LinuxForum.Fans
Тема

Опять про блэклисты

Автор: zenon 26 сообщений 4954 просмотров
19.04.2012 14:00 #246977

Может будем скидывать сюда IP адреса замеченные в непристоном поведении?
Вот например ломятся переодически ко мне:
cat /var/log/nginx/access_log | grep myadm

text
213.86.4.51 - - [05/Mar/2012:05:46:14 +0400] "GET //phpmyadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
213.86.4.51 - - [05/Mar/2012:05:46:16 +0400] "GET //myadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
213.86.4.51 - - [05/Mar/2012:05:46:16 +0400] "GET //phpmyadmin2/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
213.86.4.51 - - [05/Mar/2012:05:46:18 +0400] "GET //php-myadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
176.61.137.158 - - [05/Mar/2012:06:00:27 +0400] "GET //phpmyadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
118.219.232.205 - - [06/Mar/2012:03:20:09 +0400] "GET :81/phpmyadmin/scripts/setup.php HTTP/1.1" 400 173 "-" "-"
87.118.103.208 - - [07/Mar/2012:06:38:13 +0400] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
87.118.103.208 - - [07/Mar/2012:06:38:13 +0400] "GET /myadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
62.110.122.20 - - [07/Mar/2012:21:28:54 +0400] "GET /admin/phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
62.110.122.20 - - [07/Mar/2012:21:28:58 +0400] "GET /myadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
62.110.122.20 - - [07/Mar/2012:21:29:01 +0400] "GET /typo3/phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
62.110.122.20 - - [07/Mar/2012:21:29:05 +0400] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
62.110.122.20 - - [07/Mar/2012:21:29:05 +0400] "GET /phpmyadmin1/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
62.110.122.20 - - [07/Mar/2012:21:29:05 +0400] "GET /phpmyadmin2/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
62.110.122.20 - - [07/Mar/2012:21:29:06 +0400] "GET /xampp/phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
62.110.122.20 - - [07/Mar/2012:21:29:10 +0400] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
62.110.122.20 - - [07/Mar/2012:21:30:09 +0400] "GET /php-myadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
61.218.36.21 - - [08/Mar/2012:02:03:30 +0400] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
61.218.36.21 - - [08/Mar/2012:02:03:31 +0400] "GET /myadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
109.106.160.75 - - [10/Mar/2012:11:41:51 +0400] "GET //_phpmyadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.106.160.75 - - [10/Mar/2012:11:42:06 +0400] "GET ///phpmyadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.106.160.75 - - [10/Mar/2012:11:42:52 +0400] "GET //php-myadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
143.106.21.199 - - [11/Mar/2012:01:55:54 +0400] "GET /myadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
143.106.21.199 - - [11/Mar/2012:02:23:46 +0400] "GET /phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
143.106.21.199 - - [11/Mar/2012:02:28:25 +0400] "GET /phpmyadmin1/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
143.106.21.199 - - [11/Mar/2012:02:33:05 +0400] "GET /phpmyadmin2/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
143.106.21.199 - - [11/Mar/2012:02:42:22 +0400] "GET /typo3/phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
143.106.21.199 - - [11/Mar/2012:02:56:24 +0400] "GET /xampp/phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
193.110.72.242 - - [12/Mar/2012:04:15:42 +0400] "GET /phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
200.142.102.88 - - [13/Mar/2012:23:01:58 +0400] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
200.142.102.88 - - [13/Mar/2012:23:01:59 +0400] "GET /myadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
221.132.36.24 - - [20/Mar/2012:19:59:24 +0400] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
221.132.36.24 - - [20/Mar/2012:19:59:26 +0400] "GET /myadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
64.52.145.3 - - [21/Mar/2012:15:00:26 +0400] "GET /admin/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
64.52.145.3 - - [21/Mar/2012:15:00:28 +0400] "GET /myadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
64.52.145.3 - - [21/Mar/2012:15:00:29 +0400] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
64.52.145.3 - - [21/Mar/2012:15:00:30 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
64.52.145.3 - - [21/Mar/2012:15:00:30 +0400] "GET /phpmyadmin1/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
64.52.145.3 - - [21/Mar/2012:15:00:31 +0400] "GET /phpmyadmin2/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
116.126.127.217 - - [22/Mar/2012:04:10:10 +0400] "GET /admin/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
116.126.127.217 - - [22/Mar/2012:04:10:13 +0400] "GET /myadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
