https://bjornjohansen.no/using-fail2ban-with-wordpress
?? Dropping 'fail2ban wordpress wp-login' into google pulls up quite a lot as well. -drmike On Sat, Aug 29, 2015 at 7:38 AM, Sacks, Cailan <[email protected]> wrote: > Dude, > > Linux is free. F2ban is free. The community is a free resource. Please hang > on to money. All this said without any judgement, there are some fantastic > examples of wordpress filters on the net already. A quick google will not > only help you solve your problem, but also provide some insight in to how > this works. The latter being the reason i highly suggest you do a google as > well. > > Lstly, please dont try and search this regex in your access file and ban > them. This will lockout good and bad logins (the log entry is the same). > > Have a look at this article for more info > https://bjornjohansen.no/using-fail2ban-with-wordpress > > Have fun, and ask for help anytime. Its free. > > > Sent from Samsung tablet > > > -------- Original message -------- > From: linuxthefish <[email protected]> > Date: 29/08/2015 12:49 (GMT+02:00) > To: [email protected] > Subject: [Fail2ban-users] $20 filter for banning wp-login spam? > > Hi, > > Whoever can design a fail for fail2ban that blocks this type of spam > in /usr/local/apache/logs/access_log, I can PayPal $20 to. > > 82.165.197.140 - - [29/Aug/2015:06:48:15 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:14 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:15 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:15 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:15 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 82.165.197.140 - - [29/Aug/2015:06:48:16 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:16 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:16 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:16 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:17 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 82.165.197.140 - - [29/Aug/2015:06:48:17 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:17 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:17 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 82.165.197.140 - - [29/Aug/2015:06:48:18 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:17 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:18 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:18 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:18 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 82.165.197.140 - - [29/Aug/2015:06:48:19 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:18 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:19 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:19 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:19 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:19 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:20 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 82.165.197.140 - - [29/Aug/2015:06:48:20 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 185.4.134.146 - - [29/Aug/2015:06:48:20 -0400] "POST /wp-login.php > HTTP/1.0" 200 3534 > 74.91.22.203 - - [29/Aug/2015:06:48:20 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 82.165.197.140 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 185.4.134.146 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php > HTTP/1.0" 200 3534 > 82.165.197.140 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:21 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 82.165.197.140 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 185.4.134.146 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php > HTTP/1.0" 200 3534 > 82.165.197.140 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > 74.91.22.203 - - [29/Aug/2015:06:48:22 -0400] "POST /wp-login.php > HTTP/1.0" 200 3567 > 82.165.197.140 - - [29/Aug/2015:06:48:23 -0400] "POST /wp-login.php > HTTP/1.0" 500 251 > > Thanks > > ------------------------------------------------------------------------------ > _______________________________________________ > Fail2ban-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > > ------------------------------------------------------------------------------ > > _______________________________________________ > Fail2ban-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > ------------------------------------------------------------------------------ _______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
