgrade update +SecRule REQUEST_URI "/mt-upgrade\.cgi\?__mode\=run_actions\&installing\=1" "id:900107,status:406,deny,phase:2,t:none,t:lowercase,t:urlDecode,msg:'MovableType MT-Upgrade Remote Command Exe Attempt'" + +##1.28 BB-Press SPAM with invalid UA +SecRule REQUEST_URI "/(bb-post|bb-login|register)\.php" "id:900108,chain,phase:2,deny,status:406,msg:'BB-Press SPAM Block with bad UA'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 5\.1; rv:17\.0\) Gecko\/20100101 Firefox\/17\.0$" + +SecRule REQUEST_URI "/(bb-post|bb-login|register)\.php" "id:900109,chain,phase:2,deny,status:406,msg:'BB-Press SPAM Block Fake UA'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/4\.0 \(Windows; U; Windows NT 5\.1; zh-TW; rv:1\.9\.0\.11\)$" +##1.29 SWFupload/js/upload.php BLOCK +SecRule REQUEST_URI "/js/swfupload/js/upload\.php" "id:900110,chain,phase:2,deny,status:406,msg:'SWFupload UPLOAD block'" +SecRule REQUEST_HEADERS:User-Agent "!(^Shockwave Flash$|^Adobe Flash Player \d+$|^Java/\d+\.\d+\.\d+_\d+$)" "t:none" + +##1.31 Wordpress direct path 404 theme page POST +SecRule REQUEST_URI "/wp-content/themes/[^/]+/404\.php" "id:900111,chain,phase:2,deny,status:406,msg:'Wordpress THEME 404 page POST attempt :: Possible Injection Attempt'" +SecRule REQUEST_METHOD "POST" "t:none" + + +# wordpres db cache +SecRule Request_URI "/wp-content/w3tc/dbcache/" "id:900094,phase:1,t:none,status:406,deny,msg:'WP DB Cache Block'" + +#WP WSO Attempt +SecRule REQUEST_URI "/wp-[a-z]+[0-9]\.php" "id:900076,t:none,chain,log,deny,msg:'Wordpress WSO Request'" +SecRule REQUEST_METHOD "POST" "t:none" + +## HTTP_CMD Attempt Blocked :: Used in passthru like <?error_reporting(0);print(___);passthru(base64_decode($_SERVER[HTTP_CMD]));die;?> +Secrule REQUEST_HEADERS_NAMES "^cmd$" "id:900073,t:lowercase,log,deny,msg:'HTTP_CMD Header attempted'" +Secrule REQUEST_HEADERS_NAMES "^nessus_cmd$" "id:900074,t:lowercase,log,deny,msg:'NESSUS_CMD Header from nessus cmdline tool'" + +##Upload rule 900061 +#SecRule SCRIPT_BASENAME "^upload[^.]*\.php" "id:900054,phase:2,t:none,t:lowercase,log,pass,chain,msg:'Upload Attempt w/o Referer'" +SecRule REQUEST_URI "/uploadify\.php" "id:900054,phase:2,t:none,t:lowercase,log,deny,chain,msg:'Upload Attempt w/o Referer'" +SecRule REQUEST_METHOD "POST" "t:none,chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "chain" +SecRule REQUEST_HEADERS:User-Agent "!(^Shockwave Flash$|^Adobe Flash Player \d+$|^Java/\d+\.\d+\.\d+_\d+$)" "t:none" + +SecRule REQUEST_URI "/uploadify\.php" "id:900061,phase:2,t:none,t:lowercase,log,deny,chain,msg:'Upload Attempt w/o Referer'" +SecRule REQUEST_METHOD "POST" "t:none,chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none" + +##DDOS Script. startphp variant +SecRule REQUEST_URI "@endsWith \?action\=status" "id:900065,phase:1,t:none,deny,chain,capture,msg:'DDOS Status Report'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" +SecRule Request_URI "\?action\=start\&time_s\=\d*\&time_e\=\d+" "id:900070,phase:1,t:none,deny,capture,msg:'DDOS Self Spawn'" +SecRule Request_URI "\?action\=start\&protocol\=(?:tcp|udp)\&time_s\=\d*\&time_e\=\d+" "id:900066,phase:1,t:none,deny,capture,msg:'DDOS Self Spawn'" +SecRule REQUEST_URI "php\?mode\=(?:htt|ud)p\&address\=(?:http:\/\/|\d+)" "id:900173,phase:1,t:none,status:406,deny,msg:'Mua DDOS Script'" + + +SecRule SCRIPT_BASENAME "indx\.php" "id:900068,phase:1,t:none,deny,chain,capture,msg:'DDOS indx.php request::No UA/Ref'" +SecRule REQUEST_METHOD "POST" "t:none,chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" + +SecRule SCRIPT_BASENAME "stc?ph?\.php" "id:900069,phase:1,t:none,deny,chain,capture,msg:'DDOS stcp.php request::No UA/Ref'" +SecRule REQUEST_METHOD "POST" "t:none,chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" + +SecRule SCRIPT_BASENAME "stmdu\.php" "id:900071,phase:1,t:none,deny,chain,capture,msg:'DDOS stcp.php request::No UA/Ref'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" + + +##DDos Script +SecRule REQUEST_URI "port\=\d+\&ipbc\=\d+\.\d+\.\d+\.\d+\&mod\=(?:udp|tcp)\&time\=\d+" "id:900075,t:none,log,deny,msg:'PHP DDOS Attempt'" +##No UA/REF VB template edit +SecRule REQUEST_URI "\/admincp\/template\.php\?do\=updatetemplate" "id:900067,phase:1,t:none,t:lowercase,log,deny,chain,msg:'VB Template Update :: No UA/Ref'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" + + +#Joomla no UA/Referer Block +SecRule REQUEST_URI "\/index\.php\?option\=com_templates\&layout\=edit" "id:900063,phase:1,t:none,deny,chain,capture,msg:'No UA/Referer with Joomla theme edit'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" "chain" +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none" +#Joomla JCE Exploit bot UA +SecRule REQUEST_HEADERS:User-Agent "BOT\/0\.1 \(BOT for JCE\)" "id:900064,phase:1,t:none,deny,capture,msg:'JCE Exploit bot'" + +# /inc/upload no REFERER +SecRule Request_URI "\/inc\/upload\.php" "id:9000049,phase:2,t:none,t:lowercase,log,pass,chain,msg:'Inc Upload Exploit NO Referrer'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" +# + +##VB 3.xx Info Disclosure +SecRule Request_URI "(search|profile|subscription)\.php\?do\[[^\]]*\]\=" "id:900060,log,t:none,t:lowercase,log,msg:'VB 3.3 full path disclosure bulnerability'" + +##PHP-CGI +SecRule REQUEST_URI "\.php\?