Hi,
First off thanks for this module its great!
Our website had a malware script running in "sites/default/files/upload.htm" and "sites/default/files/page4.htm" etc.
It's cleaned now but, from logs i can find that many IP's are trying to continuously access these urls. I would like to ban them after a few (3) 404's.
From syslog the line looks like:
Nov 30 06:50:50 host drupal: http://www.website.com|1354251050|page not found|195.88.252.132|http://www.website.com/sites/default/files/upload.htm?tjw55=2m286cbe47||0||sites/default/files/upload.htm

The drupal syslog formatting is:
!base_url|!timestamp|!type|!ip|!request_uri|!referer|!uid|!link|!message

Can you please help me create a new custom filter / regex for this?
It should be specific for the path "/sites/default/files/upload.htm" not "page not found" because i don't want to ban normal "page not founds" that randomly occur.

Thanks

Comments

aabo’s picture

aabo commented

Hello again,

I think i found a solution:

failregex = .*\|<HOST>\|.*(/sites/default/files/upload.htm).*
             .*\|<HOST>\|.*(/sites/default/files/page4.htm).*
aabo’s picture

aabo commented
Status: Active » Closed (fixed)