When I look at my Apache log other_vhosts_access.log
, I see many many attempts, from a few different IP per month like this:
www.example.com:80 91.200.x.x - - [25/Jun/2017:17:20:19 +0200] "POST /wp-login.php HTTP/1.1"
www.example.com:80 91.200.x.x - - [25/Jun/2017:17:20:19 +0200] "POST /wp-login.php HTTP/1.1"
www.example.com:80 91.200.x.x - - [25/Jun/2017:17:20:20 +0200] "POST /wp-login.php HTTP/1.1"
It seems to be brute-force attacks.
Is there a simple way to auto-ban (no link with Autobahn) these attackers?
If I do it with a Wordpress plugin, the traffic will still go into PHP, wasting resources, etc.
If I do it at Apache level, it will surely still waste resource
Should I do it at lowest level possible? i.e. IP tables?
Is there a tool that looks for such attackers in other_vhosts_access.log
and automatically ban them in iptables
?