116.126.127.217 - - [22/Mar/2012:04:10:15 +0400] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
116.126.127.217 - - [22/Mar/2012:04:10:17 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
116.126.127.217 - - [22/Mar/2012:04:10:18 +0400] "GET /phpmyadmin1/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
116.126.127.217 - - [22/Mar/2012:04:10:18 +0400] "GET /phpmyadmin2/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
116.126.127.217 - - [22/Mar/2012:04:10:21 +0400] "GET /xampp/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
116.126.127.217 - - [22/Mar/2012:04:10:24 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
59.124.64.229 - - [24/Mar/2012:04:06:17 +0400] "GET /admin/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
59.124.64.229 - - [24/Mar/2012:04:06:19 +0400] "GET /myadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
59.124.64.229 - - [24/Mar/2012:04:06:22 +0400] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
59.124.64.229 - - [24/Mar/2012:04:06:24 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
59.124.64.229 - - [24/Mar/2012:04:06:25 +0400] "GET /phpmyadmin1/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
59.124.64.229 - - [24/Mar/2012:04:06:25 +0400] "GET /phpmyadmin2/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
59.124.64.229 - - [24/Mar/2012:04:06:28 +0400] "GET /xampp/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
59.124.64.229 - - [24/Mar/2012:04:06:31 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
85.237.228.171 - - [26/Mar/2012:07:12:25 +0400] "GET /phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.237.228.171 - - [26/Mar/2012:08:07:55 +0400] "GET /admin/phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.237.228.171 - - [26/Mar/2012:09:21:43 +0400] "GET /myadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.237.228.171 - - [26/Mar/2012:10:54:02 +0400] "GET /phpmyadmin1/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.237.228.171 - - [26/Mar/2012:11:12:30 +0400] "GET /phpmyadmin2/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.237.228.171 - - [26/Mar/2012:16:28:24 +0400] "GET /php-myadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
85.237.228.171 - - [26/Mar/2012:18:00:27 +0400] "GET /typo3/phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
204.9.201.211 - - [27/Mar/2012:16:56:06 +0400] "GET /admin/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
204.9.201.211 - - [27/Mar/2012:16:56:08 +0400] "GET /myadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
204.9.201.211 - - [27/Mar/2012:16:56:09 +0400] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
204.9.201.211 - - [27/Mar/2012:16:56:10 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
204.9.201.211 - - [27/Mar/2012:16:56:11 +0400] "GET /phpmyadmin1/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
204.9.201.211 - - [27/Mar/2012:16:56:11 +0400] "GET /phpmyadmin2/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
204.9.201.211 - - [27/Mar/2012:16:56:13 +0400] "GET /xampp/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
204.9.201.211 - - [27/Mar/2012:16:56:15 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
194.149.154.11 - - [27/Mar/2012:17:09:50 +0400] "GET /admin/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
194.149.154.11 - - [27/Mar/2012:17:09:51 +0400] "GET /myadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
194.149.154.11 - - [27/Mar/2012:17:09:52 +0400] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
194.149.154.11 - - [27/Mar/2012:17:09:53 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
194.149.154.11 - - [27/Mar/2012:17:09:53 +0400] "GET /phpmyadmin1/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
194.149.154.11 - - [27/Mar/2012:17:09:53 +0400] "GET /phpmyadmin2/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
194.149.154.11 - - [27/Mar/2012:17:09:54 +0400] "GET /xampp/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
194.149.154.11 - - [27/Mar/2012:17:09:55 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
77.48.63.206 - - [29/Mar/2012:19:43:30 +0400] "GET //phpmyadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
77.48.63.206 - - [29/Mar/2012:19:43:35 +0400] "GET //myadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
77.48.63.206 - - [29/Mar/2012:19:43:36 +0400] "GET //phpmyadmin2/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
77.48.63.206 - - [29/Mar/2012:19:43:38 +0400] "GET //php-myadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
115.69.211.20 - - [30/Mar/2012:12:30:29 +0400] "GET /myadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
115.69.211.20 - - [30/Mar/2012:12:30:35 +0400] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
115.69.211.20 - - [30/Mar/2012:12:30:37 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
115.69.211.20 - - [30/Mar/2012:12:30:38 +0400] "GET /phpmyadmin1/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
