| 360 | Detectability: Easy Detection Methodology: Returns status code 493 upon unusual requests. Blockpage may contain reference to wzws-waf-cgi/ directory. Blocked response page source may contain: Reference to wangshan.360.cn URL. Sorry! Your access has been intercepted because your links may threaten website security. text snippet. Response headers may contain X-Powered-By-360WZB header. Blocked response headers contain unique header WZWS-Ray. Server header may contain value qianxin-waf. |
| aeSecure | Detectability: Moderate Detection Methodology: Blocked response content contains aesecure_denied.png image (view source to see). Response headers contain aeSecure-code value. |
| Airlock | Detectability: Moderate/Difficult Detection Methodology: Set-Cookie headers may contain: AL-SESS cookie field name (case insensitive). AL-LB value (case insensitive). Blocked response page contains: Server detected a syntax error in your request text. Check your request and all parameters text snippet. |
| AlertLogic | Detectability: Difficult Detection Methodology: Blocked response page contains: We are sorry, but the page you are looking for cannot be found text snippet. The page has either been removed, renamed or temporarily unavailable text. 404 Not Found in red letters. |
| Aliyundun | Detectability: Easy Detection Methodology: Blocked response page contains: Sorry, your request has been blocked as it may cause potential threats to the server’s security text snippet. Reference to errors.aliyun.com site URL. Blocked response code returned is 405. |
| Anquanbao | Detectability: Easy Detection Methodology: Returns blocked HTTP response code 405 upon malicious requests. Blocked response content may contain /aqb_cc/error/ or hidden_intercept_time. Response headers contain X-Powered-by-Anquanbao header field. |
| Anyu | Detectability: Easy Detection Methodology: Blocked response content contains Sorry! your access has been intercepted by AnYu Blocked response page contains AnYu- the green channel text. Response headers may contain unusual header WZWS-RAY. |
| Approach | Detectability: Easy Detection Methodology: Blocked response page content may contain: Approach Web Application Firewall Framework heading. Your IP address has been logged and this information could be used by authorities to track you. warning. Sorry for the inconvenience! keyword. Approach infrastructure team text snippet. Server header has field value set to Approach. |
| Armor Defense | Detectability: Easy Detection Methodology: Blocked response content contains: This request has been blocked by website protection from Armor text. If you manage this domain please create an Armor support ticket snippet. |
| ArvanCloud | Detectability: Easy Detection Methodology: Server header contains ArvanCloud keyword. |
| ASPA | Detectability: Easy Detection Methodology: Server header contains ASPA-WAF keyword. Response contain unique header ASPA-Cache-Status with content HIT or MISS. |
| ASP.NET Generic | Detectability: Moderate Detection Methodology: Response headers may contain X-ASPNET-Version header value. Blocked response page content may contain: This generic 403 error means that the authenticated user is not authorized to use the requested resource. Error Code 0x00000000< keyword. X-Powered-By header has field value set to ASP.NET. |
| Astra | Detectability: Easy Detection Methodology: Blocked response page content may contain: Sorry, this is not allowed. in h1. our website protection system has detected an issue with your IP address and wont let you proceed any further text snippet. Reference to www.getastra.com/assets/images/ URL. Response cookies has field value cz_astra_csrf_cookie in response headers. |
| AWS ELB | Detectability: Moderate Detection Methodology: Response headers might contain: AWSALB cookie field value. X-AMZ-ID header. X-AMZ-REQUEST-ID header. Response page may contain: Access Denied in their keyword. Request token ID with length from 20 to 25 between RequestId tag. Server header field contains awselb/2.0 value. |
| Baidu Yunjiasu | Detectability: Moderate Detection Methodology: Server header may contain Yunjiasu-nginx value. Server header may contain Yunjiasu value. |
| Barikode | Detectability: Easy Detection Methodology: Blocked response page content contains: BARIKODE keyword. Forbidden Access text snippet in h1. |
| Barracuda | Detectability: Moderate Detection Methodology: Response cookies may contain barracounter_session value. Response headers may contain barracuda keyword. Response page contains: You have been blocked heading. You are unable to access this website text. |
