I'm not sure should block or not but if full path got other site there.
On Fri, Jul 15, 2016 at 5:32 PM, Alan Liddell <[email protected]>
wrote:
> If that's the verbatim output of your log, I'm pretty sure you'd have to
> reconfigure how your web server writes its logs. Per the manual:
>
>
> - In order for a log line to match your failregex, it actually has to
> match in two parts: *the beginning of the line has to match a
> timestamp pattern or regex*, and the remainder of the line has to
> match your failregex. If the failregex is anchored with a leading ^,
> then the anchor refers to the start of the remainder of the line,
> *after* the timestamp and intervening whitespace
>
> Then if this pattern isn't in the usual filters, you'd have to create one
> yourself. So if you rearranged it to output something like
>
> [15/Jul/2016:10:03:44 +0800] 27.111.213.117 "GET /2012/12/ HTTP/1.1" 200
> 72434 "-" "Mozilla/4.0 (compatible;)"
>
> this regex should match it:
>
> ^ <HOST> \"(GET|POST) \/\S+ HTTP\/1\.1\" \d+? \d+? \"-\" \"Mozilla\/4\.0
> \(compatible;\)\"$
>
> Not sure if the timestamp format is recognized. Maybe someone else can
> chime in on this one?
>
> On Fri, Jul 15, 2016 at 3:07 AM, Mohd Zainal Abidin <[email protected]>
> wrote:
>
>> Hi,
>>
>> How to block this kind of attack?
>>
>> 27.111.213.117 - - [15/Jul/2016:10:03:32 +0800] "GET /2014/07/ HTTP/1.1"
>> 200 70977 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:27 +0800] "GET /2007/05/ HTTP/1.1"
>> 200 62797 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:33 +0800] "GET /2014/06/ HTTP/1.1"
>> 200 72461 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:28 +0800] "GET /2006/12/ HTTP/1.1"
>> 200 65124 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:34 +0800] "GET /2014/05/ HTTP/1.1"
>> 200 72931 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:34 +0800] "GET /2014/04/ HTTP/1.1"
>> 200 70848 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:32 +0800] "GET /xmlrpc.php?rsd
>> HTTP/1.1" 200 866 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:36 +0800] "GET /2014/02/ HTTP/1.1"
>> 200 69820 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:36 +0800] "GET /2014/01/ HTTP/1.1"
>> 200 74012 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:37 +0800] "GET /2013/12/ HTTP/1.1"
>> 200 74001 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:37 +0800] "GET /2007/10/page/2/
>> HTTP/1.1" 200 63882 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:37 +0800] "GET /2008/05/page/2/
>> HTTP/1.1" 200 63703 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:37 +0800] "GET /2008/04/page/2/
>> HTTP/1.1" 200 64863 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:37 +0800] "GET /2008/06/page/2/
>> HTTP/1.1" 200 64089 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:37 +0800] "GET /2007/12/page/2/
>> HTTP/1.1" 200 63587 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:29 +0800] "GET /2014/12/ HTTP/1.1"
>> 200 73272 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:31 +0800] "GET /2006/11/ HTTP/1.1"
>> 200 64642 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:37 +0800] "GET /2013/11/ HTTP/1.1"
>> 200 68957 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:31 +0800] "GET /2006/09/ HTTP/1.1"
>> 200 64719 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:38 +0800] "GET /2008/01/page/2/
>> HTTP/1.1" 200 62711 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:38 +0800] "GET /2013/10/ HTTP/1.1"
>> 200 70712 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:39 +0800] "GET /2008/02/page/2/
>> HTTP/1.1" 200 64719 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:39 +0800] "GET /2007/11/page/2/
>> HTTP/1.1" 200 64808 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:39 +0800] "GET /2013/09/ HTTP/1.1"
>> 200 68252 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:32 +0800] "GET /2014/08/ HTTP/1.1"
>> 200 69468 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:39 +0800] "GET /2013/08/ HTTP/1.1"
>> 200 67360 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:41 +0800] "GET /2013/07/ HTTP/1.1"
>> 200 70473 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:41 +0800] "GET /2013/06/ HTTP/1.1"
>> 200 72604 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:35 +0800] "GET /2014/03/ HTTP/1.1"
>> 200 68842 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:42 +0800] "GET /2013/05/ HTTP/1.1"
>> 200 74481 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:42 +0800] "GET /2007/09/page/2/
>> HTTP/1.1" 200 65605 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:42 +0800] "GET /2007/07/page/2/
>> HTTP/1.1" 200 64613 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:42 +0800] "GET /2007/08/page/2/
>> HTTP/1.1" 200 64851 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:42 +0800] "GET /2007/04/page/2/
>> HTTP/1.1" 200 65041 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:42 +0800] "GET /2007/06/page/2/
>> HTTP/1.1" 200 65219 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:42 +0800] "GET /2007/03/page/2/
>> HTTP/1.1" 200 66625 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:42 +0800] "GET /2013/03/ HTTP/1.1"
>> 200 69079 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:43 +0800] "GET /2007/01/page/2/
>> HTTP/1.1" 200 65362 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:43 +0800] "GET /2013/02/ HTTP/1.1"
>> 200 71130 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:43 +0800] "GET /2007/02/page/2/
>> HTTP/1.1" 200 65625 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:44 +0800] "GET /2006/10/page/2/
>> HTTP/1.1" 200 64309 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:44 +0800] "GET /2013/01/ HTTP/1.1"
>> 200 73073 "-" "Mozilla/4.0 (compatible;)"
>> 27.111.213.117 - - [15/Jul/2016:10:03:44 +0800] "GET /2012/12/ HTTP/1.1"
>> 200 72434 "-" "Mozilla/4.0 (compatible;)"
>>
>> We getting this kind of attack from different ip last night. Our website
>> load goes to 100 and it become slow to response.
>>
>> --
>> Thank you
>> ______________________
>>
>> Mohd Zainal Abidin
>>
>>
>> ------------------------------------------------------------------------------
>> What NetFlow Analyzer can do for you? Monitors network bandwidth and
>> traffic
>> patterns at an interface-level. Reveals which users, apps, and protocols
>> are
>> consuming the most bandwidth. Provides multi-vendor support for NetFlow,
>> J-Flow, sFlow and other flows. Make informed decisions using capacity
>> planning
>> reports.http://sdm.link/zohodev2dev
>> _______________________________________________
>> Fail2ban-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>
>>
>
>
> --
> ACL
>
--
Thank you
______________________
Mohd Zainal Abidin
------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
