#! /bin/bash # Afrihost - ipset wrapper # list and manage aserv ipsets # 2016-08-15:p PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/afribin txtgrn='\e[0;32m' # green txtund=$(tput sgr 0 1) # Underline txtbld=$(tput bold) # Bold txtrst='\e[0m' # Text reset bldgrn='\e[1;32m' # Green bldblu='\e[1;36m' # Blue bldwht='\e[1;37m' # White bldred='\e[1;31m' # Red # cpanel check if ! [ -f "/usr/local/cpanel/cpanel" ]; then echo "No cpanel" exit fi if [ -f /etc/bypass_ips ]; then exit fi #log environment setup /root/.preports pRAN="$RANDOM" mkdir /var/log/ips/ 2>/dev/null PLOG=/var/log/ips/ips.log."$pRAN" env_set () { if [ ! -f "$PLOG" ]; then touch $PLOG chmod 660 "$PLOG" else chmod 660 "$PLOG" fi } env_set # some gen vars pscript=$(basename $0) TODAY=$(date +%Y-%m-%d) PWDIR="/root/.preports/"$pscript"" # IPFILTER_FUNCS redhatreleasever=$(egrep -o "4\.|5\.|6\.|7\." /etc/redhat-release|head -1) SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') checkip () { #Do we have a valid IP address? octet="(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])" ip4="^$octet\\.$octet\\.$octet\\.$octet$" if [[ $IPARG =~ $ip4 ]]; then argument="$IPARG" else echo -e ${colred}"[ ip invalid ]"${colrst} exit 1 fi } IPFilter () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | sed 's/^0*//' } IPFilter_noZA () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|NZ|ZW|BW|MZ|LS|ID|NA|ZM|CM|SZ|KE|IN|AO|IN|BE|NZ' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPFilter_noZA_without_known () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|AU|NZ|ZW|BW|MZ|LS|ID|NA|ZM|CM|SZ|KE|IN|AO|IN|NA|BE' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPDodgeCountryFilter_conn1ormore () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|NZ|ZW|BW|MZ|LS|SZ|KE|NA' | egrep 'US|RU|RS|LT|ES|UA|PT|FR|CN|RO|VN|TR|BR|MY|ID|CO|AR|MX|EG|BG|AE|AL|IR|DO|PE|KW|AE|ID|CL|SA|AO|AT|BS|BY|DK|DZ|FI|GR|HR|IL|KZ|MA|TW|CH|HK|IT|JP|PL|SE|CA|DE|IT|PH|JP|TN|KR' | sort |uniq -c | sort -k1n | awk '$1>=20 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPDodgeCountryFilter_oneconn () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|NZ|ZW|BW|MZ|LS|SZ|KE|NA' | egrep 'RU|RS|LT|ES|FR|CN|RO|VN|TR|BR|MY|ID|CO|AR|MX|EG|BG|AE|AL|IR|DO|PE|KW|AE|ID|CL|SA|AT|BS|BY|DK|DZ|FI|GR|HR|IL|KZ|MA|TW|CH|HK|JP|PL|SE|CA|IT|PH|JP|TN|KR' | sort |uniq -c | sort -k1n | awk '$1>=10 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPRealDodgeCountryFilter_conn1ormore () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|NZ|ZW|BW|MZ|LS|SZ|KE|NA'| egrep 'RU|FR|CN|RO|VN|TR|BR|MY|ID|CO|AR|MX|EG|BG|AE|AL|IR|DO|PE|KW' | sort |uniq -c | sort -k1n | awk '$1>=3 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPRealRealDodgeCountryFilter_conn1ormore () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|NZ|ZW|BW|MZ|LS|SZ|KE|NA' | egrep 'RU|UA|FR|CN|RO|VN|TR|BR|CO|AR|MX|EG|BG|AL|DO|PE|KW' | sort |uniq -c | sort -k1n | awk '$1>=3 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPDodgeCountryFilter_badies () { egrep -v 'ZA|127.0.0|_|AU|NZ|ZW|BW|MZ|LS|SZ|KE|NA' | egrep 'RU|RS|FR|CN|RO|VN|TR|BR|MY|ID|CO|AR|MX|EG|BG|AL|IR|DO|PE|KW|AE|ID|CL|SA|AT|BS|BY|DK|DZ|FI|GR|HR|KZ|MA|TW|CH|HK|IT|JP|PL|CA|PH|JP|TN|KR' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } badbots_block () { if ! [ -f /root/allowbots ] ; then egrep -i 'masscan|WPScan|healthhacks.ru' fi } exclude_TrustedSPs () { /usr/local/afribin/trustedSPs } ################ # Global Funks # ################ cphulk_blocks () { echo -e ${bldblu}"[Blocking based on /usr/local/cpanel/logs/cphulkd.log ]"${txtrst} grep $(date +"%Y"-"%m"-"%d") /usr/local/cpanel/logs/cphulkd.log|grep "Login Blocked: IP reached maximum auth failures" | grep -o "\[Remote IP Address\]=\[.*\]" | awk '{print $1,$3}' | ipgrep | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|NZ|ZW|BW|MZ|LS|ID|ZM|NA' | ipgrep | while read PDOMHIP ; do ipset -q add cphulk_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: cphulk_blocks /usr/local/cpanel/logs/cphulkd.log :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done } badbotsthreat_block () { echo -e ${bldblu}"[Blocking based on badbots_block list check ips script for function badbots_block list ]"${txtrst} grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | badbots_block | IPFilter_noZA| egrep -v '127.0.0|_' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//'| while read PDOMHIP ; do ipset -q add badbot_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: badbotsthreat_block domlogs :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done } xmlrpc_block () { echo -e ${bldblu}"[Blocking based on xlmrpc attacks ]"${txtrst} grep -i $(date +"%d"/"%b"/"%Y":%H:..) /tmp/ipsbomb | grep "POST /xmlrpc.php HTTP/1.1\" 200 40[1,4]" | exclude_TrustedSPs | geoip | awk '{print $1,$2}' | IPFilter_noZA |sort | uniq -c | sort -k1n | awk '$1>=4 {print $3}' | while read PDOMHIP ; do ipset -q add sysadmin_added_ips $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: xmlrpc_block domlogs :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done grep xmlrpc /tmp/ipsbomb | awk '{print $1}' | sort | uniq -c | awk '($1 > 10) {print $1,$3}' | geoip | IPFilter_noZA | grep "[0-9]" | ipgrep | while read PDOMHIP ; do ipset -q add fh_level4_ips $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: xmlrpc_block >4 domlogs :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done } brutelogin_blocks () { grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | /usr/local/afribin/trustedSPs | egrep -i "GET \/wp-login.php|xmlrpc|administrator|FPURL.xml|POST\ \/wp-login.php\ HTTP|administrator/index.php|POST /xmlrpc.php HTTP/1.1" | geoip | awk '{print $1,$2}'| IPFilter_noZA | IPDodgeCountryFilter_badies | awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=10 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do ipset -q add adminbrute_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: brutelogin_blocks-1 domlogs :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on known brute force attacks and known combination User-Agents 1 ]"${txtrst} grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | exclude_TrustedSPs | egrep --colour -i "GET \/wp-login.php\ |xmlrpc|administrator/index.php|FPURL.xml|POST\ \/wp-login.php\ HTTP|POST /xmlrpc.php HTTP/1.1" | egrep 'Ubuntu|X11\;\ Linux' | geoip | awk '{print $1,$2}'| IPFilter_noZA | IPRealDodgeCountryFilter_conn1ormore | awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=4 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do ipset -q add adminbrute_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: brutelogin_blocks-2 domlogs :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on known brute force attacks and known combination User-Agents 2 ]"${txtrst} egrep --colour -i "GET \/wp-login.php\ |xmlrpc|FPURL.xml|POST\ \/wp-login.php\ HTTP|POST /xmlrpc.php HTTP/1.1|\.env|/wlwmanifest.xml HTTP/1.1\"\ 404" /tmp/ipsbomb* | grep "\" 4..\ -\ " | geoip | awk '{print $1,$2}'| sort | uniq -c | sort -k1n | awk '$1>=2 {print $1,$2,$3}' | IPFilter_noZA | IPRealDodgeCountryFilter_conn1ormore| egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | ipgrep | ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: brutelogin_blocks-3 domlogs adminbrute_threats_local :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG; done echo -e ${bldblu}"[Blocking based on known brute force attacks and known combination User-Agents 3 ]"${txtrst} egrep --colour -i "GET \/wp-login.php\ |FPURL.xml|POST\ \/wp-login.php\ HTTP|POST /xmlrpc.php HTTP/1.1|\.env|/wlwmanifest.xml HTTP/1.1\"\ 404" /tmp/ipsbomb | geoip | trustedSPs | awk '{print $1,$2}'| sort | uniq -c | sort -k1n | awk '$1>=5 {print $1,$2,$3}' | IPFilter_noZA | IPRealDodgeCountryFilter_conn1ormore | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | ipgrep | ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | while read PDOMHIP ; do ipset -q add adminbrute_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: brutelogin_blocks-4 domlogs adminbrute_threats_local :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on known brute force attacks and known combination User-Agents 4 ]"${txtrst} egrep --colour -i "\.env|/wlwmanifest.xml HTTP/1.1\"\ 404" /tmp/ipsbomb* | grep "\" 4..\ " | geoip | awk '{print $1,$2}' | ipgrep | ipprocheck | trustedSPs | ipgrep | geoip | awk '{print $1,$2}'| sort | IPFilter_noZA | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | ipgrep | ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: brutelogin_blocks-5 domlogs maliciouspattern_threats_local :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done } contactspam_block () { echo -e ${bldblu}"[Blocking based on contact spam attack block]"${txtrst} if [ $(grep -i $(date +"%d"/"%b"/"%Y":%H:..:..) /tmp/ipsbomb | grep -i contact | geoip | IPFilter_noZA | exclude_TrustedSPs | awk '{print $12}' | wc -l) -gt 200 ] ; then grep -i $(date +"%d"/"%b"/"%Y":%H:..:..) /tmp/ipsbomb | grep contact | grep POST | geoip | egrep -v 'ZA|127.0.0|_|AU|NZ|ZW|BW|MZ|LS|ID|ZM|NA' | awk '{print $2}' |sort | uniq | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//'| while read PDOMHIP ; do ipset add adminbrute_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: contactspam_block :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done fi } mysqlthreat_blocks () { echo -e ${bldblu}"[Blocking based on mysql direct connect attemps ]"${txtrst} tail -n50 /var/lib/mysql/`hostname`.err | grep "could not be resolved" |geoip| egrep -v 'ZA|127.0.0|_|AU|NZ|ZW|BW|MZ|LS|AE|ZM|NA'| grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort | uniq | while read PDOMHIP ; do ipset add mysql_threats_local "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: mysqlthreat_blocks :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done } ftpthreat_blocks () { echo -e ${bldblu}"[Blocking based on ftp international auth failures ]"${txtrst} #grep "$(date +"%b %d ")" /var/log/messages | grep "Authentication failed for user" | geoip | grep -v "ZA" | tail -n30 /var/log/{messages,ftplogs} | egrep "no such user found from|Authentication failed for user" | geoip | awk '{print $13,$14}'| ipgrep | sort | uniq -c | awk '($1>20) {print $0}' |sort -k1n | egrep -v 'ZA|127.0.0|_|AU|NZ|ZW|BW|MZ|LS|ID|NA|ZM' | ipgrep | while read PDOMHIP ; do ipset add ftp_threats_local "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: ftpthreat_blocks :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done } cpanelthreats_blocks () { echo -e ${bldblu}"[Blocking based on cpanel/whm international auth failures ]"${txtrst} grep "$(date +"%Y"-"%m"-"%d %H: ")" /usr/local/cpanel/logs/login_log | grep "FAILED LOGIN" | geoip | awk '{print $6,$7}' | sed 's/)//' | sort | uniq -c | sort -k1n | IPFilter_noZA | ipgrep | while read PDOMHIP ; do ipset -q add cpanel_authfail_threats_local "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: cpanelthreats_blocks :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done } mailthreat_blocks () { echo -e ${bldblu}"[Blocking based on exim YLMF helo name and geoip]"${txtrst} for PDOMHIP in $(tail -n500 /var/log/exim_mainlog | grep AH-Block | geoip | IPFilter_noZA | ipgrep ) ; do ipset -q add ylmf_helo_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: mailthreat_blocks ylmf - /var/log/exim_mainlog :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done # echo -e ${bldblu}"[Blocking dovecot auth fail and dodge country]"${txtrst} # for i in $(tail -n100 /var/log/{exim_mainlog,exim_rejectlog} | grep "dovecot_plain authenticator failed for" | ipgrep | geoip | # IPFilter_noZA | ipgrep ) ; do # #echo "$i" | tee -a $YLMF_OUTFILE ; # ipset -q add exim_authfail_threats_local $i && echo ":::: `date +"%b%d_%T"` ips bombnofa - dovecot_plain authenticator failed "$i"" | geoip # done echo -e ${bldblu}"[Blocking dovecot auth fail and dodge country including unknown country, exclude ZA and others]"${txtrst} for i in $(tail -n200 /var/log/{exim_mainlog,exim_rejectlog} | grep "dovecot_plain authenticator failed for" | egrep -vi 'gmail|outlook|ofice365|apple|amazon' | ipgrep | geoip | sort | uniq -c | sort -k1n | awk '($1>200) {print $0}' | IPDodgeCountryFilter_conn1ormore | ipgrep ) ; do ipset -q add exim_authfail_threats_local $i && echo "$(date +"%Y"-"%m-%d-%R") :::: mailthreat_blocks /var/log/{exim_mainlog,exim_rejectlog} :::: $i" |/usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on RBL matches]"${txtrst} for i in $( tail -n100 /var/log/exim_mainlog | /usr/local/afribin/trustedSPs | egrep -vi 'gmail|outlook|ofice365|apple|amazon' | egrep "because of RBL match" | IPFilter_noZA | ipgrep | geoip | sort | uniq -c | sort -k1n | awk '($1>200) {print $0}'| ipgrep | grep "[0-9]" ) ; do ipset -q add exim_RBL_threats_local $i 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: mailthreat_blocks /var/log/exim_mainlog RBL match :::: $i" |/usr/local/afribin/geoip | tee -a $PLOG done #echo -e ${bldblu}"[Blocking based on exim_mainlog no MAIL in SMTP connection from]"${txtrst} #for i in $(tail -n100 /var/log/exim_mainlog | egrep -vi 'google|facebook|twitter|bing|jetpack|vaultpress|yahoo' | egrep -o "no MAIL in SMTP connection from.{0,20}" | # ipgrep | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU' | ipgrep | IPFilter_noZA ) ; do # #echo "$i" | tee -a "$RBL_OUTFILE" ; # ipset -q add exim_invalidhelo_threats_local $i && echo ":::: `date +"%b%d_%T"` `hostname` ipsets bombnofa - no MAIL in SMTP connection"$i"" | geoip #done #echo -e ${bldblu}"[Blocking based on exim_mainlog no MAIL in SMTP connection from]"${txtrst} #tail -100 /var/log/exim_mainlog | grep -A1 "TCP/IP connection count =" | sed 's/)//' | awk '($NF > 20)' | geoip | grep "no host name found" | #IPFilter_noZA | awk '{print $NF}' | # while read exim_dodge ; do # #echo "$i" | tee -a "$RBL_OUTFILE" ; # ipset -q add exim_invalidhelo_threats_local $exim_dodge # #echo ":::: `date +"%b%d_%T"` `hostname` ipsets bombnofa - no MAIL in SMTP connection"$exim_dodge"" | geoip #done } httpprocess_blocks () { echo -e ${bldblu}"[Blocking based on http concurrent connections more than 55 per ip and geoip]"${txtrst} for i in $(netstat -ntu | egrep ":443\ |:80\ " | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 | sort | uniq -c | sort -n | geoip | awk '($1 >= 1) {print $0}'| IPFilter_noZA | sort | uniq -c | awk '($1 > 55) {print $0}' | ipgrep ) ; do ipset add http2concurconn_threats_local $i 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: httpprocess_blocks 55 concurrent connections:::: $i" |/usr/local/afribin/geoip | tee -a $PLOG done # echo -e ${bldblu}"[Blocking based on http concurrent connections more than 5 per ip and geoip]"${txtrst} # for i in $(ss | grep http | ipgrep | geoip | IPFilter_noZA | egrep 'EG|CN|BR|TR|RU|RO|CZ|SG' | sort | uniq -c | awk '($1 > 5) {print $0}' | ipgrep ) ; do # ipset -q add http2concurconn_threats_local $i # done } concurrent_blocks_normal () { echo -e ${bldblu}"[Blocking based on concurrent connections more than 5 per ip and geoip dodge countries]"${txtrst} for i in $(netstat -ntu | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 | sort | uniq -c | sort -n | geoip | egrep -v 'ZA|_|IN|127.0.0' | awk '$1 > 45' | IPDodgeCountryFilter_badies | ipgrep); do ipset add ddos_ips_min $i 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: concurrent_blocks_normal :::: $i" |/usr/local/afribin/geoip | tee -a $PLOG done } concurrent_blocks_brute_protect () { echo -e ${bldblu}"[Blocking based on concurrent connections more than 35 per ip and geoip dodge countries]"${txtrst} for i in $(netstat -ntu | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 | sort | uniq -c | sort -n | geoip | egrep -v 'ZA|_|IN|127.0.0' | awk '$1 > 65' | ipgrep); do ipset add ddos_ips_min $i 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: concurrent_blocks_brute_protect + load trigger :::: $i" |/usr/local/afribin/geoip | tee -a $PLOG done } dovecotthreat_blocks () { echo -e ${bldblu}"[Blocking based on dovecot_login authenticator failed and dodge countries]"${txtrst} tail -n100 /var/log/exim_mainlog | grep "dovecot_login authenticator failed for" | geoip | grep -oP '\[.*?