Domain aussperren

Pionier

Hallo,

seit einigen Tagen habe ich einige "Hackversuche" auf meinem vServer.

Auszug aus der Log:

Code

77.104.217.233 - - [22/Feb/2010:22:56:52 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
77.104.217.233 - - [22/Feb/2010:22:56:52 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
67.43.5.33 - - [22/Feb/2010:22:59:28 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
67.43.5.33 - - [22/Feb/2010:22:59:28 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
58.177.209.216 - - [23/Feb/2010:01:18:14 +0100] "GET /user/soapCaller.bs HTTP/1.1" 302 199 "-" "Morfeus Fucking Scanner"
58.177.209.216 - - [23/Feb/2010:01:18:14 +0100] "GET /user/soapCaller.bs HTTP/1.1" 302 199 "-" "Morfeus Fucking Scanner"
203.200.180.74 - - [23/Feb/2010:06:16:22 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:06:16:22 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:06:41:07 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:06:41:07 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:07:09:10 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:07:09:10 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
193.74.64.40 - - [23/Feb/2010:07:26:20 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
193.74.64.40 - - [23/Feb/2010:07:26:20 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:07:41:18 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:07:41:18 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:08:15:49 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:08:15:49 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:08:50:18 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:08:50:18 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:09:28:31 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:09:28:31 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:10:09:20 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
203.200.180.74 - - [23/Feb/2010:10:09:20 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"
77.104.217.233 - - [23/Feb/2010:10:46:10 +0100] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 226 "-" "-"

Alles anzeigen

Alle Zugriffe kommen über die Domain (static.174.178.40.188.clients.your-server.de) welche auf meinen Server weist.

Wie kann ich das unterbinden?

MfG Pionier

Lucan

Ich hab auch genau die selben Log Einträge, das ist nichts wildes, geb da nichts drumm.

Hätte man hier IPTables könnte man ne Regel dafür erstellen, ansonsten In der OPENVZP Firewall die Ips Blocken.

Grüße

Pionier

Zitat von Lucan;14321

... ansonsten In der OPENVZP Firewall die Ips Blocken.

Grüße

Kann man das nicht über fail2ban regeln?