Hello! This rule doesn't work correctly - it works on requests to Captcha. Therefore, we will rewrite or remove it soon.
Thank you!

IMHO, it means that the server has probably been hacked. Look for the file "/tmp/r" and any possible related processes.

More info: https://www.exploit-db.com/exploits/44760/

Hello!
This particular request doesn't trigger a blocking rule though it is being spotted by 3 generic rules from i360_1_generic.conf
Please take into consideration that in order to be blocked a request pattern should present in strict rule sets (blocking rules) but it doesn't based on the 200 response.

You can try to activate Proactive Defense (and turn Kill mode on), which logic is based on an advanced heuristic mechanism but not on patterns match. With this mode enabled the aforementioned request will be 100% blocked (checked!).