Ban Hackers

Back in the day, hackers were unemployed or unemployable programmers or teenagers with nothing to do.
Now days, it's criminal organizations and Programmers (with a capital P) with masters degrees hired by foreign (and not so foreign) governments to hack into every server they can find. They even try to scan every possible IP address for web servers. When they find one, somebody later tries to hack it.
So, I set up a website for them to visit. It says Coming Soon.
Then, it records their IP Address and bans it from the server with iptables. It also adds their IP Address and User Agent string to the database.

Here are the IP addresses I've banned over the last week:
BannedID IP User Agent String Date Hacked Banned Reason
7099120.89.210.112Mozilla/5.0 (Linux; Android 12; V2134) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.3612/6/2025 11:41:13 PMEvil 404 /.well-known/acme-challenge/wp-login.php
70990152.32.213.68Mozilla/5.0 (Macintosh; Intel Mac OS X 9_0_1) AppleWebKit/602.49 (KHTML, like Gecko) Chrome/71.0.1745 Safari/537.3612/6/2025 11:15:18 PMTried to access http ip directly.
70989165.154.120.89curl/7.29.012/6/2025 11:14:51 PMTried to access http ip directly.
7098815.235.236.87Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)12/6/2025 10:27:32 PMTried to access http ip directly.
70987147.185.133.158Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity12/6/2025 09:56:43 PMTried to access http ip directly.
70986114.46.135.44libredtail-http12/6/2025 09:49:21 PMTried to access http ip directly.
7098520.89.192.194Mozilla/5.0 (iPad; CPU OS 16_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.112/6/2025 09:48:15 PMEvil 404 /.well-known/acme-challenge/wp-login.php
7098420.239.59.60Mozilla/5.0 (Linux; Android 11; 21081111RG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.3612/6/2025 09:04:23 PMEvil 404 /.well-known/acme-challenge/wp-login.php
7098218.158.191.233Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:116.0) Gecko/20061209 Firefox/116.012/6/2025 08:34:40 PMTried to access http ip directly.
70981135.235.173.66Mozilla/5.0 (Linux; Android 13; SM-G991U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.3612/6/2025 08:12:11 PMEvil 404 /.well-known/acme-challenge/wp-login.php
70980178.128.235.191Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.3612/6/2025 07:50:26 PMTried to access http ip directly.
7097935.240.65.85python-requests/2.32.512/6/2025 07:17:38 PMTried to access http ip directly.
709784.197.60.90Mozilla/5.0 (Linux; Android 12; 2201116SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.3612/6/2025 07:06:31 PMEvil 404 /.well-known/acme-challenge/wp-login.php
709774.217.237.240Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.3612/6/2025 07:02:38 PMEvil 404 /.well-known/acme-challenge/wp-login.php
7097620.118.216.221Mozilla/5.0 zgrab/0.x12/6/2025 06:59:42 PMUser Agent Mozilla/5.0 zgrab/0.x
70975147.185.132.58Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity12/6/2025 06:51:51 PMTried to access http ip directly.
70974103.61.9.6Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.3612/6/2025 05:45:35 PMTried to access http ip directly.
7097368.218.89.6Mozilla/5.0 (iPhone; CPU iPhone OS 15_7_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.5 Mobile/15E148 Safari/604.112/6/2025 05:36:43 PMEvil 404 /.well-known/acme-challenge/wp-login.php
7097245.88.186.148Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.012/6/2025 05:32:10 PMEvil 404 .env (AWS vulnerability)
70971196.251.100.20612/6/2025 11:57:55 AMTried to log in as root with no password.
70970117.57.168.6712/6/2025 02:37:33 AMTried to log in as root with no password.
70969195.24.237.2912/6/2025 12:39:28 AMTried to log in as root with no password.
70968195.24.237.2812/5/2025 06:47:31 PMTried to log in as root with no password.
70967196.251.100.20912/5/2025 11:03:32 AMTried to log in as root with no password.
