id: favicon-detect

info:
  name: favicon-detection
  author: un-fmunozs,DhiyaneshDk,idealphase
  severity: info
  reference:
    - https://twitter.com/brsn76945860/status/1171233054951501824
    - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
    - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
    - https://github.com/devanshbatham/FavFreak
    - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
  metadata:
    max-request: 2
  tags: tech,favicon

http:
  - method: GET
    path:
      - "{{BaseURL}}/favicon.ico"
      - "{{BaseURL}}/images/favicon.ico"

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        name: "proxmox"
        dsl:
          - "status_code==200 && (\"213144638\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "blogger"
        dsl:
          - "status_code==200 && (\"-503480258\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "oracle"
        dsl:
          - "status_code==200 && (\"1414300307\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hitachi"
        dsl:
          - "status_code==200 && (\"92627686\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hitachi-management"
        dsl:
          - "status_code==200 && (\"94231047\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "meinberg"
        dsl:
          - "status_code==200 && (\"-676779906\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "slack-instance"
        dsl:
          - "status_code==200 && (\"99395752\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "spring-boot"
        dsl:
          - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "cnservers-llc"
        dsl:
          - "status_code==200 && (\"-235701012\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian"
        dsl:
          - "status_code==200 && (\"743365239\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "chainpoint"
        dsl:
          - "status_code==200 && (\"2128230701\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lacie"
        dsl:
          - "status_code==200 && (\"-1277814690\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "parse"
        dsl:
          - "status_code==200 && (\"246145559\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian"
        dsl:
          - "status_code==200 && (\"628535358\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jira"
        dsl:
          - "status_code==200 && (\"855273746\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "avigilon"
        dsl:
          - "status_code==200 && (\"1318124267\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-confluence"
        dsl:
          - "status_code==200 && (\"-305179312\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openstack"
        dsl:
          - "status_code==200 && (\"786533217\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "pi-star"
        dsl:
          - "status_code==200 && (\"432733105\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian"
        dsl:
          - "status_code==200 && (\"705143395\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "angular-io-angularjs"
        dsl:
          - "status_code==200 && (\"-1255347784\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "xampp"
        dsl:
          - "status_code==200 && (\"-1275226814\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "react"
        dsl:
          - "status_code==200 && (\"-2009722838\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-jira"
        dsl:
          - "status_code==200 && (\"981867722\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openstack"
        dsl:
          - "status_code==200 && (\"-923088984\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "aplikasi"
        dsl:
          - "status_code==200 && (\"494866796\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubiquiti-aircube"
        dsl:
          - "status_code==200 && (\"1249285083\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-bamboo"
        dsl:
          - "status_code==200 && (\"-1379982221\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "exostar-managed-access-gateway"
        dsl:
          - "status_code==200 && (\"420473080\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-confluence"
        dsl:
          - "status_code==200 && (\"-1642532491\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cisco-meraki"
        dsl:
          - "status_code==200 && (\"163842882\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "archivematica"
        dsl:
          - "status_code==200 && (\"-1378182799\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tcn"
        dsl:
          - "status_code==200 && (\"-702384832\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cx"
        dsl:
          - "status_code==200 && (\"-532394952\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ace"
        dsl:
          - "status_code==200 && (\"-183163807\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-jira"
        dsl:
          - "status_code==200 && (\"552727997\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netdata"
        dsl:
          - "status_code==200 && (\"1302486561\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "opengeo-suite"
        dsl:
          - "status_code==200 && (\"-609520537\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dgraph-ratel"
        dsl:
          - "status_code==200 && (\"-1961046099\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-jira"
        dsl:
          - "status_code==200 && (\"-1581907337\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "material-dashboard"
        dsl:
          - "status_code==200 && (\"1913538826\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "form.io"
        dsl:
          - "status_code==200 && (\"1319699698\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kubeflow"
        dsl:
          - "status_code==200 && (\"-1203021870\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netdata-dashboard"
        dsl:
          - "status_code==200 && (\"-182423204\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "caprover"
        dsl:
          - "status_code==200 && (\"988422585\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wijungle"
        dsl:
          - "status_code==200 && (\"2113497004\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "onera"
        dsl:
          - "status_code==200 && (\"1234311970\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "smartping"
        dsl:
          - "status_code==200 && (\"430582574\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openstack"
        dsl:
          - "status_code==200 && (\"1232596212\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netdata-dashboard"
        dsl:
          - "status_code==200 && (\"1585145626\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fritz!box"
        dsl:
          - "status_code==200 && (\"-219752612\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubiquiti-airos"
        dsl:
          - "status_code==200 && (\"-697231354\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fortinet-forticlient"
        dsl:
          - "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "outlook-web-application"
        dsl:
          - "status_code==200 && (\"1768726119\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "huawei-claro"
        dsl:
          - "status_code==200 && (\"2109473187\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "asus-aicloud"
        dsl:
          - "status_code==200 && (\"552592949\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sonicwall"
        dsl:
          - "status_code==200 && (\"631108382\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "google"
        dsl:
          - "status_code==200 && (\"708578229\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "plesk"
        dsl:
          - "status_code==200 && (\"-134375033\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dahua-storm-ip-camera"
        dsl:
          - "status_code==200 && (\"2019488876\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "huawei-adsl -router"
        dsl:
          - "status_code==200 && (\"-1395400951\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sophos-cyberoam-appliance"
        dsl:
          - "status_code==200 && (\"1601194732\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lancom-systems"
        dsl:
          - "status_code==200 && (\"-325082670\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "plesk"
        dsl:
          - "status_code==200 && (\"-1050786453\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tilginab-homegateway"
        dsl:
          - "status_code==200 && (\"-1346447358\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "supermicro-intelligent-management-ipmi"
        dsl:
          - "status_code==200 && (\"1410610129\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zyxel-zywall"
        dsl:
          - "status_code==200 && (\"-440644339\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dell-sonicwall"
        dsl:
          - "status_code==200 && (\"363324987\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubiquiti-login-portals"
        dsl:
          - "status_code==200 && (\"-1446794564\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sophos-user-portal"
        dsl:
          - "status_code==200 && (\"1045696447\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "apache-tomcat"
        dsl:
          - "status_code==200 && (\"-297069493\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openvpn"
        dsl:
          - "status_code==200 && (\"396533629\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cyberoam"
        dsl:
          - "status_code==200 && (\"1462981117\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "asp.net-favicon"
        dsl:
          - "status_code==200 && (\"1772087922\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "technicolor"
        dsl:
          - "status_code==200 && (\"1594377337\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vodafone-technicolor"
        dsl:
          - "status_code==200 && (\"165976831\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubnt-router-ui"
        dsl:
          - "status_code==200 && (\"-1677255344\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "intelbras-wireless"
        dsl:
          - "status_code==200 && (\"-359621743\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kerio-connect-webmail"
        dsl:
          - "status_code==200 && (\"-677167908\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "big-ip"
        dsl:
          - "status_code==200 && (\"878647854\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "microsoft-owa"
        dsl:
          - "status_code==200 && (\"442749392\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "pfsense"
        dsl:
          - "status_code==200 && (\"1405460984\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ikuai-networks"
        dsl:
          - "status_code==200 && (\"-271448102\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dlink-webcam"
        dsl:
          - "status_code==200 && (\"31972968\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "3cx-phone-system"
        dsl:
          - "status_code==200 && (\"970132176\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bluehost"
        dsl:
          - "status_code==200 && (\"-1119613926\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sangfor"
        dsl:
          - "status_code==200 && (\"123821839\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zte-corporation-gateway-appliance"
        dsl:
          - "status_code==200 && (\"459900502\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ruckus-wireless"
        dsl:
          - "status_code==200 && (\"-2069844696\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bitnami"
        dsl:
          - "status_code==200 && (\"-1607644090\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "juniper-device-manager"
        dsl:
