id: favicon-detect

info:
  name: favicon-detection
  author: un-fmunozs,DhiyaneshDk
  severity: info
  reference:
    - https://twitter.com/brsn76945860/status/1171233054951501824
    - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
    - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
    - https://github.com/devanshbatham/FavFreak
    - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
  metadata:
    max-request: 2
  tags: tech,favicon

http:
  - method: GET
    path:
      - "{{BaseURL}}/favicon.ico"
      - "{{BaseURL}}/{{path}}favicon.ico"

    payloads:
      path:
        - images/

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        name: proxmox
        dsl:
          - "len(body)==2336 && status_code==200 && (\"02f4db63a9cfb650c05ffd82956cbfd6\" == md5(body))"

      - type: dsl
        name: blogger
        dsl:
          - "len(body)==3638 && status_code==200 && (\"59a0c7b6e4848ccdabcea0636efda02b\" == md5(body))"

      - type: dsl
        name: oracle
        dsl:
          - "len(body)==1150 && status_code==200 && (\"421e176ae0837bcc6b879ef55adbc897\" == md5(body))"

      - type: dsl
        name: hitachi
        dsl:
          - "len(body)==894 && status_code==200 && (\"41e9c43dc5e994ca7a40f4f92b50d01d\" == md5(body))"

      - type: dsl
        name: meinberg
        dsl:
          - "len(body)==1406 && status_code==200 && (\"4b2524b4f28eac7d0e872b0e1323c02d\" == md5(body))"

      - type: dsl
        name: "slack-instance"
        dsl:
          - "status_code==200 && (\"99395752\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "spring-boot"
        dsl:
          - "status_code==200 && (\"116323821\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jenkins"
        dsl:
          - "status_code==200 && (\"81586312\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cnservers-llc"
        dsl:
          - "status_code==200 && (\"-235701012\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian"
        dsl:
          - "status_code==200 && (\"743365239\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "chainpoint"
        dsl:
          - "status_code==200 && (\"2128230701\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lacie"
        dsl:
          - "status_code==200 && (\"-1277814690\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "parse"
        dsl:
          - "status_code==200 && (\"246145559\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian"
        dsl:
          - "status_code==200 && (\"628535358\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jira"
        dsl:
          - "status_code==200 && (\"855273746\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "avigilon"
        dsl:
          - "status_code==200 && (\"1318124267\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-confluence"
        dsl:
          - "status_code==200 && (\"-305179312\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openstack"
        dsl:
          - "status_code==200 && (\"786533217\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "pi-star"
        dsl:
          - "status_code==200 && (\"432733105\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian"
        dsl:
          - "status_code==200 && (\"705143395\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "angular-io-angularjs"
        dsl:
          - "status_code==200 && (\"-1255347784\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "xampp"
        dsl:
          - "status_code==200 && (\"-1275226814\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "react"
        dsl:
          - "status_code==200 && (\"-2009722838\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-jira"
        dsl:
          - "status_code==200 && (\"981867722\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openstack"
        dsl:
          - "status_code==200 && (\"-923088984\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "aplikasi"
        dsl:
          - "status_code==200 && (\"494866796\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubiquiti-aircube"
        dsl:
          - "status_code==200 && (\"1249285083\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-bamboo"
        dsl:
          - "status_code==200 && (\"-1379982221\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "exostar-managed-access-gateway"
        dsl:
          - "status_code==200 && (\"420473080\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-confluence"
        dsl:
          - "status_code==200 && (\"-1642532491\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cisco-meraki"
        dsl:
          - "status_code==200 && (\"163842882\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "archivematica"
        dsl:
          - "status_code==200 && (\"-1378182799\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tcn"
        dsl:
          - "status_code==200 && (\"-702384832\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cx"
        dsl:
          - "status_code==200 && (\"-532394952\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ace"
        dsl:
          - "status_code==200 && (\"-183163807\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-jira"
        dsl:
          - "status_code==200 && (\"552727997\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netdata"
        dsl:
          - "status_code==200 && (\"1302486561\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "opengeo-suite"
        dsl:
          - "status_code==200 && (\"-609520537\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dgraph-ratel"
        dsl:
          - "status_code==200 && (\"-1961046099\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "atlassian-jira"
        dsl:
          - "status_code==200 && (\"-1581907337\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "material-dashboard"
        dsl:
          - "status_code==200 && (\"1913538826\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "form.io"
        dsl:
          - "status_code==200 && (\"1319699698\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kubeflow"
        dsl:
          - "status_code==200 && (\"-1203021870\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netdata-dashboard"
        dsl:
          - "status_code==200 && (\"-182423204\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "caprover"
        dsl:
          - "status_code==200 && (\"988422585\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wijungle"
        dsl:
          - "status_code==200 && (\"2113497004\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "onera"
        dsl:
          - "status_code==200 && (\"1234311970\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "smartping"
        dsl:
          - "status_code==200 && (\"430582574\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openstack"
        dsl:
          - "status_code==200 && (\"1232596212\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netdata-dashboard"
        dsl:
          - "status_code==200 && (\"1585145626\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fritz!box"
        dsl:
          - "status_code==200 && (\"-219752612\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubiquiti-airos"
        dsl:
          - "status_code==200 && (\"-697231354\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fortinet-forticlient"
        dsl:
          - "status_code==200 && (\"945408572\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "outlook-web-application"
