I have an Ubuntu 12.04 machine running Apache2 which hosts about 10 wordpress websites.
Recently I have been subjected to attacks from clients which seem to be sending POST requests to a wordpress file called 'xmlrpc.php'
The way I block the IP addresses which send these malicious requests is a tedious manual process, and I want to automate this somehow.
Once I notice that my server load is high I perform he following actions:
I run apachetop on all of my virtual host access files. This shows all requests being made so I can see if any requests are being made to xmlrpc.php
Once I identify which IP's are attacking my server, I run the following command for each offending IP Address:
sudo iptables -A INPUT -s 94.102.52.95 -j DROP
When all IP address have been added to my block list, my server load immediately drops to normal levels
Is there a way to automate this process? I was thinking about writing some code within xmlrpc.php which will add any IP addresses to my block list for any IP that send requests for it. Does anyone have any idea on how to do this?
Thanks in advance!