115.69.211.20 - - [30/Mar/2012:12:30:39 +0400] "GET /phpmyadmin2/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
115.69.211.20 - - [30/Mar/2012:12:30:43 +0400] "GET /xampp/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
76.164.167.234 - - [30/Mar/2012:18:03:30 +0400] "GET /phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
76.164.167.234 - - [30/Mar/2012:18:14:08 +0400] "GET /admin/phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
76.164.167.234 - - [30/Mar/2012:18:28:16 +0400] "GET /myadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
76.164.167.234 - - [30/Mar/2012:18:45:54 +0400] "GET /phpmyadmin1/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
176.53.16.10 - - [31/Mar/2012:14:03:14 +0400] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
176.53.16.10 - - [31/Mar/2012:14:03:15 +0400] "GET /myadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
76.164.186.222 - - [31/Mar/2012:14:37:46 +0400] "GET /phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
76.164.186.222 - - [31/Mar/2012:14:50:50 +0400] "GET /admin/phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
83.103.91.91 - - [31/Mar/2012:21:01:17 +0400] "GET /admin/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
83.103.91.91 - - [31/Mar/2012:21:01:19 +0400] "GET /myadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
83.103.91.91 - - [31/Mar/2012:21:01:20 +0400] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
83.103.91.91 - - [31/Mar/2012:21:01:22 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
83.103.91.91 - - [31/Mar/2012:21:01:22 +0400] "GET /phpmyadmin1/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
83.103.91.91 - - [31/Mar/2012:21:01:23 +0400] "GET /phpmyadmin2/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
83.103.91.91 - - [31/Mar/2012:21:01:25 +0400] "GET /xampp/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
83.103.91.91 - - [31/Mar/2012:21:01:27 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
221.132.36.24 - - [03/Apr/2012:08:06:06 +0400] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
221.132.36.24 - - [03/Apr/2012:08:06:08 +0400] "GET /myadmin/scripts/setup.php HTTP/1.1" 444 0 "-" "ZmEu"
219.76.235.221 - - [03/Apr/2012:21:29:27 +0400] "GET /admin/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
219.76.235.221 - - [03/Apr/2012:21:29:29 +0400] "GET /myadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
219.76.235.221 - - [03/Apr/2012:21:29:31 +0400] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
219.76.235.221 - - [03/Apr/2012:21:29:33 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
219.76.235.221 - - [03/Apr/2012:21:29:34 +0400] "GET /phpmyadmin1/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
219.76.235.221 - - [03/Apr/2012:21:29:34 +0400] "GET /phpmyadmin2/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
219.76.235.221 - - [03/Apr/2012:21:29:37 +0400] "GET /xampp/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
219.76.235.221 - - [03/Apr/2012:21:29:39 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
60.31.123.54 - - [10/Apr/2012:18:40:49 +0400] "GET /phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
203.91.121.71 - - [11/Apr/2012:15:45:37 +0400] "GET //phpmyadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
203.91.121.71 - - [11/Apr/2012:15:45:46 +0400] "GET //myadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
203.91.121.71 - - [11/Apr/2012:15:45:47 +0400] "GET //phpmyadmin2/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
203.91.121.71 - - [11/Apr/2012:15:45:58 +0400] "GET //php-myadmin/ HTTP/1.1" 444 0 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
189.17.80.184 - - [13/Apr/2012:03:31:05 +0400] "GET /admin/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
189.17.80.184 - - [13/Apr/2012:03:31:07 +0400] "GET /myadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
189.17.80.184 - - [13/Apr/2012:03:31:09 +0400] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
189.17.80.184 - - [13/Apr/2012:03:31:11 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
189.17.80.184 - - [13/Apr/2012:03:31:12 +0400] "GET /phpmyadmin1/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
189.17.80.184 - - [13/Apr/2012:03:31:13 +0400] "GET /phpmyadmin2/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
189.17.80.184 - - [13/Apr/2012:03:31:15 +0400] "GET /xampp/phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
189.17.80.184 - - [13/Apr/2012:03:31:17 +0400] "GET /phpmyadmin/index.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
88.190.23.29 - - [14/Apr/2012:18:21:50 +0400] "GET /phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
195.54.60.60 - - [15/Apr/2012:19:40:17 +0400] "GET /phpmyadmin/translators.html HTTP/1.1" 444 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"

