By modul on

About every 2 days or so, my site is visited by some bot who is apparently looking for all kinds of php scripts belonging to PHPMyAdmin. Since I don't have that installed on my site, all he gets is a bundle of "page not found". I don't think he can cause any real damage, but it is driving my nuts to see his "visits" in my Drupal logs. This morning I had 647 hits by this booger.

Blocking him by means of his IP doesn't work, because he uses different IP's every time, and also different countries of origin.

The only possible way to keep him out of my logs would be some trick on the basis of the URLs he is trying to open:
http://www.mysite.com/phpmyadmin/some_script.php
http://www.mysite.com/dbadmin/some_other_script.php
http://www.mysite.com/php/yet_another_script.php
http://www.mysite.com/mysql/and_it_goes_on.php
etc.

So, what I am looking for, is a way (probably .htaccess based??) to divert this turd to some other site. I would, for instance, like to check the URL, and if "phpmyadmin" or "dbadmin" are part of the incoming URL, I would like to refuse it. And if it is indeed .htaccess based, could some kind soul please give me one or two examples on how to accomplish my goal?

⋅ Categories: Drupal 5.x

Comments

yelvington’s picture

yelvington commented

This has to be done outside Drupal to be effective. See http://www.leekillough.com/robots.html for a discussion of some approaches that you can consider.

Oblivious-1’s picture

Oblivious-1 commented

You could try adding this to your .htaccess, were test\.php and test2\.php and test3\.php are the names of files you want to block. I whipped it up pretty fast and haven't tested it extensively, but it should work. The downside (and the upside) is that it blocks any file with that name no matter where it is, so it will block /bad-directory/namedfile.php and also /good-directory/namedfile.php. 

<FilesMatch "^(test\.php|test2\.php|test3\.php)$">
  Order allow,deny
</FilesMatch>

--
Erik

Oblivious-1’s picture

Oblivious-1 commented

No, wait. That doesn't work. I swear it worked a second ago.
--
Erik