        dsl:
          - "status_code==200 && (\"1768726119\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "huawei-claro"
        dsl:
          - "status_code==200 && (\"2109473187\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "asus-aicloud"
        dsl:
          - "status_code==200 && (\"552592949\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sonicwall"
        dsl:
          - "status_code==200 && (\"631108382\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "google"
        dsl:
          - "status_code==200 && (\"708578229\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "plesk"
        dsl:
          - "status_code==200 && (\"-134375033\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dahua-storm-ip-camera"
        dsl:
          - "status_code==200 && (\"2019488876\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "huawei-adsl/router"
        dsl:
          - "status_code==200 && (\"-1395400951\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sophos-cyberoam-appliance"
        dsl:
          - "status_code==200 && (\"1601194732\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lancom-systems"
        dsl:
          - "status_code==200 && (\"-325082670\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "plesk"
        dsl:
          - "status_code==200 && (\"-1050786453\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tilginab-homegateway"
        dsl:
          - "status_code==200 && (\"-1346447358\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "supermicro-intelligent-management-ipmi"
        dsl:
          - "status_code==200 && (\"1410610129\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zyxel-zywall"
        dsl:
          - "status_code==200 && (\"-440644339\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dell-sonicwall"
        dsl:
          - "status_code==200 && (\"363324987\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubiquiti-login-portals"
        dsl:
          - "status_code==200 && (\"-1446794564\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sophos-user-portal/vpn-portal"
        dsl:
          - "status_code==200 && (\"1045696447\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "apache-tomcat"
        dsl:
          - "status_code==200 && (\"-297069493\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openvpn"
        dsl:
          - "status_code==200 && (\"396533629\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cyberoam"
        dsl:
          - "status_code==200 && (\"1462981117\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "asp.net-favicon"
        dsl:
          - "status_code==200 && (\"1772087922\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "technicolor"
        dsl:
          - "status_code==200 && (\"1594377337\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vodafone-technicolor"
        dsl:
          - "status_code==200 && (\"165976831\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubnt-router-ui"
        dsl:
          - "status_code==200 && (\"-1677255344\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "intelbras-wireless"
        dsl:
          - "status_code==200 && (\"-359621743\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kerio-connect-webmail"
        dsl:
          - "status_code==200 && (\"-677167908\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "big-ip"
        dsl:
          - "status_code==200 && (\"878647854\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "microsoft-owa"
        dsl:
          - "status_code==200 && (\"442749392\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "pfsense"
        dsl:
          - "status_code==200 && (\"1405460984\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ikuai-networks"
        dsl:
          - "status_code==200 && (\"-271448102\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dlink-webcam"
        dsl:
          - "status_code==200 && (\"31972968\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "3cx-phone-system"
        dsl:
          - "status_code==200 && (\"970132176\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bluehost"
        dsl:
          - "status_code==200 && (\"-1119613926\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sangfor"
        dsl:
          - "status_code==200 && (\"123821839\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zte-corporation-gateway/appliance"
        dsl:
          - "status_code==200 && (\"459900502\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ruckus-wireless"
        dsl:
          - "status_code==200 && (\"-2069844696\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bitnami"
        dsl:
          - "status_code==200 && (\"-1607644090\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "juniper-device-manager"
        dsl:
          - "status_code==200 && (\"2141724739\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "technicolor-gateway"
        dsl:
          - "status_code==200 && (\"1835479497\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gitlab"
        dsl:
          - "status_code==200 && (\"1278323681\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netasq---secure-/-stormshield"
        dsl:
          - "status_code==200 && (\"-1929912510\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vmware-horizon"
        dsl:
          - "status_code==200 && (\"-1255992602\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vmware-horizon"
        dsl:
          - "status_code==200 && (\"1895360511\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vmware-horizon"
        dsl:
          - "status_code==200 && (\"-991123252\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vmware-secure-file-transfer"
        dsl:
          - "status_code==200 && (\"1642701741\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sap-netweaver"
        dsl:
          - "status_code==200 && (\"-266008933\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sap-id-service"
        dsl:
          - "status_code==200 && (\"-1967743928\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sap-conversational-ai"
        dsl:
          - "status_code==200 && (\"1347937389\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "palo-alto-login-portal"
        dsl:
          - "status_code==200 && (\"602431586\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "palo-alto-networks"
        dsl:
          - "status_code==200 && (\"-318947884\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "outlook-web-application"
        dsl:
          - "status_code==200 && (\"1356662359\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "webmin"
        dsl:
          - "status_code==200 && (\"1453890729\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "docker"
        dsl:
          - "status_code==200 && (\"-1814887000\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "docker"
        dsl:
          - "status_code==200 && (\"1937209448\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "amazon"
        dsl:
          - "status_code==200 && (\"-1544605732\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "amazon"
        dsl:
          - "status_code==200 && (\"716989053\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "phpmyadmin"
        dsl:
          - "status_code==200 && (\"-1010568750\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zhejiang-uniview-technologies-co."