70966196.251.100.20512/5/2025 06:48:03 AMTried to log in as root with no password.
7096585.11.167.1112/5/2025 05:21:09 AMTried to log in as root with no password.
7096485.11.167.212/5/2025 04:46:09 AMTried to log in as root with no password.
7096344.201.127.18python-httpx/0.27.012/3/2025 10:16:17 AMUser Agent python-httpx/0.27.0
7096252.65.43.178python-httpx/0.27.012/3/2025 09:54:39 AMUser Agent python-httpx/0.27.0
70961136.112.155.201Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.3612/3/2025 08:49:13 AMEvil 404 /wp-includes/wlwmanifest.xml
70960146.70.165.62Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.3612/3/2025 07:24:26 AMTried to access http ip directly.
7095913.89.125.30Mozilla/5.0 zgrab/0.x12/3/2025 07:07:33 AMTried to access http ip directly.
709584.241.185.18Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.112/3/2025 05:51:17 AMEvil 404 /cgi-bin/
70957103.108.174.23Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.3612/3/2025 04:37:08 AMEvil 404 /wp-login.php
70956159.89.120.5Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);12/3/2025 02:46:42 AMEvil 404 .env (AWS vulnerability)
70955135.237.125.109Mozilla/5.0 zgrab/0.x12/3/2025 01:29:57 AMUser Agent Mozilla/5.0 zgrab/0.x
709543.255.229.16Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com)12/2/2025 11:37:15 PMTried to access http ip directly.
7095324.144.92.251Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.3612/2/2025 10:42:17 PMTried to access http ip directly.
70952103.179.190.78libredtail-http12/2/2025 07:30:33 PMTried to access http ip directly.
7095145.131.155.103Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.012/2/2025 05:51:46 PMTried to access http ip directly.
70950162.240.226.121python-requests/2.25.112/2/2025 05:43:24 PMTried to access http ip directly.
7094935.203.211.25Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity12/2/2025 05:19:40 PMTried to access http ip directly.
7094867.205.190.249Mozilla/5.0 zgrab/0.x12/2/2025 04:45:18 PMTried to access http ip directly.
709478.221.141.254curl/7.64.112/2/2025 03:35:26 PMTried to access http ip directly.
70946164.92.148.118CGrab/v6.4.312/2/2025 01:01:23 PMTried to access http ip directly.
70945213.109.147.35Mozilla/5.0 (compatible; IP-Scanner/1.0)12/2/2025 12:28:46 PMTried to access http ip directly.
709444.218.18.48Mozilla/5.0 (Linux; Android 13; SM-S908E) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.3612/2/2025 11:52:55 AMEvil 404 /cgi-bin/
7094398.81.211.21Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.3612/2/2025 11:21:13 AMTried to access http ip directly.
7094252.141.42.126Mozilla/5.0 (Linux; Android 12; V2134) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.3612/2/2025 10:29:14 AMEvil 404 /cgi-bin/file.php
709414.218.11.183Mozilla/5.0 (Linux; Android 12; 2201116SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.3612/2/2025 09:10:46 AMEvil 404 /cgi-bin/
7094045.86.86.145Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.5012/2/2025 07:01:48 AMEvil 404 .env (AWS vulnerability)
70939109.105.209.33Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.3612/2/2025 06:09:30 AMTried to access http ip directly.
7093895.214.52.170Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.3612/2/2025 05:49:12 AMTried to access http ip directly.
7093713.86.116.162Mozilla/5.0 zgrab/0.x12/2/2025 05:41:26 AMTried to access http ip directly.
70936217.182.213.59Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)12/2/2025 03:53:22 AMTried to access http ip directly.
70935157.230.106.141Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.012/2/2025 01:53:11 AMTried to access http ip directly.
70934134.122.12.9Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);12/2/2025 01:49:28 AMEvil 404 .env (AWS vulnerability)
7093351.159.103.10curl/7.81.012/2/2025 01:12:53 AMTried to access http ip directly.
