(OT) Re: Need advice with Perl and website

Replies are listed 'Best First'.
Re^2: Need advice with Perl and website by Linicks (Scribe) on Jun 10, 2016 at 15:17 UTC
"Anyone running a non-wordpress site will testify to that." Yes, indeed. I have run my own web/mailserver from home for years as a hobby, and do not use PHP (or even have it installed). The amount of hits you get with bots (and I think compromised MS machines) looking for wp php files is a pain. A few years ago I got fed up with this nonsense, so knocked up a bit of perl that tails httpd access_log for such requests - if found, a bit of perl regex grabs the ip, then adds it to IPSETS group - instant firewall drop forever until I clear the IPSET. Now, one strange thing is these 'bots' (or rather the code that does it) seems to be intelligent, and once dropped, it seems to remember - as I clean out and reset my firewall sometimes, the same IP's never come back - but new ones do. I will have to do some proper analysis on it one day I run similar code on my mail server logs too for 'other' type bots. FYI I last cleared it out and reset 5th June 2016 - here is the captured IP's since: 46.118.158.214 httpd Sun Jun 5 12:29:17 2016 157.55.39.56 httpd Sun Jun 5 13:57:17 2016 133.130.124.174 httpd Sun Jun 5 13:57:22 2016 207.46.13.150 httpd Sun Jun 5 13:58:49 2016 51.254.97.219 httpd Sun Jun 5 14:35:11 2016 212.83.177.193 httpd Sun Jun 5 16:03:56 2016 5.9.89.170 httpd Sun Jun 5 16:09:49 2016 69.30.198.178 httpd Sun Jun 5 16:19:27 2016 136.243.152.18 httpd Sun Jun 5 17:14:30 2016 51.254.129.9 httpd Sun Jun 5 19:41:22 2016 157.55.39.205 httpd Sun Jun 5 20:28:26 2016 5.9.73.227 httpd Sun Jun 5 20:31:14 2016 162.210.196.100 httpd Sun Jun 5 23:08:18 2016 51.254.215.143 httpd Mon Jun 6 03:10:05 2016 5.249.157.205 httpd Mon Jun 6 05:35:40 2016 40.77.167.33 httpd Mon Jun 6 06:09:06 2016 190.7.136.147 httpd Mon Jun 6 08:57:51 2016 199.58.86.206 httpd Mon Jun 6 12:14:57 2016 207.46.13.117 httpd Mon Jun 6 12:40:24 2016 207.46.13.128 httpd Mon Jun 6 12:57:29 2016 62.210.90.118 httpd Mon Jun 