(-|%2d)[a-zA-Z][^\=\?]+$" "id:9000047,phase:2,t:none,deny,capture,msg:'PHP-CGI Exploit Attempt::CVE-2012-1823'" + +##Joomla NoNumber Framework Block +SecRule REQUEST_URI "/index\.php\?nn_qp\=\d\&url\=" "id:9000050,phase:2,t:none,t:urlDecodeUni,t:lowercase,log,deny,chain,msg:'Joomla NoNumber Framework Exploit'" +SecRule REQUEST_METHOD "^POST$" "t:none,chain" +SecRule &REQUEST_HEADERS:Referer "@eq 0" + +#DBConnect Direct Access Reuqest +#SecRule REQUEST_URI "dbconnect\.php" "id:9000048,phase:2,t:none,deny,msg:'dbconnect.php direct access attempt'" + +#WooTheme Block +SecRule REQUEST_URI "preview-shortcode-external\.php\?shortcode\=(%5B|\[)php(%5D|\])" "id:900050,phase:2,t:none,log,status:406,deny,msg:'WooTheme Exploit'" +#WP 404 Login attempt w/ comped password +SecRule REQUEST_URI "wp-login\.php\?redirect_to\=http(%3A|:)(%2F|/)(%2F|/)[^(%2F|/)]+(%2F|/)wp-admin(%2F|/)theme-editor(\.php)?(\?|%3F)file(\=|%3D)(%252F|\%2F|\/)themes(%252F|\%2F|\/)[^(%252F|\%2F|\/)]+(%252F|\%2F|\/)404\.php" "id:900051,phase:1,t:none,t:urlDecode,log,status:406,deny,msg:'Exploited WP-Login attempt :: 404'" +#Wordpress Functions.php +SecRule REQUEST_URI "\?cperpage\=1" "id:900053,phase:2,t:none,t:lowercase,log,status:406,deny,msg:'Wordpress functions.php Admin Bypass'" + + +SecRule REQUEST_URI "wank\.php" "id:900052,phase:2,t:none,t:lowercase,chain,log,deny,msg:'Wank DDOS Access'" +SecRule REQUEST_METHOD "POST" "t:none" + +##Joomla Com_Fabrik CSV Exploit +SecRule REQUEST_URI "index\.php\?option\=com_fabrik\&c\=import\&view\=import\&filetype\=csv\&table(?:id)?\=1" "id:9000046,phase:1,status:406,t:none,t:urlDecodeUni,t:lowercase,log,deny,chain,msg:'Joomla ComFabrik CSV Exploit'" +SecRule REQUEST_METHOD "^POST$" "t:none" + +## Bad UA Brute +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows; U; Windows NT 5\.1; ru; rv:1\.9\.2\.3\) Gecko\/20100401 Firefox\/3\.6\.3" "id:9000044,phase:2,t:none,log,drop,status:406,chain,msg:'Bad UA :: Brute Force Attempt'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" +##4.9 -WPBrute +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows; U; MSIE 9\.0; WIndows NT 9\.0; en-US\)\)" "id:900122,phase:1,t:none,deny,status:406,msg:'Fake UA :: Used in Wordpress bruteforce'" +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(compatible; MSIE 9\.0; Windows NT 6\.1; WOW64; Trident\/5\.0; SLCC2; Media Center PC 6\.0; InfoPath\.3; MS-RTC LM 8; Zune 4\.7\)" "id:900123,phase:1,t:none,deny,chain,status:406,msg:'Fake UA :: Used in Wordpress bruteforce'" +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php)" +# +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.1; rv:15\.0\) Gecko\/20120716 Firefox\/15\.0a2" "id:900124,phase:1,t:none,deny,chain,status:406,msg:'Fake UA :: Used in Wordpress bruteforce'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php)" +# +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(Windows NT 6\.2; WOW64\) AppleWebKit\/537\.15 \(KHTML, like Gecko\) Chrome\/24\.0\.1295\.0 Safari\/537\.15" "id:900125,phase:1,t:none,deny,chain,status:406,msg:'Fake UA :: Used in Wordpress bruteforce'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php)" +# +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/5\.0 \(compatible; MSIE 9\.0; Windows NT 7\.1; Trident\/5\.0\)" "id:900126,phase:1,t:none,deny,chain,status:406,msg:'Fake UA :: Used in Wordpress bruteforce'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php)" +# +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/(5|6)\.0 \(Windows NT 6\.2; WOW64; rv:16\.0\.1\) Gecko\/20121011 Firefox\/16\.0\.1" "id:900127,phase:1,t:none,deny,chain,status:406,msg:'Fake UA :: Used in Wordpress bruteforce'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php)" + +#osDate RFI +SecRule REQUEST_URI "config(%5B|\[)\S+(%5D|\])=http" "id:9000040,phase:2,t:none,t:urlDecode,t:htmlEntityDecode,t:lowercase,capture,deny,log,msg:'RFI via osDate Forum module'" +#WP-Trackback Spam injection ::Temp +SecRule REQUEST_URI "wp-trackback\.php" "id:9000041,phase:1,t:none,t:urlDecode,t:htmlEntityDecode,t:lowercase,chain,status:406,drop,log,msg:'WP-Trackback Injection Rule'" +SecRule REQUEST_HEADERS:Referer "^http://google.com/$" + +#Sql COMMENT block +SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "(\/\*\!? ?