I'm setting up my first website on Ubuntu 18.04 using Apache and I've noticed the following in my apache error log on a daily basis:
94.102.49.125 - - [07/Feb/2019:11:32:55 +0000] "GET /muieblackcat HTTP/1.1" 301 555 "-" "-"
94.102.49.125 - - [07/Feb/2019:11:32:56 +0000] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 301 587 "-" "-"
94.102.49.125 - - [07/Feb/2019:11:32:56 +0000] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 301 587 "-" "-"
94.102.49.125 - - [07/Feb/2019:11:32:56 +0000] "GET //mysqladmin/scripts/setup.php HTTP/1.1" 301 587 "-" "-"
94.102.49.125 - - [07/Feb/2019:11:32:57 +0000] "GET //phpmyadmin2/scripts/setup.php HTTP/1.1" 301 589 "-" "-"
216.239.90.19 - - [07/Feb/2019:10:04:03 +0000] "GET /accounts/password_reset/ HTTP/1.1" 200 5442 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15"
186.212.109.228 - - [07/Feb/2019:10:23:31 +0000] "GET / HTTP/1.1" 200 726 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
139.162.113.204 - - [07/Feb/2019:10:46:36 +0000] "GET / HTTP/1.1" 400 3404 "-" "HTTP Banner Detection (https://security.ipip.net)"
13.57.233.99 - - [07/Feb/2019:11:01:15 +0000] "GET / HTTP/1.1" 302 3452 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"
After some research, like ip location and reading fora/blogs, it's clear that these are attacks aimed at identifying any vulnerabilities on my server.
Being new to this, and seeing a lot of pings from the same IPs I thought I'd just add a deny rule to my .htaccess file for each IP. After two days, this clearly isn't a feasible solution.
So I'm looking for other things to do. I've noticed that most of these requests are looking for specific php files, which I fortunately don't have in the requested location.
Consequently, I'm wondering if it is possible to define a rule somewhere that says something like:
"If IP(x) makes a request for ^*.php, Deny/Block IP permanently."
If this possible, where do I define such a rule and in what language etc.
Much thanks in advance!
