Dude,
Linux is free. F2ban is free. The community is a free resource. Please hang on
to money. All this said without any judgement, there are some fantastic
examples of wordpress filters on the net already. A quick google will not only
help you solve your problem, but also provide some insight in to how this
works. The latter being the reason i highly suggest you do a google as well.
Lstly, please dont try and search this regex in your access file and ban them.
This will lockout good and bad logins (the log entry is the same).
Have a look at this article for more info
https://bjornjohansen.no/using-fail2ban-with-wordpress
Have fun, and ask for help anytime. Its free.
Sent from Samsung tablet
-------- Original message --------
From: linuxthefish <[email protected]>
Date: 29/08/2015 12:49 (GMT+02:00)
To: [email protected]
Subject: [Fail2ban-users] $20 filter for banning wp-login spam?
Hi,
Whoever can design a fail for fail2ban that blocks this type of spam
in /usr/local/apache/logs/access_log, I can PayPal $20 to.
82.165.197.140 - - [29/Aug/2015:06:48:15 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:14 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:15 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:15 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:15 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
82.165.197.140 - - [29/Aug/2015:06:48:16 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:16 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:16 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:16 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:17 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
82.165.197.140 - - [29/Aug/2015:06:48:17 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:17 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:17 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
82.165.197.140 - - [29/Aug/2015:06:48:18 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:17 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:18 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:18 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:18 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
82.165.197.140 - - [29/Aug/2015:06:48:19 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:18 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:19 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:19 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:19 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:19 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:20 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
82.165.197.140 - - [29/Aug/2015:06:48:20 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
185.4.134.146 - - [29/Aug/2015:06:48:20 -0400] "POST /wp-login.php
HTTP/1.0" 200 3534
74.91.22.203 - - [29/Aug/2015:06:48:20 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
82.165.197.140 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
185.4.134.146 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php
HTTP/1.0" 200 3534
82.165.197.140 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
82.165.197.140 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
185.4.134.146 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php
HTTP/1.0" 200 3534
82.165.197.140 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
74.91.22.203 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php
HTTP/1.0" 200 3567
82.165.197.140 - - [29/Aug/2015:06:48:23 -0400] "POST /wp-login.php
HTTP/1.0" 500 251
Thanks
------------------------------------------------------------------------------
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
------------------------------------------------------------------------------
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