(?:select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe|union|concat|group_concat))" "phase:2,rev:'2.2.2',id:9000042,t:none,t:urlDecodeUni,t:lowercase,deny,msg:'SQL Comment Sequence Detected.',capture,logdata:'%{tx.0}'" + +#Known bad UA +SecRule REQUEST_HEADERS:User-Agent "Mozilla/4\.76 \[en\] \(Win98; U\)" "id:9000038,phase:1,t:none,deny,status:406,log,msg:'Known Exploiting User-Agent :: Not Valid'" +SecRule REQUEST_HEADERS:User-Agent "Chilkat\/1\.\d\.\d \(\+http:\/\/www\.chilkatsoft\.com\/ChilkatHttpUA\.asp\)" "id:9000045,phase:1,t:none,deny,log,msg:'Know BAD User-Agent'" + +SecRule REQUEST_HEADERS:User-Agent "Mozilla\/4\.0 \(compatible; Win32; WinHttp\.WinHttpRequest\.5\)" "id:9000043,t:none,status:406,chain,deny,msg:'Bad UA :: Brute Force Attempt'" +SecRule REQUEST_URI "/(wp-login\.php|administrator/index\.php|xmlrpc\.php)" +#SecRule REQUEST_URI "/wp-login\.php" + +SecRule REQUEST_HEADERS:User-Agent "Mozilla/4\.0 \(compatible; MSIE 8\.0; Windows NT 6\.1; WOW64; Trident/4\.0; SLCC2; \.NET CLR 2\.0\.5.727; \.NET CLR 3\.5.30729; \.NET CLR 3\.0\.30729; Media Center PC 6\.0; MAAR; \.NET4\.0C; \.NET4\.0E; AskTbPTV2/5\.9\.1\.14019\)" "id:9000039,phase:1,t:none,deny,status:406,log,msg:'Known Exploiting User-Agent :: Not Valid'" + +# Wordpress Exploit Comped Pass:: Referer/UA Present +SecRule REQUEST_URI "/(wp-login\.php|toolspack\.php|wp-admin/plugin-install\.php|wp-admin/update\.php|startphp\.php|static\/ajax\.php\?do\=\/ad\/complete\/$)" "id:900036,phase:2,t:none,t:lowercase,log,drop,status:406,chain,msg:'Wordpress BOT exploit :: No UA/Referer'" +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" + +# Wordpress Exploit Comped Pass :: Referer/UA Empty +SecRule REQUEST_URI "/(wp-login\.php|toolspack\.php|wp-admin/plugin-install\.php|wp-admin/update\.php|startphp\.php|static\/ajax\.php\?do\=\/ad\/complete\/$)" "id:9000037,phase:2,t:none,t:lowercase,log,drop,chain,status:406,msg:'Wordpress BOT exploit :: Empty UA/Referer'" +SecRule REQUEST_HEADERS:Referer "^$" chain +SecRule REQUEST_HEADERS:User-Agent "^$" + +##Brobot dvmessages block ::3.20 +Secrule REQUEST_URI "\/dvmessages\.php" "id:900114,phase:2,t:none,status:404,log,deny,msg:'BroBOT dvmessages request'" + + +## Wordpress BruteForce + +# This has to be global, cannot exist within a directory or location clause . . . +SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},initcol:user=%{REMOTE_ADDR},id:900999 +SecCollectionTimeout 900 +<Files wp-login.php> +# Setup brute force detection. +# React if block flag has been set. +#SecRule user:bf_block "@gt 0" "deny,status:401,log,msg:'Wordpress Brute Force 15 attempts in 3 Mins. 5 Min block'" +SecRule user:bf_block "@gt 0" "id:900998,deny,status:406,log,msg:'Wordpress Brute Force 15 attempts in 3 Mins. 5 Min block'" +# Setup Tracking. On a successful login, a 302 redirect is performed, a 200 indicates login failed. +SecRule RESPONSE_STATUS "^302" "id:900997,phase:5,t:none,nolog,pass,setvar:ip.bf_counter=0" +SecRule RESPONSE_STATUS "^200" "id:900996,phase:5,chain,t:none,nolog,pass,setvar:ip.bf_counter=+1,deprecatevar:ip.bf_counter=1/120" +SecRule ip:bf_counter "@gt 20" "t:none,setvar:user.bf_block=1,expirevar:user.bf_block=300,setvar:ip.bf_counter=0" +</Files> + +#Joomla Component OzioGallery WritetoFile block +SecRule REQUEST_URI "/components/com_oziogallery2/imagin/scripts_ralcr/filesystem/writeToFile\.php" "id:900034,rev:1,t:lowercase,severity:2,log,deny,chain,msg:'Joomla Oziogallery2 Block'" +SecRule REQUEST_METHOD "^POST$" "t:none" + +#OFC Upload Vulnerability 9.25 +SecRule REQUEST_URI "/ofc_upload_image\.php\?name\=.*?(\.|%2E)php" "id:900193,phase:1,t:none,t:lowercase,status:406,deny,log,msg:'OFC Upload Exploit :: PHP File Upload Attempt'" +#vB Upgrade ADMIN Injection + +SecRule REQUEST_URI "/install/upgrade\.php" "id:900194,phase:1,t:none,chain,status:406,deny,log,msg:'vB Upgrade Admin Injection'" +SecRule REQUEST_METHOD "POST" chain +SecRule &REQUEST_HEADERS:Referer "@eq 0" chain +SecRule &REQUEST_HEADERS:User-Agent "@eq 0" + +#Joomla Token Reset Request +SecRule REQUEST_URI "\?option\=com_user\&view\=reset\&layout\=confirm" "id:900032,rev:1,t:lowercase,severity:2,log,deny,chain,msg:'Joomla RESET request without refferer'" +SecRule &REQUEST_HEADERS:REFERER "@eq 0" chain +SecRule REQUEST_METHOD "^POST$" "t:none" + + +SecRule REQUEST_URI "\?option\=com_user\&task\=(complete|confirm)reset" "id:900033,rev:1,t:lowercase,severity:2,log,deny,chain,msg:'Joomla RESET request without refferer'" +SecRule &REQUEST_HEADERS:REFERER "@eq 0" chain +SecRule REQUEST_METHOD "^POST$" "t:none" + + + +#TimThumb /cache/ 32 md5sum.php block. +SecRule REQUEST_URI "/cache/(?:external_)?