| Bekchy | Detectability: Easy Detection Methodology: Blocked response headers contains Bekchy – Access Denied. Blocked response page contains reference to https://bekchy.com/report. |
| BinarySec | Detectability: Moderate Detection Methodology: Response headers contain: X-BinarySec-Via field. X-BinarySec-NoCache field. Server header contains BinarySec keyword. |
| BitNinja | Detectability: Easy Detection Methodology: Blocked response page may contain: Security check by BitNinja text snippet. your IP will be removed from BitNinja. Visitor anti-robot validation text snippet. (You will be challenged by a reCAPTCHA page) text. |
| BIG-IP ASM | Detectability: Moderate Detection Methodology: Response headers may contain BigIP or F5 keyword value. Response header fields may contain X-WA-Info header. Response headers might have jumbled X-Cnection field value. |
| BlockDos | Detectability: Moderate Detection Methodology: Server header contains value BlockDos.net. |
| Bluedon IST | Detectability: Easy Detection Methodology: Server header contains BDWAF field value. Blocked response page contains to Bluedon Web Application Firewall text snippet.. |
| BulletProof Security Pro | Detectability: Moderate Detection Methodology: Blocked response page contains: div with id as bpsMessage text snippet. If you arrived here due to a search or clicking on a link click your Browser’s back button to return to the previous page. text snippet. |
| CDN NS Application Gateway | Detectability: Easy Detection Methodology: Blocked response page contains CdnNsWAF Application Gateway text snippet. |
| Cerber (WordPress) | Detectability: Difficult Detection Methodology: Blocked response page contains: We’re sorry, you are not allowed to proceed text snippet. Your request looks suspicious or similar to automated requests from spam posting software warning. |
| Chaitin Safeline | Detectability: Difficult Detection Methodology: Blocked response page contains event_id keyword within HTML comments. |
| ChinaCache | Detectability: Easy Detection Methodology: Response headers contain Powered-by-ChinaCache field. |
| Cisco ACE XML Gateway | Detectability: Moderate Detection Methodology: Server header has value ACE XML Gateway set. |
| Cloudbric | Detectability: Moderate Detection Methodology: Response content contains: Malicious Code Detected heading. Your request was blocked by Cloudbric text snippet. Reference to https://cloudbric.zendesk.com URL. Cloudbric Help Center text. Page title starting with Cloudbric \ |
| Cloudflare | Detectability: Easy Detection Methodology: Response headers might have cf-ray field value. Server header field has value cloudflare. Set-Cookie response headers have __cfuid= cookie field. Page content might have Attention Required! or Cloudflare Ray ID:. Page content may contain DDoS protection by Cloudflareas text. You may encounter CLOUDFLARE_ERROR_500S_BOX upon hitting invalid URLs. |
| CloudfloorDNS | Detectability: Easy Detection Methodology: Server header field has value CloudfloorDNS WAF. Block-page title might have CloudfloorDNS – Web Application Firewall Error. Page content may contain www.cloudfloordns.com/contact URL as a contact link. |
| Cloudfront | Detectability: Easy Detection Methodology: Blocked response content contains Generated by cloudfront (CloudFront) error upon malicious request. |
| Comodo cWatch | Detectability: Easy Detection Methodology: Server header contains Protected by COMODO WAF value. |
| CrawlProtect | Detectability: Easy Detection Methodology: Response cookies might contain crawlprotect cookie name. Block Page title has CrawlProtect keyword in it. Blocked response content contains value This site is protected by CrawlProtect !!! upon malicious request. |
| Deny-All | Detectability: Difficult Detection Methodology: Response content contains value Condition Intercepted. Set-Cookie header contains cookie field sessioncookie. |
| Distil Web Protection | Detectability: Easy Detection Methodology: Response headers contain field value X-Distil-CS in all requests. Blocked response page contains: Pardon Our Interruption… heading. You have disabled javascript in your browser. text snippet. Something about your browser made us think that you are a bot. text. |
| DoSArrest Internet Security | Detectability: Easy Detection Methodology: Response headers contain field value X-DIS-Request-ID. Server header contains DOSarrest keyword. |
| DotDefender | Detectability: Easy Detection Methodology: Blocked response content contains value dotDefender Blocked Your Request. Blocked response headers contain X-dotDefender-denied field value. |
| DynamicWeb Injection Check | Detectability: Easy Detection Methodology: Blocked response headers contain X-403-Status-By field with value dw-inj-check value. |
