Country Code (CC) in custom regex ?

[jmginer]

Hello, it's possible to read the country code in a the customer regex?

In my case, I want to block xmlrpc attacks on all countries except spain.

Something like this will run?


if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) and ($cc != ES) \/xmlrpc\.php.*" /)) {
return ("xmlrpc attack",$1,"xmlrpc","20","80,443","3600");
}

Thanks!

[Sergio]

Unfortunately you didn't wrote a log line to check your rule.
But you can check if your rule is working using regex101.com

Sergio