[0-9a-z]{32}\.php" "id:900031,rev:1,t:lowercase,severity:2,log,status:406,deny,msg:'TimThumb Upload CACHE attempt'" + +## Spam Blocking via text file from StopForumSpam +# Prepare custom REMOTE_ADDR variable + + +## Zen-Photo Ajax File Manager Exploit +SecRule Request_URI "/plugins/ajaxfilemanager/ajax_create_folder.php" "log,phase:2,deny,id:9990028,chain,msg:'Ajax File Manager Exploit'" +SecRule &ARGS ^0$ + + +SecRule Request_URI "/class.images.php\?truecss\=1" "log,phase:2,deny,id:9990029,msg:'Ajax File Manager Exploit 2'" +SecRule Request_URI "/date.php\?truecss\=1" "log,phase:2,deny,id:9990030,msg:'Ajax File Manager Exploit 3'" + + + +##sm3 mailer + +SecRule REQUEST_URI "/sm\d\S\S\d\.php" "log,phase:1,deny,id:9990025,msg:'SM3 Mailer'" +SecRule REQUEST_URI "/tmp_\d{16}\.php" "log,phase:1,deny,id:9990027,msg:'OSC Backdoor TMP_number'" +SecRule REQUEST_URI "(?:cookies|showimg|truecss)\=\d&(?:showimg|cookies|truecss)\=\d" "log,phase:1,deny,id:'9990026',msg:'OSCommerce Backdoor Exploit'" + + +##TimThumb Scanning +SecRule REQUEST_URI "/timthumb\.php\?src\=/g0\.\./0d1\.gif" "log,drop,phase:1,t:none,id:999010,msg:'TimThumb Scanning'" + +SecPcreMatchLimit 10000 +SecPcreMatchLimitRecursion 10000 +SecDefaultAction "phase:2,deny,log" + +##Wordpress 1-flash-gallery Uploadify +SecRule REQUEST_URI "/wp-content/plugins/1-flash-gallery/upload\.php\?action\=uploadify&fileext\=php" \ + "id:900020,rev:1,severity:2,status:406,log,deny,msg:'Wordpress 1-Flash-Gallery Uploadify PHP upload'" + +SecRule REQUEST_URI "/wp-content/uploads/fgallery/" \ + "id:900021,rev:1,severity:2,log,deny,status:406,chain,msg:'Wordpress 1-Flash-Gallery Upload Dir POST attempt'" +SecRule REQUEST_METHOD "^POST$" "t:none" + +# Rule 310019: WEB-MISC mod_gzip_status access +SecRule REQUEST_URI "/mod_gzip_status" log,pass,id:900994 + +# Rule 310019: TorrentTrader SQL Injection +SecRule REQUEST_URI "/download\.php" \ + "id:310491,rev:1,severity:2,deny,msg:'JITP: TorrentTrader SQL Injection',chain" +SECRULE ARGS:id "\'" + +#Grumlar GIFIMG simple block. DavidN 4/1 +SecRule REQUEST_URI "gifimg\.php" \ + "id:900009,rev:1,severity:2,deny,msg:'Gumblar GIFIMG '" +# Rule 1234888: Rapidleech. JustinM 5/6 +#SecRequestBodyAccess On +#SecRule REQUEST_BODY "(megaupload|rapidshare|rapidupload|2shared|4shared|depositfiles|hotfile|mediafire|megaporn|megashare|megashares|savefile|sendspace|speedyshare)\.com" \ +# "id:1234888,phase:2,log,deny,msg:'Rapidleech'" +# +#SecRule REQUEST_BODY "rapidshare.de" \ +# "id:1234888,phase:2,log,deny,msg:'Rapidleech'" + +#SecRequestBodyAccess Off + + +#SecRule ARGS:task "confirmreset" "chain,id:1234889,phase:2,log,deny,msg:'Rapidleech1'" +#SecRule REQUEST_BODY "!token=([a-z0-9]{32})" + +#block proc/self/environ requests +#SecRule REQUEST_URI "proc/self/environ" "id:999997,phase:1,log,drop,msg:'proc environ'" +SecRule REQUEST_URI "proc/self/environ" "id:999997,phase:1,t:none,t:lowercase,t:normalisePath,t:urlDecode,log,drop,msg:'proc environ'" +# block r57 and c99shell +SecRule REQUEST_URI "c99\.php|r57shell\.php|r57\.php|c99\.txt" \ + "id:900010,rev:1,phase:1,severity:2,drop,msg:'c99 variant '" + +SecRule REQUEST_URI "concat\(username,0x3a,activation" \ + "id:900011,rev:1,severity:2,deny,msg:'attempted sql injection '" + +SecRule REQUEST_URI "tmp/x-shell" \ + "id:900012,rev:1,severity:2,deny,msg:'attempted tmp/x-shell '" + +SecRule REQUEST_URI "fwriteq\.php\?ipaddr=" \ + "id:900014,rev:1,severity:2,deny,msg:'attempted UDP flood 2'" + +#SecRule REQUEST_HEADERS:User-Agent "Mozilla/4\.76 \[ru] \(X11; U; SunOS 5\.7 sun4u\)" \ +# "log,deny,phase:1,status:403,t:-lowercase,t:-replaceNulls,t:-compressWhitespace,id:000014,rev:1,severity:2,msg:'attempoted e107 exploit '" + +#SecRule REQUEST_HEADERS:User-Agent "Mozila/4\.0\s+\(compatible;\s+MSIE\s+6\.0;\s+Windows\s+NT\s+5\.1;\s+SV1;\s+MyIE2;" \ +# "id:900016,log,drop,rev:1,severity:2,msg:'JITP: 900016 improper Mozilla useragent with MyIE2 osCommerce exploit attempt '" + +#SecRule REQUEST_HEADERS:User-Agent "Mozilla/4\.76 \[ru] \(X11; U; SunOS 5\.7 sun4u\)" \ +# "log,drop,id:000014,rev:1,severity:2,msg:'attempoted e107 exploit '" + +#SecRule REQUEST_HEADERS:User-Agent "Mozila/4\.0\s+\(compatible;\s+MSIE 6\.0;\s+Windows\s+NT\s+5\.1;\s+SV1;\s+MyIE2;" \ +# "id:900016,phase:1,log,drop,severity:2,msg:'JITP: 900016 improper Mozilla useragent with MyIE2 osCommerce exploit attempt '" + + + +### ZEN + + +SecRule REQUEST_URI "/(admin|banner_manager|product|sqlpatch|define_pages_editor|orders|record_company)\.php/password_forgotten\.php" \ + "log,deny,t:none,t:urlDecodeUni,t:lowercase,t:replaceNulls,t:compressWhiteSpace,id:320757,rev:4,severity:2,msg:'Atomicorp.com WAF Rules - Virtual Patch: ZenCart Sql