1 week of mod_evasive some nasty bots get blacklisted
This are my mod_evasive settings:
LoadModule evasive20_module /usr/lib/apache2/mod_evasive20.so
DOSEmailNotify [email protected]
And this is a small documentation I’ve forget to add in the previous article:
- DOSHashTableSize: is the size of the table of URL and IP combined. The greater this setting, the more memory is required for the look up table, but also the faster the look ups are processed. This option will automatically round up to the nearest prime number.
- DOSPageCount: is the number of same page requests from the same IP during an interval that will cause that IP to be added to the block list.
- DOSSiteCount: is the number of pages requested of a site by the same IP during an interval which will cause the IP to be added to the block list.
- DOSPageInterval: Interval for the ‘DOSPageCount’ threshold in second intervals.
- DOSSiteInterval:Interval for the ‘DOSSiteCount’ threshold in second intervals.
- DOSBlockingPeriod: is the time the IP is blacked (in seconds
- DOSEmailNotify: can be used to notify by sending an email everytime an IP is blocked
- DOSSystemCommand: is the command used to execute a command when an IP is blocked. It can be used to add a block the user from a firewall or router.
- DOSWhiteList: can be used to whitelist IPs such as 127.0.0.1
So if anybody on my homepage request 5 times the same page in less than 2 seconds, it will get blacklisted.
If anybody try to make more than 100 requests of my homepage in less than 2 seconds, it will get blacklisted.
In less than a week, the following Bots get blacklisted.
18.104.22.168 Unknown Country
22.214.171.124 Chinese (Hong Kong)
126.96.36.199 Unknown Country
188.8.131.52 Dutch (Netherlands)
184.108.40.206 GERMANY (DE) City: Muenchen Latitude: 48.15 Longitude: 11.5833
220.127.116.11 United States
18.104.22.168 Country: INDIA (IN) City: Hyderabad Latitude: 17.3833 Longitude: 78.4833
22.214.171.124 UNITED STATES (US)
126.96.36.199 Swedish (Sweden)
188.8.131.52 BELGIUM (BE) City: Tournai Latitude: 50.6 Longitude: 3.3833
184.108.40.206 NETHERLANDS (NL) City: Harlingen Latitude: 53.1833 Longitude: 5.4167
220.127.116.11 GERMANY (DE) City: Heinsberg Latitude: 51.0333 Longitude: 8.15
18.104.22.168 GERMANY (DE)
22.214.171.124 DENMARK (DK)
126.96.36.199 Dutch (Netherlands)
188.8.131.52 ITALY (IT) City: Roma Latitude: 41.9 Longitude: 12.4833
184.108.40.206 UNITED STATES (US) City: Mountain View, CA Latitude: 37.402 Longitude: -122.078 GOOGLE
220.127.116.11 GERMANY (DE)
18.104.22.168 Dutch (Netherlands)
22.214.171.124 UNITED STATES (US) City: Raleigh, NC Latitude: 35.8219 Longitude: -78.6588