# Fail2Ban filter: fake-Googlebot User-Agent, adapted for Apache's
# vhost-first "fail2ban" LogFormat (see apache-notes/apache-logformat.md).
#
# Install as: /etc/fail2ban/filter.d/apache-vhost-fakegooglebot.conf
#
# A UA containing "Googlebot/" is not proof of Google, since the string is
# copy-pasteable. This filter only flags the pattern; the matching jail's
# `ignorecommand` (the stock fail2ban-shipped
# filter.d/ignorecommands/apache-fakegooglebot script) does the actual
# reverse-DNS confirmation and tells fail2ban not to ban when the IP really
# does resolve back to a *.google(bot).com host. Without that ignorecommand
# wired up on the jail, this filter would ban genuine Googlebot too.
#
# Expected log line (same vhost-first format as apache-vhost-wp-probe.conf):
#
#   [13/Sep/2026:02:48:46 -0500] wolfstream.com:443 66.249.66.1 - - "GET / HTTP/1.1" 200 3239 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
#
# The stock filter anchors `^<HOST>` at the very start; that breaks once a
# vhost:port field is inserted ahead of it. Fix: skip one leading vhost:port
# token. The stock filter has no end anchor, so the trailing Host-header/%D
# fields this LogFormat appends are already ignored without any change.

[Definition]

datepattern = ^\[%%d/%%b/%%Y:%%H:%%M:%%S %%z\]

failregex = ^\s*\S+ <HOST> \S+ \S+ "[A-Z]+ /\S* [^"]*" \d+ \d+ \"[^"]*\" "[^"]*\bGooglebot/[^"]*"

ignoreregex =