Injection Exploit',logdata:'%{TX.0}'" + + + +SecRule REQUEST_HEADERS:User-Agent "Mozilla/4\.76 \[ru] \(X11; U; SunOS 5\.7 sun4u\)" \ + "log,drop,id:000014,rev:1,status:406,severity:2,msg:'attempoted e107 exploit '" + + +SecRule REQUEST_HEADERS:User-Agent "Mozila/4\.0 \(compatible;\s+MSIE 6\.0;\s+Windows NT 5\.1;\s+SV1; MyIE2;" \ + "id:900016,log,deny,phase:2,rev:1,status:406,severity:2,msg:'JITP: 900016 improper Mozilla useragent with MyIE2 osCommerce exploit attempt '" + +SecRule REQUEST_HEADERS:User-Agent "@beginsWith ZWNobyAiSXQgV29ya3MiO" \ + "id:900017,log,deny,phase:1,rev:1,severity:2,msg:'JITP: 900017 Base64 Useragent TEST'" + +SecRule REQUEST_HEADERS:User-Agent "@contains file_get_contents" \ + "id:900018,log,deny,phase:1,rev:1,t:base64Decode,severity:2,msg:'JITP: 900018 Base64 Useragent TEST'" + + +#SecRule REQUEST_HEADERS:User-Agent "@pmFromFile bad_robots.txt" \ +# "phase:1,rev:'2.2.0',t:none,deny,msg:'Rogue web site crawler',id:'900019',tag:'AUTOMATION/MALICIOUS',logdata:'%{TX.0}',setvar:'tx.msg=%{rule.msg}',setvar:tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var}" + +#SecRule REQUEST_HEADERS:User-Agent "@pm User-Agent" \ +# "id:900019,log,deny,phase:1,rev:1,severity:2,msg:'Fake User-Agent String'" + +#SecRule REQUEST_URI "/wp-admin" "nolog,phase:1,allow" + +#SecRule REQUEST_URI "/wp-login.php" "nolog,phase:1,allow" + +SecRule REQUEST_URI "redirect/cl2.php" "nolog,phase:1,allow,id:900993" + +#SecRule REQUEST_URI "timthumb.php" "nolog,phase:1,allow" + + + +#SecRule ARGS "(?:ht|f)tps?://(([a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+(?:[A-Z]{2}|com|org|net|edu|gov|mil|biz|info|mobi|name|aero|asia|jobs|museum))/?.*" \ +# "chain,phase:2,t:none,t:htmlEntityDecode,t:lowercase,capture,deny,log,msg:'Remote File Inclusion Attack'" +# SecRule REQUEST_HEADERS:Host "!@streq %{tx.1}" + + +# 1234234 RFI Injection +#SecRule ARGS "(?:ht|f)tps?://(([a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+(?:[a-z]{2}|com|org|net|edu|gov|mil|biz|info|mobi|name|aero|asia|jobs|museum))/?.*" "id:1234234,phase:2,t:none,t:htmlEntityDecode,t:lowercase,capture,deny,log,msg:'JITP:1234234',chain" +SecRule ARGS "(?:ht|f)tps?://((?:[a-zA-Z0-9-]*[:|@]?[\w\d]*@)?(([a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+(?:com|org|net|edu|gov|mil|biz|info|mobi|name|aero|asia|jobs|museum|[a-zA-Z]{2})?))/?.*" "id:1234234,phase:2,t:none,t:htmlEntityDecode,t:urlDecode,t:lowercase,capture,deny,log,msg:'JITP:1234234-RFI-%{matched_var_name}=%{tx.2}',chain" +SecRule REQUEST_HEADERS:Host "!@streq %{tx.2}" chain +SecRule REQUEST_FILENAME|REQUEST_URI "!(/wp-content/plugins/one-click-plugin-updater)|(/wp-content/plugins/mapquest-map-builder/tinymce/callback.htm)|(www/delivery/ajs.php)|(www/admin/dashboard.php)|(/pl/download\?file=http|/index\.php/admin/system_config/save/section/payment/|^/b/ss/mxmacromedia|^/mysqldumper/dump\.php$|(?:jw_allvideos_player|mod_mp3player)\?(?:file|playlist)=http|^/xmlrpc\.php$|^/__utm.gif\?|^/go\.php\?u=affilorama&t=http://|/imp/compose\.php|/tiki-(?:objectpermissions|editpage)|/cowadmin/editor/.*/editor|index\.php\?url=|aardvarkts/install/index|/do_command|banner_click|wp-login|tiki-view_cache|/horde/index|/horde/services/go|/goto|gallery2?/main|ad-?server/adjs|signup\.php|calendar/index\.php\?act=calendar&code=edit&cal_id=.*&event_id=|cgi-bin/stats\.cgi\?id=shop&loc=http://|/ubbthreads/ubbthreads\.php|/plugin_jw_allvideos/jw_allvideos_player\.swf\?file=http://|/wimpy\.php\?action=serveMP3&theFile=http://|/lg\.php\?bannerid=.*&campaignid=.*loc=http://|\?mode=addshout|\?feed=http://|/joomla15_2/administrator/index\.php|/wp-admin/(page|post|widgets|link|options)\.php|/batch\.html\.php\?code=http|/media-upload\.php|/admin-ajax\.php|/administrator/index2?\.php|/mt-(upgrade|wizard)\.cgi\?|/email-a-friend\.php|/cgi-bin/PManage/pmanage\.cgi|ubbthreads/admin/dofeatures\.php|cgi-bin/(?:inforx|wwiinfo|mvforms)\.(?:pl|cgi)|/admin/(?:edittemplate|webpage_update)\.php|/(?:cpinquiry|signup|profile)\.php|/catalog/secure_admin/categories\.php|plugins/unique_articles/add_article\.php|/images/banners/.*\.swf\?.*url=http://|/frame\.aspx\?u=http://|/index\.php\?sc=track&action=.*&cur=http://|/mynav\?right_frame=http://|/phpBB/install/install\.php|/count\.asp\?w=.*&r=http://|frontend/x3/|thumbnail.php)" + + + +SecRule REQUEST_URI "tiny_?mce/plugins/tinybrowser/upload(_file)?\.php\?(\S+?\=\S+?)?(\&|\?type\=\S+?&)?folder" "id:999991, phase:2,t:none,t:htmlEntityDecode,t:lowercase,capture,deny,log,msg:'JITP:TinyMCE Upload'" +SecRule REQUEST_URI "index\.php\?/component/option,com_jdownloads/Itemid,[0-9]*/task,view.upload/" "id:999992, phase:2,t:none,t:htmlEntityDecode,t:lowercase,capture,deny,log,msg:'JITP:jDownloads RFI Vuln'" +SecRule REQUEST_URI "arotoss.php.orion" "id:999993, phase:2,t:none,deny,log,msg:'JIT:WebOrb Shell'" + + +# UDP Flood Script Prevent +#SecRule Request_URI "php\?