| e3Learning Security | Detectability: Easy Detection Methodology: Server header contains e3Learning_WAF keyword. |
| EdgeCast (Verizon) | Detectability: Easy Detection Methodology: Blocked response content contains value Please contact the site administrator, and provide the following Reference ID:EdgeCast Web Application Firewall (Verizon). Blocked response code returns 400 Bad Request on malicious requests. |
| Eisoo Cloud | Detectability: Easy Detection Methodology: Blocked response page content may contain: /eisoo-firewall-block.css reference. www.eisoo.com URL. © (year) Eisoo Inc. keyword. Server header has field value set to EisooWAF-AZURE/EisooWAF. |
| Expression Engine | Detectability: Difficult Detection Methodology: Blocked response page returns Invalid URI generally. Blocked response content contains value Invalid GET Request upon malicious GET queries. Blocked POST type queries contain Invalid Data in response content. |
| F5 ASM | Detectability: Difficult Detection Methodology: Blocked response content contains warning The requested URL was rejected. Please consult with your administrator. |
| FortiWeb | Detectability: Moderate Detection Methodology: Response headers contain FORTIWAFSID= on malicious requests. Blocked response page contains: Reference to .fgd_icon image icon. Server Unavailable! as heading. Server unavailable. Please visit later. as text. |
| GoDaddy | Detectability: Easy Detection Methodology: Blocked response page contains value Access Denied – GoDaddy Website Firewall. |
| GreyWizard | Detectability: Easy Detection Methodology: Blocked response page conatins: Grey Wizard as title. Contact the website owner or Grey Wizard text snippet. We’ve detected attempted attack or non standard traffic from your IP address text snippet. Server header contain greywizard keyword. |
| Huawei Cloud | Detectability: Easy Detection Methodology: Blocked response page contains: Reference to account.hwclouds.com/static/error/images/404img.jpg error image. Reference to www.hwclouds.com URL. Reference to hws_security@{site.tld} e-mail for reporting. |
| HyperGuard | Detectability: Difficult Detection Methodology: Set-Cookie header has cookie field ODSESSION= in response headers. |
| IBM DataPower | Detectability: Difficult Detection Methodology: Response headers contains field value value X-Backside-Transport with value OK or FAIL. |
| Imperva Incapsula | Detectability: Easy Detection Methodology: Blocked response page content may contain: Powered By Incapsula text snippet. Incapsula incident ID keyword. _Incapsula_Resource keyword. subject=WAF Block Page keyword. Normal GET request headers contain visid_incap value. Response headers may contain X-Iinfo header field name. Set-Cookie header has cookie field incap_ses and visid_incap. |
| Immunify360 | Detectability: Easy Detection Methodology: Server header contain imunify360-webshield keyword. Response page contains: Powered by Imunify360 text snippet. imunify360 preloader if response type is JSON. Blocked response page contains protected by Imunify360 text. |
| IndusGuard | Detectability: Moderate Detection Methodology: Server header contains value IF_WAF. Blocked response content contains warning further investigation and remediation with a screenshot of this page. Response headers contain a unique header X-Version. |
| Instart DX | Detectability: Easy Detection Methodology: Response headers contain X-Instart-Request-ID unique header. Response headers contain X-Instart-WL unique header fingerprint. Response headers contain X-Instart-Cache unique header fingerprint. Blocked response page contains The requested URL was rejected. Please consult with your administrator. text. |
| ISA Server | Detectability: Difficult Detection Methodology: Response page contains: The ISA Server denied the specified Uniform Resource Locator (URL) text snippet. The server denied the specified Uniform Resource Locator (URL). Contact the server administrator. text snippet |
| Janusec Application Gateway | Detectability: Easy Detection Methodology: Blocked response page has image displaying JANUSEC name and logo. Blocked response page displays Janusec Application Gateway on malicious requests. |
| Jiasule | Detectability: Easy Detection Methodology: Blocked response page contains reference to static.jiasule.com/static/js/http_error.js URL. Set-Cookie header has cookie field __jsluid= or jsl_trackingin response headers. Server header has jiasule-WAF keywords. Blocked response content has notice-jiasule keyword. |
| KeyCDN | Detectability: Easy Detection Methodology: Server header contains KeyCDN keyword. |