          - "status_code==200 && (\"2141724739\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "technicolor-gateway"
        dsl:
          - "status_code==200 && (\"1835479497\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gitlab"
        dsl:
          - "status_code==200 && (\"1278323681\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netasq-secure-stormshield"
        dsl:
          - "status_code==200 && (\"-1929912510\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vmware-horizon"
        dsl:
          - "status_code==200 && (\"-1255992602\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vmware-horizon"
        dsl:
          - "status_code==200 && (\"1895360511\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vmware-horizon"
        dsl:
          - "status_code==200 && (\"-991123252\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vmware-secure-file-transfer"
        dsl:
          - "status_code==200 && (\"1642701741\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sap-netweaver"
        dsl:
          - "status_code==200 && (\"-266008933\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sap-id-service"
        dsl:
          - "status_code==200 && (\"-1967743928\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sap-conversational-ai"
        dsl:
          - "status_code==200 && (\"1347937389\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "palo-alto-login-portal"
        dsl:
          - "status_code==200 && (\"602431586\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "palo-alto-networks"
        dsl:
          - "status_code==200 && (\"-318947884\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "outlook-web-application"
        dsl:
          - "status_code==200 && (\"1356662359\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "webmin"
        dsl:
          - "status_code==200 && (\"1453890729\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "docker"
        dsl:
          - "status_code==200 && (\"-1814887000\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "docker"
        dsl:
          - "status_code==200 && (\"1937209448\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "amazon"
        dsl:
          - "status_code==200 && (\"-1544605732\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "amazon"
        dsl:
          - "status_code==200 && (\"716989053\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "phpmyadmin"
        dsl:
          - "status_code==200 && (\"-1010568750\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zhejiang-uniview-technologies"
        dsl:
          - "status_code==200 && (\"-1240222446\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "isp-manager"
        dsl:
          - "status_code==200 && (\"-986678507\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "axis-network-cameras"
        dsl:
          - "status_code==200 && (\"-1616143106\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "roundcube-webmail"
        dsl:
          - "status_code==200 && (\"-976235259\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "unifi-video-controller-airvision"
        dsl:
          - "status_code==200 && (\"768816037\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "pfsense"
        dsl:
          - "status_code==200 && (\"1015545776\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "freebox-os"
        dsl:
          - "status_code==200 && (\"1838417872\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hxxps"
        dsl:
          - "status_code==200 && (\"1188645141\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "keenetic"
        dsl:
          - "status_code==200 && (\"547282364\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sierra-wireless-ace-manager-airlink"
        dsl:
          - "status_code==200 && (\"-1571472432\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "synology-diskstation"
        dsl:
          - "status_code==200 && (\"149371702\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "instar-ip-cameras"
        dsl:
          - "status_code==200 && (\"-1169314298\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "webmin"
        dsl:
          - "status_code==200 && (\"-1038557304\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "octoprint-3d-printer"
        dsl:
          - "status_code==200 && (\"1307375944\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "webmin"
        dsl:
          - "status_code==200 && (\"1280907310\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vesta-hosting-control-panel"
        dsl:
          - "status_code==200 && (\"1954835352\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "farming-simulator-dedicated-server"
        dsl:
          - "status_code==200 && (\"509789953\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "residential-gateway"
        dsl:
          - "status_code==200 && (\"-1933493443\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cpanel-login"
        dsl:
          - "status_code==200 && (\"1993518473\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "arris"
        dsl:
          - "status_code==200 && (\"-1477563858\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "plex-server"
        dsl:
          - "status_code==200 && (\"-895890586\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dlink-webcam"
        dsl:
          - "status_code==200 && (\"-1354933624\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "deluge"
        dsl:
          - "status_code==200 && (\"944969688\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "webmin"
        dsl:
          - "status_code==200 && (\"479413330\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cambium-networks"
        dsl:
          - "status_code==200 && (\"-435817905\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "plesk"
        dsl:
          - "status_code==200 && (\"-981606721\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dahua-storm-ip-camera"
        dsl:
          - "status_code==200 && (\"833190513\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "10"
        dsl:
          - "status_code==200 && (\"-1314864135\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "parallels-plesk-panel"
        dsl:
          - "status_code==200 && (\"-652508439\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireware-watchguard"
        dsl:
          - "status_code==200 && (\"-569941107\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "shock&innovation-netis-setup"
        dsl:
          - "status_code==200 && (\"1326164945\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cacaoweb"
        dsl:
          - "status_code==200 && (\"-1738184811\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "loxone-automation"
        dsl:
          - "status_code==200 && (\"904434662\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hp-printer"
        dsl:
          - "status_code==200 && (\"905744673\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netflix"
        dsl:
          - "status_code==200 && (\"902521196\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "linksys-smart-wi-fi"
        dsl:
          - "status_code==200 && (\"-2063036701\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lwip-a-lightweight-tcp-ip-stack"
        dsl:
          - "status_code==200 && (\"-1205024243\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hitron-technologies"
        dsl:
          - "status_code==200 && (\"607846949\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dahua-storm-dvr"
        dsl:
          - "status_code==200 && (\"1281253102\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mobotix-camera"
        dsl:
          - "status_code==200 && (\"661332347\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "blue-iris-webcam"
        dsl:
          - "status_code==200 && (\"-520888198\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vigor-router"
        dsl:
          - "status_code==200 && (\"104189364\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "alibaba-cloud-block-page"
        dsl:
          - "status_code==200 && (\"1227052603\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dd-wrt-milli-httpd"
        dsl:
          - "status_code==200 && (\"252728887\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mitel-networks-micollab-end-user-portal"
        dsl:
          - "status_code==200 && (\"-1922044295\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dlink-webcam"
        dsl:
          - "status_code==200 && (\"1221759509\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dlink-router"
        dsl:
          - "status_code==200 && (\"1037387972\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "prtg-network-monitor"
        dsl:
          - "status_code==200 && (\"-655683626\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "elastic-database"
        dsl:
          - "status_code==200 && (\"1611729805\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dlink-webcam"
        dsl:
          - "status_code==200 && (\"1144925962\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wildfly"
        dsl:
          - "status_code==200 && (\"-1666561833\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cisco-meraki-dashboard"
        dsl:
          - "status_code==200 && (\"804949239\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "workday"
        dsl:
          - "status_code==200 && (\"-459291760\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "justhost"
        dsl:
          - "status_code==200 && (\"1734609466\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "baidu-ip-error-page"
        dsl:
          - "status_code==200 && (\"-1507567067\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "intelbras-sa"
        dsl:
          - "status_code==200 && (\"2006716043\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "yii-php-framework-default-favicon"
        dsl:
          - "status_code==200 && (\"-1298108480\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "truvision-nvr-interlogix"
        dsl:
          - "status_code==200 && (\"1782271534\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "redmine"
        dsl:
          - "status_code==200 && (\"603314\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "phpmyadmin"
        dsl:
          - "status_code==200 && (\"-476231906\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cisco-eg"
        dsl:
          - "status_code==200 && (\"-646322113\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jetty-"
        dsl:
          - "status_code==200 && (\"-629047854\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "luma-surveillance"
        dsl:
          - "status_code==200 && (\"-1351901211\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "parallels-plesk-panel"
        dsl:
          - "status_code==200 && (\"-519765377\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hp-printer-server"
        dsl:
          - "status_code==200 && (\"-2144363468\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "metasploit"
        dsl:
          - "status_code==200 && (\"-127886975\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "metasploit"
        dsl:
          - "status_code==200 && (\"1139788073\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "metasploit"
        dsl:
          - "status_code==200 && (\"-1235192469\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "alibi-nvr"
        dsl:
          - "status_code==200 && (\"1876585825\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sangfor"
        dsl:
          - "status_code==200 && (\"-1810847295\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "websockets-test-page-eg"
        dsl:
          - "status_code==200 && (\"-291579889\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "macos-server-apple"
        dsl:
          - "status_code==200 && (\"1629518721\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openrg"
        dsl:
