Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'm launching a new website, not hosted on WordPress, but the majority of the (thin) traffic is junk like this:

46.165.211.194 "GET /wp-login.php HTTP/1.0" 404 8012 "-" "-"
46.165.211.194 "GET /static/wp-login.php HTTP/1.0" 404 162 "-" "-"
46.165.211.194 "GET /recycle/wp-login.php HTTP/1.0" 200 29695 "-" "-"
46.165.211.194 "GET /junkmail/wp-login.php HTTP/1.0" 200 80409 "-" "-"
199.19.122.114 "GET /administrator/index.php HTTP/1.0" 404 8051 "-" "-"

I'd like to find an automatic way to exclude any IP address that has hit a honeypot (like wp-login.php) in the last week. What would a GA filter for this look like, is it possible? Is there a good tool at the Apache level for this kind of sudden death honeypot?

The spam traffic is the majority of traffic to the site, which makes log analysis a pain.

share|improve this question
    
Take a look to Apache documentation for an .htaccess file: httpd.apache.org/docs/2.2/en/howto/htaccess.html. –  Zistoloen Dec 24 '13 at 0:46
    
The question specifies "automatic". I can of course write scripts to parse logs, then build httpd.conf files to exclude certain ips. But just maybe someone's already built this. –  Bryce Dec 24 '13 at 5:33
    
@bybe I do not run wordpress. –  Bryce Dec 24 '13 at 18:36
1  
@Bryce You can block URL access using fail2ban using failregex = ^<HOST> -.*(GET|POST).*wp-login.php as an example. Regardless if you have WordPress or you don't fail2ban will do both. Having WordPress just means you can download the plugin... but its not required, since fail2ban is for Linux not WordPress. With fail2ban your be able to block IP for X mins for X attempts on filename. –  bybe Dec 24 '13 at 19:29
    
@bybe suggest that as an answer to get some points. Thanks. –  Bryce Dec 24 '13 at 20:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.