3

I get a lot of those exploit scanning bots like the ones looking for a WordPress login (which I don't have) or guessing other exploitable URLs.

Where is a sensible place to redirect them to via .htaccess - is there some URL that can slow them down or analyse their IP? I've tried a honeypot quick link but that seems to have failed after 1 day.

4
  • Redirecting them is unlikely to do anything. I've been doing it for years, but I have no evidence that it slows them down in the least. – Stephen Ostermiller May 9 '17 at 18:35
  • Yes, I agree. But if there was a way to take up process CPU on their machine rather than CPU on my hosting box, that's got to be a good thing., surely. I just can't see the alternative being anything other than ugly - ie a redirect loop with 60s delays each time. I'm sure these guys would easily bom,b my machine if I did that :( – Johan May 9 '17 at 21:05
  • @Johan trust me on this - Do not mess with these people. If you do your server will be DDOSed for days. I did it once, nowadays no matter how clever I think I might be, I think twice and ignore or delete. – Steve May 9 '17 at 21:46
  • 2
    My personal favorite is to redirect the request to the domain or IP address making the request. Makes me laugh. – closetnoc May 9 '17 at 23:30
1

I guess you want to prevent bad bots from scanning your website(s). I think you should do it from htaccess. It will prevent bad scanning bots for visiting your website and return a 403 Forbidden. you can block them according to their User agent. The first line means that it will block a vistor without user agent:

RewriteCond %{HTTP_USER_AGENT} (badbot|badbot1|badbot2) [NC]
RewriteRule ^.* - [R=404,L]

In your logs, you can spot HTTP user agents from bad bots and add it to this list.

1
  • 1
    I think a 403 invite the bot to take another change (poke around) because it found something that is forbidden to access. 403 indicates 'something important is there'. I send a 404 and this normally reduces the amount of request however there are also some evil ones that use a poke list and don't care about errorcodes. – Codebeat Sep 6 '18 at 11:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.