        dsl:
          - "status_code==200 && (\"-1240222446\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "isp-manager"
        dsl:
          - "status_code==200 && (\"-986678507\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "axis-network-cameras"
        dsl:
          - "status_code==200 && (\"-1616143106\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "roundcube-webmail"
        dsl:
          - "status_code==200 && (\"-976235259\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "unifi-video-controller-airvision"
        dsl:
          - "status_code==200 && (\"768816037\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "pfsense"
        dsl:
          - "status_code==200 && (\"1015545776\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "freebox-os"
        dsl:
          - "status_code==200 && (\"1838417872\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hxxps"
        dsl:
          - "status_code==200 && (\"1188645141\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "keenetic"
        dsl:
          - "status_code==200 && (\"547282364\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sierra-wireless-ace-manager-airlink"
        dsl:
          - "status_code==200 && (\"-1571472432\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "synology-diskstation"
        dsl:
          - "status_code==200 && (\"149371702\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "instar-ip-cameras"
        dsl:
          - "status_code==200 && (\"-1169314298\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "webmin"
        dsl:
          - "status_code==200 && (\"-1038557304\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "octoprint-3d-printer"
        dsl:
          - "status_code==200 && (\"1307375944\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "webmin"
        dsl:
          - "status_code==200 && (\"1280907310\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vesta-hosting-control-panel"
        dsl:
          - "status_code==200 && (\"1954835352\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "farming-simulator-dedicated-server"
        dsl:
          - "status_code==200 && (\"509789953\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "residential-gateway"
        dsl:
          - "status_code==200 && (\"-1933493443\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cpanel-login"
        dsl:
          - "status_code==200 && (\"1993518473\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "arris"
        dsl:
          - "status_code==200 && (\"-1477563858\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "plex-server"
        dsl:
          - "status_code==200 && (\"-895890586\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dlink-webcam"
        dsl:
          - "status_code==200 && (\"-1354933624\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "deluge"
        dsl:
          - "status_code==200 && (\"944969688\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "webmin"
        dsl:
          - "status_code==200 && (\"479413330\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cambium-networks"
        dsl:
          - "status_code==200 && (\"-435817905\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "plesk"
        dsl:
          - "status_code==200 && (\"-981606721\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dahua-storm-ip-camera"
        dsl:
          - "status_code==200 && (\"833190513\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "10"
        dsl:
          - "status_code==200 && (\"-1314864135\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "parallels-plesk-panel"
        dsl:
          - "status_code==200 && (\"-652508439\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireware-watchguard"
        dsl:
          - "status_code==200 && (\"-569941107\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "shock&innovation!!-netis-setup"
        dsl:
          - "status_code==200 && (\"1326164945\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cacaoweb"
        dsl:
          - "status_code==200 && (\"-1738184811\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "loxone-automation"
        dsl:
          - "status_code==200 && (\"904434662\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hp-printer/server"
        dsl:
          - "status_code==200 && (\"905744673\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netflix"
        dsl:
          - "status_code==200 && (\"902521196\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "linksys-smart-wi-fi"
        dsl:
          - "status_code==200 && (\"-2063036701\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lwip-a-lightweight-tcp/ip-stack"
        dsl:
          - "status_code==200 && (\"-1205024243\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hitron-technologies"
        dsl:
          - "status_code==200 && (\"607846949\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dahua-storm-dvr"
        dsl:
          - "status_code==200 && (\"1281253102\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mobotix-camera"
        dsl:
          - "status_code==200 && (\"661332347\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "blue-iris-webcam"
        dsl:
          - "status_code==200 && (\"-520888198\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vigor-router"
        dsl:
          - "status_code==200 && (\"104189364\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "alibaba-cloud-block-page"
        dsl:
          - "status_code==200 && (\"1227052603\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dd-wrt-dd-wrt-milli_httpd"
        dsl:
          - "status_code==200 && (\"252728887\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mitel-networks-micollab-end-user-portal"
        dsl:
          - "status_code==200 && (\"-1922044295\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dlink-webcam"
        dsl:
          - "status_code==200 && (\"1221759509\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dlink-router"
        dsl:
          - "status_code==200 && (\"1037387972\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "prtg-network-monitor"
        dsl:
          - "status_code==200 && (\"-655683626\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "elastic-database"
        dsl:
          - "status_code==200 && (\"1611729805\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dlink-webcam"
        dsl:
          - "status_code==200 && (\"1144925962\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wildfly"
        dsl:
          - "status_code==200 && (\"-1666561833\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cisco-meraki-dashboard"
        dsl:
          - "status_code==200 && (\"804949239\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "workday"
        dsl:
          - "status_code==200 && (\"-459291760\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "justhost"
        dsl:
          - "status_code==200 && (\"1734609466\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "baidu-ip-error-page"
        dsl:
          - "status_code==200 && (\"-1507567067\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "intelbras-sa"
        dsl:
          - "status_code==200 && (\"2006716043\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "yii-php-framework-default-favicon"
        dsl:
          - "status_code==200 && (\"-1298108480\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "truvision-nvr-interlogix"
        dsl:
          - "status_code==200 && (\"1782271534\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "redmine"
        dsl:
          - "status_code==200 && (\"603314\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "phpmyadmin"
        dsl:
          - "status_code==200 && (\"-476231906\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cisco-eg"
        dsl:
          - "status_code==200 && (\"-646322113\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jetty-404"
        dsl:
          - "status_code==200 && (\"-629047854\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "luma-surveillance"
        dsl:
          - "status_code==200 && (\"-1351901211\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "parallels-plesk-panel"
        dsl:
          - "status_code==200 && (\"-519765377\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hp-printer-/-server"
        dsl:
          - "status_code==200 && (\"-2144363468\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "metasploit"
        dsl:
          - "status_code==200 && (\"-127886975\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "metasploit"
        dsl:
          - "status_code==200 && (\"1139788073\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "metasploit"
        dsl:
          - "status_code==200 && (\"-1235192469\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "alibi-nvr"
        dsl:
          - "status_code==200 && (\"1876585825\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sangfor"
        dsl:
          - "status_code==200 && (\"-1810847295\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "websockets-test-page-eg"
        dsl:
          - "status_code==200 && (\"-291579889\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "macos-server-apple"
        dsl:
          - "status_code==200 && (\"1629518721\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openrg"
        dsl:
          - "status_code==200 && (\"-986816620\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cisco-router"
        dsl:
          - "status_code==200 && (\"-299287097\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sangfor"
        dsl:
          - "status_code==200 && (\"-1926484046\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "herospeed-digital-technology-co.-nvr/ipc/xvr"
        dsl:
          - "status_code==200 && (\"-873627015\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "nomadix-access-gateway"
        dsl:
          - "status_code==200 && (\"2071993228\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gitlab"
        dsl:
          - "status_code==200 && (\"516963061\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "magento"
        dsl:
          - "status_code==200 && (\"-38580010\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mk-auth"
        dsl:
          - "status_code==200 && (\"1490343308\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "shoutcast-server"
        dsl:
          - "status_code==200 && (\"-632583950\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"95271369\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"1476335317\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"-842192932\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"105083909\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"240606739\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fireeye"
        dsl:
          - "status_code==200 && (\"2121539357\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "adobe-campaign-classic"
        dsl:
          - "status_code==200 && (\"-333791179\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "xampp"
        dsl:
          - "status_code==200 && (\"-1437701105\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "niagara-web-server"
        dsl:
          - "status_code==200 && (\"-676077969\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "technicolor"
        dsl:
          - "status_code==200 && (\"-2138771289\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hitron-technologies-inc."
