check http

python,bot

[TorontoBoy]

UA: check_http/v1.4.15-61-g4d527 (nagios-plugins 1.4.15)
IP: 51.15.212.*
Host: 51.15.0.0 - 51.15.255.255 ONLINE_NET_DEDICATED_SERVERS FR
Protocol: Http:/1.1
Robots: No

They are looking for security loopholes, so getting a slew of 404s. This is a python plugin.

GET /shell.php HTTP/1.1 404
GET /shell.php.suspected HTTP/1.1 404
GET /tmp.php HTTP/1.1 404
GET /tmp.php.suspected HTTP/1.1 404
GET /bubus.php HTTP/1.1 404
GET /bubus.php.suspected HTTP/1.1 404
GET /wso.php HTTP/1.1 404
GET /wso.php.suspected HTTP/1.1 404
GET /wso2.php HTTP/1.1 404
GET /wso2.php.suspected HTTP/1.1 404
GET /c99.php HTTP/1.1 404
GET /c99.php.suspected HTTP/1.1 404
GET /login.php HTTP/1.1 404
GET /login.php.suspected HTTP/1.1 404
GET /.images.jpg/login.php HTTP/1.1 404
GET /.images.jpg/login.php.suspected HTTP/1.1 404
GET /1111.php HTTP/1.1 404
GET /1111.php.suspected HTTP/1.1 404
GET /1.php HTTP/1.1 404
GET /1.php.suspected HTTP/1.1 404
GET /mko.php HTTP/1.1 404
GET /mko.php.suspected HTTP/1.1 404

[lucy24]

getting a slew of 404s

If for some reason you aren't able to block them, I hope you are at least returning those 404s manually based on the UA. Saves the server the trouble of looking for nonexistent files, and leaves the robot none the wiser. (I used to return a manual 404 on all php requests, but dropped it when it became redundant. I see I should perhaps restore it, possibly even replacing the $ anchor with \b for those weird locutions.)

[TorontoBoy]

SetEnvIf User-Agent "check\_http" keep_out

For me this is a new bot, so just added to my ban list. I will be returning 403s.

[lucy24]

The lowline _ is a “word” character, just like alphanumerics. You don’t need to escape it. It won’t do any harm, but it is never necessary. The same goes for the quotation marks.

[TorontoBoy]

Thank you Lucy. I will correct it.

[jonasjacek]

CIDR: 51.15.0.0/16