(host|ip)=([0-9]{1,3}\.){3}[0-9]{1,3}(&port=[0-9]+)?(&time=[0-9]+)" "id:gatorattack1,rev:1,severity:2,msg:'JITP:gatorattack1'" +SecRule Request_URI "(?:\?|&)(?:host|ip|target)=(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:&port=[0-9]+|&time(?:out)?=[0-9]+){2}" "id:900056,rev:1,severity:2,drop,msg:'JITP:gatorattack1'" +SecRule Request_URI "(?:\?|&)(?:port|time|exit)\=\d+(?:\?|\&)(?:port|time)\=\d+(?:\?|\&)(?:host|ip|target|http)=(?:[0-9]{1,3}\.){3}[0-9]{1,3}" "id:900062,rev:1,severity:2,drop,msg:'JITP:gatorattack2'" +#SecRule Request_URI "(?:\?|&)(?:(?:host|ip|target|port|time)=[0-9\.]+(?:\?|\&)?)+" "id:900056,rev:1,severity:2,drop,msg:'JITP:gatorattack1'" +##### + + +# 1235235 New OS Commerce (file_manager\.php|categories\.php|administrators\.php|banner_manager\.php|define_language\.php) exploit prevention +SecRule Request_URI "admin\/(?:file_manager|categories|orders|admin_members|administrators|banner_manager|define_language|manufacturers|backup|configuration|modules|orders)\.php\/login(_admin)?\.php" "id:1235235,phase:1,deny,t:none,t:htmlEntityDecode,t:lowercase,capture,deny,log,msg:'JITP:1235235 OS Commerce Protection'" +#SecRule USERID "!^[a-zA-Z0-9_]+$" + + + + +# 1235236 block password_forgotten.php exploit +SecRule Request_URI "(password_forgotten|cookie_usage)\.php\?((cookies|showimg)\=1)+(language\=[a-z]{1,7})?(?:&(cookies|showimg)\=1)*" "id:1235236,log,deny,phase:1,status:403,t:-lowercase,t:-replaceNulls,t:-compressWhitespace,rev:1,severity:2,msg:'JITP: 1235236 osCommerce password_forgotten exploit attempt '" + +# 9993339 sql.php SQL Hacking Tool +SecRule REQUEST_URI "/sql.php\?action\=(logon|listdb)" "id:999333,deny,t:none,t:lowercase,phase:2,rev:1,severity:2,msg:'SQL.php Exploit'" + +# 1236236 New OS Commerce (file_manager\.php|categories\.php|administrators\.php|banner_manager\.php|define_language\.php) ?action=processuploads exploit prevention +#SecRule Request_URI "admin\/(?:file_manager\.php|categories\.php|administrators\.php|banner_manager\.php|define_language\.php)\/login\.php\?action=processuploads" "id:1236236,phase:2,t:none,t:htmlEntityDecode,t:lowercase,capture,setuid:%{REMOTE_USER},deny,log,msg:'JITP:1236236',chain" +#SecRule USERID "!^[a-zA-Z0-9_]+$" + + +# 1236245 OS Commerce define_language.php exploit prevention +#SecRule Request_URI "admin\/define_language\.php\/login\.php\?filename=cookie_usage\.php&action=save" "id:1236245,phase:2,t:none,t:htmlEntityDecode,t:lowercase,capture,setuid:%{REMOTE_USER},deny,log,msg:'JITP:1236245',chain" +#SecRule USERID "!^[a-zA-Z0-9_]+$" + + +SecRule REQUEST_URI "(?:showimg\=1)?(?:language\=([a-z]{1,7})&lang\=\1&lng\=\1)(?:&(cookies|showimg)\=1)+" "id:999811,phase:2,t:none,t:lowercase,capture,rev:1,severity:4,msg:'OSCommerce Language Sessions Exploit attempt'" + + + +SecRule REQUEST_URI "/mass.php" "id:999110,deny,phase:2,rev:1,severity:2,msg:'Possible Mass Defacer Request'" + + +#SecRule REQUEST_URI "/xmlrpc\.php" "id:900238,chain,phase:1,deny,status:406,log,msg:'JetPack XMLRPC Attempt for NonAutomatic Host'" +#SecRule ARGS:for "jetpack" "t:none,t:lowercase,chain" +#SecRule REMOTE_ADDR "!@rx (?:66\.135\.48\.(?:12[89]|1[3-9][0-9]|2[0-4][0-9]|25[0-5])|76\.74\.248\.(?:12[89]|1[3-9][0-9]|2[0-4][0-9]|25[0-5])|76\.74\.25[45]\.(?:12[0-8]|1[0-1][0-9]|0?[0-9]?[0-9])|216\.151\.209\.(?:12[0-7]|1[01][0-9]|0?[7-9][0-9]|0?6[4-9])|216\.151\.210\.(?:12[0-8]|1[0-1][0-9]|0?[0-9]?[0-9])|207\.198\.101\.(?:12[0-8]|1[0-1][0-9]|[0-9]?[0-9])|209\.15\.21\.\d+|66\.135\.58\.(?:[6][0-3]|[45][0-9]|3[0-9])|216\.152\.133\.1(?:[3-8][0-9]|2[89]|9[01])|69\.174\.248\.(?:12[0-8]|1[0-1][0-9]|[0-9]?[0-9])|192\.0\.(?:6[4-9]|7[01])\.\d+|66\.155\.(?:1[01]|[89])\.\d+|192\.0\.(?:9[0-5]|8[0-9])\.\d+|192\.185\.1\.20)" + + +SecRule Request_URI "/fckeditor/editor/filemanager/connectors/test\.html" "id:999009,deny,phase:2,rev:1,severity:2,msg:'Fckeditor exploit'" + +SecRule REQUEST_URI "/uploadify/uploadify\.php\?fileext=(?:php|cl|cgi)" "id:999050,deny,phase:2,rev:1,severity:2,msg:'Uploadify Exploit'" + +#TESTING RULE ... uncomment and go to domain.com/fordtest.php +#while tailing /usr/local/apache/logs/error_log to ensure mod_sec is working +#SecRule REQUEST_URI "fordtest\.php" \ +#"id:900015,rev:1,severity:2,msg:'attempted path traversal'" + +SecRule REQUEST_URI "/password_forgotten\.php" \ + "log,deny,auditlog,t:urlDecodeUni,t:lowercase,chain,id:390637,rev:1,severity:2,msg:'Atomicorp.com WAF Rules - Virtual Patch: Zencart PHP code injection attack'" +SecRule ARGS:action "^insert$" chain +SecRule ARGS|REQUEST_BODY "(php|;+|shell_exec|wget|system\()" + +#/index.php?main_page=conditions//admin/record_company.php/password_forgotten.php?action=insert +SecRule REQUEST_URI "/password_forgotten\.php" \ + "log,deny,auditlog,t:none,t:urlDecodeUni,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,t:lowercase,t:compressWhiteSpace,t:lowercase,chain,id:390638,rev:1,severity:2,msg:'Atomicorp.com WAF Rules - Virtual Patch: Zencart PHP code injection attack'" +SecRule ARGS:admin_email "(union select|php|;+|shell_exec|wget|system\()" + +#SecRule REQUEST_URI "/_?