          - "status_code==200 && (\"-986816620\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cisco-router"
        dsl:
          - "status_code==200 && (\"-299287097\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sangfor"
        dsl:
          - "status_code==200 && (\"-1926484046\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "herospeed-digital-technology-co"
        dsl:
          - "status_code==200 && (\"-873627015\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "nomadix-access-gateway"
        dsl:
          - "status_code==200 && (\"2071993228\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gitlab"
        dsl:
          - "status_code==200 && (\"516963061\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "magento"
        dsl:
          - "status_code==200 && (\"-38580010\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mk-auth"
        dsl:
          - "status_code==200 && (\"1490343308\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "shoutcast-server"
        dsl:
          - "status_code==200 && (\"-632583950\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"95271369\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"1476335317\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"-842192932\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"105083909\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"240606739\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"2121539357\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "adobe-campaign-classic"
        dsl:
          - "status_code==200 && (\"-333791179\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "xampp"
        dsl:
          - "status_code==200 && (\"-1437701105\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "niagara-web-server"
        dsl:
          - "status_code==200 && (\"-676077969\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "technicolor"
        dsl:
          - "status_code==200 && (\"-2138771289\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hitron-technologies-inc"
        dsl:
          - "status_code==200 && (\"711742418\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ibm-notes"
        dsl:
          - "status_code==200 && (\"728788645\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "barracuda"
        dsl:
          - "status_code==200 && (\"1436966696\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "servicenow"
        dsl:
          - "status_code==200 && (\"86919334\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openfire-admin-console"
        dsl:
          - "status_code==200 && (\"1211608009\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hp-ilo"
        dsl:
          - "status_code==200 && (\"2059618623\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sunny-webbox"
        dsl:
          - "status_code==200 && (\"1975413433\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zyxel"
        dsl:
          - "status_code==200 && (\"943925975\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "huawei"
        dsl:
          - "status_code==200 && (\"281559989\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tenda-web-master"
        dsl:
          - "status_code==200 && (\"-2145085239\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "prometheus-time-series-collection-and-processing-server"
        dsl:
          - "status_code==200 && (\"-1399433489\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wdcp-cloud-host-management-system"
        dsl:
          - "status_code==200 && (\"1786752597\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "domoticz-home-automation"
        dsl:
          - "status_code==200 && (\"90680708\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tableau"
        dsl:
          - "status_code==200 && (\"-1441956789\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openwrt-luci"
        dsl:
          - "status_code==200 && (\"-675839242\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubiquiti-airos"
        dsl:
          - "status_code==200 && (\"1020814938\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mdaemon-webmail"
        dsl:
          - "status_code==200 && (\"-766957661\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "teltonika"
        dsl:
          - "status_code==200 && (\"119741608\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "entrolink"
        dsl:
          - "status_code==200 && (\"1973665246\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "windriver-webserver"
        dsl:
          - "status_code==200 && (\"74935566\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "microhard-systems"
        dsl:
          - "status_code==200 && (\"-1723752240\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "skype"
        dsl:
          - "status_code==200 && (\"-1807411396\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "teltonika"
        dsl:
          - "status_code==200 && (\"-1612496354\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "eltex-router"
        dsl:
          - "status_code==200 && (\"1877797890\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bintec-elmeg"
        dsl:
          - "status_code==200 && (\"-375623619\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "syncthru-web-service-printers"
        dsl:
          - "status_code==200 && (\"1483097076\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "boaserver"
        dsl:
          - "status_code==200 && (\"1169183049\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "securepoint"
        dsl:
          - "status_code==200 && (\"1051648103\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "moodle"
        dsl:
          - "status_code==200 && (\"-438482901\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "radix"
        dsl:
          - "status_code==200 && (\"-1492966240\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cradlepoint-technology-router"
        dsl:
          - "status_code==200 && (\"1466912879\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "drupal"
        dsl:
          - "status_code==200 && (\"-167656799\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "blackboard"
        dsl:
          - "status_code==200 && (\"-1593651747\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jupyter-notebook"
        dsl:
          - "status_code==200 && (\"-895963602\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hostmonster-web-hosting"
        dsl:
          - "status_code==200 && (\"-972810761\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-router-network"
        dsl:
          - "status_code==200 && (\"1703788174\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "rocket-chat"
        dsl:
          - "status_code==200 && (\"225632504\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mofinetwork"
        dsl:
          - "status_code==200 && (\"-1702393021\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zabbix"
        dsl:
          - "status_code==200 && (\"892542951\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "totolink-network"
        dsl:
          - "status_code==200 && (\"547474373\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ossia-provision-sr"
        dsl:
          - "status_code==200 && (\"-374235895\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cpanel-login"
        dsl:
          - "status_code==200 && (\"1544230796\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-router-network"
        dsl:
          - "status_code==200 && (\"517158172\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jeedom-home-automation"
        dsl:
          - "status_code==200 && (\"462223993\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jboss-application-server-7"
        dsl:
          - "status_code==200 && (\"937999361\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "niagara-web-server-tridium"
        dsl:
          - "status_code==200 && (\"1991562061\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "solarwinds-serv-u-ftp-server"
        dsl:
          - "status_code==200 && (\"812385209\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "aruba-virtual-controller"
        dsl:
          - "status_code==200 && (\"1142227528\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dell"
        dsl:
          - "status_code==200 && (\"-1153950306\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "remobjects-sdk-remoting-sdk"
        dsl:
          - "status_code==200 && (\"72005642\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zyxel-zywall"
        dsl:
          - "status_code==200 && (\"-484708885\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "visualsvn-server"
        dsl:
          - "status_code==200 && (\"706602230\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jboss"
        dsl:
          - "status_code==200 && (\"-656811182\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "starface-voip-software"
        dsl:
          - "status_code==200 && (\"-332324409\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netis-network-devices"
        dsl:
          - "status_code==200 && (\"-594256627\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "whm"
        dsl:
          - "status_code==200 && (\"-649378830\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tandberg"
        dsl:
          - "status_code==200 && (\"97604680\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ghost-cms"
        dsl:
          - "status_code==200 && (\"-1015932800\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "avtech-ip-surveillance-camera"
        dsl:
          - "status_code==200 && (\"-194439630\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "liferay-portal"
        dsl:
          - "status_code==200 && (\"129457226\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "parallels-plesk-panel"
        dsl:
          - "status_code==200 && (\"-771764544\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "odoo"
        dsl:
          - "status_code==200 && (\"-617743584\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "polycom"
        dsl:
          - "status_code==200 && (\"77044418\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cake-php"
        dsl:
          - "status_code==200 && (\"980692677\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "exacq"
        dsl:
          - "status_code==200 && (\"476213314\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "checkpoint"
        dsl:
          - "status_code==200 && (\"794809961\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubiquiti-unms"
        dsl:
          - "status_code==200 && (\"1157789622\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cpanel-login"
        dsl:
          - "status_code==200 && (\"1244636413\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "worldclient-for-mdaemon"
        dsl:
          - "status_code==200 && (\"1985721423\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netport-software-dsl"
        dsl:
          - "status_code==200 && (\"-1124868062\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "f5-big-ip"
        dsl:
          - "status_code==200 && (\"-335242539\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mailcow"
        dsl:
          - "status_code==200 && (\"2146763496\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "qnap-nas-virtualization-station"
        dsl:
          - "status_code==200 && (\"-1041180225\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netgear"
        dsl:
          - "status_code==200 && (\"-1319025408\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gogs"
        dsl:
          - "status_code==200 && (\"917966895\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "trendnet-ip-camera"
        dsl:
          - "status_code==200 && (\"512590457\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "asustor"
        dsl:
          - "status_code==200 && (\"1678170702\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dahua"
