I'm setting up my first website on Ubuntu 18.04 using Apache and I've noticed the following in my apache error log on a daily basis: - - [07/Feb/2019:11:32:55 +0000] "GET /muieblackcat HTTP/1.1" 301 555 "-" "-" - - [07/Feb/2019:11:32:56 +0000] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 301 587 "-" "-" - - [07/Feb/2019:11:32:56 +0000] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 301 587 "-" "-" - - [07/Feb/2019:11:32:56 +0000] "GET //mysqladmin/scripts/setup.php HTTP/1.1" 301 587 "-" "-" - - [07/Feb/2019:11:32:57 +0000] "GET //phpmyadmin2/scripts/setup.php HTTP/1.1" 301 589 "-" "-" - - [07/Feb/2019:10:04:03 +0000] "GET /accounts/password_reset/ HTTP/1.1" 200 5442 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15" - - [07/Feb/2019:10:23:31 +0000] "GET / HTTP/1.1" 200 726 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" - - [07/Feb/2019:10:46:36 +0000] "GET / HTTP/1.1" 400 3404 "-" "HTTP Banner Detection (https://security.ipip.net)" - - [07/Feb/2019:11:01:15 +0000] "GET / HTTP/1.1" 302 3452 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"

After some research, like ip location and reading fora/blogs, it's clear that these are attacks aimed at identifying any vulnerabilities on my server.

Being new to this, and seeing a lot of pings from the same IPs I thought I'd just add a deny rule to my .htaccess file for each IP. After two days, this clearly isn't a feasible solution.

So I'm looking for other things to do. I've noticed that most of these requests are looking for specific php files, which I fortunately don't have in the requested location.

Consequently, I'm wondering if it is possible to define a rule somewhere that says something like:

"If IP(x) makes a request for ^*.php, Deny/Block IP permanently."

If this possible, where do I define such a rule and in what language etc.

Much thanks in advance!

  • 1
    Why not just use fail2ban? – Michael Hampton Feb 7 at 13:39
  • yea, I'm reading through it right now. It sounds like it'll do what i need, but how can I be sure that it won't block me or another user? – Jed Feb 7 at 13:41

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.