| KnownSec | Detectability: Easy Detection Methodology: Blocked response page displays ks-waf-error.png image (view source to see). |
| KONA Site Defender (Akamai) | Detectability: Easy Detection Methodology: Server header contains AkamaiGHost keyword. |
| LiteSpeed | Detectability: Easy Detection Methodology: Server header has value set to LiteSpeed. Response page contains: Proudly powered by LiteSpeed Web Server text. Reference to http://www.litespeedtech.com/error-page Access to resource on this server is denied. |
| Malcare | Detectability: Moderate Detection Methodology: Blocked response page may contains: Blocked because of Malicious Activities text snippet. Firewall powered by MalCare text snippet. |
| MissionControl Application Shield | Detectability: Easy Detection Methodology: Server header field contains Mission Control Application Shield value. |
| ModSecurity | Detectability: Moderate/Difficult Detection Methodology: Blocked response page contains: This error was generated by Mod_Security text snippet. One or more things in your request were suspicious text snippet. rules of the mod_security module text snippet. mod_security rules triggered text snippet. Reference to /modsecurity-errorpage/ directory. Server header may contain Mod_Security or NYOB keywords. Sometimes, the response code to an attack is 403 while the response phrase is ModSecurity Action. |
| ModSecurity CRS | Detectability: Difficult Detection Methodology: Blockpage occurs on adding a separate request header X-Scanner when set to a particular paranoa level. |
| NAXSI | Detectability: Easy Detection Methodology: Blocked response page conatins This Request Has Been Blocked By NAXSI. Response headers contain unusual field X-Data-Origin with value naxsi/waf keyword. Server header contains naxsi/waf keyword value. Blocked response page may contain NAXSI blocked information error code. |
| Nemesida | Detectability: Difficult Detection Methodology: Blocked response page conatins Suspicious activity detected. Access to the site is blocked.. Contains reference to email nwaf@{site.tld} |
| Netcontinuum | Detectability: Moderate Detection Methodology: Session cookies contain NCI__SessionId= cookie field name. |
| NetScaler AppFirewall | Detectability: Moderate Detection Methodology: Response headers may contain Connection: header field name jumbled to nnCoection: nsaf= cookie field name. citrix_ns_id field name. NSC keyword. NS-CACHE field value. |
| NevisProxy | Detectability: Moderate Detection Methodology: Response header cookies contain Navajo keyword. |
| NewDefend | Detectability: Easy Detection Methodology: Response page contains: Reference to http://www.newdefend.com/feedback/misinformation/ URL. Reference to /nd_block/ directory. Server header contains NewDefend keyword. |
| Nexusguard | Detectability: Easy Detection Methodology: Blocked response page has reference to speresources.nexusguard.com/wafpage/index.html URL. |
| NinjaFirewall | Detectability: Moderate Detection Methodology: Response page title contains NinjaFirewall: 403 Forbidden. Response page contains: For security reasons, it was blocked and logged text snippet. NinjaFirewall keyword in title. Returns a 403 Forbidden response upon malicious requests. |
| NSFocus | Detectability: Easy Detection Methodology: Server header contain NSFocus keyword. |
| NullDDoS | Detectability: Easy Detection Methodology: Server header contains the NullDDoS System keyword. |
| onMessage Shield | Detectability: Easy Detection Methodology: Response headers contain header X-Engine field with value onMessage Shield. Blocked response page contains: Blackbaud K-12 conducts routine maintenance keyword. This site is protected by an enhanced security system. Reference to https://status.blackbaud.com URL. Reference to https://maintenance.blackbaud.com URL. |
| OpenResty Lua WAF | Detectability: Easy Detection Methodology: Server header contains openresty/{version} keyword. Blocked response page contains openresty/{version} text. Blocked response code returned is 406 Not Acceptable. |
| Palo Alto | Detectability: Moderate Detection Methodology: Blocked response page contains Virus/Spyware Download Blocked. Response page might contain Palo Alto Next Generation Security Platform text snippet. |
| PentaWAF | Detectability: Easy Detection Methodology: Server header contains PentaWAF/{version} keyword. Blocked response page contains text PentaWAF/{version}. |
| PerimeterX | Detectability: Easy Detection Methodology: Blocked response page contains reference to https://www.perimeterx.com/whywasiblocked URL. |
| pkSecurityModule IDS | Detectability: Moderate Detection Methodology: Response content may contain pkSecurityModule: Security.Alert. A safety critical request was discovered and blocked text snippet. |
