restrict access?

[jammy3]

I often get "hits" from DIFFERENT IP addresses for the same bogus files/paths.

One frequent example is:

/a1b2c3d4e5f6g7h8i9/nonexistentfile.php

I'd like to BAN anyone that requests this path/file as it's always the first in a series of requests, but haven't figured out how.

I already have a setting to ban after N requests, but I'd rather have a separate rule for specific file access.

TIA.

[aprelium]

jammy3,

Activate the anti-hacking feature. It will automatically ban IPs which send more than a given number of bogus request in a certain amount of time.
_________________
Support Team
Aprelium - http://www.aprelium.com

[jammy3]

[AbyssUnderground]

Unless you have any of those programs/scripts installed I dont think it will be much to worry about.

You could always ban the IP range of the anonymous IP's they are using.
_________________
Andy (AbyssUnderground) (previously The Inquisitor)
www.abyssunderground.co.uk

[Clarke]

For real! What is this. I get repeated requests for months now by different IP looking for this Too!

/a1b2c3d4e5f6g7h8i9/nonexistentfile.php

I did some googling on this and game across this Thread. THere is other sites talking about this.
Im really curious as to what this is.

This are some other strange requests I get once and awhile

[pkSML]

I've seen this problem too. It is very annoying. I think it comes from IP scanners run by hackers. I have Abyss X2 and see this problem only on the default host. In other words, they found it by requesting http://24.145.130.71, not http://stephen.calvarybucyrus.org, which is hosted at this IP.

It seems like a hacker, and they probably share their codes. Hackers are often looking for exploitation possibilities. If they find a certain file, they know something about your system, and probably have a way to compromise its security. There are many of them running the same code, so this is my explanation for the multiple IP's seen in your log.
_________________
Stephen
Need a LitlURL?

http://CodeBin.yi.org

[loloyd]

It may not be actively from a hacker at all, but from a host of compromised unsecure PCs mostly running on deficiently-patched Windows. My home-based server also suffers from this same problem (and more) and I think the bots doing this sure are smart. They actually circumvent abuse-detection systems (like in what you can set in Abyss' Anti-Hacking Protection feature) by trying only a few possibly exploitable resources on your website at any given time. It really is a big nuisance like spam.

As of the moment, there appears to be nothing that's at least 75% effective (with zero false positives) in blocking these hack attempts.
_________________

http://home.loloyd.com/ is online if the logo graphic at left is showing.