Jde o jeden z několika útoků na Vsevjednom.cz. Cílem je načítání spousty neexistujících souborů. Kontrolní skript, který blokne (díky ipset) útočící IP adresy. Naprostá většina IP adres je Googlu: bc.googleusercontent.com. Nejdřív vytvoření databází:
ipset create cn hash:net timeout 0 maxelem 524288
ipset create cn6 hash:net timeout 0 maxelem 524288
A potom blokující skript:
#!/bin/bash
BLOCK='(https://developer.amazon.com/support/amazonbot|https://commoncrawl.org/faq/|https://openai.com/bot|mailto:support@anthropic.com|anthropic-ai|/?ineedthispage=yes//page/2//page/2/|GoogleOther|http://www.apple.com/go/applebot|https://openai.com/gptbot|claudebot@anthropic.com|wp2shell|https://perplexity.ai/perplexity|staging.italo.cz|Amzn-SearchBot|https://internet-measurement.com/|/.env|.php[[:space:]]HTTP/1.1\"[[:space:]](301|404)|MistralAI-User|https://openai.com/searchbot|https://leakix.net|https://openai.com/bot|libredtail|https://perplexity.ai/perplexitybot|http://timpi.io/crawler|/../../../../..|.json|SERankingBacklinksBot|Applebot-Extended|ShapBot/0.|https://www.nokia.com/genomecrawler|https://images.megaupload.cz/robots.txt|Go-http-client|Bytespider|media/com_sppagebuilder/|wp-includes/wlwmanifest.xml|https://www.nokia.com/genomecrawler|https://images.megaupload.cz/robots.txt|Go-http-client|Bytespider|media/com_sppagebuilder/|wp-includes/wlwmanifest.xml|ArcGISExposureScanner|https://pagerank.vsevjednom.cz/robots.txt|crusader-worker)';
H=`date +"%Y:%H:"`;
date
ipset list|grep -v ":"|wc -l
for i in `cat /var/log/apache2/virtual.log |grep $H|grep -E $BLOCK|awk {'print $2'}|sort |uniq|grep -v 89.221.220.8|grep -v "2a02:2b88:2:908::1"|grep -v "83.240."|grep -v "109.81."|grep -v rodinausoudu`; do
n=`cat /var/log/apache2/virtual.log |grep $i|grep $H|wc -l`;
zeme=`/root/scripts/country $i`;
h=`host $i|awk {'print $5'}|sed 's/\.$//'`;
echo "Vyhledavam: $i ($n)";
if [[ $n -gt "10" ]];
then
if [[ $n -gt "20" ]];
then
prvni=`echo $i|tr "." " "|awk {'print $1'} `;
druha=`echo $i|tr "." " "|awk {'print $2'} `;
prvnidve=`echo "$prvni.$druha"`;
ip=`ipset list |grep $i`;
if [[ $h == *"ooglebot"* ]];
then
echo "NE, Googlebot: $i ($zeme) ($h) ($n)";
elif [ "$ip" != "" ]; then
echo "TATO IP UŽ JE BLOKLÁ: $i ($zeme) ($h) ($n)";
elif [[ $h != *"ooglebot"* ]] && [[ $h != *"bing"* ]] && [ "$zeme" != "CZ" ] && [ "$zeme" != "SK" ] && [ "$zeme" != "HR" ] && [ "$zeme" != "HU" ] && [ "$prvnidve" != "66.249" ]; then
echo "NOVÁÁÁÁÁÁÁÁÁ BLOKACE: $i ($zeme) ($h) ($n)";
if [[ $string =~ .*:.* ]]
then
ipset add cn6 $i;
else
ipset -A cn $i;
fi
else
echo "NE (asi nějaká blízká země ($zeme) nebo Googlebot): $i ($h) ($n)";
fi
else
if [[ $h == *"ooglebot"* ]];
then
echo "NE (Googlebot) ($n): $i ($zeme) ($h)";
else
echo "NE (málo načtení: $n): $i ($zeme) ($h)";
fi
fi
fi
done;
ipset list|grep -v ":"|wc -l
date