[ 2014 Micro Blacklist ] Over the past several months, I’ve assembled a “micro” blacklist to keep some recent threats at bay. Eventually, this will be integrated into the next nG Blacklist, but for now I just wanted to post and share with anyone else who is actively monitoring their server logs and aware of the recent spike in malicious activity.

The 2014 Micro Blacklist blocks some particularly persistent user agents and hosts, as well as a handful of resource-wasting IP addresses that just won’t stop scanning and sniffing around where they don’t belong. Lastly, there a couple of lines for blocking some relentless 404 requests.

2014 Micro Blacklist

To implement this blacklist, just copy/paste into the root .htaccess file of your website. If the .htaccess file doesn’t exist, check that you’re on an Apache server (and that .htaccess is enabled), and then go ahead and create one. Check out my .htaccess book if you need help with anything .htaccess related, and/or to learn WAY more about securing your site.

# 2014 Micro Blacklist
<IfModule mod_setenvif.c>
	Order Allow,Deny
	Allow from all
	Deny from 123.151.39.
	Deny from 77.172.210.
	Deny from 174.94.131.
	Deny from 89.238.137.59
	Deny from 212.90.148.101
	Deny from 91.207.61.129
	Deny from 202.46.52.120
	Deny from 128.73.60.194
	Deny from 68.108.17.141
	Deny from 27.54.93.178
	Deny from 194.9.94.213
	Deny from 122.166.169.127
	Deny from 96.9.163.49
	Deny from 54.229.73.40
	Deny from 203.109.158.201
	Deny from 46.105.113.8
	Deny from 183.60.244.
	Deny from 54.232.102.193
	Deny from 195.157.124.186
	Deny from 118.39.113.219
	Deny from 27.255.56.87
	Deny from 69.161.138.1
	Deny from 192.96.204.42
	Deny from 178.63.52.200
	Deny from 27.252.92.103
	Deny from 37.59.65.58
	Deny from 186.202.126.94
	Deny from 186.213.72.146
	Deny from 186.219.44.6
</IfModule>
<IfModule mod_rewrite.c>
	RewriteCond %{HTTP_HOST} (.*).crimea.com [NC,OR]
	RewriteCond %{HTTP_HOST} s368.loopia.se [NC,OR]
	RewriteCond %{HTTP_HOST} kanagawa.ocn [NC,OR]
	RewriteCond %{HTTP_HOST} g00g1e [NC,OR]
	RewriteCond %{HTTP_USER_AGENT} (ia_archiver|g00g1e|seekerspider|siclab|spam|sqlmap) [NC]
	RewriteRule .* - [F,L]
</IfModule>
<IfModule mod_alias.c>
	RedirectMatch 403 router.php
	RedirectMatch 403 /).html(
</IfModule>
<IfModule mod_rewrite.c>
	RewriteCond %{QUERY_STRING} http://www.google.com/humans.txt? [NC]
	RewriteRule .* - [F,L]
</IfModule>

Notes: ia_archiver was a tough call — they do some legit stuff, but lots of illicit/malicious requests are made claiming that UA or some derivitive thereof.. so it’s your call on that, feel free to remove it if the wayback machine is important to you or whatever.

About the IPs, normally I don’t bother blocking individual IPs because they are frequently spoofed and/or changing constantly. When it looks like an IP is directly tied to the perpetrator, blocking by IP can be an effective remedy for the endless scanning and malicious HTTP requests that ail you.

Update: Added to the list protection against the humans.txt scanning script for good measure.

Lastly, this “micro” blacklist serves as a good starting point for building up your own mini-firewall that’s tuned to your particular server and traffic profile.

Have fun and keep those sites secure people.

No Comments
Comments to: 2014 Micro Blacklist

Recent Articles

Good Reads

Worlwide

Overview VipsPM – Project Management Suite is a Powerful web-based Application. VipsPM is a perfect tool to fulfill all your project management needs like managing Projects, Tasks, Defects, Incidents, Timesheets, Meetings, Appointments, Files, Documents, Users, Clients, Departments, ToDos, Project Planning, Holidays and Reports. It has simple yet efficient layout will make managing projects easier than […]

Trending

Turquoise Jewelry is one of the ancient healing stones used for personal adornment and astrological benefits. The rare greenish blue-colored pectolite is celebrated for its enchanting powers among many crystal lovers. It is a hydrated phosphate of copper and aluminum that ranks 5 to 6 on the Mohs hardness scale. It is deemed a protective […]
Singapore is recognised globally as a prime destination for foreign investors. Its business structure is well-developed, and its tax system is favourable to business owners. The government has a strong support system for entrepreneurs and provides legal protection for intellectual property rights. All of these conditions create an environment that is ideal for Singapore company […]
2020 has been a year that represents aggressive and sustained volatility with a confluence of unexpected situations, including economic shifts and market disturbance confluence. The COVID-19 pandemic forces businesses to adjust their methods of operations to ensure survival. These adjustments become the trajectory and guidance of what 2021 should look like and what companies should […]
COVID-19 pandemic has affected Thailand’s economy and labor market. World Bank’s Thailand Economic Monitor predicted that it would take Thailand over two years to return to its pre-COVID-19 growth and domestic product output levels. Although the country has successfully curbed the pandemic tide over the last few months, the economy remains severely hit. Nevertheless, heavily […]