Option to Block Host Name?

  • Resolved nevrsmer

    (@nevrsmer)


    4 years, 1 month ago

    Hi,

    I see Defender has the option to block IPs. Is there an option to block by host name? In our logs, we see there are a number of host names that constantly switch IP address, making it futile blocking them by IP.

    For example, the two hosts below will constantly scan our site. I’ll block them by IP, but they just change IP and continue scanning the site.

    scanner-08.ch1.censys-scanner.com
    scanner-04.ch1.censys-scanner.com

    Can I block hosts in Defender? If not, do you know of a rule I could implement in the root .htaccess file to block by host name?

    Thank you, and have a good day.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support Dimitris – WPMU DEV Support

    (@wpmudev-support6)

    Hello @nevrsmer

    This isn’t possible with Defender but you could use a rule in .htaccess like the following:

    <IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*censys-scanner\.com [NC]
RewriteRule .* - [F]
</IfModule>

    Thank you,
    Dimitris

    Thread Starter nevrsmer

    (@nevrsmer)

    Hello Dimitris,

    Thanks for the .htaccess rule!

    I have a question when you have a moment, please.

    How would I modify the rule you provided to block multiple host names.

    For example, how would I block the following host names using the rule you provided?

    51-159-30-87.rev.poneytelecom.eu
    gwc.cluster027.hosting.ovh.net
    bh-ht-14.webhostbox.net
    zg-0915a-85.stretchoid.com

    Again, many thanks, and have a good day!!

    Plugin Support Dimitris – WPMU DEV Support

    (@wpmudev-support6)

    Hey there

    This should do the trick:

    <IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*censys-scanner\.com [OR]
RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*poneytelecom\.eu [OR]
RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*hosting\.ovh\.net [OR]
RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*webhostbox\.net [OR]
RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*stretchoid\.com 
RewriteRule .* - [F]
</IfModule>

    Thank you,
    Dimitris

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Option to Block Host Name?’ is closed to new replies.