ET WEB_SERVER Fake Googlebot UA 2 Inbound

alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (
    msg:"ET WEB_SERVER Fake Googlebot UA 2 Inbound";
    flow:established,to_server;
    http.user_agent;
    content:"Googlebot-"; fast_pattern; nocase;
    content:!"Googlebot-News"; startswith;
    content:!"Googlebot-Image/1.0"; startswith;
    content:!"Googlebot-Video/1.0"; startswith;
    content:!"Mobile/2.1|3b| +http|3a|//www.google.com/bot.html)"; endswith;
    reference:url,www.incapsula.com/the-incapsula-blog/item/369-was-that-really-a-google-bot-crawling-my-site;
    reference:url,support.google.com/webmasters/bin/answer.py?hl=en&answer=1061943;
    classtype:network-scan;
    sid:2015527; rev:4;
    metadata:created_at 2012_07_26, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_27;
)