From: syscon edm <syscon780@gmail.com>
To: gentoo-user@lists.gentoo.org
Subject: [gentoo-user] spammer Eric
Date: Wed, 11 Sep 2024 00:20:48 -0600 [thread overview]
Message-ID: <CAEVFJ_CUZXJO0nLvDCpgWjcJ3mWkqakBz7CrEwEBDDOR-jeBnw@mail.gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 1641 bytes --]
Is anybody familiar with spammer "Eric Jones"? I think he is famous.
Anyhow, he collects the input from "captcha" first. If the IP is not
blocked /doesn't get "403"
his program goes for "contact us"
Here is the log:
37.72.186.22 - - [10/Sep/2024:21:51:46 -0600] "GET
/contact_us.php%09%092024-06-17+14:07%09Ready+contact+form+successfully+found+/+Requires+captcha+input%09
http://domain.ca%09%09%09%09%09 HTTP/1.1" 404 196
37.72.186.22 - - [10/Sep/2024:21:51:47 -0600] "GET / HTTP/1.1" 200 28533
37.72.186.22 - - [10/Sep/2024:21:51:49 -0600] "GET /contact_us.php
HTTP/1.1" 200 25619
I created htaccess entry:
# Block specific request pattern targeting /contact_us.php
RewriteCond %{REQUEST_URI} ^/contact_us.php [NC]
RewriteCond %{THE_REQUEST} "GET
/contact_us.php%09%092024-06-17+14:07%09Ready+contact+form+successfully+found+/+Requires+captcha+input%09
http://domain.ca%09%09%09%09%09 HTTP/1.1" [NC]
RewriteRule .* - [F]
but it doesn't work.
The issue likely stems from the fact that %09 (tab character) and similar
URL-encoded characters in the request may not be processed as-is by
THE_REQUEST directive in .htaccess. Apache doesn't decode these characters
automatically when matching with THE_REQUEST.
Wildcard and escaping in THE_REQUEST: Instead of directly using %09, I can
use .* (wildcards) to match anything that could appear in between different
parts of the request string.
I'll see if the belows will work:
RewriteCond %{REQUEST_URI} ^/contact_us.php [NC]
RewriteCond %{THE_REQUEST} "GET
/contact_us.php.*Ready\+contact\+form\+successfully\+found.*Requires\+captcha\+input.*
http://domain.ca" [NC]
RewriteRule .* - [F]
[-- Attachment #2: Type: text/html, Size: 2160 bytes --]
reply other threads:[~2024-09-11 6:21 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAEVFJ_CUZXJO0nLvDCpgWjcJ3mWkqakBz7CrEwEBDDOR-jeBnw@mail.gmail.com \
--to=syscon780@gmail.com \
--cc=gentoo-user@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox