<?php
date_default_timezone_set('America/New_York');
$ip=$_SERVER['REMOTE_ADDR'];
//$ip="127.0.0.2"; // for testing
$origRequest = $_GET['req'];
putenv("TZ=US/Eastern");
$timeNow = time();
$fresh = time() - 900; // AbuseIPDB rejects IPs reported by a user within 15 minutes
$domain = "[example.tld]"; // domain of reporting site or server
$currentDateTime = (date("M d, Y h:i:s a"));
$ports="80,443";
$categories="15,21"; // for AbuseIPDB Report
$con = mysqli_connect("[database-host-domain]","[database_user]","[database_password]","[database_name]");
if (!$con) { die('Could not connect: ' . mysqli_error($con)); }
$result = mysqli_query($con, "SELECT * FROM reports WHERE (ip4 LIKE '$ip' AND time >= '$fresh')");
$row = mysqli_fetch_array($result);
$reportDate = $row['datetime'];
if (empty($reportDate)) {
// sanitize
$timeNow = mysqli_real_escape_string($con, $timeNow);
$ip = mysqli_real_escape_string($con, $ip);
$domain = mysqli_real_escape_string($con, $domain);
$currentDateTime = mysqli_real_escape_string($con, $currentDateTime);
$origRequest = mysqli_real_escape_string($con, $origRequest);
$comment="Hit on " . $origRequest; // for AbuseIPDB Report and database entry
/* If origRequest is stripped out by mysqli_real_escape_string, it probably means it contained malicious SQL code. Therefore:*/
if (empty($origRequest)) {
$comment = "Web-based SQL injection attempt";
$categories = "15,16,21";
}
// insert to db
mysqli_select_db($con, "[database_name]");
$sql = "INSERT INTO reports (datetime, time, ip4, ports, categories, domain, origRequest, comment) VALUES ('$currentDateTime','$timeNow','$ip','$ports','$categories','$domain','$origRequest','$comment')";
if (!mysqli_query($con,$sql)) {
echo("Error description: " . mysqli_error($con));
}
// make report
$data = (array(
"ip" => $ip,
"categories" => $categories,
"comment" => $comment
));
$headers = array('Key: [key goes here]', 'Accept: application/json');
$ch = curl_init("https://api.abuseipdb.com/api/v2/report");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1 ); // Set to 0 for testing to display response from AbuseIPDB
curl_setopt($ch, CURLOPT_POST, 1 );
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$output=curl_exec($ch);
curl_close($ch);
}
include("401.php");
?># Honeypot for non-existent login attempts
RewriteCond %{REQUEST_URI} /wp-login.php [NC,OR]
RewriteCond %{REQUEST_URI} /wp-config.php [NC,OR]
RewriteCond %{REQUEST_URI} /wp-contacts.php [NC,OR]
RewriteCond %{REQUEST_URI} /xmlrpc.php [NC,OR]
RewriteCond %{REQUEST_URI} /webconfig.txt.php [NC,OR]
RewriteCond %{REQUEST_URI} /admin.php [NC,OR]
RewriteCond %{REQUEST_URI} /login.php [NC,OR]
RewriteCond %{REQUEST_URI} /adminer.php [NC,OR]
RewriteCond %{REQUEST_URI} /lequ.php [NC,OR]
RewriteCond %{REQUEST_URI} /install.php [NC,OR]
RewriteCond %{REQUEST_URI} /setup.php [NC,OR]
RewriteCond %{REQUEST_URI} /shell.php [NC,OR]
RewriteCond %{REQUEST_URI} /user.php [NC,OR]
RewriteCond %{REQUEST_URI} ^/install/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/setup/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/plus/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/data/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/inc/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/.git/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/templates/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/fckeditor/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/config/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/administrator/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/admin/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/manager/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/cms/(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/wp-admin/(.*)$ [NC]
RewriteRule .* https://www.example.com/honey.php?req=%{REQUEST_URI} [L]
Our local honeywagon proprietor, years ago when we lived in a different locale, named his "Mr. Slurpee," and had a graphic of a cartoon tanker sipping on a straw stuck in a toilet. Very cute.
I thought honey pot was a colloquialism for something entirely different
Yep, I used to operate one during summers and holiday vacations in high school and college. It was a local farmer to my parents. Nasty, nasty smell!
