Normally, mod_security parses incoming traffic and blocks suspicious activity based on third-party rules [1]. Since you're using Squid, you can monitor outgoing

Normally, mod_security parses incoming traffic and blocks suspicious activity based on third-party rules [1]. Since you're using Squid, you can monitor outgoing traffic instead. Malicious traffic would get dropped instead of being proxied. Since you control the source servers, you could tarpit and/or ban the user. Snort + Snortsam [2] or fwsnort [3] would do the same thing for non-HTTP traffic. [1] https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project https://www.owasp.org/index.php/Category:OWASP_ModSecurity_C... [2] http://www.snortsam.net http://www.snortsam.net [3] http://cipherdyne.org/fwsnort/ http://cipherdyne.org/fwsnort/