        dsl:
          - "status_code==200 && (\"-1466785234\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "discuz"
        dsl:
          - "status_code==200 && (\"-505448917\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wdcp-cloud-host-management-system"
        dsl:
          - "status_code==200 && (\"255892555\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "joomla"
        dsl:
          - "status_code==200 && (\"1627330242\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "smartermail"
        dsl:
          - "status_code==200 && (\"-1935525788\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "seafile"
        dsl:
          - "status_code==200 && (\"-12700016\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bintec-elmeg"
        dsl:
          - "status_code==200 && (\"1770799630\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netgear-readynas"
        dsl:
          - "status_code==200 && (\"-137295400\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ipecs"
        dsl:
          - "status_code==200 && (\"-195508437\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bet365"
        dsl:
          - "status_code==200 && (\"-2116540786\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "reolink"
        dsl:
          - "status_code==200 && (\"-38705358\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "idera"
        dsl:
          - "status_code==200 && (\"-450254253\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "proofpoint"
        dsl:
          - "status_code==200 && (\"-1630354993\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kerio-connect-webmail"
        dsl:
          - "status_code==200 && (\"-1678298769\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "worldclient-mdaemon"
        dsl:
          - "status_code==200 && (\"-35107086\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "realtek"
        dsl:
          - "status_code==200 && (\"2055322029\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ruijie-networks-login"
        dsl:
          - "status_code==200 && (\"-692947551\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "askey-cable-modem"
        dsl:
          - "status_code==200 && (\"-1710631084\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "askey-cable-modem"
        dsl:
          - "status_code==200 && (\"89321398\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jaws-web-server-ip-camera"
        dsl:
          - "status_code==200 && (\"90066852\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jaws-web-server-ip-camera"
        dsl:
          - "status_code==200 && (\"768231242\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "homegrown-website-hosting"
        dsl:
          - "status_code==200 && (\"-421986013\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "technicolor-thomson-speedtouch-network-adsl"
        dsl:
          - "status_code==200 && (\"156312019\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dvr-korean"
        dsl:
          - "status_code==200 && (\"-560297467\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "joomla"
        dsl:
          - "status_code==200 && (\"-1950415971\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tp-link-network-device"
        dsl:
          - "status_code==200 && (\"1842351293\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "salesforce"
        dsl:
          - "status_code==200 && (\"1433417005\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "apache-haus"
        dsl:
          - "status_code==200 && (\"-632070065\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "untangle"
        dsl:
          - "status_code==200 && (\"1103599349\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "shenzhen-coship-electronics"
        dsl:
          - "status_code==200 && (\"224536051\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-router-network"
        dsl:
          - "status_code==200 && (\"1038500535\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-camera"
        dsl:
          - "status_code==200 && (\"-355305208\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kibana"
        dsl:
          - "status_code==200 && (\"-267431135\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kibana"
        dsl:
          - "status_code==200 && (\"-759754862\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kibana"
        dsl:
          - "status_code==200 && (\"-1200737715\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kibana"
        dsl:
          - "status_code==200 && (\"75230260\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kibana"
        dsl:
          - "status_code==200 && (\"1668183286\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "intelbras-sa"
        dsl:
          - "status_code==200 && (\"283740897\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "icecast-streaming-media-server"
        dsl:
          - "status_code==200 && (\"1424295654\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "nec-webpro"
        dsl:
          - "status_code==200 && (\"1922032523\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vivotek-camera"
        dsl:
          - "status_code==200 && (\"-1654229048\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "microsoft-iis"
        dsl:
          - "status_code==200 && (\"-1414475558\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "univention-portal"
        dsl:
          - "status_code==200 && (\"-1697334194\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "portainer-docker-management"
        dsl:
          - "status_code==200 && (\"-1424036600\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "nos-router"
        dsl:
          - "status_code==200 && (\"-831826827\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tongda"
        dsl:
          - "status_code==200 && (\"-759108386\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "crushftp"
        dsl:
          - "status_code==200 && (\"-1022206565\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "endian-firewall"
        dsl:
          - "status_code==200 && (\"-1225484776\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kerio-control-firewall"
        dsl:
          - "status_code==200 && (\"-631002664\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ferozo-panel"
        dsl:
          - "status_code==200 && (\"2072198544\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kerio-control-firewall"
        dsl:
          - "status_code==200 && (\"-466504476\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cafe24-korea"
        dsl:
          - "status_code==200 && (\"1251810433\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mautic-open-source-marketing-automation"
        dsl:
          - "status_code==200 && (\"1273982002\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netiaspot-network"
        dsl:
          - "status_code==200 && (\"-978656757\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "multilaser"
        dsl:
          - "status_code==200 && (\"916642917\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "canvas-lms-learning-management"
        dsl:
          - "status_code==200 && (\"575613323\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ibm-server"
        dsl:
          - "status_code==200 && (\"1726027799\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "adb-broadband-spa-network"
        dsl:
          - "status_code==200 && (\"-587741716\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "arris-network"
        dsl:
          - "status_code==200 && (\"-360566773\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "huawei-network"
        dsl:
          - "status_code==200 && (\"-884776764\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wampserver"
        dsl:
          - "status_code==200 && (\"929825723\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "seagate-technology-nas"
        dsl:
          - "status_code==200 && (\"240136437\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "upc-ceska-republica-network"
        dsl:
          - "status_code==200 && (\"1911253822\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "flussonic-video-streaming"
        dsl:
          - "status_code==200 && (\"-393788031\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "joomla"
        dsl:
          - "status_code==200 && (\"366524387\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wampserver"
        dsl:
          - "status_code==200 && (\"443944613\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "metabase"
        dsl:
          - "status_code==200 && (\"1953726032\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-network"
        dsl:
          - "status_code==200 && (\"-2031183903\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mobileiron"
        dsl:
          - "status_code==200 && (\"545827989\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mobileiron"
        dsl:
          - "status_code==200 && (\"967636089\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mobileiron"
        dsl:
          - "status_code==200 && (\"362091310\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mobileiron"
        dsl:
          - "status_code==200 && (\"2086228042\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "communigate"
        dsl:
          - "status_code==200 && (\"-1588746893\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zte-network"
        dsl:
          - "status_code==200 && (\"1427976651\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "infinet-wireless-wanflex-network"
        dsl:
          - "status_code==200 && (\"1648531157\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mersive-solstice"
        dsl:
          - "status_code==200 && (\"938616453\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "université-toulouse-1-capitole"
        dsl:
          - "status_code==200 && (\"1632780968\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "digium-switchvox"
        dsl:
          - "status_code==200 && (\"2068154487\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "powermta-monitoring"
        dsl:
          - "status_code==200 && (\"-1788112745\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "smartlang"
        dsl:
          - "status_code==200 && (\"-644617577\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "checkpoint-gaia"
        dsl:
          - "status_code==200 && (\"-1822098181\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mailwizz"
        dsl:
          - "status_code==200 && (\"2127152956\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "rabbitmq"
        dsl:
          - "status_code==200 && (\"1064742722\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openmediavault-nas"
        dsl:
          - "status_code==200 && (\"-693082538\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openwrt-luci"
        dsl:
          - "status_code==200 && (\"1941381095\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "honeywell"
        dsl:
          - "status_code==200 && (\"903086190\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bomgar-support-portal"
        dsl:
          - "status_code==200 && (\"829321644\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "nuxt-js"
        dsl:
          - "status_code==200 && (\"-1442789563\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "roundcube-webmail"
        dsl:
          - "status_code==200 && (\"-2140379067\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-camera"
        dsl:
          - "status_code==200 && (\"-1897829998\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netgear-network"
        dsl:
          - "status_code==200 && (\"1047213685\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sonarqube"
        dsl:
          - "status_code==200 && (\"1485257654\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lupus-electronics-xt"
        dsl:
          - "status_code==200 && (\"-299324825\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vanderbilt-spc"
        dsl:
          - "status_code==200 && (\"-1162730477\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vzpp-plesk"
        dsl:
          - "status_code==200 && (\"-1268095485\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "baidu"
        dsl:
          - "status_code==200 && (\"1118684072\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "owncloud"
        dsl:
          - "status_code==200 && (\"-1616115760\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sentora"
        dsl:
          - "status_code==200 && (\"-2054889066\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "alfresco"
        dsl:
          - "status_code==200 && (\"1333537166\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "digital-keystone-dk"
        dsl:
          - "status_code==200 && (\"-373674173\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wispr-airlan"
        dsl:
          - "status_code==200 && (\"-106646451\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "synology-vpn-plus"
        dsl:
          - "status_code==200 && (\"1235070469\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sentry"
        dsl:
          - "status_code==200 && (\"2063428236\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "watchguard"
        dsl:
          - "status_code==200 && (\"15831193\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "web-client-pro"
        dsl:
          - "status_code==200 && (\"-956471263\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tecvoz"
        dsl:
          - "status_code==200 && (\"-1452159623\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mdaemon-remote-administration"
        dsl:
          - "status_code==200 && (\"99432374\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "paradox-ip-module"
        dsl:
          - "status_code==200 && (\"727253975\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dokuwiki"
        dsl:
          - "status_code==200 && (\"-630493013\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sails"
        dsl:
          - "status_code==200 && (\"552597979\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fastpanel-hosting"
        dsl:
          - "status_code==200 && (\"774252049\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "c-lodop"
        dsl:
          - "status_code==200 && (\"-329747115\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jamf-pro-login"
        dsl:
          - "status_code==200 && (\"1262005940\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "struxureware-schneider-electric"
        dsl:
          - "status_code==200 && (\"979634648\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "axcient-replibit-management-server"
        dsl:
          - "status_code==200 && (\"475379699\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "twonky-server-media-streaming"
        dsl:
          - "status_code==200 && (\"-878891718\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "windows-azure"
        dsl:
          - "status_code==200 && (\"-2125083197\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "isp-manager-web-hosting-panel"
        dsl:
          - "status_code==200 && (\"-1151675028\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jupyterhub"
        dsl:
          - "status_code==200 && (\"1248917303\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "centurylink-modem-gui-login-eg"
        dsl:
          - "status_code==200 && (\"-1908556829\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tecvoz"
        dsl:
          - "status_code==200 && (\"1059329877\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "opnsense"
        dsl:
          - "status_code==200 && (\"-1148190371\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ligowave-network"
        dsl:
          - "status_code==200 && (\"1467395679\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "rumpus"
        dsl:
          - "status_code==200 && (\"-1528414776\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "spiceworks-panel"
        dsl:
          - "status_code==200 && (\"-2117390767\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "teamcity"
        dsl:
          - "status_code==200 && (\"-1944119648\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "instar-full-hd-ip-camera"
        dsl:
          - "status_code==200 && (\"-1748763891\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gpon-home-gateway"
        dsl:
          - "status_code==200 && (\"251106693\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "alienvault"
        dsl:
          - "status_code==200 && (\"-1779611449\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "arbor-networks"
        dsl:
          - "status_code==200 && (\"-1745552996\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "accrisoft"
        dsl:
          - "status_code==200 && (\"-1275148624\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "yasni"
        dsl:
          - "status_code==200 && (\"-178685903\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "slack"
        dsl:
          - "status_code==200 && (\"-43161126\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "innovaphone"
        dsl:
          - "status_code==200 && (\"671221099\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "shinobi-cctv"
        dsl:
          - "status_code==200 && (\"-10974981\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tp-link-network-device"
        dsl:
          - "status_code==200 && (\"1274078387\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "siemens-ozw772"
        dsl:
          - "status_code==200 && (\"-336242473\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lantronix-spider"
        dsl:
          - "status_code==200 && (\"882208493\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "claimtime-ramsell-public-health-safety"
        dsl:
          - "status_code==200 && (\"-687783882\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "surfilter-ssl-vpn-portal"
        dsl:
          - "status_code==200 && (\"-590892202\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kyocera-printer"
        dsl:
          - "status_code==200 && (\"-50306417\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lucee"
        dsl:
          - "status_code==200 && (\"784872924\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ricoh"
        dsl:
          - "status_code==200 && (\"1135165421\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "handle-proxy"
        dsl:
          - "status_code==200 && (\"926501571\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "metasploit"
        dsl:
          - "status_code==200 && (\"579239725\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-689902428\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-600508822\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"656868270\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-2056503929\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-1656695885\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"331870709\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"1241049726\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"998138196\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"322531336\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-401934945\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-613216179\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "chef-automate"
        dsl:
          - "status_code==200 && (\"-276759139\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gargoyle-router-management-utility"
        dsl:
          - "status_code==200 && (\"1862132268\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "keepitsafe-management-console"
        dsl:
          - "status_code==200 && (\"-1738727418\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "entronix-energy-management-platform"
        dsl:
          - "status_code==200 && (\"-368490461\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openproject"
        dsl:
          - "status_code==200 && (\"1836828108\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "unified-management-console-polycom"
        dsl:
          - "status_code==200 && (\"-1775553655\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "moxapass-iologik-remote-ethernet-io-server"
        dsl:
          - "status_code==200 && (\"381100274\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hfs-http-file-server"
        dsl:
          - "status_code==200 && (\"2124459909\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hfs-http-file-server"
        dsl:
          - "status_code==200 && (\"731374291\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "traccar-gps-tracking"
        dsl:
          - "status_code==200 && (\"-335153896\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iw"
        dsl:
          - "status_code==200 && (\"896412703\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wordpress-under-construction-icon"
        dsl:
          - "status_code==200 && (\"191654058\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "combivox"
        dsl:
          - "status_code==200 && (\"-342262483\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netcomwireless-network"
        dsl:
          - "status_code==200 && (\"5542029\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "elastic-database"
        dsl:
          - "status_code==200 && (\"1552860581\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "drupal"
        dsl:
          - "status_code==200 && (\"1174841451\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "truvision-nvr"
        dsl:
          - "status_code==200 && (\"-1093172228\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "spamexperts"
        dsl:
          - "status_code==200 && (\"-1688698891\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sonatype-nexus-repository-manager"
        dsl:
          - "status_code==200 && (\"-1546574541\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "idirect-canada-network-management"
        dsl:
          - "status_code==200 && (\"-256828986\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openerp-now-known-as-odoo"
        dsl:
          - "status_code==200 && (\"1966198264\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "pkp-openjournalsystems-public-knowledge-project"
        dsl:
          - "status_code==200 && (\"2099342476\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "liquidfiles"
        dsl:
          - "status_code==200 && (\"541087742\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zyxel-network"
        dsl:
          - "status_code==200 && (\"-882760066\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "universal-devices-ud"
        dsl:
          - "status_code==200 && (\"16202868\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "huawei-network"
        dsl:
          - "status_code==200 && (\"987967490\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gm77"
        dsl:
          - "status_code==200 && (\"-647318973\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "okazik"
        dsl:
          - "status_code==200 && (\"-1583478052\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gitea"
        dsl:
          - "status_code==200 && (\"1969970750\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tc-group"
        dsl:
          - "status_code==200 && (\"-1734573358\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "deluge-web-ui"
        dsl:
          - "status_code==200 && (\"-1589842876\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "登录-amh"
        dsl:
          - "status_code==200 && (\"1822002133\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "otrs-open-ticket-request-system"
        dsl:
          - "status_code==200 && (\"-2006308185\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bosch-security-systems-camera"
        dsl:
          - "status_code==200 && (\"-1702769256\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "node-red"
        dsl:
          - "status_code==200 && (\"321591353\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "motioneye-camera"
        dsl:
          - "status_code==200 && (\"-923693877\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "saia-burgess-controls-pcd"
        dsl:
          - "status_code==200 && (\"-1547576879\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "arcadyan-o2-box-network"
        dsl:
          - "status_code==200 && (\"1479202414\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-network"
        dsl:
          - "status_code==200 && (\"1081719753\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "abilis-network-automation"
        dsl:
          - "status_code==200 && (\"-166151761\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ghost-cms"
        dsl:
          - "status_code==200 && (\"-1231681737\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airwatch"
        dsl:
          - "status_code==200 && (\"321909464\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airwatch"
        dsl:
          - "status_code==200 && (\"-1153873472\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airwatch"
        dsl:
          - "status_code==200 && (\"1095915848\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airwatch"
        dsl:
          - "status_code==200 && (\"788771792\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airwatch"
        dsl:
          - "status_code==200 && (\"-1863663974\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "keyhelp-keyweb-ag"
        dsl:
          - "status_code==200 && (\"-1267819858\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "keyhelp-keyweb-ag"
        dsl:
          - "status_code==200 && (\"726817668\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "glpi"
        dsl:
          - "status_code==200 && (\"-1474875778\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netcom-technology"
        dsl:
          - "status_code==200 && (\"5471989\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cradlepoint"
        dsl:
          - "status_code==200 && (\"-1457536113\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "myasp"
        dsl:
          - "status_code==200 && (\"-736276076\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "intelbras-sa"
        dsl:
          - "status_code==200 && (\"-1343070146\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lenel"
        dsl:
          - "status_code==200 && (\"538585915\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "okofen-pellematic"
        dsl:
          - "status_code==200 && (\"-625364318\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "simplehelp-remote-support"
        dsl:
          - "status_code==200 && (\"1117165781\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "graphql"
        dsl:
          - "status_code==200 && (\"-1067420240\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dnn-cms"
        dsl:
          - "status_code==200 && (\"-1465479343\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "apple"
        dsl:
          - "status_code==200 && (\"1232159009\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "apple"
        dsl:
          - "status_code==200 && (\"1382324298\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "apple"
        dsl:
          - "status_code==200 && (\"-1498185948\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ispconfig"
        dsl:
          - "status_code==200 && (\"483383992\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "microsoft-outlook"
        dsl:
          - "status_code==200 && (\"-1249852061\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "possibly-dvr"
        dsl:
          - "status_code==200 && (\"999357577\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "possible-ip-camera"
        dsl:
          - "status_code==200 && (\"492290497\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dvr"
        dsl:
          - "status_code==200 && (\"400100893\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "One Identity Password Manager"
        dsl:
          - "status_code==200 && (\"983384876\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Kaseya"
        dsl:
          - "status_code==200 && (\"-1445519482\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "OpenSNS"
        dsl:
          - "status_code==200 && (\"1167011145\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SpamSniper"
        dsl:
          - "status_code==200 && (\"-1000719429\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Selea-ANPR-Camera"
        dsl:
          - "status_code==200 && (\"-41369781\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Selea-CarPlateServer"
        dsl:
          - "status_code==200 && (\"-656528622\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "KevinLAB"
        dsl:
          - "status_code==200 && (\"-1650202746\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "cisco-ucs"
        dsl:
          - "status_code==200 && (\"-521603470\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vmware-Workspace-ONE-Access"
        dsl:
          - "status_code==200 && (\"-1250474341\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mspcontrol"
        dsl:
          - "status_code==200 && (\"331817455\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Ionic"
        dsl:
          - "status_code==200 && (\"-1698328762\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Tufin-SecureTrack"
        dsl:
          - "status_code==200 && (\"-1238669242\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "WSO2-api-manager"
        dsl:
          - "status_code==200 && (\"1398055326\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Synapse-Mobility"
        dsl:
          - "status_code==200 && (\"-2015389528\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Gradle-enterprise"
        dsl:
          - "status_code==200 && (\"1614287628\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Kubernetes-Operational-View"
        dsl:
          - "status_code==200 && (\"2130463260\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Rancher"
        dsl:
          - "status_code==200 && (\"464587962\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Emby"
        dsl:
          - "status_code==200 && (\"902188936\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Zimbra"
        dsl:
          - "status_code==200 && (\"1624375939\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ICT Protege WX"
        dsl:
          - "status_code==200 && (\"1841044852\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Coverity"
        dsl:
          - "status_code==200 && (\"-994319624\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Aqua Enterprise"
        dsl:
          - "status_code==200 && (\"-1261322577\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Leica RefWorx"
        dsl:
          - "status_code==200 && (\"-1054477011\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Liferay"
        dsl:
          - "status_code==200 && (\"-2024949122\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "GoAnyWhere"
        dsl:
          - "status_code==200 && (\"1484947000\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Vue"
        dsl:
          - "status_code==200 && (\"-1252041730\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Sophos Email Appliance"
        dsl:
          - "status_code==200 && (\"-830586692\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Temporal Web UI"
        dsl:
          - "status_code==200 && (\"557327884\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Springboot Actuators"
        dsl:
          - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Snipe-IT"
        dsl:
          - "status_code==200 && (\"431627549\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "RSSHub"
        dsl:
          - "status_code==200 && (\"-1893514038\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SECUI WAF"
        dsl:
          - "status_code==200 && (\"-1101206929\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Aqua Enterprise"
        dsl:
          - "status_code==200 && (\"-1261322577\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "Bamboo"
        dsl:
          - "status_code==200 && (\"-1379982221\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Iparapheur"
        dsl:
          - "status_code==200 && (\"-1383463717\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "MonstraCMS"
        dsl:
          - "status_code==200 && (\"419828698\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Silverback MDM"
        dsl:
          - "status_code==200 && (\"635899646\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Hikvision"
        dsl:
          - "status_code==200 && (\"999357577\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "LimeSurvey Survey Software"
        dsl:
          - "status_code==200 && (\"1781653957\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Jenkins"
        dsl:
          - "status_code==200 && (\"81586312\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "OSQuery Fleet"
        dsl:
          - "status_code==200 && (\"-1529860313\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "OpenTSDB"
        dsl:
          - "status_code==200 && (\"407286339\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "WebMethod Integration Server"
        dsl:
          - "status_code==200 && (\"-234335289\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Structurizr"
        dsl:
          - "status_code==200 && (\"1199592666\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "EmqDefault"
        dsl:
          - "status_code==200 && (\"-670975485\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "Node-Red"
        dsl:
          - "status_code==200 && (\"321591353\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "TimeKeeper"
        dsl:
          - "status_code==200 && (\"2134367771\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Apollo"
        dsl:
          - "status_code==200 && (\"11794165\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "XXL-JOB"
        dsl:
          - "status_code==200 && (\"1691956220\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "PRTG Network Monitor"
        dsl:
          - "status_code==200 && (\"-655683626\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Everything Server"
        dsl:
          - "status_code==200 && (\"-977323269\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Laravel Horizon"
        dsl:
          - "status_code==200 && (\"450899026\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Temporal Web UI"
        dsl:
          - "status_code==200 && (\"557327884\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "File Browser"
        dsl:
          - "status_code==200 && (\"1052926265\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "RethinkDB Administration Console"
        dsl:
          - "status_code==200 && (\"969374472\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Doris Dashboard"
        dsl:
          - "status_code==200 && (\"24048806\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Apache Impala"
        dsl:
          - "status_code==200 && (\"587330928\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Openstack"
        dsl:
          - "status_code==200 && (\"786533217\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Jupyter Lab"
        dsl:
          - "status_code==200 && (\"450899026\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Fastvue"
        dsl:
          - "status_code==200 && (\"-1117549627\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "TeslaMate"
        dsl:
          - "status_code==200 && (\"-1478287554\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Prometheus Promtail"
        dsl:
          - "status_code==200 && (\"932345713\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Celery Flower"
        dsl:
          - "status_code==200 && (\"-374133142\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Setup GitHub Enterprise"
        dsl:
          - "status_code==200 && (\"-1373456171\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "OpenBMCS"
        dsl:
          - "status_code==200 && (\"1550906681\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "OpenBMCS"
        dsl:
          - "status_code==200 && (\"1550906681\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Acuneti360"
        dsl:
          - "status_code==200 && (\"-347188002\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Open Journal Systems"
        dsl:
          - "status_code==200 && (\"2099342476\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ClipBucket"
        dsl:
          - "status_code==200 && (\"538583492\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Bitrix24"
        dsl:
          - "status_code==200 && (\"-2115208104\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Netsparker Enterprise"
        dsl:
          - "status_code==200 && (\"-1575154882\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Kyocera Printer"
        dsl:
          - "status_code==200 && (\"-50306417\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "AceNet AceReporter Report"
        dsl:
          - "status_code==200 && (\"-1595726841\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jshERP"
        dsl:
          - "status_code==200 && (\"-1298131932\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "IBM OpenAdmin Tool"
        dsl:
          - "status_code==200 && (\"965982073\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iSAMS"
        dsl:
          - "status_code==200 && (\"-81573405\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "Sensu by Sumo Logic"
        dsl:
          - "status_code==200 && (\"-749942143\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "WSO2 Management Console"
        dsl:
          - "status_code==200 && (\"1398055326\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Buddy"
        dsl:
          - "status_code==200 && (\"-850502287\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "T-Up OpenFrame"
        dsl:
          - "status_code==200 && (\"824580113\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Dahua Web Service"
        dsl:
          - "status_code==200 && (\"1653394551\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Horde"
        dsl:
          - "status_code==200 && (\"-741491222\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Vault"
        dsl:
          - "status_code==200 && (\"-919788577\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Rancher"
        dsl:
          - "status_code==200 && (\"464587962\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ShardingSphere ElasticJob UI"
        dsl:
          - "status_code==200 && (\"816588900\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "OpenBullet"
        dsl:
          - "status_code==200 && (\"-1264095219\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "JshERP Boot"
        dsl:
          - "status_code==200 && (\"-1298131932\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "Jamf MDM"
        dsl:
          - "status_code==200 && (\"1262005940\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "AceNet AceReporter Report"
        dsl:
          - "status_code==200 && (\"-1595726841\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Horde Webmail"
        dsl:
          - "status_code==200 && (\"2104916232\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Piwigo"
        dsl:
          - "status_code==200 && (\"540706145\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "DbGate Web Client Management"
        dsl:
          - "status_code==200 && (\"1198579728\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Eventum"
        dsl:
          - "status_code==200 && (\"305412257\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Drone CI"
        dsl:
          - "status_code==200 && (\"1354079303\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Sophos Web Appliance"
        dsl:
          - "status_code==200 && (\"-893681401\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Proofpoint Protection Server"
        dsl:
          - "status_code==200 && (\"942678640\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Appwrite"
        dsl:
          - "status_code==200 && (\"-633108100\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Homer"
        dsl:
          - "status_code==200 && (\"-417785140\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Avatier Password Management"
        dsl:
          - "status_code==200 && (\"983734701\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Zuul"
        dsl:
          - "status_code==200 && (\"-1127895693\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SAS"
        dsl:
          - "status_code==200 && (\"957255151\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "Structurizr"
        dsl:
          - "status_code==200 && (\"1199592666\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "UniboPanel"
        dsl:
          - "status_code==200 && (\"176427349\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Microsoft Exchange Web Service"
        dsl:
          - "status_code==200 && (\"1768726119\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Redash"
        dsl:
          - "status_code==200 && (\"698624197\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Rancher Dashboard"
        dsl:
          - "status_code==200 && (\"-1324930554\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "MobileIron Sentry"
        dsl:
          - "status_code==200 && (\"967636089\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Keycloak Admin"
        dsl:
          - "status_code==200 && (\"-1105083093\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ProxmoVirtual Environment"
        dsl:
          - "status_code==200 && (\"213144638\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Jellyseerr"
        dsl:
          - "status_code==200 && (\"-2017604252\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airCube"
        dsl:
          - "status_code==200 && (\"1249285083\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Strider CD"
        dsl:
          - "status_code==200 && (\"115295460\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "CloudPanel"
        dsl:
          - "status_code==200 && (\"151132309\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Kasm"
        dsl:
          - "status_code==200 && (\"-2144699833\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Veeam"
        dsl:
          - "status_code==200 && (\"-633512412\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Dashy"
        dsl:
          - "status_code==200 && (\"-1013024216\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ArcServe"
        dsl:
          - "status_code==200 && (\"-1889244460\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Pichome"
        dsl:
          - "status_code==200 && (\"933976300\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Kiteworks PCN"
        dsl:
          - "status_code==200 && (\"-1215318992\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "XXLJOB Admin"
        dsl:
          - "status_code==200 && (\"1691956220\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Vidyo Admin"
        dsl:
          - "status_code==200 && (\"-1970367401\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Seafile"
        dsl:
          - "status_code==200 && (\"1552322396\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Kanboard"
        dsl:
          - "status_code==200 && (\"2056442365\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Virtua Software"
        dsl:
          - "status_code==200 && (\"876876147\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ASPECT Control"
        dsl:
          - "status_code==200 && (\"1011076161\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Navicat On-Prem Server"
        dsl:
          - "status_code==200 && (\"598296063\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "OpenVZ Web"
        dsl:
          - "status_code==200 && (\"-1898583197\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "OfficeKeeper Admin"
        dsl:
          - "status_code==200 && (\"-800060828\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Modoboa"
        dsl:
          - "status_code==200 && (\"1949005079\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Monstra Admin"
        dsl:
          - "status_code==200 && (\"419828698\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Apigee"
        dsl:
          - "status_code==200 && (\"-839356603\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Immich"
        dsl:
          - "status_code==200 && (\"-43504595\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "MantisBT"
        dsl:
          - "status_code==200 && (\"662709064\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "WD My Cloud"
        dsl:
          - "status_code==200 && (\"-1074357885\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ServiceNow"
        dsl:
          - "status_code==200 && (\"1701804003\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Atlantis"
        dsl:
          - "status_code==200 && (\"-1706783005\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "RaspberryMatic"
        dsl:
          - "status_code==200 && (\"-578216669\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Eagle For Apache Kakfa"
        dsl:
          - "status_code==200 && (\"1693580324\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Liferay"
        dsl:
          - "status_code==200 && (\"129457226\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Archibus Web Central"
        dsl:
          - "status_code==200 && (\"889652940\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Shell In A Bo"
        dsl:
          - "status_code==200 && (\"-629968763\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Regify"
        dsl:
          - "status_code==200 && (\"1817615343\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SolarWinds ARM"
        dsl:
          - "status_code==200 && (\"-1416464161\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Dynatrace"
        dsl:
          - "status_code==200 && (\"1828614783\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Sunbird DCIM"
        dsl:
          - "status_code==200 && (\"781922099\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "KubeView"
        dsl:
          - "status_code==200 && (\"-379154636\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "HiveManager"
        dsl:
          - "status_code==200 && (\"1604363273\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SAUTER moduWeb Vision"
        dsl:
          - "status_code==200 && (\"-1663319756\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "WebTitan Cloud"
        dsl:
          - "status_code==200 && (\"1090061843\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Cofense Vision"
        dsl:
          - "status_code==200 && (\"739801466\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Doris"
        dsl:
          - "status_code==200 && (\"24048806\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "File Browser"
        dsl:
          - "status_code==200 && (\"1052926265\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Joget"
        dsl:
          - "status_code==200 && (\"-1343712810\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "IBM Maximo"
        dsl:
          - "status_code==200 && (\"-399298961\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "IBM WebSphere Application"
        dsl:
          - "status_code==200 && (\"1337147129\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Zyxel Firewall"
        dsl:
