Geek Answers Handbook

Block requests by username using htaccess

Recently, my WordPress site experienced a surge of hacking attempts by different IP addresses, but they all have the same user hostname:

The user with the IP address xxx.xxx.xx.x was blocked from logging in or using the password recovery form for the following reason: Used an invalid username to log into the system. IP User: 91.121.156.62 User Host Name: ks359219. badhost.com

The user with the IP address xxx.xxx.xx.x was blocked from logging in or using the password recovery form for the following reason: Used an invalid username to log into the system. IP User: 5.135.182.147 User Host Name: ks3289006. badhost.com

The user with the IP address xxx.xxx.xx.x was blocked from logging in or using the password recovery form for the following reason: Used an invalid username to log into the system. IP User: 5.135.185.89 User Host Name: ks3290602. badhost.com

The user with the IP address xxx.xxx.xx.x was blocked from logging in or using the password recovery form for the following reason: Used an invalid username to log into the system. IP User: 5.39.86.162 User Host Name: ks3273571. badhost.com

The security plugin I use seems to block them, but I would like to block all requests from ANY IP address associated with the username with a wildcard such as xxx. badhost.com

The plugin allows me to block a number of IP addresses, such as 123.12.1. * but not hostnames. What would be the best way to block these hacking attempts? .Htaccess? Thanks

+4
source share
3 answers

See this page of the Apache document for examples of what you might want to do. It covers most cases of redirection, blocking, etc. From direct domains and link sites.

http://httpd.apache.org/docs/2.2/rewrite/access.html#blocked-inline-images

0
source

For WordPress, you can use VSF Simple block http://wordpress.org/plugins/vsf-simple-block/

In the Block Rules settings, enter the part of the host name string that you want to block, for example. badhost.com

Remember that this is an active plugin, so it uses some server resources and database queries for each search query, but we did not find it too heavy.

PS - from ks. part of the example I have a good idea that you want to ban hosts - I agree with you, these hosts are bad news - Deny them .... :)

0
source

If you run whois ks3273571.badhost.com , it will tell you NetRange and CIDR for this ISP network block.

For example, whois 69.59.197.21 (StackOverflow) reports:

 NetRange: 69.59.192.0 - 69.59.223.255 CIDR: 69.59.192.0/19
-1
source

More articles:


All Articles