Thanks for your reply.
What I decided to do (well, part of it anyway) is just use .htaccess to redirect the bad hits. First they go to a script that collects the IP and some other data and stashes it a database so it can be used to compile blocklists that can be shared; and that script in turn includes an actual 401 page with proper headers after it's done collecting the data.
The .htaccess entries look something like this:
Code: Select all
# Honeypot for non-existent login attempts
RewriteCond %{REQUEST_URI} /wp-login.php [NC,OR]
RewriteCond %{REQUEST_URI} /wp-config.php [NC,OR]
RewriteCond %{REQUEST_URI} /wp-contacts.php [NC,OR]
RewriteCond %{REQUEST_URI} /xmlrpc.php [NC,OR]
RewriteCond %{REQUEST_URI} /webconfig.txt.php [NC,OR]
RewriteCond %{REQUEST_URI} /admin.php [NC,OR]
RewriteCond %{REQUEST_URI} /login.php [NC,OR]
RewriteCond %{REQUEST_URI} /adminer.php [NC,OR]
RewriteCond %{REQUEST_URI} /lequ.php [NC,OR]
RewriteCond %{REQUEST_URI} /install.php [NC,OR]
RewriteCond %{REQUEST_URI} /setup.php [NC,OR]
RewriteCond %{REQUEST_URI} /shell.php [NC,OR]
RewriteCond %{REQUEST_URI} /user.php [NC,OR]
RewriteCond %{REQUEST_URI} ^/install/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/setup/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/plus/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/data/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/inc/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/.git/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/templates/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/fckeditor/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/config/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/administrator/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/admin/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/manager/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/cms/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/wp-admin/(.*)$ [NC]
RewriteRule .* https://www.[domain-name].com/busted.php?req=%{REQUEST_URI} [L]
The above is installed on many sites that I own or manage. The exact entries change from time to time, mainly in response to newly-discovered exploits. Obviously, none of the entries correspond to pages that actually exist.
busted.php in turn collects information such as the date, time, IP, name of the page originally sought (using a single line of php:
), and so forth. It then stashes the data in a database, which in turn is used to compile the blocklists. The databases are pruned regularly, so all IP's are automatically rehabilitated in a few days if they stop misbehaving.
In addition, the script checks whether the IP has hit any of the honeypots or otherwise misbehaved within the past 900 seconds, and if not, reports it to AbuseIPDB. So the misbehaving IP's are available on both the lists I compile and from AbuseIPDB.
My free blocklists are available to anyone in the Internet-connected world and are updated daily. I also have paid (but inexpensive) blocklists that draw from the same database but are updated hourly.
The site itself is ad-monetized so I don't know if I'm allowed to link it here. But if you search Google for "Recently Misbehaving IP Addresses" you should find it. Feel free to use the lists if you like.
Richard