пропозиції роботи
Irek
Słonina
programowanie, bazy
danych i linuksy
Temat: Apache 2.2 - Blokowanie HTTP GET do stron nieserwowanych...
Hej,wygląda na to, że atakuje mnie jakiś botnet. Mam kupę śmiecia w postaci:
174.139.182.82 - - [29/Apr/2013:11:37:15 +0200] "GET http://b.scorecardresearch.com/b?c1=8&c2=2102&c3=0&c4=&c5=&c15=&c16=&ns__t=1367228180187&ns_c=&c8=online%2Clpn%2Cnursing%2Cschool&c7=http%3A%2F%2Ftravelsupermarket.com%2F&c9=http%3A%2F%2Fwww.google.com%2Furl%3Fsa%3Dt%26rct%3Dj%26q%3Droth%2520ira%2520qualifications%26source%3Dweb%26cd%3D34%26ved%3D0CRzQFjANi%26url%3Dhttp%253A%252F%252Ftravelsupermarket.com%252F%26ei%3DkrGjrpNnmnIzvDKTz0XKq8%26usg%3D5GKTivv_Wrh8NculiFTON3xGXHQ_wDmN8K HTTP/1.1" 302 - "http://travelsupermarket.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; pl-PL) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.1 Safari/525.17"
60.190.216.228 - - [29/Apr/2013:11:37:15 +0200] "GET /fcg-bin/cgi_emotion_list.fcg?uin=1319166781&loginUin=0&s=371494&num=3&noflower=1&g_tk=5381 HTTP/1.1" 404 305 "http://user.qzone.qq.com/1319166781" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; SE 2.X MetaSr 1.0"
23.19.164.170 - - [29/Apr/2013:11:37:15 +0200] "GET http://cdn.spotxchange.com/media/thumbs/pixel/pixel.gif HTTP/1.1" 200 43 "http://cdn.turn.com/server/ddc.htm?uid=7757466991326314943&rnd=7685409397288387007&fpid=12&nu=y&t=&sp=n&purl=&ctid=3&cyid=12" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; en) Opera 8.52"
198.20.175.6 - - [29/Apr/2013:11:37:14 +0200] "GET http://ad.yieldmanager.com/pixel?id=2155814&t=2&piggyback=http%3A%2F%2Fad.yieldmanager.com%2Fcms%2Fv1%3Fesig%3D1~862d802dd86fb59368388ad078a7f298ddbbd0b7%26nwid%3D10000424978%26sigv%3D1&B=1&SIG=10v5htni8;x-cookie=7ntapgy8afsco&o=3&f=sn HTTP/1.1" 302 - "http://cdn.turn.com/server/ddc.htm?uid=8742247822043445151&rnd=3337646794222139295&fpid=12&nu=y&t=&sp=n&purl=&ctid=3&cyid=12" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl-PL) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1"
108.62.165.2 - - [29/Apr/2013:11:37:14 +0200] "GET http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=549072&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=134226 HTTP/1.1" 200 9200 "http://cruisevacationsguide.com/" "Opera/9.22 (Windows NT 5.1; U; pl)"
14.155.224.4 - - [29/Apr/2013:11:37:14 +0200] "GET http://r.tapit.com/adrequest.php?udid=d5c6e47e40dc3394ecefa68c94028483&format=json&ua=Mozilla%2F5.0%20(Linux%3B%20U%3B%20Android%202.2.1%3B%20ko-kr%3B%20SHW-M110S%20Build%2FFROYO)%20AppleWebKit%2F533.1%20(KHTML%2C%20like%20Gecko)%20Version%2F4.0%20Mobile%20Safari%2F533.1%20NAVER(inapp%3B%20search%3B%20100)&zone=6510&lat=34.035450&long=-113.008464 HTTP/1.0" 200 34 "-" "Mozilla/5.0 (Linux; U; Android 2.2.1; ko-kr; SHW-M110S Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 NAVER(inapp; search; 100)"
108.62.165.2 - - [29/Apr/2013:11:37:14 +0200] "GET http://bh.contextweb.com/bh/rtset?do=add&pid=537085&ev=A5D34DD7BA586ABF5EA30D7B8669BFD0 HTTP/1.1" 200 49 "http://bh.contextweb.com/bh/visitormatch?tag=134339&pid=549118" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.43 Safari/534.24"