У меня нет ни phpmyadmin ни xampp...

19.04.2012 14:06 #246981

а есть смысл? ведь потом это надо все к общему знаменателю подвести, иначе практического толку, имхо, 0

19.04.2012 14:14 #246983
"osorkon" написал:
а есть смысл? ведь потом это надо все к общему знаменателю подвести

Список сделать, пополнять, а блокировать с помощью iptables просто, тема уже вылизана.

19.04.2012 14:22 #246985

так не вопрос. я прям щас могу выложить список плохишей из логов ssh_auth, xferlog, access_log и пр. но кто будет искать в этих сотнях строк дубликаты, удалять не нужное и приводить в удобоваримый вид?

19.04.2012 14:30 #246987
"osorkon" написал:
но кто будет искать в этих сотнях строк дубликаты, удалять не нужное и приводить в удобоваримый вид?

Таки надо думать парсер. Был бы кодером то не вопрос, а так только грепать могу... ну не только конечно... :)

19.04.2012 14:31 #246988
"osorkon" написал:
удалять не нужное и приводить в удобоваримый вид?

diff. Кому потребуется, скопирут списочек себе, обработает...

19.04.2012 14:36 #246989

А меня вот это задолбало.

Показать
text
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:49 +0000] "STOR /upload/Video/Serial/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:49 +0000] "STOR /=UpLoad=/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:49 +0000] "STOR /-=UPLOAD=-/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:49 +0000] "STOR /Upload/Video/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:50 +0000] "STOR /Sharing/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:50 +0000] "STOR /_Upload/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:50 +0000] "STOR /_UpLoad/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:50 +0000] "STOR /ftp/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:51 +0000] "STOR /inbox/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:51 +0000] "STOR /public/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:51 +0000] "STOR /share/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:51 +0000] "STOR /Incoming/Video/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:52 +0000] "STOR /Incoming/Music/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:52 +0000] "STOR /_exchange/video/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:52 +0000] "STOR /_exchange/music/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:52 +0000] "STOR /_exchange/soft/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:53 +0000] "STOR /obmen/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:53 +0000] "STOR /~upload/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:53 +0000] "STOR /UPLOAD/VIDEO/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:53 +0000] "STOR /UPLOAD/SOFT/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:54 +0000] "STOR /!UPLOAD/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:54 +0000] "STOR /video/upload/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:54 +0000] "STOR /tmp/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:54 +0000] "STOR /in/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:55 +0000] "STOR /!incoming!/Video/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:55 +0000] "STOR /!incoming!/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:55 +0000] "STOR /Inbox/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:55 +0000] "STOR /guest/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:56 +0000] "STOR /pub/incoming/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:56 +0000] "STOR /nanka_3arpy3ku/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:56 +0000] "STOR /data/!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -
217.117.190.244 UNKNOWN ftp [18/Апр/2012:17:54:57 +0000] "STOR //!krasfs.ru - глобальный поиск файлов по всем FTP и Торрент-Трекерам.url" 550 -

Вычислить от куда лезет не могу.

