Multiple set of errors multiple times per day... How to figure out the cause?

supak111 wrote: ↑

Fri Dec 13, 2024 6:53 pm

Keep getting these 44 lines of errors multiple times a day and can't figure out who or what is doing it.

paulfeakins wrote: ↑

Fri Dec 13, 2024 8:28 pm

You should probably install this before your site crashes: https://www.opencart.com/index.php?rout ... n_id=25968

supak111 wrote: ↑

Fri Dec 13, 2024 9:47 pm

I keep an eye on my log files so they never really get large so I don't really need the extension.

paulfeakins wrote: ↑

Mon Dec 16, 2024 7:52 pm

supak111 wrote: ↑

Fri Dec 13, 2024 9:47 pm

I keep an eye on my log files so they never really get large so I don't really need the extension.

All of them? And it is free.

supak111 wrote: ↑

Tue Dec 17, 2024 11:28 pm

I don't have the IP's off that particular bot that was causing all my errors from post #1. But I do still get hit by bots that are fishing to exploits. They search for specific files that are knows to have vulnerability.

What I did for these horrible bots is as soon as a bot looks for one of these vulnerable files it gives it self away and its IP address. I instantly take their IP address and save it directly to my .htaccess file as "Deny from $ip" with a small PHP script I wrote.

Here is the list of keywords I look for so far (it keeps expanding):

Code: Select all

$spamwords = [
    '.docker',
    '.env',
    '.ftpconfig',
    '.git',
    '.hg',
    '.svn',
    '.tmb',
    '.wp-cli',
    '0x.php',
    '01.php',
    '1index.php',
    '02.php',
    '2index.php',
    '3index.php',
    '4price.php',
    '007licenseplate.sql',
    '007plate.sql',
    '13.php',
    '098.php',
    '1234.php',
    '2021wp',
    '_ignition',
    '_profiler',
    'abe.php',
    'acme-challenge',
    'adm.php',
    'adminer.php',
    'ae.php',
    'ajax-actions.php',
    'ak.php',
    'aks.php',
    'alfa.php',
    'alfa-rex.php7',
    'alfa-rex2.php7',
    'ALFA_DATA',
    'alfacgiapi',
    'alfanew.php',
    'alfanew2.php7',
    'archives.php',
    'as.php',
    'asset',
    'asus.php',
    'atomlib.php',
    'auto-seo.php',
    'autoload_classmap.php',
    'autoload_classmap',
    'avaa.php',
    'aws.yml',
    'backup',
    'baxa1.ph',
    'bckp',
    'berlin.php',
    'bkp',
    'bkup',
    'bless.php',
    'blocks',
    'blog.php',
    'bs1.php',
    'buy.php',
    'byp.php',
    'bypass.php',
    'c.php',
    'cc.php',
    'certificates',
    'cgi-bin',
    'chosen',
    'citrix',
    'ckeditor',
    'class.api.php',
    'class.php',
    'class-php',
    'classsmtps.php',
    'classwithtostring.php',
    'click.php',
    'cljntmcz.php',
    'cloud.php',
    'cnzcsfwm.php',
    'colors.php',
    'colour.php',
    'components',
    'conf_upload.php',
    'config.php7',
    'config',
    'cong.php',
    'content.php',
    'contentloader1.php',
    'cookie.php',
    'core',
    'crack_self_restore.php',
    'cron.php',
    'csv.php',
    'ctc_admin',
    'curl.php',
    'data',
    'database',
    'default.php',
    'defaults.php',
    'delpaths.php',
    'demo',
    'depotcv.php',
    'developer',
    'disagraeed.php',
    'disagraeosc.php',
    'disagraep.php',
    'disagreed.php',
    'disagrsod.php',
    'do_not',
    'doc.php',
    'donot',
    'downloader',
    'dropdown.php',
    'dump',
    'dup-installer',
    'ebs.php7',
    'edit.php',
    'elfinder',
    'erin1.PhP7',
    'ern.PhP7',
    'ern1.PhP7',
    'error',
    'ethan.php',
    'ewebeditor',
    'file.php',
    'filemanager',
    'flower.php',
    'framework',
    'fresh:',
    'frontend',
    'function.php',
    'fw.php',
    'gawean.PhP7',
    'gif.php',
    'goat1.php',
    'good.php',
    'hidelicenseplate.sql',
    'hideplate.sql',
    'includ',
    'include',
    'indoxploit.php',
    'info.php',
    'inputs.php',
    'installer.php',
    'installer-backup.php',
    'ioxi001.PhP7',
    'ioxi002.PhP7',
    'item.php',
    'jp.php',
    'karma.conf',
    'kcfinder',
    'KodExplorer',
    'koko.PhP7',
    'langs',
    'laravel',
    'legion.php',
    'license.php',
    'license.txt',
    'link.php',
    'local.php',
    'locally',
    'lock.php',
    'log.php',
    'logs',
    'lufix.php',
    'lv.php',
    'magento',
    'main',
    'makeasmtp.php',
    'marijuana.php',
    'matomo',
    'media.php',
    'media-admin.php',
    'menu.php',
    'mini',
    'moodle',
    'moon.php',
    'mycommand.php',
    'mysql',
    'network.php',
    'no.php',
    'nologin.php',
    'options.php',
    'options-discussion.php',
    'ova-tools.php',
    'panel',
    'pgs.phP7',
    'pki-validation',
    'platform',
    'plugins-dist.php',
    'pomo',
    'portal',
    'post.php',
    'praxismanagement',
    'print',
    'public',
    'radio.php',
    'randkeyword',
    'rdweb',
    'README.md',
    'readme.php',
    'repeater.php',
    'report',
    'rest-api',
    'root',
    'rsd.xml',
    'RxR.php',
    'rxr.php',
    'saka.phP7',
    'sandbox',
    'secret',
    'security.txt',
    'server',
    'session.php',
    'shell',
    'shells.php',
    'sidwsi.php',
    'simple.php',
    'site1.com',
    'site2.com',    
    'sitio',
    'sito',
    'sleepster',
    'soso',
    'sql',
    'stag',
    'static',
    'style.php',
    'temp',
    'ticket',
    'tiny.php',
    'tinyfilemanager',
    'trydeal.sql',
    'ueditor',
    'UEditor',
    'up.php',
    'upall.php',
    'UpdateChecker.exe',
    'upel.php',
    'upfile.php',
    'upgrade.php',
    'upload',
    'ups.php',
    'used:',
    'userarea',
    'utchiha.php',
    'utility',
    'Utility',
    'v3.php',
    'v5.php',
    'vendor',
    'vqmod',
    'widgets.php',
    'wikindex.php',
    'wordpress',
    'worksec.php',
    'worm0.PhP7',
    'worm3.PhP7',
    'wp-',
    'ws.php',
    'WSOEnigma.php',
    'xl2023.php',
    'xleet.php',
    'xmlrpc',
    'xx.php',
    'xxx.php',
    'yanz.php',
    '.aws',
    'zencart'
    // DONT USE - script, prod, .php, auth,
];