#?(?:(?:p(?:ma_?(?:bd)?)?(?:hp)?)?\d?)?(?:mya?d?)?(?:sql)?\d?_?-?(?:php(?:as)?)?(?:db)?(?:(database)?ad?mm??i?n?s?(?:istrator)?(?:\.old)?)?-?_?(?:(?:(?:\d\.?){1,5})?-?(?:pl\d?|rc\d?|beta\d?)?)/scripts/setup\.php" +SecRule REQUEST_URI "/_?#?(?:(?:p(?:ma_?(?:bd)?)?(?:hp)?)?\d?)?-?(?:mya?d?)?(?:sql)?\d?_?-?(?:php(?:as)?)?(?:db)?(?:(database)?ad?mm??i?n?s?(?:istrator)?(?:\.old)?)?-?_?(?:(?:(?:\d\.?){1,5})?-?(?:pl\d?|rc\d?|beta\d?)?)/(scripts/setup|config/config\.inc)\.php" \ + "id:999995,log,drop,auditlog,t:lowercase,phase:1,rev:2,severity:4,msg:'PHPMyadmin Script Attack'" + +SecRule REQUEST_URI "/connectors/php/(?:config|connector)\.php\?Command=FileUpload&CurrentFolder=" "id:998001,deny,phase:2,rev:1,severity:2,msg:'TinyMCE Upload Vuln'" + +### Tell a Friend ### +SecRule REQUEST_URI "/index.php\?act=taf" "id:999111,deny,phase:2,rev:1,msg:'CubeCart TAF Block'" +SecRule REQUEST_URI "/(?:tell|email)(?:-|a)?friend\.php" "id:999112,deny,phase:2,rev:1,msg:'Generic TAF Block'" +SecRule REQUEST_URI "/do.taf.php" "id:999113,deny,phase:2,rev:1,msg:'Generic TAF Block'" + + +##Logging Com_JCE +SecRule request_uri "index\.php\?option\=com_jce\&task\=plugin\&plugin\=imgmanager\&file\=imgmanager" "id:900190,phase:1,t:none,t:urlDecode,t:lowercase,pass,log,chain,msg:'JCE Access Attempt'" +SecRule REQUEST_METHOD "^POST$" "t:none" + + +SecRule REQUEST_FILENAME "\.php[456]?_?\d?\.(asf|asx|avi|bmp|gif|ico|jpe|jpeg|jpg|png|tif|tiff|wax|wmv|wmx)$" "id:900055,deny,status:412,log,msg:'Fake Image Extension'" + +## Wordpress File-Manager / PHPFM Exploit 8.10.2011 +SecRule REQUEST_URI "/incl/upload\.inc\.php\?allowupload\=1&upload\=1" "id:998002,deny,phase:1,t:none,t:lowercase,rev:1,severity:2,msg:'WP-FileManager - PHPFM Upload Exploit'" + +## TimThumb Vulnerability with stock whitelist exceptions. +##SecRule TX:2 "!@endsWith [^a-zA-Z]?blogger.com" chain +<LocationMatch /(tim)?thumb.php> +SecRuleRemoveById 1234234 +SecRule ARGS "(?:ht|f)tps?://((?:[a-zA-Z0-9-]*[:|@]?[\w\d]*@)?(([a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+(?:com|org|net|edu|gov|mil|biz|info|mobi|name|aero|asia|jobs|museum|[a-zA-Z]{2})?))/?.*" "id:1234234,phase:2,t:none,t:htmlEntityDecode,t:urlDecode,t:lowercase,capture,deny,log,msg:'JITP:1234234A-RFI-%{matched_var_name}=%{tx.2}',chain" +SecRule REQUEST_HEADERS:Host "!@streq %{tx.2}" chain +SecRule TX:2 "!@endsWith [^a-zA-Z]?(imgur|flickr|staticflickr|picasa|photobucket|img\.youtube|wordpress|www\.flickr)\.com|imageshack\.us|upload\.wikimedia\.org" +#SecRule TX:2 "!@endsWith [^a-zA-Z]?flickr.com" chain +#SecRule TX:2 "!@endsWith [^a-zA-Z]?staticflickr.com" chain +#SecRule TX:2 "!@endsWith [^a-zA-Z]?picasa.com" chain +#SecRule TX:2 "!@endsWith [^a-zA-Z]?imgur.com" chain +#SecRule TX:2 "!@endsWith [^a-zA-Z]?flickr.com" chain +#SecRule TX:2 "!@endsWith [^a-zA-Z]?imageshack.us" chain +#SecRule TX:2 "!@endsWith [^a-zA-Z]?wordpress.com" chain +#SecRule TX:2 "!@endsWith [^a-zA-Z]?img.youtube.com" chain +#SecRule TX:2 "!@endsWith [^a-zA-Z]?photobucket.com" chain +#SecRule TX:2 "!@endsWith [^a-zA-Z]?upload.wikimedia.org" +</LocationMatch> + + +## s2memeber exceptions +<LocationMatch /\?ws_plugin__s2member.*> +SecRuleRemoveById 350147 +SecRuleRemoveById 340147 +SecRuleRemoveById 340149 +SecRuleRemoveById 340102 +</LocationMatch> + +#8.18.2011 Joomla 1.5.14 or less images/stories/ block +SecRule Request_URI "/images/stories/\S+?\.php(\d*?\.\S*)?" "id:'999250',phase:2,t:none,t:urlDecodeUni,t:replaceNulls,t:replaceComments,t:compressWhiteSpace,log,chain,drop,msg:'Joomla Images/Stories Exploit'" +SecRule Request_URI "!^/index.php/" + +<LocationMatch /wp-comments-post.php> +SecRequestBodyAccess On +SecRequestBodyLimitAction ProcessPartial +#SecRuleInheritance Off +###SecRule ARGS_POST "\s*(mclude|mfunc|dynamic-cached-content)\s*-+>" "id:900137,log,deny,status:406,msg:'w3tc and supercache RCE Exploit'" +SecRule ARGS_POST "\s*(mclude|mfunc|dynamic-cached-content)\s*(?:-|\?)