Kus’ Blog

While researching why the servers where overloaded I saw that some webpages where attacked/scanned from hundreds of different ips. Most of the where from Caravan Networks from Russia…

I know almost for sure that no webs pages in our servers have russian clients target so I wanted to ban them all, from their IP range. The problem was this range wasn’t trivial to get, so I did this little hack to get them.

Saddly it isn’t 100% effective but nearly 80%

First thing to get is a list of the attackers ip. In this case we got them from grepping through an apache access log.

cat /usr/local/apache/domlogs/kedume9/somedomain.com | grep "POST /web/ht" | cut -f 1 -d " " | sort -u malos.txt

did the trick.

Now the nice bash thing:

#!/bin/bash
for malo in `cat malos.txt`;
do
whois $malo | grep inetnum | awk '{print $2,$3,$4}' - | xargs ipcalc | grep '/' >> ranges.tmp
done
sort -u ranges.tmp > ranges.txt

As you see we are grepping inetnum from the whois as almost all ips showed the same information. This is a point of failure as it’s really possible that an ip range would have been marked in another fashion, as NetRange:. You will have to manually look for error in ipcalc.

Anyway, from a list of 2531 unique ips I got 33 internet ranges. Would be nice to check the origin country at this point.

Hope this helps to anyone