        dsl:
          - "status_code==200 && (\"711742418\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ibm-notes"
        dsl:
          - "status_code==200 && (\"728788645\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "barracuda"
        dsl:
          - "status_code==200 && (\"1436966696\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "servicenow"
        dsl:
          - "status_code==200 && (\"86919334\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openfire-admin-console"
        dsl:
          - "status_code==200 && (\"1211608009\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hp-ilo"
        dsl:
          - "status_code==200 && (\"2059618623\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sunny-webbox"
        dsl:
          - "status_code==200 && (\"1975413433\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zyxel"
        dsl:
          - "status_code==200 && (\"943925975\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "huawei"
        dsl:
          - "status_code==200 && (\"281559989\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tenda-web-master"
        dsl:
          - "status_code==200 && (\"-2145085239\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "prometheus-time-series-collection-and-processing-server"
        dsl:
          - "status_code==200 && (\"-1399433489\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wdcp-cloud-host-management-system"
        dsl:
          - "status_code==200 && (\"1786752597\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "domoticz-home-automation"
        dsl:
          - "status_code==200 && (\"90680708\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tableau"
        dsl:
          - "status_code==200 && (\"-1441956789\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openwrt-luci"
        dsl:
          - "status_code==200 && (\"-675839242\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubiquiti-airos"
        dsl:
          - "status_code==200 && (\"1020814938\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mdaemon-webmail"
        dsl:
          - "status_code==200 && (\"-766957661\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "teltonika"
        dsl:
          - "status_code==200 && (\"119741608\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "entrolink"
        dsl:
          - "status_code==200 && (\"1973665246\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "windriver-webserver"
        dsl:
          - "status_code==200 && (\"74935566\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "microhard-systems"
        dsl:
          - "status_code==200 && (\"-1723752240\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "skype"
        dsl:
          - "status_code==200 && (\"-1807411396\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "teltonika"
        dsl:
          - "status_code==200 && (\"-1612496354\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "eltex-router"
        dsl:
          - "status_code==200 && (\"1877797890\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bintec-elmeg"
        dsl:
          - "status_code==200 && (\"-375623619\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "syncthru-web-service-printers"
        dsl:
          - "status_code==200 && (\"1483097076\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "boaserver"
        dsl:
          - "status_code==200 && (\"1169183049\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "securepoint"
        dsl:
          - "status_code==200 && (\"1051648103\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "moodle"
        dsl:
          - "status_code==200 && (\"-438482901\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "radix"
        dsl:
          - "status_code==200 && (\"-1492966240\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cradlepoint-technology-router"
        dsl:
          - "status_code==200 && (\"1466912879\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "drupal"
        dsl:
          - "status_code==200 && (\"-167656799\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "blackboard"
        dsl:
          - "status_code==200 && (\"-1593651747\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jupyter-notebook"
        dsl:
          - "status_code==200 && (\"-895963602\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hostmonster---web-hosting"
        dsl:
          - "status_code==200 && (\"-972810761\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-router/network"
        dsl:
          - "status_code==200 && (\"1703788174\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "rocket-chat"
        dsl:
          - "status_code==200 && (\"225632504\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mofinetwork"
        dsl:
          - "status_code==200 && (\"-1702393021\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zabbix"
        dsl:
          - "status_code==200 && (\"892542951\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "totolink-network"
        dsl:
          - "status_code==200 && (\"547474373\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ossia-provision-sr-|-webcam/ip-camera"
        dsl:
          - "status_code==200 && (\"-374235895\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cpanel-login"
        dsl:
          - "status_code==200 && (\"1544230796\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-router/network"
        dsl:
          - "status_code==200 && (\"517158172\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jeedom-home-automation"
        dsl:
          - "status_code==200 && (\"462223993\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jboss-application-server-7"
        dsl:
          - "status_code==200 && (\"937999361\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "niagara-web-server-/-tridium"
        dsl:
          - "status_code==200 && (\"1991562061\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "solarwinds-serv-u-ftp-server"
        dsl:
          - "status_code==200 && (\"812385209\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "aruba-virtual-controller"
        dsl:
          - "status_code==200 && (\"1142227528\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dell"
        dsl:
          - "status_code==200 && (\"-1153950306\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "remobjects-sdk-/-remoting-sdk-for-.net-http-server-microsoft"
        dsl:
          - "status_code==200 && (\"72005642\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zyxel-zywall"
        dsl:
          - "status_code==200 && (\"-484708885\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "visualsvn-server"
        dsl:
          - "status_code==200 && (\"706602230\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jboss"
        dsl:
          - "status_code==200 && (\"-656811182\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "starface-voip-software"
        dsl:
          - "status_code==200 && (\"-332324409\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netis-network-devices"
        dsl:
          - "status_code==200 && (\"-594256627\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "whm"
        dsl:
          - "status_code==200 && (\"-649378830\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tandberg"
        dsl:
          - "status_code==200 && (\"97604680\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ghost-cms"
        dsl:
          - "status_code==200 && (\"-1015932800\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "avtech-ip-surveillance-camera"
        dsl:
          - "status_code==200 && (\"-194439630\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "liferay-portal"
        dsl:
          - "status_code==200 && (\"129457226\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "parallels-plesk-panel"
        dsl:
          - "status_code==200 && (\"-771764544\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "odoo"
        dsl:
          - "status_code==200 && (\"-617743584\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "polycom"
        dsl:
          - "status_code==200 && (\"77044418\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cake-php"
        dsl:
          - "status_code==200 && (\"980692677\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "exacq"
        dsl:
          - "status_code==200 && (\"476213314\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "checkpoint"
        dsl:
          - "status_code==200 && (\"794809961\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ubiquiti-unms"
        dsl:
          - "status_code==200 && (\"1157789622\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cpanel-login"
        dsl:
          - "status_code==200 && (\"1244636413\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "worldclient-for-mdaemon"
        dsl:
          - "status_code==200 && (\"1985721423\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netport-software-dsl"
        dsl:
          - "status_code==200 && (\"-1124868062\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "f5-big-ip"
        dsl:
          - "status_code==200 && (\"-335242539\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mailcow"
        dsl:
          - "status_code==200 && (\"2146763496\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "qnap-nas-virtualization-station"
        dsl:
          - "status_code==200 && (\"-1041180225\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netgear"
        dsl:
          - "status_code==200 && (\"-1319025408\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gogs"
        dsl:
          - "status_code==200 && (\"917966895\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "trendnet-ip-camera"
        dsl:
          - "status_code==200 && (\"512590457\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "asustor"
        dsl:
          - "status_code==200 && (\"1678170702\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dahua"
        dsl:
          - "status_code==200 && (\"-1466785234\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "discuz!"