| Positive Technologies Application Firewall | Detectability: Difficult Detection Methodology: Blocked response page contains Forbidden in h1 followed by: Request ID: in format yyyy-mm-dd-hh-mm-ss-{ref. code} |
| PowerCDN | Detectability: Moderate Detection Methodology: Response headers may contain Via header with content powercdn.com. X-Cache header with content powercdn.com. X-CDN header with content PowerCDN. |
| Profense | Detectability: Easy Detection Methodology: Set-Cookie headers contain PLBSID= cookie field name. Server header contain Profense keyword. |
| Proventia (IBM) | Detectability: Difficult Detection Methodology: Blocked response page might contain to request does not match Proventia rules text snippet. |
| Puhui | Detectability: Easy Detection Methodology: Server header contain PuhuiWAF keyword. |
| Qiniu CDN | Detectability: Easy Detection Methodology: Response content may contain Response headers contain unusual header X-Qiniu-CDN with value set to either 0 or 1. |
| Radware Appwall | Detectability: Moderate Detection Methodology: Response page contains the following text snippet: Unauthorized Activity Has Been Detected. and Case Number Blocked response page has reference to radwarealerting@{site.tld} email. Blocked response page has title set to Unauthorized Request Blocked. Response headers may contain X-SL-CompState header field name. |
| Reblaze | Detectability: Moderate Detection Methodology: Cookies in response headers contain rbzid= header field name. Server field value might contain Reblaze Secure Web Gateway text snippet. Response page contains: Access Denied (403) in bold. Current session has been terminated text. For further information, do not hesitate to contact us. |
| Request Validation Mode | Detectability: Easy Detection Methodology: A firewall found specifically on ASP.NET websites and none others. Response page contains either of the following text snippet: ASP.NET has detected data in the request that is potentially dangerous. Request Validation has detected a potentially dangerous client input value. HttpRequestValidationException. Blocked response code returned is always 500 Internal Error. |
| RSFirewall | Detectability: Easy Detection Methodology: Response page contains: COM_RSFIREWALL_403_FORBIDDEN keyword. COM_RSFIREWALL_EVENT keyword. |
| Sabre | Detectability: Easy Detection Methodology: Returns status code 500 Internal Error upon malicious requests. Response content has: Contact email [email protected]. Your request has been blocked bold warning. clicking the above email link will automatically add some important details to the email for us to investigate the problem text snippet. |
| Safe3 | Detectability: Easy Detection Methodology: Response headers contain: X-Powered-By header has field value Safe3WAF. Server header contains field value set to Safe3 Web Firewall. Response page contains Safe3waf keyword. |
| SafeDog | Detectability: Easy/Moderate Detection Methodology: Server header in response may contain: WAF/2.0 keyword. safedog field value. |
| SecKing | Detectability: Easy/Moderate Detection Methodology: Server header in response may contain: SECKINGWAF keyword. SECKING/{version} field value. |
| SecuPress | Detectability: Easy Detection Methodology: Response content may contain: SecuPress as text. Block ID: Bad URL Contents as text. Response code returned is 503 Service Unavailable. |
| Secure Entry | Detectability: Easy Detection Methodology: Server header contains value set to Secure Entry Server. |
| SecureIIS | Detectability: Easy Detection Methodology: Response page contains either of the following text snippet: Image displaying beyondtrust logo. Download SecureIIS Personal Edition Reference to http://www.eeye.com/SecureIIS/ URL. SecureIIS Error text snippet. |
| SecureSphere | Detectability: Difficult Detection Methodology: Response page contains the following text snippet: Error in h2 text. Title contains only text as Error. Contact support for additional information. text. |
| SEnginx | Detectability: Easy Detection Methodology: Blocked response page contains SENGINX-ROBOT-MITIGATION keyword. |
| ServerDefender VP | Detectability: Easy Detection Methodology: Blocked response contains X-Pint header field with p80 keyword. |
| Shadow Daemon | Detectability: Difficult Detection Methodology: Blocked response page contains request forbidden by administrative rules. keyword. |