\]' | IPDodgeCountryFilter_oneconn | while read dovecot_autdodge ; do ipset add exim_authfail_threats_local "$dovecot_autdodge" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: dovecotthreat_blocks /var/log/exim_mainlog :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done } #proxy404_block proxy404_block ipset -q add hostname404_threats_local "$PDOMHIP" 2>/dev/null && echo "2021-07-01-01:20 :::: proxy404_block :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: proxy404_block :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG #modsecthreat_block modsecthreat_block ipset add modsec_threats_local "$PDOMHIP" 2>/dev/null && echo "2021-07-01-01:20 :::: modsecthreat_block :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: modsecthreat_block :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG proxy404_block () { echo -e ${bldblu}"[Blocking based on 404 to hostname and dodge country and two connections ]"${txtrst} tail -n250 /usr/local/apache/domlogs/`hostname` /usr/local/apache/logs/access_log /usr/local/apache/domlogs/proxy-subdomains-vhost.localhost 2>/dev/null | egrep '404|\\x16\\x03' | /usr/local/afribin/trustedSPs | ipgrep | sort | uniq -c | sort -k1n | awk '($1>23) {print $0}' | ipgrep | geoip | IPFilter_noZA | egrep -v 'ZA|127.0.0|_|AU' | ipgrep | while read PDOMHIP ; do ipset -q add hostname404_threats_local "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: proxy404_block :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done } cpanel_blankreferer () { SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; tail -n100 /usr/local/cpanel/logs/access_log | rg --text '"-" "-" "-" "-"' | rg --text -v 127.0.0.1 | rg --text -v '^\-' | geoip | awk '{print $1,$2}' | sort | uniq | egrep -v "ZA|AU|NZ|127.0.0|$SHELLSERVERIP|197.242.144.211|197.242.158.140" | awk '{print $2}' | ipgrep | ipprocheck | egrep -iv 'cloudbrick|cloudflare|securi' | awk '{print $1}' | grep . | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: cpanel_access_malpattern_threat :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG ; done } check_swap_and_kill_doveadm() { # Get current swap usage as a percentage swap_used=$(free | awk '/Swap/ { printf "%.0f", $3/$2 * 100 }') # Check if swap usage is above 99% if (( swap_used > 99 )); then echo "Swap usage is above 99% ($swap_used%). Killing /usr/bin/doveadm -v expunge processes..." # Kill all processes called "/usr/bin/doveadm -v expunge" ps auwfx | grep doveadm | awk '{print $2}' |xargs -i kill -9 {} ps auwfx | grep doveadm | awk '{print $2}' |xargs -i kill -9 {} ps auwfx | grep doveadm | awk '{print $2}' |xargs -i kill -9 {} echo "doveadm Processes killed due to swap over usage" fi } modsecthreat_block () { echo -e ${bldblu}"[Blocking based on modsec threats ]"${txtrst} tail -n100 /usr/local/apache/logs/error_log | grep ModSecurity: | geoip | awk '{print $1,$2,$3,$4,$5,$6,$10,$11}' | IPFilter_noZA |IPDodgeCountryFilter_badies| ipgrep | while read PDOMHIP ; do ipset -q add modsec_threats_local "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: modsecthreat_block :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on hostname accesslogs and python scanners and threats shells etc.. ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') ; tail -n100 /usr/local/apache/logs/access_log | egrep "zgrab|python-requests" | grep -v robot | grep "HTTP/1.1\" 40." | geoip |IPFilter_noZA | egrep -iv 'StatusCake|UptimeRobot|ocsp.comodoca.com|COMODO|pingdom|monitis|Site24|COMODO|DCV|Cpanel-HTTP-Client|sucuri|letsencrypt|downnotifier.com|127.0.0.1|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140' | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | sort | uniq | ipgrep | while read PDOMHIP ; do ipset -q add modsec_threats_local "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: modsec_shell_attack_block :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on domlogs and python scanners and threats shells etc.. ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') ; grep "python-requests" /tmp/ipsbomb* | grep -v robot | grep "HTTP/1.1\" 40." | geoip | IPFilter_noZA | egrep -iv 'StatusCake|UptimeRobot|ocsp.comodoca.com|COMODO|pingdom|monitis|Site24|COMODO|DCV|Cpanel-HTTP-Client|sucuri|letsencrypt|downnotifier.com|127.0.0.1|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140' | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | sort | uniq | ipgrep | while read PDOMHIP ; do ipset -q add ddos_ips "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: domlog_scanner_shell_attack_block ddos_ips :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on domlogs and POST /owa/auth.owa attacks etc.. ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') ; grep "POST /owa/auth.owa" /tmp/ipsbomb* | geoip | egrep -iv 'StatusCake|UptimeRobot|ocsp.comodoca.com|COMODO|pingdom|monitis|Site24|COMODO|DCV|Cpanel-HTTP-Client|sucuri|letsencrypt|downnotifier.com|127.0.0.1|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140' | ipgrep | sort | uniq | geoip | IPFilter_noZA | ipgrep | while read PDOMHIP ; do ipset -q add sysadmin_added_ips "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: domlog_owa/auth.owa attack :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done } httphitthreats_block () { echo -e ${bldblu}"[Blocking based on http 130 process limit and killing some http processes ]"${txtrst} hostname | grep aserv.co.za && if ps auwfx | grep "/usr/sbin/httpd -k start" | wc -l | awk '($1 > 130)' | grep "[0-9]" ; then ps auwfx | grep "/usr/sbin/httpd -k start" |sort -k3 | grep "S\ " | head -n20 | awk '{print $2}' | xargs -i kill -9 {} netstat -ntu | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 | sort | uniq -c | sort -n | geoip | egrep 'CN|TR|EG|CZ|RU|SG|BR|BG|IR|IT|SC' | awk '{print $3}' | ipgrep | grep "[0-9]"| while read PDOMHIP ; do ipset -q add ddos_ips "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: httphitthreats_block :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG done fi } byloadthreat_block () { echo -e ${bldblu}"[Blocking based on byloadthreat_block ]"${txtrst} ps auwfx| sort -k3n | egrep 'php-fpm|php-cgi' | egrep -v 'root|mysql' | awk '{print $1}' | sort | uniq | sed 's/+//' | while read puname ; do grep "USER="$puname"" /var/cpanel/users/"$puname"* | sed 's/USER=//' | while read realuname ; do tail -n10 /usr/local/apache/domlogs/"$realuname"/* /usr/local/afribin/trustedSPs | geoip | awk '{print $1,$2}' | egrep -v 'ZA|127.0.0|_|AU' | ipgrep | while read PDOMHIP ; do ipset -q add ddos_ips_min "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: byloadthreat_block_ipsmonitor1 :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG ;done; done ; done echo -e ${bldblu}"[Blocking based on byloadthreat_block 2 ]"${txtrst} ntshow | awk '($1 > 50)' | egrep -v "ZA|_|AU|NZ|IN|SZ|ZW" |ipgrep | while read PDOMHIP ; do ipset -q add ddos_ips_min "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: byloadthreat_block_ipsmonitor2:::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG ; done ntshow | awk '($1 > 150)' | egrep -v "ZA|_|AU|NZ|IN|SZ|ZW"|ipgrep | while read PDOMHIP ; do ipset -q add ddos_ips_min "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: byloadthreat_block_ipsmonitor3:::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG ; done ntshow | awk '($1 > 1250)' | egrep -v "_|AU|NZ|IN|SZ|ZW|ZA" | ipgrep | while read PDOMHIP ; do ipset -q add ddos_ips "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: byloadthreat_block_ipsmonitor4:::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG ; done } apache_modsec_threat_log () { tail -n100 /usr/local/apache/logs/error_log | egrep -i 'wp-config.php|XML parser error: XML|xmlrpc.php|anonymousfox|contact|mail|register|spam' | grep -o "\[client.*:.*\]\ " | awk '{print $2}' | ipgrep | sort | uniq | geoip| IPFilter_noZA | egrep -v 'ZA|AU|NZ|__'| ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | sort | uniq | while read PDOMHIP ; do ipset -q add modsec_threats_local "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: ipsmonitor modsec_threats_local :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG ; done } apache_shells_other_threat_log () { echo -e ${bldblu}"[Blocking based known shells and cpanel hacking tools 1 ]"${txtrst} egrep -ir 'zgrab|spamx|freshtools|spamxtoolz|spamx|toolsxtoolsx|MadStore|orvx|shell.php|/account.php?.*fox.*HTTP/1.1\" 200' /tmp/ipsbomb* | /usr/local/afribin/trustedSPs | geoip | IPFilter_noZA | grep "[0-9]" | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | egrep -v "127.0.0.1|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: apache_shells_other_threat_log domlogs :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based known shells and cpanel hacking tools 10 ]"${txtrst} egrep 'binance|wp_is_mobile|defau11.php|xindex.php|cmdshell|Fox=' /tmp/ipsbomb* |grep -v "action=elementor" | ipprocheck | egrep -vi 'SingleHop|sectigo|google|facebook|twitter|jetpack|vaultpress|UptimeRobot|ocsp.comodoca.com|COMODO|pingdom|monitis|Site24|COMODO|DCV|Cpanel-HTTP-Client|sucuri|letsencrypt|AIOSEO|Cloudflare|cloudbric' | awk '{print $1}' | sort | uniq | geoip | grep -v ZA | ipgrep | egrep -v "127.0.0.1|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: apache_shells_other_threat_log domlogs_fox_aggressive :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based known shells and cpanel hacking tools 2 ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') tail -n100 /usr/local/cpanel/logs/access_log | grep '400 0 "-" "-" "-" "-"' | awk '{print $1,$2}'| ipgrep | geoip | IPFilter_noZA | sort | uniq | ipgrep | egrep -v "127.0.0.1|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" | grep "[0-9]" | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: apache_shells_other_threat_log2 domlogs :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based known shells and cpanel hacking tools 3 ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') egrep 'binance|wp_is_mobile|defau11.php|xindex.php|cmdshell' /tmp/ipsbomb* | ipprocheck | egrep -vi 'SingleHop|sectigo|google|facebook|twitter|jetpack|vaultpress|UptimeRobot|ocsp.comodoca.com|COMODO|pingdom|monitis|Site24|COMODO|DCV|Cpanel-HTTP-Client|sucuri|letsencrypt|AIOSEO|Cloudflare|cloudbric|SingleHop|192.0.109' | geoip | grep -v ZA | ipgrep | sort | uniq | egrep -v "127.0.0.1|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: apache_shells_other_threat_log3 domlogs :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based known shells and cpanel hacking tools 4 ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') grep 'xmlrpc.php HTTP/1.1.*40.' /tmp/ipsbomb* 2>/dev/null | egrep -vi 'SingleHop|sectigo|google|facebook|twitter|jetpack|vaultpress|UptimeRobot|ocsp.comodoca.com|COMODO|pingdom|monitis|Site24|COMODO|DCV|Cpanel-HTTP-Client|sucuri|letsencrypt|AIOSEO|Cloudflare|cloudbric|SingleHop|192.0.109' | grep -i Windows | awk '{print $1}' | ipprocheck | egrep -vi 'SingleHop|sectigo|google|facebook|twitter|jetpack|vaultpress|UptimeRobot|ocsp.comodoca.com|COMODO|pingdom|monitis|Site24|COMODO|DCV|Cpanel-HTTP-Client|sucuri|letsencrypt|AIOSEO|Cloudflare|cloudbric|SingleHop|192.0.109' |ipgrep | geoip | egrep -v "ZA|AU|NZ|127.0.0|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" | sort | uniq | ipgrep | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: apache_shells_other_threat_log4 domlogs :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done #echo -e ${bldblu}"[Blocking based known shells and cpanel hacking tools 3 ]"${txtrst} #SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') ; grep -f /usr/local/afribin/configs/cpanel_malicious_patterns /tmp/ipsbomb* | geoip | grep -v robot | geoip | egrep -iv 'ZA|StatusCake|UptimeRobot|ocsp.comodoca.com|COMODO|pingdom|monitis|Site24|COMODO|DCV|Cpanel-HTTP-Client|sucuri|letsencrypt|downnotifier.com|127.0.0.1|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140' | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | sort | uniq | ipgrep | while read PDOMHIP ; do ipset -q add ddos_ips "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: domlog_scanner_shell_attack_block ddos_ips :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG ; done echo -e ${bldblu}"[Blocking based known /admin/ attacks based on uniq countries count per /tmp/ipsbomb* dump ]"${txtrst} grep -w "POST /admin/\ HTTP/1.1\" 200.