709321.9.238.116Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.3612/2/2025 12:54:37 AMEvil 404 .env (AWS vulnerability)
709314.241.192.251Mozilla/5.0 (Linux; Android 12; 2201116SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.3612/1/2025 11:58:55 PMEvil 404 /admin/function.php
70930204.76.203.52Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.4612/1/2025 11:28:40 PMTried to access http ip directly.
7092935.203.211.185Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity12/1/2025 11:28:34 PMTried to access http ip directly.
70928111.250.96.203libredtail-http12/1/2025 10:36:07 PMTried to access http ip directly.
70927148.251.136.40Mozilla/5.0 (X11; Linux x86_64)12/1/2025 09:14:29 PMEvil 404 .env (AWS vulnerability)
70926168.90.140.81Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.3612/1/2025 07:38:28 PMTried to access http ip directly.
70925185.16.39.146Wget12/1/2025 07:01:45 PMTried to access http ip directly.
70924101.36.121.22Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.012/1/2025 07:01:24 PMTried to access http ip directly.
7092316.144.240.99python-httpx/0.28.112/1/2025 06:25:40 PMUser Agent python-httpx/0.28.1
70922147.185.132.174Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity12/1/2025 03:57:01 PMTried to access http ip directly.
70921165.22.56.158Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.3612/1/2025 03:22:43 PMTried to access http ip directly.
7092020.41.85.28Mozilla/5.0 (iPhone; CPU iPhone OS 17_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0.1 Mobile/15E148 Safari/604.112/1/2025 02:44:56 PMEvil 404 /admin/function.php
7091920.40.217.42Mozilla/5.0 zgrab/0.x12/1/2025 02:24:28 PMUser Agent Mozilla/5.0 zgrab/0.x
7091820.64.105.133Mozilla/5.0 zgrab/0.x12/1/2025 01:07:17 PMUser Agent Mozilla/5.0 zgrab/0.x
7091720.64.105.127Mozilla/5.0 zgrab/0.x12/1/2025 11:59:29 AMUser Agent Mozilla/5.0 zgrab/0.x
7091654.173.125.196Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.3612/1/2025 11:25:51 AMTried to access http ip directly.
709154.189.136.80Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/118.0 Mobile/15E148 Safari/605.1.1512/1/2025 11:12:22 AMEvil 404 /admin/controller/extension/extension/
7091475.119.139.162Mozilla/5.0 (X11; Linux x86_64)12/1/2025 11:09:23 AMEvil 404 .env (AWS vulnerability)
7091375.119.139.162Mozilla/5.0 (X11; Linux x86_64)12/1/2025 11:09:23 AMEvil 404 .env (AWS vulnerability)
709124.241.185.10Mozilla/5.0 (Linux; Android 12; SM-A525F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.3612/1/2025 10:22:19 AMEvil 404 /admin/controller/extension/extension/
70911149.13.91.105python-requests/2.32.412/1/2025 10:04:49 AMTried to access http ip directly.
709104.217.180.63Mozilla/5.0 (Linux; Android 11; 21081111RG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.3612/1/2025 09:47:02 AMEvil 404 /admin/function.php
709094.230.41.104Mozilla/5.0 (Linux; Android 12; SM-A525F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.3612/1/2025 06:29:42 AMEvil 404 /admin/controller/extension/extension/
7090834.63.98.132Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.3612/1/2025 03:12:29 AMEvil 404 /wp-includes/js/jquery/jquery.js
70907137.184.84.186Mozilla/5.0; Keydrop.io/1.0(onlyscans.com/about);12/1/2025 02:27:29 AMEvil 404 .env (AWS vulnerability)
7090635.202.124.59Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.3612/1/2025 01:35:30 AMEvil 404 /wp-includes/js/jquery/jquery.js
709052.57.122.173Mozilla/5.0 (Debian; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.012/1/2025 01:32:39 AMEvil 404 .env (AWS vulnerability)
7090435.203.210.180Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity12/1/2025 01:09:31 AMTried to access http ip directly.