| ShieldSecurity | Detectability: Difficult Detection Methodology: Blocked response page contains: You were blocked by the Shield. text. Something in the URL, Form or Cookie data wasn’t appropriate text snippet. Warning: You have {number} remaining transgression(s) against this site. Seriously stop repeating what you are doing or you will be locked out. |
| SiteGround | Detectability: Difficult Detection Methodology: Blocked response page contains The page you are trying to access is restricted due to a security rule text snippet. |
| SiteGuard (JP Secure) | Detectability: Difficult Detection Methodology: Response page contains: Powered by SiteGuard text snippet. The server refuse to browse the page. text snippet. The URL may not be correct. Please confirm the value. |
| SiteLock TrueShield | Detectability: Easy Detection Methodology: Blocked response page source contains the following: Reference to www.sitelock.com URL. Sitelock is leader in Business Website Security Services. text. sitelock-site-verification keyword. sitelock_shield_logo image. |
| SonicWall | Detectability: Easy Detection Methodology: Server header contain SonicWALL keyword value. Blocked response page contains either of the following text snippet: Image displaying Dell logo. This request is blocked by the SonicWALL. Web Site Blocked text snippet. nsa_banner as keyword. :p |
| Sophos UTM | Detectability: Easy Detection Methodology: Blocked response page contains Powered by UTM Web Protection keyword. |
| SquareSpace | Detectability: Difficult Detection Methodology: Response code returned is 404 Not Found upon malicious requests. Blocked response page contains either of the following text snippet: BRICK-50 keyword. 404 Not Found text snippet. |
| SquidProxy IDS | Detectability: Easy Detection Methodology: Server header contains field value squid/{version}. Blocked response page contains Access control configuration prevents your request from being allowed at this time.. |
| StackPath | Detectability: Easy Detection Methodology: Contains image displaying StackPath logo. Blocked response page contains You performed an action that triggered the service and blocked your request. |
| Stingray | Detectability: Difficult Detection Methodology: Blocked response code returns 403 Forbidden or 500 Internal Error. Response headers contain the X-Mapping header field name. |
| Sucuri CloudProxy | Detectability: Easy Detection Methodology: Response headers may contain Sucuri or Cloudproxy keywords. Blocked response page contains the following text snippet: Access Denied – Sucuri Website Firewall text. Reference to https://sucuri.net/privacy-policy URL. Sometimes the email [email protected]. Contains copyright notice ;copy {year} Sucuri Inc. Response headers contains X-Sucuri-ID header along with normal requests. |
| Synology Cloud | Detectability: Easy Detection Methodology: Blocked response page has Copyright (c) 2019 Synology Inc. All rights reserved.as text. |
| Tencent Cloud | Detectability: Moderate Detection Methodology: Blocked response code returns 405 Method Not Allowed error. Blocked response page contains reference to waf.tencent-cloud.com URL. |
| Teros | Detectability: Difficult Detection Methodology: Response headers contain cookie field st8id. |
| TrafficShield | Detectability: Moderate Detection Methodology: Server might contain F5-TrafficShield keyword. ASINFO= value might be detected in response cookies. |
| TransIP | Detectability: Easy Detection Methodology: Response headers contain unique header X-TransIP-Backend. Response headers contain another header X-TransIP-Balancer. |
| UCloud UEWaf | Detectability: Easy Detection Methodology: Response content might contain: Reference to /uewaf_deny_pages/default/img/ inurl directory. ucloud.cn URL. Response headers returned has Server header set to uewaf/{version}. |
| URLMaster SecurityCheck | Detectability: Moderate Detection Methodology: Response headers might contain: UrlMaster keyword. UrlRewriteModule keyword. SecurityCheck keyword. Blocked response code returned is 400 Bad Request text snippet. |
| URLScan | Detectability: Moderate Detection Methodology: Blocked response page contains: Rejected-by-URLScan text snippet. Server Erro in Application as heading. Module: IIS Web Core in table. |
| USP Secure Entry | Detectability: Moderate Detection Methodology: Response headers contain Secure Entry Server field value. |
| Varnish (OWASP) | Detectability: Easy Detection Methodology: Malicious request returns 404 Not Found Error. Response page contains: Request rejected by xVarnish-WAF text snippet. |
| Varnish CacheWall | Detectability: Easy Detection Methodology: Response page contains: Error 403 Naughty, not Nice! as heading. Varnish cache Server as text. |
