How to block specific human looking user agent in nginx -
i have been having few problems spam , bots registering , these anti captcha systems not seem working.
i have analyzed access logs , discovered user agents not used humans maybe because old... noticed there has been head / / post / attacks coming in web server using exact same string on user agents. possibly booters using same user agents spam/add bots.
216.151.139.172 - - [24/mar/2013:00:58:20 +0000] "get /index.php?action=verificationcode;vid=register;rand=12c64196f4558b2dff00db7ed3ee8ad9 http/1.1" 200 2189 "index.php?action=register" "mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; trident/4.0; .net clr 1.1.4322)" "-"
in nginx without blocking user agents, there anyway block string contained in useragent these bots can stop registering , advertising.
"mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; trident/4.0; .net clr 1.1.4322)"
thanks reading.
you can try this
if ($http_user_agent = "mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; trident/4.0; .net clr 1.1.4322)") { return 444; # 444 special nginx status code that's useful in fighting attack }
but user agent string valid, means block legit visits well.
i'd suggest try ip based access control. see http://wiki.nginx.org/httpaccessmodule setting up. it's better in opinion.
Comments
Post a Comment