Jde o jeden z několika útoků na Vsevjednom.cz. Jeho cílem je načítání spousty neexistujících souborů. Tohle je kontrolní skript, který blokne (díky ipset) útočící IP adresy. Naprostá většina útoku je z Googlu: bc.googleusercontent.com. Nejdřív se musí vytvořit databáze:
ipset create cn hash:net timeout 0 maxelem 524288
ipset create cn6 hash:net timeout 0 maxelem 524288
A blokující skript:
#!/bin/bash
BLOCK='(Dalvik/2.1.0|LoadOfflineData|https://developer.amazon.com/support/amazonbot|https://commoncrawl.org/faq/|https://openai.com/bot|mailto:support@anthropic.com|anthropic-ai|/?ineedthispage=yes//page/2//page/2/|GoogleOther|http://www.apple.com/go/applebot|https://openai.com/gptbot|claudebot@anthropic.com|wp2shell|https://perplexity.ai/perplexity|staging.italo.cz|Amzn-SearchBot|https://internet-measurement.com/|/.env|.(php|tar|tar.gz|tgz|bz2|config)[[:space:]]HTTP/1.1\"[[:space:]](301|302|404)|MistralAI-User|https://openai.com/searchbot|https://leakix.net|https://openai.com/bot|libredtail|https://perplexity.ai/perplexitybot|http://timpi.io/crawler|/../../../../..|.json|SERankingBacklinksBot|Applebot-Extended|ShapBot/0.|https://www.nokia.com/genomecrawler|https://images.megaupload.cz/robots.txt|Go-http-client|Bytespider|media/com_sppagebuilder/|wp-includes/wlwmanifest.xml|https://www.nokia.com/genomecrawler|https://images.megaupload.cz/robots.txt|Go-http-client|Bytespider|media/com_sppagebuilder/|wp-includes/wlwmanifest.xml|ArcGISExposureScanner|https://pagerank.vsevjednom.cz/robots.txt|crusader-worker|[[:space:]]HTTP/1.1\"[[:space:]]500[[:space:]]|metabase-cve|.yml[[:space:]]HTTP/1.1|.php[[:space:]]HTTP\/1.1\"[[:space:]]404[[:space:]]|alibaba.com|\.\./\.\./)';
H=`date "+/%Y:%H:" --date="0 hours ago"`;
cat /var/log/apache2/virtual.log |grep $H|grep -E $BLOCK
date
ipset list cn|grep -v ":"|wc -l
ipset list cn6|grep ":"|wc -l
echo "!POSLEDNÍ HODINA!";
echo "_1: LoadOfflineData ve virtual.log, hledá se jen tohle: $BLOCK";
n=`cat /var/log/apache2/virtual.log |grep $i|grep $H|wc -l`;
ss=`/root/scripts/continent $i | grep -Po [A-Z]{2}`;
zeme=`/root/scripts/country $i`;
h=`host $i|awk {'print $5'}|sed 's/\.$//'`;
rh=`cat /var/log/apache2/virtual.log|grep $H|grep $i|tr ":" " "|awk {'print $1'} |awk 'NR == 1'`;
r=`cat /var/log/apache2/virtual.log|grep $H|grep $i|awk {'print $8'} |awk 'NR == 1'`;
android=`cat /var/log/apache2/virtual.log|grep $H |grep $i |grep "LoadOfflineData/"|awk {'print $16'}|awk 'NR == 1'`;
verze=`cat /var/log/apache2/virtual.log|grep $H |grep $i |grep "LoadOfflineData/"|awk {'print $17'}|awk 'NR == 1'|sed "s/;//"`;
if [[ $n -lt "15" ]];
then
echo "$i: jen $n";
elif [[ $n -gt "14" ]];
then
prvni=`echo $i|tr "." " "|awk {'print $1'} `;
druha=`echo $i|tr "." " "|awk {'print $2'} `;
prvnidve=`echo "$prvni.$druha"`;
ip=`ipset list |grep $i`;
h=`host $i|awk {'print $5'}|sed 's/\.$//'`;
if [[ $h == *"ooglebot"* ]];
then
echo "NE, Googlebot: $i ($zeme) ($h) ($n) $r";
elif [ "$ip" != "" ] && [ "$ip" != "$blok" ]; then
echo "TATO IP JE UŽ BLOKLÁ: $cas: $i ($zeme) ($h) ($n) $rh$r";