        dsl:
          - "status_code==200 && (\"-505448917\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wdcp-cloud-host-management-system"
        dsl:
          - "status_code==200 && (\"255892555\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "joomla"
        dsl:
          - "status_code==200 && (\"1627330242\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "smartermail"
        dsl:
          - "status_code==200 && (\"-1935525788\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "seafile"
        dsl:
          - "status_code==200 && (\"-12700016\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bintec-elmeg"
        dsl:
          - "status_code==200 && (\"1770799630\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netgear-readynas"
        dsl:
          - "status_code==200 && (\"-137295400\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ipecs"
        dsl:
          - "status_code==200 && (\"-195508437\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bet365"
        dsl:
          - "status_code==200 && (\"-2116540786\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "reolink"
        dsl:
          - "status_code==200 && (\"-38705358\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "idera"
        dsl:
          - "status_code==200 && (\"-450254253\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "proofpoint"
        dsl:
          - "status_code==200 && (\"-1630354993\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kerio-connect-webmail"
        dsl:
          - "status_code==200 && (\"-1678298769\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "worldclient-for-mdaemon"
        dsl:
          - "status_code==200 && (\"-35107086\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "realtek"
        dsl:
          - "status_code==200 && (\"2055322029\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ruijie-networks-login"
        dsl:
          - "status_code==200 && (\"-692947551\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "askey-cable-modem"
        dsl:
          - "status_code==200 && (\"-1710631084\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "askey-cable-modem"
        dsl:
          - "status_code==200 && (\"89321398\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jaws-web-server-ip-camera"
        dsl:
          - "status_code==200 && (\"90066852\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jaws-web-server-ip-camera"
        dsl:
          - "status_code==200 && (\"768231242\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "homegrown-website-hosting"
        dsl:
          - "status_code==200 && (\"-421986013\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "technicolor-/-thomson-speedtouch-network-/-adsl"
        dsl:
          - "status_code==200 && (\"156312019\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dvr-korean"
        dsl:
          - "status_code==200 && (\"-560297467\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "joomla"
        dsl:
          - "status_code==200 && (\"-1950415971\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tp-link-network-device"
        dsl:
          - "status_code==200 && (\"1842351293\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "salesforce"
        dsl:
          - "status_code==200 && (\"1433417005\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "apache-haus"
        dsl:
          - "status_code==200 && (\"-632070065\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "untangle"
        dsl:
          - "status_code==200 && (\"1103599349\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "shenzhen-coship-electronics-co."