6 13:32:46 2016 157.55.39.100 httpd Mon Jun 6 14:29:09 2016 178.0.26.166 httpd Mon Jun 6 15:15:16 2016 109.248.32.78 httpd Mon Jun 6 16:51:17 2016 157.55.39.208 httpd Mon Jun 6 18:56:04 2016 157.55.39.179 httpd Mon Jun 6 22:03:25 2016 178.211.164.180 httpd Mon Jun 6 23:53:44 2016 207.46.13.180 httpd Tue Jun 7 00:05:58 2016 1.55.245.42 httpd Tue Jun 7 01:15:40 2016 40.77.167.12 httpd Tue Jun 7 02:42:36 2016 178.162.211.200 httpd Tue Jun 7 02:59:22 2016 103.231.44.52 smtpd Tue Jun 7 09:34:16 2016 157.55.39.148 httpd Tue Jun 7 11:33:48 2016 91.200.12.132 httpd Tue Jun 7 13:18:25 2016 69.197.177.50 httpd Tue Jun 7 20:33:49 2016 207.46.13.105 httpd Tue Jun 7 20:35:22 2016 144.76.93.46 httpd Tue Jun 7 20:42:42 2016 51.254.32.82 httpd Tue Jun 7 21:34:10 2016 188.126.129.20 httpd Tue Jun 7 22:02:18 2016 181.143.8.34 httpd Tue Jun 7 22:10:46 2016 106.184.3.122 smtpd Tue Jun 7 22:17:17 2016 62.210.107.201 httpd Tue Jun 7 22:25:19 2016 5.9.111.70 httpd Tue Jun 7 23:40:23 2016 157.55.39.28 httpd Wed Jun 8 00:08:55 2016 51.254.129.91 httpd Wed Jun 8 02:29:19 2016 51.254.141.30 httpd Wed Jun 8 03:15:36 2016 157.55.39.213 httpd Wed Jun 8 07:05:58 2016 71.6.165.200 smtpd Wed Jun 8 08:00:40 2016 69.197.177.26 httpd Wed Jun 8 08:04:28 2016 195.154.185.20 httpd Wed Jun 8 15:32:17 2016 142.54.184.90 httpd Wed Jun 8 16:51:53 2016 183.182.100.26 smtpd Wed Jun 8 17:14:12 2016 208.100.26.231 smtpd Wed Jun 8 23:36:36 2016 104.41.203.153 httpd Wed Jun 8 23:56:00 2016 40.77.167.6 httpd Thu Jun 9 09:18:38 2016 169.229.3.91 httpd Thu Jun 9 10:13:03 2016 144.76.29.162 httpd Thu Jun 9 19:41:56 2016 46.4.32.75 httpd Thu Jun 9 20:49:59 2016 144.76.7.107 httpd Thu Jun 9 21:06:52 2016 51.254.32.67 httpd Fri Jun 10 00:15:29 2016 149.202.54.5 httpd Fri Jun 10 01:22:23 2016 143.202.77.99 httpd Fri Jun 10 04:40:51 2016 195.154.187.115 httpd Fri Jun 10 04:43:25 2016 51.255.194.31 httpd Fri Jun 10 05:14:35 2016 157.55.39.225 httpd Fri Jun 10 09:19:22 2016 5.39.216.131 httpd Fri Jun 10 15:39:39 2016 157.55.39.147 httpd Fri Jun 10 15:55:12 2016 [download] Nick	[reply] [d/l]