Here are some of the IP's I gathered to block and the file or keyword the BOT was looking for:

Code: Select all

Deny from 13.76.244.185   //radio.php
Deny from 3.120.186.2     //.env
Deny from 84.239.16.8     //.env
Deny from 3.106.167.75    //.env
Deny from 15.156.74.184   //.env
Deny from 3.107.187.199   //.env
Deny from 34.216.138.85   //.env
Deny from 3.76.252.132    //.env
Deny from 54.159.209.4    //.env
Deny from 13.76.244.125   //lock.php
Deny from 15.188.62.166   //wordpress
Deny from 3.140.245.206   //main
Deny from 3.12.73.7       //backup
Deny from 172.172.130.74  //disagraeosc.php
Deny from 13.58.216.29    //main
Deny from 15.152.112.203  //.env
Deny from 3.15.190.168    //main
Deny from 103.194.184.194 //includ
Deny from 18.118.50.130   //main
Deny from 52.187.27.127   //cljntmcz.php
Deny from 116.213.38.242  //includ
Deny from 103.194.185.42  //static
Deny from 52.163.76.196   //autoload_classmap.php
Deny from 35.180.252.16   //wordpress
Deny from 13.38.120.183   //wordpress
Deny from 119.42.147.194  //static
Deny from 52.163.71.87    //cloud.php
Deny from 103.194.185.58  //includ
Deny from 20.169.232.142  //autoload_classmap.php
Deny from 198.23.136.133  //public

supak111 wrote: ↑

Wed Dec 18, 2024 4:00 am

A bot thats visiting various URL's on my site 30-60 times in 10 seconds is worse IMO... Portably slows down everyone that on the site at the time of the bot attack.

With the solution above, it can hit once and it automatically goes on the "Deny from" list.

I have iSenseLabs BotBlocker that looks up IP addresses and compares them to reported BOTs, I'm sure that slows down the site too? No?

	# give straight 410 for non existing files/directories with a dot
	RewriteCond %{REQUEST_URI} \.
	RewriteCond %{REQUEST_FILENAME} !-s
	RewriteCond %{REQUEST_FILENAME} !-d
		RewriteRule ^.*$ - [G,L]
	
	# any virtual url not containing a dot, let OC handle them
	RewriteCond %{REQUEST_URI} !\.
	RewriteCond %{REQUEST_FILENAME} !-s
	RewriteCond %{REQUEST_FILENAME} !-d
		RewriteRule ^([^?]*) /index.php?_route_=$1 [PT,QSA,L]

nonnedelectari wrote: ↑

Wed Dec 18, 2024 8:36 am

If you use seo urls and make sure your seo urls do not contain a dot, you can use this in your htaccess instead of the original seo url handling code.

Code: Select all

	# give straight 410 for non existing files/directories with a dot
	RewriteCond %{REQUEST_URI} \.
	RewriteCond %{REQUEST_FILENAME} !-s
	RewriteCond %{REQUEST_FILENAME} !-d
		RewriteRule ^.*$ - [G,L]
	
	# any virtual url not containing a dot, let OC handle them
	RewriteCond %{REQUEST_URI} !\.
	RewriteCond %{REQUEST_FILENAME} !-s
	RewriteCond %{REQUEST_FILENAME} !-d
		RewriteRule ^([^?]*) /index.php?_route_=$1 [PT,QSA,L]

This is nice but problem is that contact page...

actually most of the links in the footer are NOT seo urls so they do contains a dot/period