+>" "id:900137,log,t:none,t:lowercase,deny,status:406,msg:'w3tc and supercache RCE Exploit-Matched:%{matched_var}'" +SecRuleRemoveById 1234234 +SecRuleRemoveById "300000–399999" +</LocationMatch> +secrule ARGS_POST "TABLEJOIN" "id:89006,status:406,t:none,t:urldecode,deny,msg:'WHMCS TableJOIN Exploit Attempt'" + +<LocationMatch /c(art|lientarea)\.php> +SecRequestBodyAccess On +SecRequestBodyLimitAction ProcessPartial +SecRuleRemoveById 1234234 +</LocationMatch> + +<LocationMatch /view(ticket|quote|email)\.php> +SecRequestBodyAccess On +SecRequestBodyLimitAction ProcessPartial +SecRuleRemoveById 1234234 +</LocationMatch> + + +<LocationMatch /su(bmitticket|pporttickets)\.php> +SecRequestBodyAccess On +SecRequestBodyLimitAction ProcessPartial +SecRuleRemoveById 1234234 +</LocationMatch> + + +#<LocationMatch /clientarea\.php> +#SecRequestBodyAccess On +#SecRequestBodyLimitAction ProcessPartial +#SecRule ARGS "@beginsWith AES_ENCRYPT" "id:900196,status:406,deny,log,msg:'WHMCS SQL Injection Attempt AES_ENCYPT'" +#</LocationMatch> +SecRequestbodyAccess Off +# + +<LocationMatch /wp/v2/> +SecRequestBodyAccess On +# This catches GET and urlencoded-POST parameters +SecRule REQUEST_URI "@rx wp/v2/[\w_-]+/\d+" "phase:2,log,deny,status:406,msg:'Prohibited',chain,id:900502" +SecRule ARGS:id "!@rx ^\d+$" "t:none" +# This catches JSON POST parameters +SecRule REQUEST_URI "@rx wp/v2/[\w_-]+/\d+" "phase:1,log,deny,status:406,msg:'Prohibited',chain,id:900501" +SecRule REQUEST_HEADERS:Content-Type "application/json" "t:none,t:lowercase,ctl:requestBodyProcessor=JSON,chain" +SecRule ARGS:id "!@rx ^\d+$" "t:none" +SecRequestbodyAccess Off +</LocationMatch> + +# WP Cherry Plugin Exploit - Unrestricted File Upload +# https://github.com/CherryFramework/cherry-plugin/issues/6 +# 20170203 +SecRule REQUEST_URI "/wp-content/plugins/cherry-plugin/admin/import-export/upload.php" "id:900503,phase:1,deny,chain,status:406,msg:'WP Cherry Plugin Exploit'" +SecRule REQUEST_METHOD "POST" "t:none" + +# XM1RPC SEO Spam Campaign +# https://blog.sucuri.net/2016/11/xm1rpc-spam-backdoor.html +# 20170203 +SecRule REQUEST_URI "/xm1rpc.php" "id:900504,t:none,phase:1,chain,log,deny,status:406,msg:'Block Backdoor Access FAKE WP File'" +SecRule REQUEST_METHOD "POST" "t:none" [0m [0;32minfo: FileBucket got a duplicate file {md5}d41d8cd98f00b204e9800998ecf8427e[0m [0;32minfo: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/modsec/modsec2.user.conf]: Filebucketed /etc/apache2/conf.d/modsec/modsec2.user.conf to puppet with sum d41d8cd98f00b204e9800998ecf8427e[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/modsec/modsec2.user.conf]/content: content changed '{md5}d41d8cd98f00b204e9800998ecf8427e' to '{md5}5166027b74789bf2238454fb7b3b5028'[0m [0;36mnotice: /Stage[main]/Cpanel::Easyapache4/File[/etc/apache2/conf.d/modsec/modsec2.user.conf]/mode: mode changed '0600' to '0644'[0m [0;36mnotice: /Stage[main]/Cpanel-sl/Lve[clamscan_user]/pmem: pmem changed '2048M' to '2.0G'[0m [0;36mnotice: /Stage[main]/Cpanel-sl/Lve[clamscan_user]/vmem: vmem changed '4096M' to '4.0G'[0m [0;36mnotice: /Stage[main]/Cpanel-sl/Lve[pkgacct_user]/pmem: pmem changed '1024M' to '1.0G'[0m [0;36mnotice: /Stage[main]/Cpanel-sl/Lve[pkgacct_user]/vmem: vmem changed '2048M' to '2.0G'[0m [0;36mnotice: Finished catalog run in 629.58 seconds[0m 08-06-2018 16:42:02 : 3202 : Installing alt-python and alt-ruby packages 08-06-2018 16:42:02 : 3202 : Installing attracta in the background 08-06-2018 16:42:02 : 3202 : Exiting post_ea4_install function 08-06-2018 16:42:02 : 3202 : Inside rebuild_and_restart Built /etc/apache2/conf/httpd.conf OK Starting httpd: [Fri Jun 08 16:42:22.534389 2018] [so:warn] [pid 763359:tid 140049408255968] AH01574: module remoteip_module is already loaded, skipping [Fri Jun 08 16:42:22.537232 2018] [so:warn] [pid 763359:tid 140049408255968] AH01574: module version_module is already loaded, skipping [Fri Jun 08 16:42:22.578021 2018] [so:warn] [pid 763359:tid 140049408255968] AH01574: module lsapi_module is already loaded, skipping AH00112: Warning: DocumentRoot [/home/karyanao/public_html/images/icon] does not exist AH00112: Warning: DocumentRoot [/home/mokeubtt/public_html/webmart] does not exist AH00112: Warning: DocumentRoot [/home/karyanao/public_html/images/2] does not exist [ OK ] Starting haproxy: [ OK ] Shutting down system logger: [ OK ] Starting system logger: [ OK ] 08-06-2018 16:42:31 : 3202 : Exiting rebuild_and_restart function 08-06-2018 16:42:31 : 3202 : Inside notify_hipchat % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 153 0 159 --:--:-- --:--:-- --:--:-- 159 0 80 0 80 0 153 65 126 --:--:-- 0:00:01 --:--:-- 0 0 80 0 80 0 153 65 126 --:--:-- 0:00:01 --:--:-- 0 {"event":"success","description":"event successfully queued to the event queue"} % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 161 0 118 --:--:-- 0:00:01 --:--:-- 118 0 0 0 0 0 161 0 97 --:--:-- 0:00:01 --:--:-- 0 08-06-2018 16:42:33 : 3202 : Exiting notify_hipchat function