blok=`echo $ip`;
elif [ "$ip" != "$blok" ] && [[ $h != *"ooglebot"* ]] && [[ $h != *"bing"* ]] && [ "$zeme" != "CZ" ] && [ "$zeme" != "SK" ] && [ "$zeme" != "HR" ] && [ "$zeme" != "HU" ] && [ "$zeme" != "IT" ] && [ "$zeme" != "ES" ] && [ "$prvnidve" != "66.249" ]; then
echo "NOVÁÁÁÁÁÁÁÁÁ BLOKACE: $cas: $i ($zeme) ($h) ($n) $rh$r";
blok=`echo $ip`;
if [[ $string =~ .*:.* ]]
then
echo "_";
else
ipset add cn $i;
fi
elif [ "$ip" != "$blok" ]; then
echo "NE (asi nějaká blízká země ($zeme) nebo Googlebot): $i ($h) ($n) $rh$r";
fi
fi
done;
echo "--------";
echo "_2: .php HTTP/1.1";
for i in `cat /var/log/apache2/virtual.log |grep $H|grep ".php HTTP/1.1" |awk {'print $2'} |sort|uniq`; do
n=`cat /var/log/apache2/virtual.log |grep $H|grep ".php HTTP/1.1"|grep $i|wc -l`;
h=`host $i|awk {'print $5'}|sed 's/\.$//'`
ss=`/root/scripts/continent $i | grep -Po [A-Z]{2}`;
zeme=`/root/scripts/country $i`;
prvni=`echo $i|tr "." " "|awk {'print $1'} `;
druha=`echo $i|tr "." " "|awk {'print $2'} `;
prvnidve=`echo "$prvni.$druha"`;
ip=`ipset list |grep $i|awk {'print $1'}`
if [ "$n" -gt "100" ] && [[ $h != *"ooglebot"* ]] && [[ $h != *"bing"* ]] && [ "$zeme" != "CZ" ] && [ "$zeme" != "SK" ] && [ "$zeme" != "HR" ] && [ "$zeme" != "HU" ] && [ "$zeme" != "IT" ] && [ "$zeme" != "ES" ] && [ "$prvnidve" != "66.249" ]; then
if [ "$i" == "$ip" ]; then
echo "TATO IP JE UŽ BLOKLÁ: $i ($zeme, $h)";
else
ipset add cn $i;
echo "NOVÁ BLOKACE: $i ($zeme, $h): $n";
fi;
else
echo "NE BLOKACE: IP $i je CZ/SK/HR/HU/IT/ES nebo Google nebo Bind ($h) ($zeme, $n)";
fi;
done;
echo "--------";
echo "_3: UNION ALL";
for i in `cat /var/log/apache2/virtual.log |grep "%27%20UNION%20ALL"|awk {'print $2'}|sort|uniq`; do
if [[ -z "$t" ]]; then
t=1;
fi
n=`cat /var/log/apache2/virtual.log |grep $i|grep $H|wc -l`;
zeme=`/root/scripts/country $i`;
h=`host $i|awk {'print $5'}|sed 's/\.$//'`;
if [[ $n -gt "10" ]];
then
if [[ $n -gt "20" ]];
then
prvni=`echo $i|tr "." " "|awk {'print $1'} `;
druha=`echo $i|tr "." " "|awk {'print $2'} `;
prvnidve=`echo "$prvni.$druha"`;
ip=`ipset list |grep $i`;
if [[ $h == *"ooglebot"* ]];
then
echo "NE, Googlebot: $i ($zeme) ($h) ($n)";
elif [ "$ip" != "" ]; then
echo "TATO IP UŽ JE BLOKLÁ: $i ($zeme) ($h) ($n)";
elif [[ $h != *"ooglebot"* ]] && [[ $h != *"bing"* ]] && [ "$zeme" != "CZ" ] && [ "$zeme" != "SK" ] && [ "$zeme" != "HR" ] && [ "$zeme" != "HU" ] && [ "$prvnidve" != "66.249" ]; then
echo "NOVÁÁÁÁÁÁÁÁÁ BLOKACE: $i ($zeme) ($h) ($n)";
if [[ $string =~ .*:.* ]]
then
ipset add cn6 $i;
else
ipset add cn $i;
fi
else
echo "NE (asi nějaká blízká země ($zeme) nebo Googlebot): $i ($h) ($n)";
fi
else
if [[ $h == *"ooglebot"* ]];
then
echo "NE (Googlebot) ($n): $i ($zeme) ($h)";
else
echo "NE (málo načtení: $n): $i ($zeme) ($h)";
fi
fi
cas=``;
fi
done;
echo "--------";
: '
H=`date +"%Y:%H:"`;
num=`cat /var/log/apache2/virtual.log |grep $H|uniq|grep "LoadOfflineData/"|awk {'print $2'}|uniq|wc -l`;
num1=`cat /var/log/apache2/virtual.log |grep $H|uniq|grep "LoadOfflineData/"|awk {'print $2'}|wc -l`;
ipset=`ipset list|grep -v ":"|wc -l`;