19.04.2012 14:40 #246993
"yars" написал:
diff. Кому потребуется, скопирут списочек себе, обработает...

Подробней, плиз, а как обработать надо тут выложить, чтобы все могли это сделать.
Блокировка, примерно так:

text
BLOCKDB=”/root/ip.blocked”
IPS=$(grep -Ev "^#" $BLOCKDB)
for i in $IPS
do
 iptables -I 1 PREROUTING 1 -s $i -j DROP
done
19.04.2012 14:49 #246995
"--=XliN=--" написал:
А меня вот это задолбало.

аналогично. однажды я устал отслеживать изменение ip и просто сделал

text
deny_file={*.url,urls}

в vsftpd.conf

19.04.2012 15:17 #247003
"osorkon" написал:
аналогично. однажды я устал отслеживать изменение ip

Спасибо за наводку. Сделал

text
PathDenyFilter "(\\.url|\\.urls)$"

в proftpd.conf

19.04.2012 15:19 #247004
newzenon написал:
[quote="yars"]diff. Кому потребуется, скопирут списочек себе, обработает...

Подробней, плиз, а как обработать надо тут выложить, чтобы все могли это сделать.
Блокировка, примерно так:

text
BLOCKDB=”/root/ip.blocked”
IPS=$(grep -Ev "^#" $BLOCKDB)
for i in $IPS
do
 iptables -I 1 PREROUTING 1 -s $i -j DROP
done

[/quote]
Поиск различий diff'ом:

text

diff -B -w --changed-group-format="%=" --line-format="%L" file1.new file2.new > result.txt

Но я так и не понял, как же убрать все повторяющиеся строки?
Убрал про ... ХВАТИТ УЖЕ

19.04.2012 15:22 #247005

Что я сделал - скопировал приведенные выше логи в файлы 1 и 2, прогнал их через

text

cut -d " " -f 1 file1.txt > file1.new 
cut -d " " -f 1 file2.txt > file2.new

И в таком виде скормил diff'у.

19.04.2012 15:47 #247006

Эть:

text
cut -d " " -f 1 /var/log/nginx/access_log | sort -u
19.04.2012 16:05 #247008

Еще бы критерии левых запросов .... а то только примерно как-то или вручную.

19.04.2012 19:23 #247041
"newzenon" написал:
Таки надо думать парсер

Так что нужно ? Выдернуть IP-шники из логов ?
Я могу потренироваться на Python вечером, если не занят буду .

19.04.2012 19:41 #247043

-=Serj=- дак уже додумали

text
cat /var/log/nginx/access_log | grep _критерий_ > _файло_
cut -d " " -f 1 _файло_ | sort -u >> blacklist
19.04.2012 21:15 #247057

А так не лучше

text
cat /var/log/nginx/access_log | grep _критерий_ >> _файло_
cut -d " " -f 1 _файло_ | sort -u > blacklist

Как мне кажется, так не будут дублироваться IP, которые уже есть в blacklist

19.04.2012 21:19 #247060
"-=Serj=-" написал:
А так не лучше

sort -u можно повторно натравить на blacklist, а _файло_ тут посредник,...
ы. - лучше однострок придумай

19.04.2012 21:25 #247063
text
grep _критерий_ /var/log/nginx/access_log | cut -d " " -f 1 | sort -u > blacklist
Войдите или зарегистрируйтесь, чтобы ответить.