| Viettel | Detectability: Easy Detection Methodology: Response page contains: Block page has title set to Access denied · Viettel WAF. Reference to https://cloudrity.com.vn/ URL. Response page contains keywords Viettel WAF system. Contact information reference to https://cloudrity.com.vn/customer/#/contact URL. |
| VirusDie | Detectability: Easy Detection Methodology: Response page contains: http://cdn.virusdie.ru/splash/firewallstop.png picture. copy; Virusdie.ru copyright notice. Response page title contains Virusdie keyword. Page metadata contains name=”FW_BLOCK” keyword |
| WallArm | Detectability: Moderate Detection Methodology: Server headers contain nginx-wallarm value. |
| WatchGuard IPS | Detectability: Easy Detection Methodology: Server headers may contain WatchGuard field value. Blocked response page contains: Request denied by WatchGuard Firewall text. WatchGuard Technologies Inc. as footer. |
| WebARX Security | Detectability: Easy Detection Methodology: Restricted to specifically WordPress sites only. Blocked response page contains: This request has been blocked by WebARX Web Application Firewall text. Reference to /wp-content/plugins/webarx/ directory where it is installed. |
| WebKnight | Detectability: Easy Detection Methodology: Response headers contain WebKnight keyword. Blocked response page contains: WebKnight Application Firewall Alert text warning. AQTRONIX WebKnight text snippet. Blocked response code returned is 999 No Hacking. :p Blocked response code returned is also 404 Hack Not Found. :p |
| WebLand | Detectability: Easy Detection Methodology: Server header contains Apache Protected By WebLand WAF keyword. |
| WebRay | Detectability: Easy Detection Methodology: Server header contains WebRay-WAF keyword. Response headers may have DrivedBy field with value RaySrv RayEng/{version}. |
| WebSEAL | Detectability: Easy Detection Methodology: Server header contain WebSEAL keyword. Blocked response page contains: This is a WebSEAL error message template file text. WebSEAL server received an invalid HTTP request text snippet. |
| WebTotem | Detectability: Easy Detection Methodology: Blocked response page contains The current request was blocked by WebTotem. |
| West263CDN | Detectability: Easy Detection Methodology: Response headers contain X-Cache header field with WT263CDN value. |
| Wordfence | Detectability: Easy Detection Methodology: Response headers contain WebKnight keyword. Blocked response page contains: Generated by Wordfence text snippet. A potentially unsafe operation has been detected in your request to this site text warning. Your access to this site has been limited text warning. This response was generated by Wordfence text snippet. |
| WTS-WAF | Detectability: Easy Detection Methodology: Blocked response page title has WTS-WAF keyword. Server header contains wts as value. |
| XLabs Security WAF | Detectability: Easy Detection Methodology: Response headers contain X-CDN header field with XLabs Security value. |
| Xuanwudun WAF | Detectability: Easy Detection Methodology: Blocked response page contains reference to http://admin.dbappwaf.cn/index.php/Admin/ClientMisinform/ site URL. |
| Yunaq Chuangyu | Detectability: Moderate Detection Methodology: Response page has reference to: 365cyd.com or 365cyd.net URL. Reference to help page at http://help.365cyd.com/cyd-error-help.html?code=403. |
| Yundun | Detectability: Easy Detection Methodology: Server header contains YUNDUN as value. X-Cache header field contains YUNDUN as value. Response page contains Blocked by YUNDUN Cloud WAF text snippet. Blocked response page contains reference to yundun.com/yd_http_error/ URL. |
| Yunsuo | Detectability: Easy Detection Methodology: Blocked response page contains image class reference to yunsuologo. Response headers contain the yunsuo_session field name. |
| YxLink | Detectability: Easy Detection Methodology: Response might have yx_ci_session cookie field. Response might have yx_language cookie field. Server header contains Yxlink-WAF field value. |
| ZenEdge | Detectability: Easy Detection Methodology: Blocked response page contains reference to /__zenedge/assets/ directory. Server header contain ZENEDGE keyword. Blocked response headers may contain X-Zen-Fury header. |
| ZScaler | Detectability: Easy Detection Methodology: Server header has value set to ZScaler. Blocked response page contains: Access Denied: Accenture Policy text. Reference to https://policies.accenture.com URL. Reference to image at https://login.zscloud.net/img_logo_new1.png. Your organization has selected Zscaler to protect you from internet threats. The Internet site you have attempted to access is prohibited. Accenture’s webfilters indicate that the site likely contains content considered inappropriate. |
