Re: How to block ip addresses which always hack my website
Ervin Hegedüs <[email protected]>
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <[email protected]> |
Hi, On Fri, Aug 30, 2019 at 12:32:14PM +0630, wai phyo wrote: > I would like to block IP Address that visited 404 pages more than 10 times > in a minute. > Please tell me how can I write rule??? I'm not sure that I'ld do it with ModSecurity - if you really want to build a mechanism to listen the 404 answer code, then it would be better to catch it before the higher layer. I mean, you can use an IDS, for example fail2ban[1], which checks the http log, and if an IP triggers x+1 HTTP 404 in k+1 minute, then it will be blocked until z+1 minute - on L3. a. [1] https://github.com/fail2ban/fail2ban _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/