# SPDX-License-Identifier: AGPL-3.0-only
# The same 301 lines, when the client identifies itself: a crawler
# linking its documentation (+http://), Google, a prefetch proxy, a
# mail client loading remote content. CrowdSec expressed this as a
# negative UA filter; RE2 has no negative match, so the exclusion is a
# parser matching the BENIGN case with weight -1 in the rule — the
# http-static-miss trick again. A self-identified crawler collecting
# redirects nets to zero; whoever hides does not.
# Uptime monitors (Uptime-Kuma, UptimeRobot, Pingdom, StatusCake…) poll
# an http:// URL every minute and never follow the 301: thirty in half an
# hour, the redirect-crawler's exact shape — a customer's own monitor
# banned (seen 2026-08-19). Named here so they weigh nothing.
parser: http-301-bot
log: http
prefilter: '" 301 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?[^ "]*)? [^"]*" 301 \d+ "[^"]*" "(?P<ua>[^"]*(?i:\+https?://|google|prefetch proxy|outlook|thunderbird|uptime|monitor|pingdom|statuscake|site24x7|hetrixtools|freshping|updown\.io|checkly|zabbix|nagios|icinga|betterstack|cron-job|solarwinds|observability|datadog|newrelic|synthetic)[^"]*)"$'
time_field: time
time_format: nginx
