Need to block this ASAP

Server Config
1

In my log files, I’ve been receiving thousands of requests that look like the following:


"POST / HTTP/1.0" 200 18890 "-" The Incutio XML-RPC PHP Library -- WordPress/3.0.1"

It’s so bad that the shared server that I’m on crashed.

Can someone help me block these types of requests?

Thanks!

2

I’m not sure if that’s the user agent.

The only thing it shows in my logs is the following:

IP ADDRESS - - [DATE] “POST / HTTP/1.0” 200 18890 “-” The Incutio XML-RPC PHP Library – WordPress/3.0.1"

I’m guessing “The Incutio XML-RPC PHP Library – WordPress/3.0.1” is the user agent, right?

If that IS the user agent, can I just block these requests the same way bots/spiders are blocked?

3

404,

Do you have the IP address? That’s easiest to block. USER_AGENT? Do you even have mod_rewrite available to you?

On the other hand, this looks like you may have installed “The Incutio XML-RPC PHP Library” in your WP installation. Disable it until you can find out how to run it properly.

Regards,

DK

4

Are they all coming from a single IP?

5

All from different IPs. Thousands from all over the world.

I don’t use WordPress or the Incutio XML-RPC PHP Library either.

It looks like someone added my site to a WordPress plugin that tries to ping my website using the XML-RPC interface.

Can I create a simple .htaccess file that blocks anything with “Incutio XML-RPC PHP Library” in the request?

I’m pretty sure I have mod_rewrite available too.

6

404,

Yup! There was a recent thread about blocking bot* and *bot which would have code you SHOULD look at for this.

Regards,

DK

7

404,

Is “Incutio XML-RPC PHP Library” part of the {USER_AGENT} string? If not, what is being recorded?

Regards,

DK

8

OK, instead of blocking the user agent, I’ve decided to use a different approach.

All of these requests are POST requests (which is something I’d like to block for other bots/spiders as well), so I came up with this:


RewriteEngine on
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_HOST} !.*mydomain.com.*
RewriteRule ^.* - [F,L]

but for some reason it doesn’t work. Any ideas?

I’d like to block all POST requests to my site, yet allow all POST requests from within my site.

9

404,

You’re looking at your own server’s details, not the {HTTP_REFERER}.

Regards,

DK