Hello
A lot of my customers are accessing some random urls where there is the same malicious code.
Some partial malicious code is:
function bredir(a, b, c, d, e, ldr, ifc) { var h, i, j; var f = 0; var g = 0; var k = false; var l = false; var m = [ [300, 250, false], [250, 250, false], [240, 400, false], [336, 280, false], [180, 150, false], [468, 60, false], [234, 60, false], [88, 31, false], [120, 90, false], [120, 60, false], [120, 240, false], [125, 125, false], [728, 90, false], [160, 600, false], [120, 600, false], [300, 600, false], [300, 125, false], [530, 300, false], [190, 200, false], [470, 250, false], [720, 300, true], [500, 350, true], [550, 480, true] ]; if (typeof window.innerHeight == "number") { g = window.innerHeight; f = window.innerWidth; } else if (typeof document.body.offsetHeight == "number") { g = document.body.offsetHeight; f = document.body.offsetWidth; } for (var n = 0; n < m.length; n++) { j = m[n]; h = Math.abs(f - j[0]); i = Math.abs(g - j[1]); if (top != self) { \ \ Blocking the domains is not an option because it seems the domains are randomic and the name of the files also but the content is the same So i would like to use regex instad to block with layer7. So the question. What regex should I put to block this? I put just "function bredir" but nothing.