        dsl:
          - "status_code==200 && (\"224536051\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-router/network"
        dsl:
          - "status_code==200 && (\"1038500535\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-camera"
        dsl:
          - "status_code==200 && (\"-355305208\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kibana"
        dsl:
          - "status_code==200 && (\"-267431135\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kibana"
        dsl:
          - "status_code==200 && (\"-759754862\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kibana"
        dsl:
          - "status_code==200 && (\"-1200737715\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kibana"
        dsl:
          - "status_code==200 && (\"75230260\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kibana"
        dsl:
          - "status_code==200 && (\"1668183286\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "intelbras-sa"
        dsl:
          - "status_code==200 && (\"283740897\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "icecast-streaming-media-server"
        dsl:
          - "status_code==200 && (\"1424295654\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "nec-webpro"
        dsl:
          - "status_code==200 && (\"1922032523\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vivotek-camera"
        dsl:
          - "status_code==200 && (\"-1654229048\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "microsoft-iis"
        dsl:
          - "status_code==200 && (\"-1414475558\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "univention-portal"
        dsl:
          - "status_code==200 && (\"-1697334194\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "portainer-docker-management"
        dsl:
          - "status_code==200 && (\"-1424036600\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "nos-router"
        dsl:
          - "status_code==200 && (\"-831826827\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tongda"
        dsl:
          - "status_code==200 && (\"-759108386\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "crushftp"
        dsl:
          - "status_code==200 && (\"-1022206565\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "endian-firewall"
        dsl:
          - "status_code==200 && (\"-1225484776\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kerio-control-firewall"
        dsl:
          - "status_code==200 && (\"-631002664\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ferozo-panel"
        dsl:
          - "status_code==200 && (\"2072198544\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kerio-control-firewall"
        dsl:
          - "status_code==200 && (\"-466504476\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cafe24-korea"
        dsl:
          - "status_code==200 && (\"1251810433\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mautic-open-source-marketing-automation"
        dsl:
          - "status_code==200 && (\"1273982002\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netiaspot-network"
        dsl:
          - "status_code==200 && (\"-978656757\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "multilaser"
        dsl:
          - "status_code==200 && (\"916642917\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "canvas-lms-learning-management"
        dsl:
          - "status_code==200 && (\"575613323\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ibm-server"
        dsl:
          - "status_code==200 && (\"1726027799\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "adb-broadband-s.p.a.-network"
        dsl:
          - "status_code==200 && (\"-587741716\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "arris-network"
        dsl:
          - "status_code==200 && (\"-360566773\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "huawei-network"
        dsl:
          - "status_code==200 && (\"-884776764\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wampserver"
        dsl:
          - "status_code==200 && (\"929825723\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "seagate-technology-nas"
        dsl:
          - "status_code==200 && (\"240136437\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "upc-ceska-republica-network"
        dsl:
          - "status_code==200 && (\"1911253822\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "flussonic-video-streaming"
        dsl:
          - "status_code==200 && (\"-393788031\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "joomla"
        dsl:
          - "status_code==200 && (\"366524387\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wampserver"
        dsl:
          - "status_code==200 && (\"443944613\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "metabase"
        dsl:
          - "status_code==200 && (\"1953726032\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-network"
        dsl:
          - "status_code==200 && (\"-2031183903\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mobileiron"
        dsl:
          - "status_code==200 && (\"545827989\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mobileiron"
        dsl:
          - "status_code==200 && (\"967636089\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mobileiron"
        dsl:
          - "status_code==200 && (\"362091310\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mobileiron"
        dsl:
          - "status_code==200 && (\"2086228042\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "communigate"
        dsl:
          - "status_code==200 && (\"-1588746893\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zte-network"
        dsl:
          - "status_code==200 && (\"1427976651\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "infinet-wireless-|-wanflex-network"
        dsl:
          - "status_code==200 && (\"1648531157\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mersive-solstice"
        dsl:
          - "status_code==200 && (\"938616453\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "université-toulouse-1-capitole"
        dsl:
          - "status_code==200 && (\"1632780968\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "digium-switchvox"
        dsl:
          - "status_code==200 && (\"2068154487\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "powermta-monitoring"
        dsl:
          - "status_code==200 && (\"-1788112745\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "smartlan/g"
        dsl:
          - "status_code==200 && (\"-644617577\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "checkpoint-gaia"
        dsl:
          - "status_code==200 && (\"-1822098181\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mailwizz"
        dsl:
          - "status_code==200 && (\"2127152956\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "rabbitmq"
        dsl:
          - "status_code==200 && (\"1064742722\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openmediavault-nas"
        dsl:
          - "status_code==200 && (\"-693082538\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openwrt-luci"
        dsl:
          - "status_code==200 && (\"1941381095\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "honeywell"
        dsl:
          - "status_code==200 && (\"903086190\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bomgar-support-portal"
        dsl:
          - "status_code==200 && (\"829321644\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "nuxt-js"
        dsl:
          - "status_code==200 && (\"-1442789563\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "roundcube-webmail"
        dsl:
          - "status_code==200 && (\"-2140379067\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-camera"
        dsl:
          - "status_code==200 && (\"-1897829998\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netgear-network"
        dsl:
          - "status_code==200 && (\"1047213685\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sonarqube"
        dsl:
          - "status_code==200 && (\"1485257654\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lupus-electronics-xt"
        dsl:
          - "status_code==200 && (\"-299324825\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vanderbilt-spc"
        dsl:
          - "status_code==200 && (\"-1162730477\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vzpp-plesk"
        dsl:
          - "status_code==200 && (\"-1268095485\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "baidu"
        dsl:
          - "status_code==200 && (\"1118684072\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "owncloud"
        dsl:
          - "status_code==200 && (\"-1616115760\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sentora"
        dsl:
          - "status_code==200 && (\"-2054889066\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "alfresco"
        dsl:
          - "status_code==200 && (\"1333537166\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "digital-keystone-dk"
        dsl:
          - "status_code==200 && (\"-373674173\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wispr-airlan"
        dsl:
          - "status_code==200 && (\"-106646451\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "synology-vpn-plus"
        dsl:
          - "status_code==200 && (\"1235070469\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sentry"
        dsl:
          - "status_code==200 && (\"2063428236\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "watchguard"
        dsl:
          - "status_code==200 && (\"15831193\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "web-client-pro"
        dsl:
          - "status_code==200 && (\"-956471263\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tecvoz"
        dsl:
          - "status_code==200 && (\"-1452159623\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mdaemon-remote-administration"
        dsl:
          - "status_code==200 && (\"99432374\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "paradox-ip-module"
        dsl:
          - "status_code==200 && (\"727253975\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dokuwiki"
        dsl:
          - "status_code==200 && (\"-630493013\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sails"
        dsl:
          - "status_code==200 && (\"552597979\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "fastpanel-hosting"
        dsl:
          - "status_code==200 && (\"774252049\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "c-lodop"
        dsl:
          - "status_code==200 && (\"-329747115\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jamf-pro-login"
        dsl:
          - "status_code==200 && (\"1262005940\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "struxureware-schneider-electric"
        dsl:
          - "status_code==200 && (\"979634648\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "axcient-replibit-management-server"
        dsl:
          - "status_code==200 && (\"475379699\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "twonky-server-media-streaming"
        dsl:
          - "status_code==200 && (\"-878891718\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "windows-azure"
        dsl:
          - "status_code==200 && (\"-2125083197\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "isp-manager-web-hosting-panel"
        dsl:
          - "status_code==200 && (\"-1151675028\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "jupyterhub"
        dsl:
          - "status_code==200 && (\"1248917303\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "centurylink-modem-gui-login-eg"
        dsl:
          - "status_code==200 && (\"-1908556829\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tecvoz"
        dsl:
          - "status_code==200 && (\"1059329877\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "opnsense"
        dsl:
          - "status_code==200 && (\"-1148190371\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ligowave-network"
        dsl:
          - "status_code==200 && (\"1467395679\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "rumpus"
        dsl:
          - "status_code==200 && (\"-1528414776\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "spiceworks-panel"
        dsl:
          - "status_code==200 && (\"-2117390767\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "teamcity"
        dsl:
          - "status_code==200 && (\"-1944119648\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "instar-full-hd-ip-camera"
        dsl:
          - "status_code==200 && (\"-1748763891\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gpon-home-gateway"
        dsl:
          - "status_code==200 && (\"251106693\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "alienvault"
        dsl:
          - "status_code==200 && (\"-1779611449\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "arbor-networks"
        dsl:
          - "status_code==200 && (\"-1745552996\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "accrisoft"
        dsl:
          - "status_code==200 && (\"-1275148624\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "yasni"
        dsl:
          - "status_code==200 && (\"-178685903\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "slack"
        dsl:
          - "status_code==200 && (\"-43161126\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "innovaphone"
        dsl:
          - "status_code==200 && (\"671221099\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "shinobi-cctv"
        dsl:
          - "status_code==200 && (\"-10974981\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tp-link-network-device"
        dsl:
          - "status_code==200 && (\"1274078387\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "siemens-ozw772"
        dsl:
          - "status_code==200 && (\"-336242473\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lantronix-spider"
        dsl:
          - "status_code==200 && (\"882208493\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "claimtime-ramsell-public-health-&-safety"
        dsl:
          - "status_code==200 && (\"-687783882\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "surfilter-ssl-vpn-portal"
        dsl:
          - "status_code==200 && (\"-590892202\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "kyocera-printer"
        dsl:
          - "status_code==200 && (\"-50306417\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lucee!"
        dsl:
          - "status_code==200 && (\"784872924\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ricoh"
        dsl:
          - "status_code==200 && (\"1135165421\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "handle-proxy"
        dsl:
          - "status_code==200 && (\"926501571\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "metasploit"
        dsl:
          - "status_code==200 && (\"579239725\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-689902428\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-600508822\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"656868270\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-2056503929\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-1656695885\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"331870709\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"1241049726\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"998138196\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"322531336\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-401934945\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iomega-nas"
        dsl:
          - "status_code==200 && (\"-613216179\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "chef-automate"
        dsl:
          - "status_code==200 && (\"-276759139\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gargoyle-router-management-utility"
        dsl:
          - "status_code==200 && (\"1862132268\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "keepitsafe-management-console"
        dsl:
          - "status_code==200 && (\"-1738727418\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "entronix-energy-management-platform"
        dsl:
          - "status_code==200 && (\"-368490461\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openproject"
        dsl:
          - "status_code==200 && (\"1836828108\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "unified-management-console-polycom"
        dsl:
          - "status_code==200 && (\"-1775553655\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "moxapass-iologik-remote-ethernet-i/o-server-"
        dsl:
          - "status_code==200 && (\"381100274\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hfs-http-file-server"
        dsl:
          - "status_code==200 && (\"2124459909\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "hfs-http-file-server"
        dsl:
          - "status_code==200 && (\"731374291\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "traccar-gps-tracking"
        dsl:
          - "status_code==200 && (\"-335153896\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "iw"
        dsl:
          - "status_code==200 && (\"896412703\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "wordpress-under-construction-icon"
        dsl:
          - "status_code==200 && (\"191654058\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "combivox"
        dsl:
          - "status_code==200 && (\"-342262483\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netcomwireless-network"
        dsl:
          - "status_code==200 && (\"5542029\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "elastic-database"
        dsl:
          - "status_code==200 && (\"1552860581\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "drupal"
        dsl:
          - "status_code==200 && (\"1174841451\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "truvision-nvr"
        dsl:
          - "status_code==200 && (\"-1093172228\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "spamexperts"
        dsl:
          - "status_code==200 && (\"-1688698891\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "sonatype-nexus-repository-manager"
        dsl:
          - "status_code==200 && (\"-1546574541\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "idirect-canada-network-management"
        dsl:
          - "status_code==200 && (\"-256828986\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "openerp-now-known-as-odoo"
        dsl:
          - "status_code==200 && (\"1966198264\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "pkp-openjournalsystems-public-knowledge-project"
        dsl:
          - "status_code==200 && (\"2099342476\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "liquidfiles"
        dsl:
          - "status_code==200 && (\"541087742\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "zyxel-network"
        dsl:
          - "status_code==200 && (\"-882760066\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "universal-devices-ud"
        dsl:
          - "status_code==200 && (\"16202868\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "huawei-network"
        dsl:
          - "status_code==200 && (\"987967490\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gm77[.]com"
        dsl:
          - "status_code==200 && (\"-647318973\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "okazik[.]pl"
        dsl:
          - "status_code==200 && (\"-1583478052\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "gitea"
        dsl:
          - "status_code==200 && (\"1969970750\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "tc-group"
        dsl:
          - "status_code==200 && (\"-1734573358\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "deluge-web-ui"
        dsl:
          - "status_code==200 && (\"-1589842876\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "登录-amh"
        dsl:
          - "status_code==200 && (\"1822002133\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "otrs-open-ticket-request-system"
        dsl:
          - "status_code==200 && (\"-2006308185\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "bosch-security-systems-camera"
        dsl:
          - "status_code==200 && (\"-1702769256\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "node-red"
        dsl:
          - "status_code==200 && (\"321591353\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "motioneye-camera"
        dsl:
          - "status_code==200 && (\"-923693877\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "saia-burgess-controls-pcd"
        dsl:
          - "status_code==200 && (\"-1547576879\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "arcadyan-o2-box-network"
        dsl:
          - "status_code==200 && (\"1479202414\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "d-link-network"
        dsl:
          - "status_code==200 && (\"1081719753\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "abilis-network/automation"
        dsl:
          - "status_code==200 && (\"-166151761\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ghost-cms"
        dsl:
          - "status_code==200 && (\"-1231681737\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airwatch"
        dsl:
          - "status_code==200 && (\"321909464\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airwatch"
        dsl:
          - "status_code==200 && (\"-1153873472\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airwatch"
        dsl:
          - "status_code==200 && (\"1095915848\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airwatch"
        dsl:
          - "status_code==200 && (\"788771792\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "airwatch"
        dsl:
          - "status_code==200 && (\"-1863663974\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "keyhelp-keyweb-ag"
        dsl:
          - "status_code==200 && (\"-1267819858\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "keyhelp-keyweb-ag"
        dsl:
          - "status_code==200 && (\"726817668\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "glpi"
        dsl:
          - "status_code==200 && (\"-1474875778\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "netcom-technology"
        dsl:
          - "status_code==200 && (\"5471989\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cradlepoint"
        dsl:
          - "status_code==200 && (\"-1457536113\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "myasp"
        dsl:
          - "status_code==200 && (\"-736276076\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "intelbras-sa"
        dsl:
          - "status_code==200 && (\"-1343070146\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "lenel"
        dsl:
          - "status_code==200 && (\"538585915\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "okofen-pellematic"
        dsl:
          - "status_code==200 && (\"-625364318\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "simplehelp-remote-support"
        dsl:
          - "status_code==200 && (\"1117165781\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "graphql"
        dsl:
          - "status_code==200 && (\"-1067420240\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dnn-cms"
        dsl:
          - "status_code==200 && (\"-1465479343\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "apple"
        dsl:
          - "status_code==200 && (\"1232159009\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "apple"
        dsl:
          - "status_code==200 && (\"1382324298\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "apple"
        dsl:
          - "status_code==200 && (\"-1498185948\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ispconfig"
        dsl:
          - "status_code==200 && (\"483383992\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "microsoft-outlook"
        dsl:
          - "status_code==200 && (\"-1249852061\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "possibly-dvr"
        dsl:
          - "status_code==200 && (\"999357577\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "possible-ip-camera"
        dsl:
          - "status_code==200 && (\"492290497\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "dvr"
        dsl:
          - "status_code==200 && (\"400100893\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "One Identity Password Manager"
        dsl:
          - "status_code==200 && (\"983384876\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Kaseya"
        dsl:
          - "status_code==200 && (\"-1445519482\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "OpenSNS"
        dsl:
          - "status_code==200 && (\"1167011145\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "SpamSniper"
        dsl:
          - "status_code==200 && (\"-1000719429\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Selea-ANPR-Camera"
        dsl:
          - "status_code==200 && (\"-41369781\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Selea-CarPlateServer"
        dsl:
          - "status_code==200 && (\"-656528622\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "KevinLAB"
        dsl:
          - "status_code==200 && (\"-1650202746\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "qdPM"
        dsl:
          - "status_code==200 && (\"762074255\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "cisco-ucs"
        dsl:
          - "status_code==200 && (\"-521603470\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "vmware-Workspace-ONE-Access"
        dsl:
          - "status_code==200 && (\"-1250474341\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "mspcontrol"
        dsl:
          - "status_code==200 && (\"331817455\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Ionic"
        dsl:
          - "status_code==200 && (\"-1698328762\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Tufin-SecureTrack"
        dsl:
          - "status_code==200 && (\"-1238669242\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "WSO2-api-manager"
        dsl:
          - "status_code==200 && (\"1398055326\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Synapse-Mobility"
        dsl:
          - "status_code==200 && (\"-2015389528\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Gradle-enterprise"
        dsl:
          - "status_code==200 && (\"1614287628\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Kubernetes-Operational-View"
        dsl:
          - "status_code==200 && (\"2130463260\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Rancher"
        dsl:
          - "status_code==200 && (\"464587962\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Emby"
        dsl:
          - "status_code==200 && (\"902188936\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Zimbra"
        dsl:
          - "status_code==200 && (\"1624375939\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "ICT Protege WX"
        dsl:
          - "status_code==200 && (\"1841044852\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Coverity"
        dsl:
          - "status_code==200 && (\"-994319624\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Aqua Enterprise"
        dsl:
          - "status_code==200 && (\"-1261322577\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Leica RefWorx"
        dsl:
          - "status_code==200 && (\"-1054477011\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Liferay"
        dsl:
          - "status_code==200 && (\"-2024949122\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "GoAnyWhere"
        dsl:
          - "status_code==200 && (\"1484947000\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Vue.js"
        dsl:
          - "status_code==200 && (\"-1252041730\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Sophos Email Appliance"
        dsl:
          - "status_code==200 && (\"-830586692\" == mmh3(base64_py(body)))"

      - type: dsl
        name: "Temporal Web UI"
        dsl:
          - "status_code==200 && (\"557327884\" == mmh3(base64_py(body)))"

# digest: 4a0a00473045022100d71ac6e337a29693c828dd52cf7bdd31b46245a76ca3464f385f1f66244c2ea502207d0d9d59f973c1834b815447948836d0d84bb70ab51a9aeec1c78b06ece23fc0:922c64590222798bb761d5b6d8e72950