          - "status_code==200 && (\"-440644339\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Fortinet FortiOS Management Interface"
        dsl:
          - "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "FortiOS Admin"
        dsl:
          - "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "DzzOffice"
        dsl:
          - "status_code==200 && (\"-1961736892\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "DzzOffice"
        dsl:
          - "status_code==200 && (\"-1961736892\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "DbGate Web Client"
        dsl:
          - "status_code==200 && (\"1198579728\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Spring Boot H2 Database"
        dsl:
          - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Universal Media Server"
        dsl:
          - "status_code==200 && (\"-902890504\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SOUND4 IMPACTFIRST PULSE Eco"
        dsl:
          - "status_code==200 && (\"-1548359600\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Joomla JLeReview"
        dsl:
          - "status_code==200 && (\"-1950415971\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Jorani Benjamin BALET"
        dsl:
          - "status_code==200 && (\"-2032163853\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "HTTP File Server"
        dsl:
          - "status_code==200 && (\"2124459909\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "MSNSwitch Firmware MNT"
        dsl:
          - "status_code==200 && (\"-2073748627\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "HotelDruid Hotel Management Software"
        dsl:
          - "status_code==200 && (\"-1521640213\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "NexusPHP"
        dsl:
          - "status_code==200 && (\"-582931176\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Sophos Mobile managed on-premises"
        dsl:
          - "status_code==200 && (\"-1274798165\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "WSO2 Management"
        dsl:
          - "status_code==200 && (\"1398055326\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "GLPI"
        dsl:
          - "status_code==200 && (\"-1474875778\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "RStudio Connect"
        dsl:
          - "status_code==200 && (\"217119619\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SmarterTools SmarterTrack"
        dsl:
          - "status_code==200 && (\"1410071322\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "MCMS"
        dsl:
          - "status_code==200 && (\"1464851260\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Apache ShardingSphere ElasticJob-UI"
        dsl:
          - "status_code==200 && (\"816588900\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SolarView Compact"
        dsl:
          - "status_code==200 && (\"-244067125\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Rukovoditel"
        dsl:
          - "status_code==200 && (\"-1499940355\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "RaspAP"
        dsl:
          - "status_code==200 && (\"-1465760059\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "VMware Workspace ONE Access"
        dsl:
          - "status_code==200 && (\"-1250474341\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Hitachi Pentaho Business Analytics Server"
        dsl:
          - "status_code==200 && (\"1749354953\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Zimbra Collaboration Suite"
        dsl:
          - "status_code==200 && (\"1624375939\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "VMware"
        dsl:
          - "status_code==200 && (\"-1250474341\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Wavlink"
        dsl:
          - "status_code==200 && (\"-1350437236\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Likeshop"
        dsl:
          - "status_code==200 && (\"874152924\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Fortra GoAnywhere MFT"
        dsl:
          - "status_code==200 && (\"1170495932\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "GoAnywhere"
        dsl:
          - "status_code==200 && (\"1828756398\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "GoAnywhere Web Client"
        dsl:
          - "status_code==200 && (\"1484947000\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Qlik Sense Enterprise"
        dsl:
          - "status_code==200 && (\"-74348711\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "VertaAI ModelDB"
        dsl:
          - "status_code==200 && (\"-2097033750\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Gibbon"
        dsl:
          - "status_code==200 && (\"-165631681\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Squide"
        dsl:
          - "status_code==200 && (\"1099097618\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Axigen WebMail"
        dsl:
          - "status_code==200 && (\"-1247684400\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Ivanti Endpoint Manager Mobile (EPMM)"
        dsl:
          - "status_code==200 && (\"362091310\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Dolibarr"
        dsl:
          - "status_code==200 && (\"440258421\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "Microweber"
        dsl:
          - "status_code==200 && (\"780351152\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "CData RSB Connect"
        dsl:
          - "status_code==200 && (\"163538942\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Kyocera TASKalfa printer"
        dsl:
          - "status_code==200 && (\"-50306417\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Gibbon"
        dsl:
          - "status_code==200 && (\"-165631681\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "PMB"
        dsl:
          - "status_code==200 && (\"1469328760\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Jorani"
        dsl:
          - "status_code==200 && (\"-2032163853\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "NocoDB version"
        dsl:
          - "status_code==200 && (\"-2017596142\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "D-Link D-View"
        dsl:
          - "status_code==200 && (\"-1317621215\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "JeecgBoot"
        dsl:
          - "status_code==200 && (\"1380908726\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "CraftCMS"
        dsl:
          - "status_code==200 && (\"-47932290\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Structurizr on-premises"
        dsl:
          - "status_code==200 && (\"1199592666\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Label Studio"
        dsl:
          - "status_code==200 && (\"-1649949475\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Fortra GoAnywhere MFT"
        dsl:
          - "status_code==200 && (\"1484947000\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Web2py URL"
        dsl:
          - "status_code==200 && (\"-1680052984\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "MOVEit Transfer"
        dsl:
          - "status_code==200 && (\"989289239\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SysAid Server"
        dsl:
          - "status_code==200 && (\"1540720428\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Hestiacp"
        dsl:
          - "status_code==200 && (\"-476299640\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Anyscale Ray"
        dsl:
          - "status_code==200 && (\"463802404\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "MajorDoMo"
        dsl:
          - "status_code==200 && (\"1903390397\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Zimbra Collaboration Suite"
        dsl:
          - "status_code==200 && (\"475145467\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SonicWall GMS and Analytics Web Services"
        dsl:
          - "status_code==200 && (\"-1381126564\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "TimeKeeper by FSMLabs"
        dsl:
          - "status_code==200 && (\"2134367771\" == mmh3(base64_py(body)))"


      - type: dsl
        name: "IceWarp Webmail Server"
        dsl:
          - "status_code==200 && (\"2144485375\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "MobileIron Core"
        dsl:
          - "status_code==200 && (\"362091310\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Flatpress"
        dsl:
          - "status_code==200 && (\"-1189292869\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Ray Static File"
        dsl:
          - "status_code==200 && (\"463802404\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SysAid Help Desk"
        dsl:
          - "status_code==200 && (\"1540720428\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Dahua Security"
        dsl:
          - "status_code==200 && (\"2019488876\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ThinVNC"
        dsl:
          - "status_code==200 && (\"-1414548363\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "qdPM"
        dsl:
          - "status_code==200 && (\"762074255\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Virtua Software Cobranca"
        dsl:
          - "status_code==200 && (\"876876147\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Cachet"
        dsl:
          - "status_code==200 && (\"-1606065523\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "GenieACS"
        dsl:
          - "status_code==200 && (\"-2098066288\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Redash Setup Configuration"
        dsl:
          - "status_code==200 && (\"698624197\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Apache Superset"
        dsl:
          - "status_code==200 && (\"1582430156\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Revive Adserver"
        dsl:
          - "status_code==200 && (\"106844876\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Hikvision IP camera NVR"
        dsl:
          - "status_code==200 && (\"999357577\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Agentejo Cockpit"
        dsl:
          - "status_code==200 && (\"688609340\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Apache Kylin"
        dsl:
          - "status_code==200 && (\"-186961397\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "IBM Maximo Asset Management"
        dsl:
          - "status_code==200 && (\"-399298961\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Monstra CMS"
        dsl:
          - "status_code==200 && (\"419828698\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Western Digital MyCloud NAS"
        dsl:
          - "status_code==200 && (\"-1074357885\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "FileCatalyst"
        dsl:
          - "status_code==200 && (\"-1599943282\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Veeam Service Provider Console"
        dsl:
          - "status_code==200 && (\"-1728967963\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mooSocial"
        dsl:
          - "status_code==200 && (\"702863115\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "n8n"
        dsl:
          - "status_code==200 && (\"-831756631\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "umami"
        dsl:
          - "status_code==200 && (\"-130447705\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "snowflake"
        dsl:
          - "status_code==200 && (\"307296554\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ic-realtime"
        dsl:
          - "status_code==200 && (\"2019488876\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lorex"
        dsl:
          - "status_code==200 && (\"1653394551\" == mmh3(base64_py(body)))"

    extractors:
      - type: dsl
        dsl:
          - 'mmh3(base64_py(body))'
# digest: 4a0a00473045022100c58de167fd57418bef3c06144b8c31ac6643bc3fd4be254b92d150469cf3b8b9022035f7c5eef3dafa91dbedac40679286c24fb12239c15058df9406552bd078d7b0:922c64590222798bb761d5b6d8e72950