Question How to protect bot scan folder ?

[WSNHosting]

80.15.74.9 - - [17/Oct/2017:06:09:19 +0700] "HEAD http://ip:80/mysql/admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:19 +0700] "HEAD http://ip:80/mysql/dbadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:20 +0700] "HEAD http://ip:80/mysql/sqlmanager/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:20 +0700] "HEAD http://ip:80/mysql/mysqlmanager/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:20 +0700] "HEAD http://ip:80/phpmyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:21 +0700] "HEAD http://ip:80/phpMyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:21 +0700] "HEAD http://ip:80/phpMyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:21 +0700] "HEAD http://ip:80/phpmyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:21 +0700] "HEAD http://ip:80/phpmyadmin2/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:22 +0700] "HEAD http://ip:80/phpmyadmin3/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:22 +0700] "HEAD http://ip:80/phpmyadmin4/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:22 +0700] "HEAD http://ip:80/2phpmyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:22 +0700] "HEAD http://ip:80/phpmy/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:23 +0700] "HEAD http://ip:80/phppma/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:23 +0700] "HEAD http://ip:80/myadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:23 +0700] "HEAD http://ip:80/shopdb/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:23 +0700] "HEAD http://ip:80/MyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:24 +0700] "HEAD http://ip:80/program/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:24 +0700] "HEAD http://ip:80/PMA/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:24 +0700] "HEAD http://ip:80/dbadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:24 +0700] "HEAD http://ip:80/pma/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:25 +0700] "HEAD http://ip:80/db/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:25 +0700] "HEAD http://ip:80/admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:25 +0700] "HEAD http://ip:80/mysql/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:26 +0700] "HEAD http://ip:80/database/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:26 +0700] "HEAD http://ip:80/db/phpmyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:26 +0700] "HEAD http://ip:80/db/phpMyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:26 +0700] "HEAD http://ip:80/sqlmanager/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:27 +0700] "HEAD http://ip:80/mysqlmanager/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:27 +0700] "HEAD http://ip:80/php-myadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:27 +0700] "HEAD http://ip:80/phpmy-admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:27 +0700] "HEAD http://ip:80/mysqladmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:28 +0700] "HEAD http://ip:80/mysql-admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:28 +0700] "HEAD http://ip:80/admin/phpmyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:28 +0700] "HEAD http://ip:80/admin/phpMyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:28 +0700] "HEAD http://ip:80/admin/sysadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:29 +0700] "HEAD http://ip:80/admin/sqladmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:29 +0700] "HEAD http://ip:80/admin/db/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:29 +0700] "HEAD http://ip:80/admin/web/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:29 +0700] "HEAD http://ip:80/admin/pMA/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:30 +0700] "HEAD http://ip:80/mysql/pma/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:30 +0700] "HEAD http://ip:80/mysql/db/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:30 +0700] "HEAD http://ip:80/mysql/web/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
80.15.74.9 - - [17/Oct/2017:06:09:30 +0700] "HEAD http://ip:80/mysql/pMA/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"

 

[IgorG]

In case of nginx, I like to use the return code 444, something like:

location ~ /wp-content/ { return 444; }
location ~ /wp-includes/ { return 444; }
location ~ /webboard/ { return 444; }

444 No Response
Used to indicate that the server has returned no information to the client and closed the connection.

 

[WSNHosting]

In case of nginx, I like to use the return code 444, something like:

location ~ /wp-content/ { return 444; }
location ~ /wp-includes/ { return 444; }
location ~ /webboard/ { return 444; }

444 No Response
Used to indicate that the server has returned no information to the client and closed the connection.

is many folder in list, have iptables auto block ?

 

[IgorG]

Try to use Web Application Firewall (ModSecurity)

 

[UFHH01]

Hi WSNHosting,

have iptables auto block ?

Did you consider to use Fail2Ban, with a unique jail, to get rid of these bots/scripts ?