Help blocking attack site via htaccess

[whitebark]

Across a number of my servers I've seen a marked increase in automated attacks via GET requests on any of my sites running php files.

I have been getting a ton of these types of requests (none successful):
/index.php?name=hxxp://hackedsite.fortunecity.co.uk/index.htm?

How can I block these as I've counted well over 100 ip's the twits have used in the past week so ip banning is not going to work. It leaves the referrer field blank.

Thanks

 

[weblord]

Blocking Brute Force Attacks
http://www.owasp.org/index.php/Blocking_Brute_Force_Attacks

Block brute force attacks with iptables
http://kevin.vanzonneveld.net/techblog/article/block_brute_force_attacks_with_iptables/

.htaccess just temporary first aid
http://www.securityfocus.com/infocus/1370

 

[whitebark]

Thanks William but these are not brute force attacks in that way. They are attempting to have the destination page appended to the end of the url which is infected with their attack exploit code use a GET request on various .php files on my servers hoping to find a hole.

Here's a pic of the droppings they are leaving behind:

I was going to ban it by user agent but they are switching that up as well. The constant is the method of attack.

 

[Peter]

if they are trying to add the same address into the mix all the time you could use mod rewrite to send them elsewhere.

Alternatively try mod security if you have the right access to install it on the server

 

[weblord]

keep all the logs and submit an abuse report to
http://www.fortunecity.com/contact.shtml to have their site closed.
this is funny fortunecity's abuse email is [email protected]
and also CC: this [email protected]
http://network-tools.com/default.asp?prog=dnsrec&host=fortunecity.co.uk
http://members.spamcop.net/sc?action=showroute;ip=66.11.225.247;typecodes=17

Reports routes for 66.11.225.247:
routeid:41724250 66.11.224.0 - 66.11.239.255 to:[email protected]
Administrator found from whois records

block it via
Proxy Deny
Referer-based Deflector
http://httpd.apache.org/docs/2.0/misc/rewriteguide.html

on .htaccess block these ip:
ns-1.fortunecity.com [63.251.83.65]
ns-2.fortunecity.com [63.251.171.88]
66.11.225.247

 

[whitebark]

I've reported the site to fortune city twice already. They don't seem to care. Google shows I'm not the only to be under attack and to have reported it. Doesn't dotster own/control fortune city? They should be ashamed. (just noticed that William's post shows a dotster email address so they do)

Problem is they (or someone else has already moved on to another set of three sites to attempt the same thing), so this could get tiring.

 

[weblord]

dotster has gone haywire before theyre good
then just block the ip

 

[Peter]

dotster has gone haywire before theyre good
then just block the ip

As stated in his first post the requests are coming from hundreds of IP's

 

[weblord]

get the 100 ip's and blocked em, if they use one domain in fortunecity then block fortunecity.co.uk as well since they won't attend to an abuse report, also the attacked file index.php make it a static first .htm or move it to another folder.

to avoid your .htaccess being bloated, install apf firewall to ban those sets of ip
http://www.mysql-apache-php.com/apf-firewall.htm

As stated in his first post the requests are coming from hundreds of IP's

 

[Peter]

get the 100 ip's and blocked em, if they use one domain in fortunecity then block fortunecity.co.uk as well since they won't attend to an abuse report, also the attacked file index.php make it a static first .htm or move it to another folder.

to avoid your .htaccess being bloated, install apf firewall to ban those sets of ip
http://www.mysql-apache-php.com/apf-firewall.htm

That is not a viable option unless you are going to site their watching your log files endlessly. Also adding so many IP's to the deny list can slow things down dramatically.

If the requests are the same then a simple mod rewrite will resolve the situation.