*Ubuntu" /tmp/ipsbomb* | geoip | /usr/local/afribin/trustedSPs | egrep -v 'ZA|AU|NZ|127.0.0' | awk '{print $1}' | sort | uniq | wc -l | awk '($1 > 3)' | grep "^[0-9]" && grep "POST /admin/\ HTTP/1.1\" 200.*Ubuntu" /tmp/ipsbomb* | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | geoip| egrep -v 'ZA|AU|NZ|127.0.0' | awk '{print $2}' | sort | uniq | ipgrep | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: Blocking_based_admin :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based known attempt hack modsec wget requests ]"${txtrst} tail -n500 /usr/local/apache/logs/error_log | geoip| grep -i modsec | egrep 'wget|webshell' | grep -P "\[client.*]\ \[client" | egrep -o "http..................................|\[client.*]\ \[client" | ipgrep | geoip | grep "^[a-zA-Z]" | ipgrep | sort | uniq |while read ppip ; do if ! geoiplookup $ppip | /usr/local/afribin/trustedSPs_inverted ; then echo $ppip ; fi ; done | geoip | /usr/local/afribin/trustedSPs | geoip | awk '{print $2,$3}' | egrep -v 'ZA|127.0.0|_|AU' | ipgrep | while read PDOMHIP ; do ipset -q add modsec_threats_local "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: ipsmonitor modsec_threats_local candcs :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG ; done #grep -f /usr/local/afribin/configs/cpanel_malicious_patterns /tmp/ipsbomb* | geoip |awk -F ":" '{print $1,$2}' |awk '{print $2,$3}' | #sort |uniq -c | sort -k1n | awk '$1>=1 {print $1,$2,$3,$4}' |IPFilter_noZA | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | #while read PDOMHIP ; do # ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: maliciouspattern_threats_local /tmp/ipsbomb2 /usr/local/afribin/configs/cpanel_malicious_ipsbmombrun :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG #done echo -e ${bldblu}"[Blocking based wp_is_mobile attacks ]"${txtrst} tail -n300 /usr/local/cpanel/logs/access_log | grep --text wp_is_mobile ; grep wp_is_mobile /tmp/ipsbomb* | ipgrep | sort | uniq -c | awk '($1 > 3)' | grep [0-9] | egrep -v 'ZA|AU|NZ|127.0.0' | awk '{print $2}' | sort | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: Blocking_based_admin :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based magicreg login attempts]"${txtrst} tail -n300 /usr/local/cpanel/logs/access_log | grep --text magicreg |geoip | awk '{print $1,$2}' | egrep -v 'ZA|AU|NZ|127.0.0|14.142.179.150|103.214.235.222' | awk '{print $2}' | sort | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null || continue echo "$(date +"%Y"-"%m-%d-%R") :::: magicreg_login_attempt :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based fake google referer attacks ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') grep "404\ .*\ \"www.google.com\"" /tmp/ipsbomb* | awk '{print $1}'| sort | uniq | ipprocheck | /usr/local/afribin/trustedSPs | geoip | egrep -v "ZA|AU|NZ|127.0.0|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: google_fake_bot_malicious :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based author_attack_hack 404 attacks ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') grep "GET /?author=.*HTTP/1.1\" 404" /tmp/ipsbomb* | awk '{print $1}'| sort | uniq | ipprocheck | /usr/local/afribin/trustedSPs | geoip | egrep -v "ZA|AU|NZ|127.0.0|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: author_attack_hack :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based plugin vul wp-config get ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') egrep "\.\./\.\./wp-config|\.\./wp-config.php" /tmp/ipsbomb* 2>/dev/null | geoip |awk '{print $2}'| egrep -v "ZA|AU|NZ|127.0.0|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" |ipgrep | sort | uniq | ipgrep | ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: Blocking based plugin vul wp-config get :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on GuzzleHttp attacks ]"${txtrst} grep "GET /.* HTTP/1.1.* 4..\ .*GuzzleHttp" /tmp/ipsbomb* | ipgrep | sort | uniq -c | awk '($1 > 3)' | grep [0-9] |geoip |egrep -v 'ZA|AU|NZ|127.0.0' | awk '{print $2}' | sort | ipgrep | /usr/local/afribin/ipprocheck | /usr/local/afribin/trustedSPs | ipgrep | egrep -v "ZA|AU|NZ|127.0.0|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" | while read PDOMHIP ; do ipset -q add maliciouspattern_threats_local $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: Blocking_based_GuzzleHttp :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on dodge useragent1 ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') egrep "\"Mozilla/5.0 \(Windows NT 10.0; Win64; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/74.0.3729.169 Safari/537.36\"" /tmp/ipsbomb* 2>/dev/null | awk '{print $1}' |geoip | egrep -v "ZA|AU|NZ|127.0.0|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" |ipgrep | sort | uniq | ipprocheck |trustedSPs | awk '{print $1}' | ipgrep| while read PDOMHIP ; do ipset -q add ddos_ips $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: Blocking_based_useragent1 :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on dodge blank useragents ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') egrep " - \"-\" \"-\"" /tmp/ipsbomb* | egrep 'CONNECT|HEAD|OPTIONS|GET' 2>/dev/null | awk '{print $1}' |geoip | egrep -v "MW|ZA|AU|NZ|127.0.0|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" |ipgrep | sort | uniq | ipprocheck |trustedSPs | awk '{print $1}' | ipgrep| while read PDOMHIP ; do ipset -q add ddos_ips $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: Blocking_based_useragent_blank :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done echo -e ${bldblu}"[Blocking based on dodge Blocking_based_useragent2 ]"${txtrst} SHELLSERVERIP=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|head -1) ; SHELLSERVERIPS=$(ip addr | egrep 'lo|global'|awk '{print $2}'|grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'|grep -v 127\.0\.0|sed 's/ /|/g') grep '"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36"' /tmp/ipsbomb* 2>/dev/null | awk '{print $1}' |geoip | egrep -v "ZA|AU|NZ|127.0.0|$SHELLSERVERIP|$SHELLSERVERIPS|197.242.144.211|197.242.158.140" |ipgrep | sort | uniq | ipprocheck |trustedSPs | awk '{print $1}' | ipgrep| while read PDOMHIP ; do ipset -q add ddos_ips $PDOMHIP 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: Blocking_based_useragent2 :::: $PDOMHIP" | /usr/local/afribin/geoip | tee -a $PLOG done } # ###### LOAD FUNCTION CALLS ###### normal_load () { echo -e ${bldblu}"[Running ideal load blocks]"${txtrst} echo -e ${bldblu}"[Creating tail dump of domlogs /usr/local/apache/domlogs/ by time and grep date to the min to use for subsequent blocks below"${txtrst} echo -e ${bldblu}"[ Checking swap above 95% ]"${txtrst} cat /dev/null > /tmp/ipsbomb # find /usr/local/apache/{logs,domlogs}/* -maxdepth 0 -type f -mmin -10 | egrep -v 'bytes_|ftp' | find /usr/local/apache/{logs/,domlogs/} -maxdepth 1 -type f -mmin -1 ! -name '*bytes*' ! -name '*ftp*' | xargs -i tail -n10 {} > /tmp/ipsbomb chmod 600 /tmp/ipsbomb echo ":::: ips bomb :::: Created /tmp/ipsbomb" tail -n50 /var/log/secure | egrep "Invalid user|Failed password for invalid user|authentication failure" | geoip | egrep -v 'ZA|127.0.0|AU|NZ|ZW|BW|MZ|LS|ID|NA|ZM|CM|SZ|KE|IN|AO|IN|NA' | ipgrep | /usr/local/afribin/trustedSPs | geoip | awk '{print $1,$2}' | egrep -v 'ZA|127.0.0|_|AU' | sort | uniq -c | awk '($1 > 5 )' | ipgrep | while read PDOMHIP ; do ipset -q add sshbrute_threats_local "$PDOMHIP" 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: sshbrute_threats_local :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG ; done if [[ `hostname` = *\.aserv\.co\.za ]] ; then ps auwfx| grep php-cgi | awk '{if($1!=$1+0 && $1!="root")print $0}' | awk '{print $1}'|sed 's/+//' | sort | uniq -c | awk '($1 > 50 )' | awk '{print $2}' | while read pusercgi ; do ps awufx | grep $pusercgi | grep php-cgi| grep -v grep | awk '{print $2}' | xargs -i kill -9 {} done fi } emerg_hammer () { echo "HAMMER emerg_hammer" echo -e ${bldblu}"[LOAD HIGHER THAN 80 :: GOING TO TRY HAMMER DOWN ]"${txtrst} if ! /usr/local/lsws/bin/lshttpd -t | grep OK ; then echo "apache and fpm quick restart" ; for run in {1..60}; do killall -9 httpd php-fpm php-cgi nginx ; done echo "apache and fpm quick restart" ; for run in {1..60}; do killall -9 httpd php-fpm php-cgi nginx ; done echo "apache and fpm quick restart" ; for run in {1..60}; do killall -9 httpd php-fpm php-cgi nginx ; done ps auwfx| grep php-cgi | awk '{if($1!=$1+0 && $1!="root")print $0}' | awk '{print $1}'|sed 's/+//' | sort | uniq -c | awk '($1 > 50 )' | awk '{print $2}' | while read pusercgi ; do ps awufx | grep $pusercgi | grep php-cgi| grep -v grep | awk '{print $2}' | xargs -i kill -9 {} done if ps auwfx | grep "/usr/sbin/httpd -k start" | wc -l | awk '($1 > 130)' | grep "[0-9]" ; then ps auwfx | grep "/usr/sbin/httpd -k start" |sort -k3 | grep "S\ " | head -n40 | awk '{print $2}' | xargs -i kill -9 {} #telegram-send "$(hostname) - apache hit 130 processes, investigate" fi /scripts/restartsrv_apache_php_fpm service httpd start service nginx start fi if /usr/local/lsws/bin/lshttpd -t | grep OK ; then ps awufx| grep lsphp | awk '{print $1}' | sort | uniq -c | sort -k1n | awk '( $1 > 80)' | awk '{print $NF}' | while read pabuser ; do ps auwfx| grep $pabuser | awk '{print $2}' | xargs -i kill -9 {} ; done touch /usr/local/lsws/admin/tmp/.lsphp_restart.txt ; killall -9 lsphp echo "$(date +"%Y"-"%m-%d-%R") ::: emerg_hammer_restarted_web_services ::::" | tee -a $PLOG fi echo "$(date +"%Y"-"%m-%d-%R") ::: emerg_hammer_restarted_web_services ::::" | tee -a $PLOG apache_shells_other_threat_log ntshow | egrep 'PL|BG|BD|CA|RO|TR|EG|CN|IT|RU|BR|SG|US|FR|CA' |ipgrep| xargs -i ipset -q add ddos_ips {} ntshow | egrep -v "ZA|_|AU|NZ|IN" | ipgrep | xargs -i ipset -q add ddos_ips_min {} ntshow | awk '($1 > 55)' | egrep -v "ZA|_|AU|NZ|IN" | ipgrep | xargs -i ipset -q add ddos_ips_min {} for i in $(netstat -ntu | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 | sort | uniq -c | sort -n | geoip | egrep 'CN|TR|EG|CZ|RU|SG|BR|CO|JP|RO|CH' | awk '{print $3}' | sort | uniq -c | sort -n | geoip | awk '$1 > 0 ' | IPDodgeCountryFilter_badies | ipgrep); do ipset -q add ddos_ips_min $i done } midemerg_hammer () { echo "HAMMER midemerg_hammer Start" concurrent_blocks_brute_protect apache_shells_other_threat_log #if ! screen -ls | grep ipsmalblock ; then screen -dmS ipsmalblock /usr/local/afribin/configs/cpanel_malicious_ipsbmombrun ; fi normal_load #apache_modsec_threat_log badbotsthreat_block cphulk_blocks xmlrpc_block brutelogin_blocks contactspam_block mysqlthreat_blocks ftpthreat_blocks cpanelthreats_blocks mailthreat_blocks httpprocess_blocks dovecotthreat_blocks proxy404_block modsecthreat_block httphitthreats_block # added hammer byloadthreat_block echo -e ${bldblu}"[Blocking based on load and concurrent connections of dodge countries 1min block]"${txtrst} ntshow | egrep 'JP|ES|SE|RU|CN|RO|VN|TR|BR|MY|ID|CO|AR|MX|EG|BG|AE|AL|IR|DO|PE|KW|ET' | ipgrep | xargs -i ipset -q add ddos_ips {} if [[ `hostname` = *\.aserv\.co\.za ]] ; then if ! /usr/local/lsws/bin/lshttpd -t | grep OK ; then ps auwfx| grep php-cgi | awk '{if($1!