1 week of mod_evasive some nasty bots get blacklisted
This are my mod_evasive settings:
LoadModule evasive20_module /usr/lib/apache2/mod_evasive20.so
DOSEmailNotify [email protected]
And this is a small documentation I’ve forget to add in the previous article:
- DOSHashTableSize: is the size of the table of URL and IP combined. The greater this setting, the more memory is required for the look up table, but also the faster the look ups are processed. This option will automatically round up to the nearest prime number.
- DOSPageCount: is the number of same page requests from the same IP during an interval that will cause that IP to be added to the block list.
- DOSSiteCount: is the number of pages requested of a site by the same IP during an interval which will cause the IP to be added to the block list.
- DOSPageInterval: Interval for the ‘DOSPageCount’ threshold in second intervals.
- DOSSiteInterval:Interval for the ‘DOSSiteCount’ threshold in second intervals.
- DOSBlockingPeriod: is the time the IP is blacked (in seconds
- DOSEmailNotify: can be used to notify by sending an email everytime an IP is blocked
- DOSSystemCommand: is the command used to execute a command when an IP is blocked. It can be used to add a block the user from a firewall or router.
- DOSWhiteList: can be used to whitelist IPs such as 127.0.0.1
So if anybody on my homepage request 5 times the same page in less than 2 seconds, it will get blacklisted.
If anybody try to make more than 100 requests of my homepage in less than 2 seconds, it will get blacklisted.
In less than a week, the following Bots get blacklisted.
220.127.116.11 Unknown Country
18.104.22.168 Chinese (Hong Kong)
22.214.171.124 Unknown Country
126.96.36.199 Dutch (Netherlands)
188.8.131.52 GERMANY (DE) City: Muenchen Latitude: 48.15 Longitude: 11.5833
184.108.40.206 United States
220.127.116.11 Country: INDIA (IN) City: Hyderabad Latitude: 17.3833 Longitude: 78.4833
18.104.22.168 UNITED STATES (US)
22.214.171.124 Swedish (Sweden)
126.96.36.199 BELGIUM (BE) City: Tournai Latitude: 50.6 Longitude: 3.3833
188.8.131.52 NETHERLANDS (NL) City: Harlingen Latitude: 53.1833 Longitude: 5.4167
184.108.40.206 GERMANY (DE) City: Heinsberg Latitude: 51.0333 Longitude: 8.15
220.127.116.11 GERMANY (DE)
18.104.22.168 DENMARK (DK)
22.214.171.124 Dutch (Netherlands)
126.96.36.199 ITALY (IT) City: Roma Latitude: 41.9 Longitude: 12.4833
188.8.131.52 UNITED STATES (US) City: Mountain View, CA Latitude: 37.402 Longitude: -122.078 GOOGLE
184.108.40.206 GERMANY (DE)
220.127.116.11 Dutch (Netherlands)
18.104.22.168 UNITED STATES (US) City: Raleigh, NC Latitude: 35.8219 Longitude: -78.6588