Should I block ftp & mail in urls that shows up in the Latest Visitors Logs?
Are they a bot, hacker or misconfigured server?
Examples: ftp.somesite.com, mail.somesite.com
IF so; how would I block only those words in htaccess?
-
Are these valid sub-domains? If not, are they showing up in your example.com site log files? Even with log file data, we may never know what the pay-off would be, but I suspect this is a script-kiddie looking for vulnerabilities. Many hosts create these sub-domains by default- not sure why. I suspect there is no danger, but I would block them in .htaccess anyway- perhaps redirect them to a bad site. ;-)– closetnocFeb 11, 2015 at 18:07
-
I have seen many spam/hacking attempts from .ua, .ru and .cn. It's phun watching them try & hack a non-wp site...– user49378Feb 11, 2015 at 18:16
-
Yep Script-kiddie stuff. You can block if you want. Do you need code??– closetnocFeb 11, 2015 at 18:18
-
My site is set-up to attract this activity. It is rather fun to waste their time! Plus I am a tattle-tale by posting them on my site which I am working on and is getting better and better each day. Free content! Yeahhhh!!!– closetnocFeb 11, 2015 at 18:20
-
Yes, I need the Code 8)– user49378Feb 11, 2015 at 18:22
Add a comment
|
1 Answer
If these sub-domains do not exist and these requests are being handled by your site, you can safely block them using .htaccess. Try this:
RewriteCond %{REMOTE_HOST} ^ftp\.example\.com$ [NC,OR]
RewriteCond %{REMOTE_HOST} ^mail\.example\.com$ [NC]
RewriteRule .* - [F,L] # manually added
Obviously replace example.com with your domain name keeping the \ [back-slash] before the . [dot] to properly escape.
Of course you can replace the RewriteRule with a redirect:
RewriteRule .* http://www.a-bad-place.com/ [R,L]
-- or --
RewriteRule .* http://www.house-of-mouse.com/ [R,L]
Replace www.a-bad-place.com or www.house-of-mouse.com with a site of your choice. (Just for humor of course- I am not advising redirecting an attack on another site. But if you do, I won't tell. [That's a joke son. Laugh. - Foghorn Leghorn] )
answered Feb 11, 2015 at 18:33
-
NOTE: these are "Some Other Sites" trying to access my site. The funny thing is mail.mysite.com links to sosoulmate.com - don't you just love that? I could care less because [email protected] still works.– user49378Feb 11, 2015 at 18:44
-
@EastTexas Ooopppssss! I may have had a brain-fart. Mail.example.com is the attacking site? That is how I wrote the .htaccess. Feb 11, 2015 at 18:47
-
@EastTexas Perhaps this is new to you, but as you get older and become an old fart (like I am) and more and more gassy, these various bubbles to not always exhaust properly and rise up to the brain causing havoc. This is why it is important to keep your ears clean and blow your nose. But do not have a lit cigarette while doing this. It will singe your ear/nose hairs at the very least which is good, but can otherwise really ruin your day. (another joke) Feb 11, 2015 at 18:53
-
Possibly a bit of an aside, but...
REMOTE_HOSTis only set (to the host) ifHostnameLookupsis enabled on the server, otherwise it's likely to contain the IP address (or not be set at all). Although I guess it is enabled if you are getting hosts (rather than IP addresses) in your access logs? However,HostnameLookupsis Off by default - for performance reasons - since Apache will otherwise need to make DNS lookups for every request.– MrWhiteFeb 11, 2015 at 21:44 -
@w3d Excellent point!! Some installs/builds enable this, but Apache by default does not. I forgot about that. Thanks!! Feb 11, 2015 at 21:52