Replies are listed 'Best First'.

Re^2: Need advice with Perl and website
by Linicks (Scribe) on Jun 10, 2016 at 15:17 UTC

"Anyone running a non-wordpress site will testify to that."

Yes, indeed. I have run my own web/mailserver from home for years as a hobby, and do not use PHP (or even have it installed). The amount of hits you get with bots (and I think compromised MS machines) looking for wp php files is a pain.

A few years ago I got fed up with this nonsense, so knocked up a bit of perl that tails httpd access_log for such requests - if found, a bit of perl regex grabs the ip, then adds it to IPSETS group - instant firewall drop forever until I clear the IPSET.

Now, one strange thing is these 'bots' (or rather the code that does it) seems to be intelligent, and once dropped, it seems to remember - as I clean out and reset my firewall sometimes, the same IP's never come back - but new ones do. I will have to do some proper analysis on it one day

I run similar code on my mail server logs too for 'other' type bots.

FYI I last cleared it out and reset 5th June 2016 - here is the captured IP's since:

46.118.158.214 httpd Sun Jun  5 12:29:17 2016
157.55.39.56 httpd Sun Jun  5 13:57:17 2016
133.130.124.174 httpd Sun Jun  5 13:57:22 2016
207.46.13.150 httpd Sun Jun  5 13:58:49 2016
51.254.97.219 httpd Sun Jun  5 14:35:11 2016
212.83.177.193 httpd Sun Jun  5 16:03:56 2016
5.9.89.170 httpd Sun Jun  5 16:09:49 2016
69.30.198.178 httpd Sun Jun  5 16:19:27 2016
136.243.152.18 httpd Sun Jun  5 17:14:30 2016
51.254.129.9 httpd Sun Jun  5 19:41:22 2016
157.55.39.205 httpd Sun Jun  5 20:28:26 2016
5.9.73.227 httpd Sun Jun  5 20:31:14 2016
162.210.196.100 httpd Sun Jun  5 23:08:18 2016
51.254.215.143 httpd Mon Jun  6 03:10:05 2016
5.249.157.205 httpd Mon Jun  6 05:35:40 2016
40.77.167.33 httpd Mon Jun  6 06:09:06 2016
190.7.136.147 httpd Mon Jun  6 08:57:51 2016
199.58.86.206 httpd Mon Jun  6 12:14:57 2016
207.46.13.117 httpd Mon Jun  6 12:40:24 2016
207.46.13.128 httpd Mon Jun  6 12:57:29 2016
62.210.90.118 httpd Mon Jun  6 13:32:46 2016
157.55.39.100 httpd Mon Jun  6 14:29:09 2016
178.0.26.166 httpd Mon Jun  6 15:15:16 2016
109.248.32.78 httpd Mon Jun  6 16:51:17 2016
157.55.39.208 httpd Mon Jun  6 18:56:04 2016
157.55.39.179 httpd Mon Jun  6 22:03:25 2016
178.211.164.180 httpd Mon Jun  6 23:53:44 2016
207.46.13.180 httpd Tue Jun  7 00:05:58 2016
1.55.245.42 httpd Tue Jun  7 01:15:40 2016
40.77.167.12 httpd Tue Jun  7 02:42:36 2016
178.162.211.200 httpd Tue Jun  7 02:59:22 2016
103.231.44.52 smtpd Tue Jun  7 09:34:16 2016
157.55.39.148 httpd Tue Jun  7 11:33:48 2016
91.200.12.132 httpd Tue Jun  7 13:18:25 2016
69.197.177.50 httpd Tue Jun  7 20:33:49 2016
207.46.13.105 httpd Tue Jun  7 20:35:22 2016
144.76.93.46 httpd Tue Jun  7 20:42:42 2016
51.254.32.82 httpd Tue Jun  7 21:34:10 2016
188.126.129.20 httpd Tue Jun  7 22:02:18 2016
181.143.8.34 httpd Tue Jun  7 22:10:46 2016
106.184.3.122 smtpd Tue Jun  7 22:17:17 2016
62.210.107.201 httpd Tue Jun  7 22:25:19 2016
5.9.111.70 httpd Tue Jun  7 23:40:23 2016
157.55.39.28 httpd Wed Jun  8 00:08:55 2016
51.254.129.91 httpd Wed Jun  8 02:29:19 2016
51.254.141.30 httpd Wed Jun  8 03:15:36 2016
157.55.39.213 httpd Wed Jun  8 07:05:58 2016
71.6.165.200 smtpd Wed Jun  8 08:00:40 2016
69.197.177.26 httpd Wed Jun  8 08:04:28 2016
195.154.185.20 httpd Wed Jun  8 15:32:17 2016
142.54.184.90 httpd Wed Jun  8 16:51:53 2016
183.182.100.26 smtpd Wed Jun  8 17:14:12 2016
208.100.26.231 smtpd Wed Jun  8 23:36:36 2016
104.41.203.153 httpd Wed Jun  8 23:56:00 2016
40.77.167.6 httpd Thu Jun  9 09:18:38 2016
169.229.3.91 httpd Thu Jun  9 10:13:03 2016
144.76.29.162 httpd Thu Jun  9 19:41:56 2016
46.4.32.75 httpd Thu Jun  9 20:49:59 2016
144.76.7.107 httpd Thu Jun  9 21:06:52 2016
51.254.32.67 httpd Fri Jun 10 00:15:29 2016
149.202.54.5 httpd Fri Jun 10 01:22:23 2016
143.202.77.99 httpd Fri Jun 10 04:40:51 2016
195.154.187.115 httpd Fri Jun 10 04:43:25 2016
51.255.194.31 httpd Fri Jun 10 05:14:35 2016
157.55.39.225 httpd Fri Jun 10 09:19:22 2016
5.39.216.131 httpd Fri Jun 10 15:39:39 2016
157.55.39.147 httpd Fri Jun 10 15:55:12 2016
[download]

Nick

[reply]
[d/l]