7090334.14.118.150python-requests/2.32.512/1/2025 12:40:23 AMTried to access http ip directly.
7090220.41.75.148Mozilla/5.0 (iPad; CPU OS 17_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0.1 Mobile/15E148 Safari/604.111/30/2025 11:48:14 PMEvil 404 /admin/function.php
7090120.98.136.63Mozilla/5.0 zgrab/0.x11/30/2025 11:15:24 PMTried to access http ip directly.
70900216.24.219.62Go-http-client/1.111/30/2025 10:43:15 PMEvil 404 /wp-content/txets.php
7089987.120.191.38Mozilla/5.011/30/2025 10:09:27 PMTried to access http ip directly.
70898178.158.17.232Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.3611/30/2025 09:29:29 PMTried to access http ip directly.
708974.241.249.26Mozilla/5.0 (Linux; Android 12; 2201116SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.3611/30/2025 09:02:20 PMEvil 404 /wp-admin/classwithtostring.php
70896196.251.100.189Hello World11/30/2025 08:46:51 PMTried to access http ip directly.
7089595.214.54.147Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.4611/30/2025 07:38:34 PMTried to access http ip directly.
70894103.40.61.98libredtail-http11/30/2025 07:19:59 PMTried to access http ip directly.
708934.217.237.166Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.111/30/2025 06:59:53 PMEvil 404 /wp-admin/classwithtostring.php
70892149.50.97.212Wget/1.12 (freebsd8.1)11/30/2025 05:42:15 PMUser Agent Wget/1.12 (freebsd8.1)
7089145.135.194.99Hello World11/30/2025 03:27:45 PMTried to access http ip directly.
70890172.174.250.151Mozilla/5.0 zgrab/0.x11/30/2025 03:13:48 PMUser Agent Mozilla/5.0 zgrab/0.x
708893.129.23.188python-requests/2.31.011/30/2025 02:27:39 PMUser Agent python-requests/2.31.0
7088852.168.1.86Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/119.0.6045.109 Mobile/15E148 Safari/604.111/30/2025 01:59:12 PMEvil 404 /admin/controller/extension/extension/
7088744.220.48.213python-httpx/0.28.111/30/2025 12:50:39 PMUser Agent python-httpx/0.28.1
70885167.172.190.36Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)11/30/2025 11:36:54 AMTried to access http ip directly.
7088646.101.225.54Go-http-client/1.111/30/2025 11:36:54 AMTried to access http ip directly.
70884138.197.191.158Go-http-client/1.111/30/2025 11:25:01 AMEvil 404 /cgi-bin/authLogin.cgi
70883167.99.243.138Go-http-client/1.111/30/2025 11:25:01 AMEvil 404 /solr/admin/info/system
708823.84.163.153Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.3611/30/2025 11:24:08 AMTried to access http ip directly.
708814.218.17.104Mozilla/5.0 (Linux; Android 11; 21081111RG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.3611/30/2025 10:20:47 AMEvil 404 /admin/controller/extension/extension/
70880137.184.167.209Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.3611/30/2025 07:30:45 AMTried to access http ip directly.
70879111.237.111.115Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.3611/30/2025 07:24:19 AMTried to access http ip directly.
70878172.202.117.178Mozilla/5.0 zgrab/0.x11/30/2025 06:34:49 AMUser Agent Mozilla/5.0 zgrab/0.x
70877199.45.155.93Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)11/30/2025 04:36:19 AMTried to access http ip directly.
7087686.54.42.197Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.3611/30/2025 04:25:41 AMEvil 404 .env (AWS vulnerability)
70875158.220.103.210libredtail-http11/30/2025 04:18:41 AMTried to access http ip directly.
70874106.219.68.2Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.3611/30/2025 12:49:04 AMTried to access http ip directly.