n=0;
EU=0;
NA=0;
SA=0;
AS=0;
AU=0;
AF=0;
AN=0;
echo "_3: zase LoadOfflineData ve virtual.log - tady se už hledá vše, bez omezení na prohlížeč";
for i in `cat /var/log/apache2/virtual.log |grep $H|uniq|grep "LoadOfflineData/"`; do
n=$(expr $n + 1)
cas=`echo $i | awk {'print $5'}|sed 's/\[//'`
i=`echo $i | awk {'print $2'}`;
ss=`/root/scripts/continent $i | grep -Po [A-Z]{2}`;
sss=`/root/scripts/country $i | grep -Po [A-Z]{2}`;
zeme=$zeme"\n\n
"$ss;
if [ "$ss" == "EU" ]; then
EU=$((EU+1))
fi
if [ "$ss" == "NA" ]; then
NA=$((NA+1))
fi
if [ "$ss" == "SA" ]; then
SA=$((SA+1))
fi
if [ "$ss" == "AS" ]; then
AS=$((AS+1))
fi
if [ "$ss" == "AU" ] || [ "$ss" == "OC" ]; then
AU=$((AU+1))
fi
if [ "$ss" == "AF" ]; then
AF=$((AF+1))
fi
if [ "$ss" == "AN" ]; then
AN=$((AN+1))
fi
android=`cat /var/log/apache2/virtual.log |grep $i |grep "LoadOfflineData/"|awk {'print $16'}|awk 'NR == 1'`;
verze=`cat /var/log/apache2/virtual.log |grep $i |grep "LoadOfflineData/"|awk {'print $17'}|awk 'NR == 1'|sed "s/;//"`;
if [ "$check" == "0" ]; then
host="";
else
host=`host -W 0 $i| sed -n '1p' |awk {'print $5'}`;
fi
check=0;
else
check="";
fi
http=`cat /var/log/apache2/virtual.log |grep $i |grep $cas| grep "LoadOfflineData/"|awk {'print $10'}|awk 'NR == 1'|sed "s/;//"`;
num=`cat /var/log/apache2/virtual.log |grep $i|grep "LoadOfflineData/"|wc -l`;
n=$(expr $n + 1)
h=`host $i|awk {'print $5'}|sed 's/\.$//'`;
if [[ $n -gt "10" ]];
then
if [[ $n -gt "20" ]];
then
prvni=`echo $i|tr "." " "|awk {'print $1'} `;
druha=`echo $i|tr "." " "|awk {'print $2'} `;
prvnidve=`echo "$prvni.$druha"`;
ip=`ipset list |grep $i`;
if [[ $h == *"ooglebot"* ]];
then
echo "NE, Googlebot: $i ($zeme) ($h) ($n)";
elif [ "$ip" != "" ]; then
echo "TATO IP UŽ JE BLOKLÁ: $i ($zeme) ($h) ($n)";
elif [[ $h != *"ooglebot"* ]] && [[ $h != *"bing"* ]] && [ "$zeme" != "CZ" ] && [ "$zeme" != "SK" ] && [ "$zeme" != "HR" ] && [ "$zeme" != "HU" ] && [ "$prvnidve" != "66.249" ]; then
echo "NOVÁÁÁÁÁÁÁÁÁ BLOKACE: $i ($zeme) ($h) ($n)";
if [[ $string =~ .*:.* ]]
then
ipset add cn6 $i;
else
ipset add cn $i;
fi
else
echo "NE (asi nějaká blízká země ($zeme) nebo Googlebot): $i ($h) ($n)";
fi
else
if [[ $h == *"ooglebot"* ]];
then
echo "NE (Googlebot) ($n): $i ($zeme) ($h)";
else
echo "NE (málo načtení: $n): $i ($zeme) ($h)";
fi
fi
cas=``;
fi
i=`echo $i| tr '.' ' ' |awk {'print $1"."$2"."$3"."$4'}`;
echo "$n: $cas: $i - $ss - $sss ($android $verze) - $host ($http), pocet: $num";
ip=`ipset list |grep $i`;
if [ "$ip" == "" ]; then
ipset add cn $i;
fi
done;
cas=$(date +/%Y:%H: --date="1 hours ago");
echo "--------";'
echo "4: connect do mailu";
for i in `cat /var/log/syslog|grep $H|tr "[" " "|tr "]" " " |grep "connect from"|awk {'print $9'}|uniq`; do
kontinent=`./scripts/continent $i`;
if [ "$kontinent" != "EU" ]; then
echo $i;
if [[ $string =~ .*:.* ]]
then
ipset add cn6 $i;
else
ipset add cn $i;
fi
fi
done
echo "--------";
echo "Seznam blokovaných zemí je zde: /root/scripts/block-china.sh";
ipset list cn|grep -v ":"|wc -l
ipset list cn6|grep ":"|wc -l
date