Some more filtering.

Filter three different known exploit scanners, two of them for jdownloads
(Joomla module); if you're actually using it with the default locations,
please just disable the rules, or if it's causing even more problems, open
an issue.

The third one is for the vtiger CRM default install path, again please
disable it as needed (possibly only for authorized IPs).

Change the yacybot filtering to just yacy to filter their proxies too
(especially if they fix the user-agent not to be a plea), and add "rarely
used" which seems to hit more than rarely my websites.