67.198.159.122 - - [29/Apr/2013:11:37:15 +0200] "GET http://ib.adnxs.com/ttj?id=1124787&size=300x250 HTTP/1.0" 200 - "http://adserve.dexplatform.com/i_opt.php?f=728x90&w=728&h=90&r=pl&n=cdxn&i=1217" "Opera/9.80 (X11; Linux i686; U; ja) Presto/2.7.62 Version/11.01"
60.190.216.239 - - [29/Apr/2013:11:37:15 +0200] "GET /fcg-bin/cgi_emotion_list.fcg?uin=446703427&loginUin=0&s=742181&num=3&noflower=1&g_tk=5381 HTTP/1.1" 404 305 "http://user.qzone.qq.com/446703427" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; SE 2.X MetaSr 1.0"
172.240.87.154 - - [29/Apr/2013:11:37:15 +0200] "GET http://b.scorecardresearch.com/beacon.js HTTP/1.1" 200 1900 "http://bigwigbiz.com/" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl-PL) AppleWebKit/525.19 (KHTML, like Gecko) Version/3.1.2 Safari/525.21"
192.154.110.165 - - [29/Apr/2013:11:37:15 +0200] "GET http://ad.360yield.com/match?publisher_dsp_id=4&external_user_id=2326564169319745328 HTTP/1.1" 200 43 "http://cdn.turn.com/server/ddc.htm?uid=2326564169319745328&rnd=2542736951433529136&fpid=12&nu=y&t=&sp=n&purl=&ctid=3&cyid=12" "Mozilla/5.0 (Windows; U; Windows NT 5.1; pl-PL) AppleWebKit/525.19 (KHTML, like Gecko) Version/3.1.2 Safari/525.21"
198.100.104.115 - - [29/Apr/2013:11:37:14 +0200] "GET http://search.yahoo.com/ HTTP/1.1" 200 15407 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Acoo Browser; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"
198.20.175.6 - - [29/Apr/2013:11:37:15 +0200] "GET http://ak1.abmr.net/is/tag.contextweb.com?U=/TagPublish/GetAd.aspx&V=3-P9gzhD5R4PRCyHY%2fN+MMQ4gYu5AubtYKI0uUDsf92jdzRfL4SEFqdZWmjZh3bV6a&I=23B01BCE1E2FDA4&D=contextweb.com&01AD=1&tagver=1&cp=549136&ct=134407&cn=1&crtg=&cwod=&epid=&esid=&ifurl=&tppg=&brk=false&ccid=&wp=0&cf=300X250&rq=1&dw=1889&cwu=http%3A%2F%2Fwirelessbroadbandservice.co.uk%2F&cwr=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3B_ylt%3Dz256wFf6dFf0zvBc%3Fp%3Dfixed%2Brate%2Bdeals%26fr%3Dush_on_omg%26fr2%3Dsb-top%26xargs%3D12KPjg1HY5OC1ioN5nYOSnf56ybrRd94RwXwhYBovbRec3L%252EVmZOUt8WFUTUIlStoyfmwYKZtk8%252EUfgmfGLIr1Gw%26pstart%3D10%26b%3D371%26xa%3DSISasQxuO0y8JPaYmaauUx--%2C1367271348&mrnd=66131668&if=0&tl=2&pxy=867,434&cxy=1889,434&dxy=1889,434&tz=420&ln=pl-pl,pl-pl,pl-pl HTTP/1.1" 302 - "http://wirelessbroadbandservice.co.uk/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; pl-PL) AppleWebKit/523.15 (KHTML, like Gecko) Version/3.0 Safari/523.15"
198.20.170.26 - - [29/Apr/2013:11:37:14 +0200] "GET http://user.lucidmedia.com/user/browser?p=b2108357999e9462&r=1 HTTP/1.1" 302 - "http://bh.contextweb.com/bh/visitormatch?tag=158983&pid=555013" "Mozilla/5.0 (Windows; U; Windows NT 5.1; pl-PL) AppleWebKit/525.19 (KHTML, like Gecko) Version/3.1.2 Safari/525.21"
Mógłby ktoś podsunąć pomysł jak to przyblokować?
Mój apache nawiązuje kupę połączeń wychodzących więc pewnie przyczynia się w większym lub mniejszym stopniu to bycia cześcią botnetu.
Na razie jedynym pomysłem jest mod_rewrite żeby blokował strony inne niż moje własne, w międzyczasie będę próbował sobie takie reguły napisać. Gdyby ktoś jednak miał inny/lepszy pomysł bardzo chętnie usłyszę.
Fail2Ban nie dał rady wychwycić tego syfu, atakowany jestem z unikalnych adresów, wygląda na jakiś botnet.