=$1+0 && $1!="root")print $0}' | awk '{print $1}'|sed 's/+//' | sort | uniq -c | awk '($1 > 50 )' | awk '{print $2}' | while read pusercgi ; do ps awufx | grep $pusercgi | grep php-cgi| grep -v grep | awk '{print $2}' | xargs -i kill -9 {} for i in $(ps auwfx| grep php-cgi | grep -v grep | awk '{print $1}' | sort | uniq | sed -e 's/+$//' | xargs -i grep {} /etc/userdomains | awk '{print $2}') ; do ips applyfpm $i ; ps auwfx| grep $i | awk '{print $2}' | xargs -i kill -9 {} ; done done fi fi ntshow | awk '($1 > 10)' | egrep -v 'IN|ZA|_|AU' | ipgrep | xargs -i ipset -q add ddos_ips {} ; echo "HAMMER midemerg_hammer end" } ccemerg_hammer () { echo "HAMMER ccemerg_hammer Start" if ! screen -ls | grep ipsmalblock ; then screen -dmS ipsmalblock /usr/local/afribin/configs/cpanel_malicious_ipsbmombrun ; fi concurrent_blocks_brute_protect xmlrpc_block #apache_modsec_threat_log brutelogin_blocks normal_load apache_shells_other_threat_log badbotsthreat_block cphulk_blocks contactspam_block mysqlthreat_blocks ftpthreat_blocks cpanelthreats_blocks mailthreat_blocks httpprocess_blocks dovecotthreat_blocks proxy404_block modsecthreat_block httphitthreats_block echo -e ${bldblu}"[Blocking based on load and concurrent connections of dodge countries 1min block]"${txtrst} ntshow | egrep 'PL|MA|EG|BG|BD|CA|RO|TR|EG|CN|IT|RU|BR|SG' |ipgrep|xargs -i ipset -q add ddos_ips_min {} if [[ `hostname` = *\.aserv\.co\.za ]] ; then if ! /usr/local/lsws/bin/lshttpd -t 2>/dev/null | grep OK ; then for i in $(ps auwfx| grep php-cgi | grep -v grep | awk '{print $1}' | sort | uniq | sed -e 's/+$//' | xargs -i grep {} /etc/userdomains | awk '{print $2}') ; do ips applyfpm $i ; ps auwfx| grep $i | awk '{print $2}' | xargs -i kill -9 {} ; done ps auwfx| sort -k3n | egrep 'php-fpm|php-cgi' | egrep -v 'root|mysql' | awk '{print $1}' | sort | uniq | while read puname ; do grep "USER="$puname"$" /var/cpanel/users/"$puname" | sed 's/USER=//' | while read realuname ; do tail -n10 /usr/local/apache/domlogs/"$realuname"/* | /usr/local/afribin/trustedSPs | geoip | awk '{print $1,$2}' | egrep -v 'ZA|127.0.0|_|AU|NZ|IN' | ipgrep | xargs -i ipset -q add ddos_ips_min {} ; done ; done else /usr/local/lsws/bin/lshttpd -t | grep OK && { touch /usr/local/lsws/admin/tmp/.lsphp_restart.txt ; killall -9 lsphp ; touch /root/.ips_ccemerg_restart ; } fi ntshow | awk '($1 > 20)' | grep -Ev "ZA|__ 100\.|__ 10\.|127.0.0.1|__ 102\." | ipgrep | xargs -i ipset -q add ddos_ips {} 2>/dev/null && echo "$(date +"%Y"-"%m-%d-%R") :::: load_emerg_hammer :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG ntshow | egrep 'SE|TG|PY|BG|FI|MA|KN|AZ|KG|KZ|MX|RS|BR|VN|HK|KR|TH|BG|RU|EG|IR|TR' | ipgrep | ipprocheck | trustedSPs | ipgrep | sort | uniq | awk -F "." '{print $1"."$2"."$3".0/24"}' | sort | uniq | xargs ipset add ddos_ips {} && echo "$(date +"%Y"-"%m-%d-%R") :::: load_emerg_hammer2 :::: $PDOMHIP" |/usr/local/afribin/geoip | tee -a $PLOG fi echo "HAMMER ccemerg_hammer end" } normal_hammer () { normal_load apache_shells_other_threat_log #apache_modsec_threat_log concurrent_blocks_normal httpprocess_blocks httphitthreats_block if ! screen -ls | grep ipsmalblock ; then screen -dmS ipsmalblock /usr/local/afribin/configs/cpanel_malicious_ipsbmombrun ; fi badbotsthreat_block cphulk_blocks xmlrpc_block brutelogin_blocks contactspam_block mysqlthreat_blocks ftpthreat_blocks cpanelthreats_blocks mailthreat_blocks dovecotthreat_blocks proxy404_block modsecthreat_block #ntshow | awk '($1 > 270)' | IPFilter_noZA | ipgrep | xargs -i ipset -q add fh_level4_ips {} ntshow | awk '($1 > 140)' | egrep -v 'ZA|_|AU' | ipgrep | xargs -i ipset -q add ddos_ips {} ; ntshow | egrep 'RU' | ipgrep | xargs -i ipset -q add ddos_ips_min {} echo "HAMMER normal_hammer" } trigger_func () { if cat /proc/cpuinfo | grep "model name" | grep -q EPYC ; then trigger=90 else trigger=50 fi ppload="$(uptime | awk '{print $(NF-2)}' | awk -F "." '{print $1}')" response=`echo | awk -v T=$trigger -v L=$ppload 'BEGIN{if ( L > T){ print "greater"}}'` if [[ $response = "greater" ]] ; then emerg_hammer /usr/local/afribin/maintenance/block_dodge_cpanel /bin/bash /usr/local/afribin/maintenance/block_dodge_cpanel2 fi trigger=$(echo $((`nproc`+15))) ppload="$(uptime | awk '{print $(NF-2)}' | awk -F "." '{print $1}')" response=`echo | awk -v T=$trigger -v L=$ppload 'BEGIN{if ( L > T){ print "greater"}}'` if [[ $response = "greater" ]] ; then midemerg_hammer /usr/local/afribin/maintenance/block_dodge_cpanel /bin/bash /usr/local/afribin/maintenance/block_dodge_cpanel2 fi trigger=$(echo $((`nproc`+1))) ppload="$(uptime | awk '{print $(NF-2)}' | awk -F "." '{print $1}')" response=`echo | awk -v T=$trigger -v L=$ppload 'BEGIN{if ( L > T){ print "greater"}}'` if [[ $response = "greater" ]] ; then ccemerg_hammer /usr/local/afribin/maintenance/block_dodge_cpanel /bin/bash /usr/local/afribin/maintenance/block_dodge_cpanel2 fi trigger=$(echo $((`nproc`))) ppload="$(uptime | awk '{print $(NF-2)}' | awk -F "." '{print $1}')" response=`echo | awk -v T=$trigger -v L=$ppload 'BEGIN{if ( L < T){ print "lessthan"}}'` if [[ $response = "lessthan" ]] ; then normal_hammer /usr/local/afribin/maintenance/block_dodge_cpanel /bin/bash /usr/local/afribin/maintenance/block_dodge_cpanel2 fi } usage_short() { cat <