RewriteEngine On 

RewriteCond %{HTTP_USER_AGENT} 2345Explorer [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Bytespider [NC,OR]
RewriteCond %{HTTP_USER_AGENT} curl [NC,OR]
RewriteCond %{HTTP_USER_AGENT} DotBot [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Daum [NC,OR]
RewriteCond %{HTTP_USER_AGENT} edge.crawler [NC,OR]
RewriteCond %{HTTP_USER_AGENT} evc-batch [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Expanse [NC,OR]
RewriteCond %{HTTP_USER_AGENT} GRequests [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Go-http-client [NC,OR]
RewriteCond %{HTTP_USER_AGENT} GoogleImageProxy [NC,OR]
RewriteCond %{HTTP_USER_AGENT} HeyTapBrowser [NC,OR]
RewriteCond %{HTTP_USER_AGENT} hrankbot [NC,OR]
RewriteCond %{HTTP_USER_AGENT} facebookexternalhit [NC,OR]  
RewriteCond %{HTTP_USER_AGENT} ltx71 [NC,OR]
RewriteCond %{HTTP_USER_AGENT} MJ12bot [NC,OR]
RewriteCond %{HTTP_USER_AGENT} NetSystemsResearch [NC,OR]
RewriteCond %{HTTP_USER_AGENT} oBot [NC,OR]
RewriteCond %{HTTP_USER_AGENT} PetalBot [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Photon [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ScamadviserExternalHit [NC,OR]
RewriteCond %{HTTP_USER_AGENT} SemrushBot [NC,OR]
RewriteCond %{HTTP_USER_AGENT} SeznamBot [NC,OR]
RewriteCond %{HTTP_USER_AGENT} SiteLockSpider [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Trident [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ZoomInfoBot [NC]
RewriteRule .* - [F,L]
RewriteCond %{SERVER_NAME} ^(www\.)?amazonaws.com\.$ [OR]
RewriteCond %{SERVER_NAME} ^(www\.)?sitelock.com\.$ [OR]
RewriteCond %{SERVER_NAME} ^(www\.)?thiefdomain3\.example$
RewriteRule ^ - [F,L]
RewriteCond %{HTTP_REFERER} anonymousfox\.co [NC,OR]
RewriteCond %{HTTP_REFERER} anotherbadsite\.com
RewriteRule .* - [F]
#RewriteCond %{HTTP_USER_AGENT} ^.Sogou web spider.*$
#RewriteRule ^(.*)$ https://bork.fastbk.com [R=301]

# To set your custom php.ini, add the following line to this file:
# #SuPHP_ConfigPath /home/yourusername/path/to/php.ini
# php_value mbstring.func_overload 4 # Required for PWSB support. Please do not uncomment this line.

<RequireAll>
    Require all granted
#1.2.202.135 tot Thailand 1.2.202.35.bc.googleusercontent.com
    Require not ip 1.2.202
#china telecom
    Require not ip 1.180 1.181 1.183
#amazonaws singapore - 3.0.100.252 - - [12/Jul/2021:05:31:59 -0700] "GET /autodiscover/autodiscover.xml/sito/wp-includes/wlwmanifest.xml HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
#a lot of other amazon, range 3.0.0.0 - 3.127.255.255
    Require not ip 3.0.0.0/9
#abuseipdb - 3.134.116.214 amazonaws colombus oh - ec2-3-134-116-214.us-east-2.compute.amazonaws.com - - [19/Jul/2021:11:25:43 -0700] "GET /403.html/website/wp-includes/wlwmanifest.xml HTTP/1.1" 403 1443 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
    Require not ip 3.134.116
#3.137.179.11 amazonaws columbus OH 
    Require not ip 3.137.179
#amazonaws columbus OH - 3.139.100.170 - - [13/Jul/2021:02:59:53 -0700] "POST /wp-includes/css/wp-config.php HTTP/1.1" 401 228 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"
    Require not ip 3.139.100
#3.216.90.166 amazonaws ashburn va - ec2-3-216-90-166.compute-1.amazonaws.com - - [21/Jul/2021:17:06:59 -0700] "GET /.git/config HTTP/1.1" 403 1269 "-" "python-requests/2.18.4"
    Require not ip 3.216.90
#tokyo m247 5.181.235.71 - - [22/Jul/2021:04:45:06 -0700] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 247 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
    Require not ip 5.181.235
#5.188.62.214 abuseipdb pinspb data center russia
#    Require not ip 5.188.62
#historically, lots of hacks from 5.188, from .9 through .211
    Require not ip 5.188
#abuseip confirmed - st. petersburg russia
    Require not ip 5.189.239.157
#5-255-174-141-kh.maxnet.ua - - [08/Jul/2021:05:41:58 -0700] "GET /xmlrpc.php HTTP/1.1" 301 242 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36"
    Require not ip 5.255.174.141
#yandex but ... 5.255.231.72 - - [17/Jul/2021:09:06:10 -0700] "GET /.well-known/acme-challenge/?C=N;O=A HTTP/1.1" 401 228 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"
    Require not ip 5.255.231
#yandex but ... 5.255.253.129 - - [17/Jul/2021:12:05:53 -0700] "GET / HTTP/1.1" 401 228 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"
    Require not ip 5.255.253
#bork - abuseipdb - China Aliyun hosting - 8.162.77.34.bc.googleusercontent.com - - [16/Jul/2021:11:54:00 -0700] "GET / HTTP/1.1" 404 - "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers&#39; presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com"
    Require not ip 8.162.77
#13.64.192.210 microsoft data center San Francisco  
    Require not ip 13.64.192
#bork - 13.66.4.173 - - [09/Jul/2021:14:23:39 -0700] "GET / HTTP/1.1" 200 6137 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
     Require not ip 13.66.4.173
#13.67.214.75 microsoft data center des moines ia - 13.67.214.75 - - [19/Jul/2021:14:07:38 -0700] "GET /xmlrpc.php?rsd HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
     Require not ip 13.67.214
#13.67.225.238 - abuseipdb - microsoft data center des moine IA - 13.67.225.238 - - [15/Jul/2021:04:48:08 -0700] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 247 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
     Require not ip 13.67.225
#bork - abuseipdb - microsoft Des Moines IA - 13.89.52.110 - - [13/Jul/2021:01:49:00 -0700] "GET / HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
    Require not ip 13.89.52
#13.212.79.131 - - [08/Jul/2021:16:06:13 -0700] "GET /autodiscover/autodiscover.xml/wp-includes/wlwmanifest.xml HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
    Require not ip 13.212.79.131
#amazonaws mumbai india
    Require not ip 13.232.49
#chinaunicom
    Require not ip 14.205.124    
#bork - abuseipdb - Amazon data center Hong Kong - 16.162.77.34.bc.googleusercontent.com - - [16/Jul/2021:02:28:34 -0700] "GET / HTTP/1.1" 404 - "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers&#39; presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com" [combined with 8.162.77
    Require not ip 16.162.77
#amazon range 18.32.0.0 - 18.255.255.255 18.222.249.110 - - [21/Jul/2021:12:58:45 -0700] "POST /wp-includes/css/wp-config.php HTTP/1.1" 401 228 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"
    Require not ip 18.128.0.0/9 18.32.0.0/11 18.64.0.0/10
#amazon
    Require not ip 18.128.0.0/9 18.32.0.0/11 18.64.0.0/10
#18.185.249.102 amazonaws Frankfurt Germany
    Require not ip 18.185.249
#18.220.247.253 amazonaws columbus oh
    Require not ip 18.220.247
#amazonaws portland
    Require not ip 18.237.219
#bork - abuseipdb confirmed - microsoft germany 
    Require not ip 20.52.236.228
#20.64.250.79 - amazonaws portland - [10/Jul/2021:09:29:45 -0700] "GET //xmlrpc.php?rsd HTTP/1.1" 301 235 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
    Require not ip 20.64.250
#microsoft data center 20.33.0.0 - 20.128.255.255 -- interesting that some in this range report as amazonaws, though 20.33.0.0 - 20.128.255.255
#bork - abuseipdb 20.84.100.48 - - [22/Jul/2021:06:57:20 -0700] "GET / HTTP/1.1" 200 13791 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
    Require not ip 20.48.0.0/12 20.64.0.0/10 20.36.0.0/14 20.34.0.0/15 20.33.0.0/16 20.128.0.0/16 20.40.0.0/13
#20.81.249.155 - microsoft data center Boydton VA - 20.81.249.155 - - [17/Jul/2021:02:32:33 -0700] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 301 259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
    Require not ip 20.81.249
#20.83.169.32 abuseipdb microsoft data center washington va 20.83.169.32 - - [20/Jul/2021:19:53:46 -0700] "GET /autodiscover/autodiscover.xml/wp-includes/wlwmanifest.xml HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
    Require not ip 20.83.169
#leaseweb VA
    Require not ip 23.19.128.0/17 23.19.64.0/18
#bork - 23.95.9.175 - - [09/Jul/2021:10:42:30 -0700] "GET / HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0" colorcrossing.com
    Require not ip 23.95.9
#colocrossing buffalo ny
    Require not ip 23.94 23.95
#23.95.108.186 colocrossing data center atlanta
    Require not ip 23.95.108
#23.108.53.182 leaseweb miami fl
    Require not ip 23.108.53
#bork - abuseipdb - emeraldonion data center seattle 23.129.64.156 - - [19/Jul/2021:12:57:23 -0700] "GET /config HTTP/1.1" 301 231 "https://www.fastbk.com/.git/config" "Go-http-client/1.1" with 185.191.124.152 and 185.220.101.216 and luxembourgtor2
    Require not ip 23.129.64
#abuseipdb - Mariott Inn NYC, NY - rrcs-24-97-201-131.nys.biz.rr.com - - [12/Jul/2021:14:12:39 -0700] "GET /.env HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31" [note - retried with just IP]
#24.97.201.131 - - [12/Jul/2021:14:12:39 -0700] "POST /.env HTTP/1.1" 301 239 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31"
    Require not ip 24.97.201.131
#this is the alleged "Expanse" ip backwards, because abuseipdb reports as 31.130.96.34.bc.googleusercontent.com and it is not getting blocked by my block list
    Require not ip 31.130.96.34
#bork - 31.173.149.92 - abuseipdb - megafon.ru Volga Russia - 31.173.149.82 - - [15/Jul/2021:22:44:14 -0700] "GET /index.php HTTP/1.1" 404 8493 "https://bork.fastbk.com/" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0"
    Require not ip 31.173.149.82
#34.68.97.70 google data center council bluffs IA 70.97.68.34.bc.googleusercontent.com - - [20/Jul/2021:10:38:27 -0700] "GET /wp-login.php HTTP/1.1" 403 - "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 34.68.97
#abuseipdb - google brussels - ip logged as Expanse and was a "503" response
    Require not ip 34.77.162
#34.86.35.20 - abuseipdb - google data center 20.35.86.34.bc.googleusercontent.com washington dc 34.86.35.20 - - [15/Jul/2021:20:31:24 -0700] "GET / HTTP/1.1" 200 37163 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers&#39; presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com"
    Require not ip 34.86.35
#allow/deny block is not working??? Expanse - but is it? Why does it resolve to a China googleusercontent.com site?
    Require not ip 34.96.130
#paloaltonetworks, a security company that owns Expanse.  Will this block the inquriries?
    Require not ip 34.107.151
#34.132.218.239 abuseipdb google data center council bluffs IA
    Require not ip 34.132.218
#amazonaws 
    Require not ip 34.192.0.0/10
#34.209.101.13 amazonaws portland
    Require not ip 34.209
#34.210.248.213 amazonaws portland
    Require not ip 34.210.248
#34.209.174.100 amazonaws portland
#    Require not ip 34.209.174
#amazonaws portland
    Require not ip 34.211.183
#amazonaws portland
    Require not ip 34.217
#amazon data center portland
    Require not ip 34.218.244
#34.219.200.113 amazonaws portland
#34.219.5.80 amazonaws portland
    Require not ip 34.219
#amazonaws portland
    Require not ip 34.220.88
#amazonaws portland
    Require not ip 34.221.169
#amazonaws Dublin
    Require not ip 34.253.69
#amazonaws portland 
    Require not ip 35.160.3
 #amazonaws data center portland
    Require not ip 35.162.154
#35.163.233.222 amazonaws data center portland
    Require not ip 35.163.233
#amazon
    Require not ip 35.176.0.0/13 35.152.0.0/13 35.160.0.0/12
#google cloud
    Require not ip 35.240.0.0/13 35.224.0.0/12 35.208.0.0/12
#35.245.160.47 google data center washington dc 47.160.245.35.bc.googleusercontent.com - - [20/Jul/2021:18:02:31 -0700] "GET /403.html/wp-includes/wlwmanifest.xml HTTP/1.1" 403 1443 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
    Require not ip 35.245.160
#chinaunicom
    Require not ip 36.249.204
#37.0.8.22 - legaconetworks netherlands - 
    Require not ip 37.0.8
#37.18.90.101 1cloud data center Russia
    Require not ip 37.18.90
#37.120.193.232 - - [08/Jul/2021:11:53:07 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" m247 belgrade 37.120.193.0 - 37.120.193.255 217.138.211.0 - 217.138.211.255 m247 brussels working together
#181.214.206.232 - - [08/Jul/2021:11:53:37 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36"
    Require not ip 37.120.193
#37.120.235.169 - - [12/Jul/2021:12:51:27 -0700] "POST /mail.php HTTP/1.0" 403 1269 "https://ridesbyscott.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36" data center dublin ireland
    Require not ip 37.120.235
#abuseipdb microsoft 40.76.110.71 - - [23/Jul/2021:04:08:53 -0700] "GET /xmlrpc.php?rsd HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
    Require not ip 40.112.0.0/13 40.76.0.0/14 40.80.0.0/12 40.120.0.0/14 40.96.0.0/12 40.74.0.0/15 40.125.0.0/17 40.124.0.0/16
#40.76.110.71 - - [03/Jul/2021:10:24:04 -0700] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36" [microsoft data server, washington VA]
    Require not ip 40.76.110
#hrankbot but also 40.86.86.233 - - [20/Jul/2021:20:16:28 -0700] "GET /403.html/wp-includes/wlwmanifest.xml HTTP/1.1" 403 1269 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
    Require not ip 40.86
#abuseipdb - microsoft data center washington va
    Require not ip 40.88.21
#abusipdb - Microsoft Virginia - 40.88.21.235 - - [08/Jul/2021:07:47:23 -0700] "GET / HTTP/1.1" 200 1120 "https://www.daltrey.org/" "Mozilla/5.0 (compatible; DuckDuckGo-Favicons-Bot/1.0; +http://duckduckgo.com)"
#    Require not ip 40.88.21.235
#40.113.195.43 - - [11/Jul/2021:03:36:39 -0700] "GET //wp2/wp-includes/wlwmanifest.xml HTTP/1.1" 301 259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" Microsoft data center des moines IA
    Require not ip 40.113.195
#40.119.52.57 microsoft data center san antonio tx
    Require not ip 40.119.52
#45.12.223.138 - abuseipdb - m247 data center Oslo - 45.12.223.138 - - [17/Jul/2021:08:00:00 -0700] "GET /assets/global/plugins/jquery-file-upload/server/php/index.php?secure=1 HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
    Require not ip 45.12.223
#abuseipdb - novoserve data center amsterdam - vm2140965.62ssd.had.wf - - [15/Jul/2021:20:47:33 -0700] "GET / HTTP/1.0" 200 7472 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36"
    Require not ip 45.14.12
#jjxy.goldmanfun.com - - [08/Jul/2021:12:46:15 -0700] "GET /403.html HTTP/1.1" 403 1269 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" and 45.15.143.130 acloud data center - - [08/Jul/2021:12:46:37 -0700] "POST /wp-includes/css/wp-config.php HTTP/1.1" 403 1269 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"
    Require not ip 45.15.143
#45.61.146.100 - frantech.ca data center cheyenne wy - 45.61.146.100 - - [10/Jul/2021:22:08:36 -0700] "POST / HTTP/1.1" 403 1269 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
    Require not ip 45.61.146
#abuseipdb vultr data center singapore - 45.77.242.162.vultr.com - - [19/Jul/2021:03:27:26 -0700] "GET /.env HTTP/1.1" 301 232 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
    Require not ip 45.77.242
#abuseipdb - Croatia - we.webbateapi.xyz - - [12/Jul/2021:03:39:11 -0700] "GET /owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2ffastbk.com%2fowa%2f HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"
#45.95.171.132 - - [12/Jul/2021:03:39:13 -0700] "GET /owa/auth/logon.aspx?url=https%3a%2f%2fautodiscover.fastbk.com%2fowa%2f&reason=0 HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"
    Require not ip  45.95.171.132
#45.129.18.61 eonscope data center boca raton FL
    Require not ip 45.129.18
#bork - abuseipdb - legaconetworks.nl NYC, NY data center - 45.130.83.115 - - [15/Jul/2021:23:26:19 -0700] "GET / HTTP/1.1" 200 8496 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
    Require not ip 45.130.83
#45.145.18.3 bitway isp romania
    Require not ip 45.145.18
#45.146.164.69 - - [08/Jul/2021:12:15:23 -0700] "GET /bkp/archive.zip HTTP/1.1" 401 228 "-" "Go-http-client/1.1"
    Require not ip 45.146.164
#45.159.22.62 - ixserv data center nuremburg
    Require not ip 45.159.22
#45.200.120.168 cloudinnovation data center Hong Kong
    Require not ip 45.200.120
#abuseipdb - turkrdns data center Istanbul Turkey 46.45.185.186 - - [09/Jul/2021:10:25:36 -0700] "GET / HTTP/1.1" 500 289 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36"
    Require not ip 46.45.185
#45.234.182.192 teran jorge luis isp argentina 
    Require not ip 45.234.182
#this is a hacking probe for urls tool - 45.146.164.50 - - [11/Jul/2021:09:53:58 -0700] "GET / HTTP/1.1" 406 300 "-" "httpx - Open-source project (github.com/projectdiscovery/httpx)"
#46.150.244.209 - - [10/Jul/2021:05:26:29 -0700] "GET /rife/res1.htm HTTP/1.1" 404 236 "http://z-audi.ru/" "Re-re Studio (+http://vip0.ru/)"
    Require not ip 46.150.244.209
#bork - crawler-46-246-64-21.twingly.com - - [04/Jul/2021:16:46:54 -0700] "GET / HTTP/1.1" 200 234 "-" "Twingly Recon" Tried to access /git/archive.zip and /file/archive.zip!
    Require not ip 46.246.64.21
#bork - 47.148.251.70 - - [12/Jul/2021:09:17:50 -0700] "GET / HTTP/2.0" 401 228 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 47.148.251.70
#47.242.188.12 - - [08/Jul/2021:20:05:14 -0700] "HEAD / HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36"
    Require not ip 47.242.188.12
#I've denied a lot of sites from 51.xxx.xxx.xxx Tired of this.
    Require not ip 51
#abusipdb - ovh.com England htm)"ip5.ip-51-68-223.eu - - [11/Jul/2021:13:10:24 -0700] "GET /datamine/sub_cate.php?cate=electric+vehicles+%2F%2A%2A%2FAND%2F%2A%2A%2F6538%27%3D%276538%27%2F%2A%2A%2FUNION%2F%2A%2A%2FALL%2F%2A%2A%2FS
#    Require not ip 51.68.223.5
#abuseipdb - ovh.com France visage.ps - - [11/Jul/2021:14:22:01 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
#    Require not ip 51.91.14.4
#bork - ns3174248.ip-51-210-34.eu - - [09/Jul/2021:22:07:59 -0700] "GET /config HTTP/1.1" 404 6136 "https://daltreynet.daltrey.org/.git/config" "Go-http-client/1.1"
#    Require not ip 51.210.34.150
#52.11.19.227 amazonaws portland abuseipdb
    Require not ip 52.11
#amazon
    Require not ip 52.64.0.0/12 52.0.0.0/10
#amazonaws portland
    Require not ip 52.36.99
#amazonaws portland
    Require not ip 52.38.74
#amazonaws Beijing
    Require not ip 52.80.209
#amazonaws Beijing
#     Require not ip 52.81.1
#amazonaws portland
    Require not ip 52.88.141
#abuseipdb - microsoft data center washington, VA - 52.142.40.107 - - [14/Jul/2021:18:34:49 -0700] "GET //xmlrpc.php?rsd HTTP/1.1" 301 235 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
    Require not ip 52.142.40.107
#52.147.205.216 - - [07/Jul/2021:17:38:30 -0700] "GET //xmlrpc.php?rsd HTTP/1.1" 301 235 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
    Require not ip 52.147.205.216
#52.188.162.137 - - [10/Jul/2021:08:59:11 -0700] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
    Require not ip 52.188.162
#52.246.250.182 - - [10/Jul/2021:11:56:14 -0700] "GET / HTTP/1.1" 200 6137 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
    Require not ip 52.246.250.182
#52.247.226.68 abuseipdb microsoft data center quincy wa
    Require not ip 52.247.226
#52.250.113.144 abuseipdb microsoft data center quincy washington - 52.250.113.144 - - [17/Jul/2021:20:43:12 -0700] "GET //cms/wp-includes/wlwmanifest.xml HTTP/1.1" 421 322 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36"
    Require not ip 52.250.113
#ovh data center Roubaix France aHref bot 54.36.148
#ip-54-36-149-88.a.ahrefs.com
    Require not ip 54.36
#abuseipdb - Canada - ns555766.ip-54-39-17.net - - [11/Jul/2021:05:23:45 -0700] "GET / HTTP/1.1" 200 1120 "-" "python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.31.1.el7.x86_64"
    Require not ip 54.39.17.10
#amazonaws portland
    Require not ip 54.70.234
#amazonaws portland
#    Require not ip 54.148
#amazonaws portland
#    Require not ip 54.149.255
#54.184.5.68 amazonaws portland
#    Require not ip 54.184.5
#amazonaws portland
#    Require not ip 54.185.180
#amazonaws portland
#    Require not ip 54.188.157
#amazonaws portland
#    Require not ip 54.189
#amazonaws portland
#    Require not ip 54.190.20
#amazonaws portland
#    Require not ip 54.191.127
#54.200.110.70 amazonaws portland
#    Require not ip 54.200.110
#amazonaws portland
#    Require not ip 54.202
#amazonaws portland abuseipdb
#    Require not ip 54.203.73
#amazonaws portland
#    Require not ip 54.202.54
#54.212.67.77 amazonaws portland
#    Require not ip 54.212.67
#amazon 54.144.0.0 - 54.221.255.255
    Require not ip 54.144.0.0/12 54.160.0.0/11 54.192.0.0/12 54.208.0.0/13 54.216.0.0/14 54.220.0.0/15
#amazon Beijing
    Require not ip 54.222.215
#amazonaws Beijing 
    Require not ip 54.222.230  54.222.243
#amazonaws Beijing
#    Require not ip 54.222.243
#amazonaws Beijing
    Require not ip 54.223.28
#58.53.128.88 china telecom china
    Require not ip 58.53.128
#61.7.183.125 - - [09/Jul/2021:05:44:02 -0700] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 247 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36"
    Require not ip 61.7.183.125
#61.135.15.155 chinaunicom Beijing
    Require not ip 61.135.15
#Reston, VA - coordinated with "intelligence" and "luminati" 64.137.41.141 - - [04/Jul/2021:17:49:40 -0700] "GET / HTTP/2.0" 200 234 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Mobile/15E148 Safari/604.1"    
    Require not ip 61.137.41.141
#61.244.70.248 abuseipdb hkbn isp hong kong 061244070248.ctinets.com - - [20/Jul/2021:09:09:30 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 61.244.70
#abuseipdb - namecheap.inc. Atlanta - premium104.web-hosting.com - - [12/Jul/2021:09:11:05 -0700] "GET / HTTP/2.0" 401 228 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 63.250.38
#64.21.98.41 abuseipdb net access corp. newark nj
    Require not ip 64.21.98
#64.90.48.197 abuseipdb dreamhost brea ca 64.90.32.0 - 64.90.63.255
    Require not ip 64.90.32.0/19
#64.62.252.163 - - [13/Jul/2021:02:54:26 -0700] "GET /robots.txt HTTP/1.1" 301 239 "-" "The Knowledge AI"
    Require not ip 64.62.252
#64.71.131.244 he.net fremont ca abuseipdb
    Require not ip 64.71.131
#64.135.127.37 host.net boca raton FL
    Require not ip 64.135.127
#64.137.108.75 - - [04/Jul/2021:17:44:40 -0700] "GET /home/ HTTP/2.0" 404 234 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Mobile/15E148 Safari/604.1"
    Require not ip 64.137.108.75
#abuseipdb - domaintools - search engine spider Seattle, WA - ipv4-64-246-165-50.greenhousedata.net - - [12/Jul/2021:16:04:08 -0700] "GET /robots.txt HTTP/1.0" 401 228 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:59.0) Gecko/20100101 Firefox/59.0" 
    Require not ip 64.246.165
#65.1.129.224 amazonaws mumbai
    Require not ip 65.1.129
#abuseipdb - Finland static.214.198.21.65.clients.your-server.de - - [11/Jul/2021:11:23:25 -0700] "GET /wp-includes HTTP/1.1" 301 239 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
    Require not ip 65.21.198.214
#66.160.140.179 - - [20/Jul/2021:00:23:20 -0700] "GET /robots.txt HTTP/1.1" 200 254 "-" "The Knowledge AI"
    Require not ip 66.160.140
#google bot but ... 66.249.73.114 - - [17/Jul/2021:20:53:25 -0700] "GET /.well-known/acme-challenge/ HTTP/1.1" 401 228 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
    Require not ip 66.249.73
#dreamhost brea ca
    Require not ip 67.205.0.0/18
#coloacation los angeles 
    Require not ip 67.227.0.0/17
#abuseipdb - dreamhost webhosting, Brea, CA - ps620922.dreamhostps.com - - [12/Jul/2021:11:37:11 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 67.205
#greenhousedata - ipv4-64-246-165-50.greenhousedata.net - - [12/Jul/2021:16:04:08 -0700] "GET /robots.txt HTTP/1.0" 401 228 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:59.0) Gecko/20100101 Firefox/59.0"
    Require not ip 68.168.245
#68.183.68.148 digitalocean data center frankfurt abuseipdb 68.183.68.148 - - [18/Jul/2021:20:28:27 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 68.183.68
#69.16.145.208 strongvpn - highwinds - 244.158.200.192.as13926.net - - [21/Jul/2021:10:34:39 -0700] "GET /b2evo1/blog7.php?tempskin=_rss2 HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Rv:50.0) Gecko/20100101 Firefox/50.0"
    Require not ip 69.16.128.0/18
#69.30.225.98 - - [08/Jul/2021:06:24:23 -0700] "GET //wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php HTTP/1.1" 503 282 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36"
    Require not ip 69.30.225.98
#amazon - may be the ip that checked my abuse complaint! 72-21-196-66.amazon.com - - [22/Jul/2021:12:15:55 -0700] "GET / HTTP/2.0" 200 1192 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Firefox/78.0"
    Require not ip 72.21.192.0/19
#abuseipdb - verizon rahway NJ - 72.79.45.44 - - [12/Jul/2021:10:19:30 -0700] "GET / HTTP/1.1" 401 228 "-" "panscient.com" (corporate data marketing scum)
    Require not ip 72.79.45.44
#75.119.129.90 abuseipdb contabo data center munich
    Require not ip 75.119.129
#dreamhost brea ca - ps593887.dreamhostps.com - - [22/Jul/2021:13:15:01 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 75.119.192.0/19
#abuseip evil, databasebydesignllc data center Philadelphia PA - 76.72.172.166 - - [07/Jul/2021:12:14:44 -0700] "GET / HTTP/2.0" 206 1713 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0"
    Require not ip 76.72.172
#kapersky russia
    Require not ip 77.74.176 77.74.177 77.74.178 77.74.179
#seznambot
    Require not ip 77.75.76
    Require not ip 77.75.78
#77.81.142.121 m247 data center mexico city working with this one unn-138-199-29-42.datapacket.com
    Require not ip 77.81.142
#abuseipdb - snel data center netherlands - 77.95.229.45 - - [10/Jul/2021:19:06:47 -0700] "GET /.env HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
    Require not ip 77.95.229
#77.111.247.90 - - [08/Jul/2021:08:32:44 -0700] "GET /assets/ckfinder/core/connector/php/connector.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.3945.117 Safari/537.36"
    Require not ip 77.111.247.90
#78.157.36.98 tehran - s203.mehost.co - - [21/Jul/2021:20:44:33 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 78.157.36.0/24
#abuseipdb - 34sp data center Manchester England - 80.82.113.57 - - [10/Jul/2021:14:31:11 -0700] "GET /autodiscover/autodiscover.xml HTTP/1.1" 406 300 "http://autodiscover.ridesbyscott.com/wp-login.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 80.82.113
#strato germany
    Require not ip 81.169.250.0/24
#abuseipdb - Umea Sweden ISP - h-81-170-128-52.a258.priv.bahnhof.se - - [12/Jul/2021:13:10:30 -0700] "GET /EVware/ HTTP/1.1" 401 228 "-" "nu.marginalia.wmsa.edge-crawler"
    Require not ip 81.170.128.52
#abuseipdb kazahkistan - 82.200.247.240 - - [22/Jul/2021:12:20:14 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 82.200.247.0/24
#83.96.255.253 abuseipdb resource.cloud netherlands
    Require not ip 83.96.255
#85.203.51.210 - abuseipdb - data center netherlands
    Require not ip 85.203.51
#semrush, mountain view, ca 
    Require not ip 85.208.98
#netuity poland 85.237.192.0 - 85.237.223.255   
    Require not ip 85.237.192 85.237.193 85.237.194  
    Require not ip 85.237.195 85.237.196 85.237.197 85.237.192 85.237.198 85.237.199 85.237.200 85.237.201 85.237.202 85.237.202 85.237.203 85.237.204 85.237.205 85.237.206
    Require not ip 85.237.207 85.237.208 85.237.209 85.237.210 85.237.211 85.237.212 85.237.213 85.237.214 85.237.215 85.237.216 85.237.217 85.237.218 85.237.219 85.237.219
    Require not ip 85.237.220 85.237.221 85.237.222 85.237.223
#87.118.110.27 abuseipdb keyweb data center tor germany with 104.244.76.13 and 193.218.118.116
    Require not ip 87.118.110
#bork - abuseip - Italy - Aruba shared hosting - host228-105-46-89.serverdedicati.aruba.it - - [16/Jul/2021:14:31:41 -0700] "GET /wp-admin/ HTTP/1.1" 301 232 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 89.46.105
#abusipdb - meric Turkey - heap.macmojave.com - - [11/Jul/2021:09:09:28 -0700] "GET /.env HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
    Require not ip 91.194.55.194
#91-207-219-72.broadband.ipmcenter.ru - - [08/Jul/2021:06:09:21 -0700] "GET /index.php?option=com_users&view=registration HTTP/1.1" 301 276 "-" "Opera/9.80 (Windows NT 6.0); U; en) Presto/2.7.62 Version/11.00"
    Require not ip 91.207.219.72
#91.222.236.97 fitz data center london - 91.222.236.0 - 91.222.236.255 
    Require not ip 91.222.236
#abuseipdb - domengood.ru data center Samara Russia - 1709.domengood.ru - - [16/Jul/2021:18:40:44 -0700] "HEAD / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB5; MRA 5.2 (build 02415); BTRS122153; MRSPUTNIK 2, 0, 1, 31 SW; RadioClicker LITE; RadioClicker http://radioclicker.com; MRSPUTNIK 2, 0, 1, 31 HW; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; OfficeLiveConnector.1.5; OfficeLivePatch.1.3; .NET4.0C)"
    Require not ip 91.227.68
#admin hack idhosting data center poland
    Require not ip 91.231.140
#netsystemsresearch, but also cgi attacks from this block, evil in abuseipdb
    Require not ip 92.118.160
#93.158.90.156 abuseipdb availo data center sweden 
    Require not ip 93.158.90
#abuseipdb - Russia - 93.159.230.28 - - [08/Jul/2021:07:45:22 -0700] "GET / HTTP/1.1" 200 1120 "http://daltrey.org" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"
    Require not ip 93.159.230.28
#95.163.255.172 ztomy data center germany - fetcher16-23.go.mail.ru - - [18/Jul/2021:07:58:56 -0700] "GET / HTTP/1.1" 406 300 "-" "Mozilla/5.0 (compatible; Linux x86_64; Mail.RU_Bot/2.0; +http://go.mail.ru/help/robots)"
    Require not ip 95.163.255
#sh.cz data center - maybe this one: unn-212-102-57-22.cdn77.com - - [17/Jul/2021:06:00:53 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0"
    Require not ip 95.168.203
#95.181.238.12 m247 data center bahamas
    Require not ip 95.181.238
#china telcom
    Require not ip 101.224.155
#102-129-128-97.quadranthosting.com - - [04/Jul/2021:17:44:40 -0700] "GET / HTTP/2.0" 200 234 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Mobile/15E148 Safari/604.1"
    Require not ip 102.129.128.97
#abuseipdb - Asdigi.com - Vietnam - 103.221.220.99 - - [12/Jul/2021:09:21:11 -0700] "GET / HTTP/1.1" 401 228 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 103.221.220
#axgn data center singapore
    Require not ip 103.253.25
#cloudflare SF CA - no-mans-land.m247.com - - [13/Jul/2021:04:02:35 -0700] "GET /linux/ HTTP/1.0" 200 64382 "https://daltrey.org/linux/" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46" dedic1492.hidehost.net - - [21/Jul/2021:08:13:01 -0700] "GET /b2evo1/blog1.php HTTP/1.0" 404 236 "https://daltrey.org/b2evo1/blog1.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4099.2 Safari/537.36" cloudfare range 104.16.0.0 - 104.31.255.255
    Require not ip 104.16 104.17 104.18 104.19 104.20 104.21 104.22 104.23 104.24 104.25 104.26 104.27 104.28 104.29 104.30 104.31 104.32
#microsoft mfst 104.40.0.0 - 104.47.255.255 
    Require not ip 104.40.0.0/13
#quadranet Tarzana - 104.129.56.139 - - [21/Jul/2021:06:57:07 -0700] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
    Require not ip 104.129.0.0/18
#104.161.21.118 - - [09/Jul/2021:05:26:47 -0700] "GET /wordpress/ HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0"
    Require not ip 104.161.21.118
#abuseipdb - microsoft data center washington VA - 104.211.46.133 - - [13/Jul/2021:10:17:53 -0700] "GET /.env HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
    Require not ip 104.211.46
#digitalocean
    Require not ip 104.236.0.0/16
#104.244.76.13 abuseipdb frantech luxemborg data center tor
    Require not ip 104.244.76
#digitalocean - North Bergen, NJ -104.248.234.14 - - [13/Jul/2021:02:25:40 -0700] "GET /robots.txt HTTP/1.1" 401 228 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://www.majestic12.co.uk/bot.php?+)"
    Require not ip 104.248.234
#alibaba - 106.14.41.203 - - [22/Jul/2021:00:13:43 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 106.14.41.0/24
#china telcom
    Require not ip 106.118.200
#abuseipdb bestit Kansas City MO
    Require not ip 107.150.32.0/19
#107.150.46.53 - - [09/Jul/2021:08:14:33 -0700] "GET //wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36"
#    Require not ip 107.150.46.53
# working together! Kansas City 142.54.181.60 - - [08/Jul/2021:05:30:03 -0700] "GET //wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php HTTP/1.1" 503 282 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36"
#Kansas City 107.150.59.242 - - [08/Jul/2021:05:33:42 -0700] "GET //wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php HTTP/1.1" 200 11819 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36"
#    Require not ip 107.150.59.242
#107-175-197-170-host.colocrossing.com - - [16/Jul/2021:08:36:57 -0700] "HEAD /wordpress HTTP/1.1" 301 - "http://ridesbyscott.com/wordpress" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"
    Require not ip 107.175.197
#bork - abuseipdb - frantech.ca datacenter Cheyenne Wyoming - lux2.tor-exit-node.net - - [15/Jul/2021:22:45:08 -0700] "GET / HTTP/1.1" 200 8496 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" [working with onion.xor.sc tor-exit-3.zbau.f3netze.de]
    Require not ip 107.189.8
#abuseipdb - websitewelcome.com - Provo Utah - br692.hostgator.com.br - - [12/Jul/2021:09:14:27 -0700] "GET / HTTP/2.0" 401 228 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 108.179.193
#bork - ip-109-42-114-138.web.vodafone.de - - [11/Jul/2021:05:30:33 -0700] "GET /phpinfo().html HTTP/2.0" 401 228 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
    Require not ip 109.42.114.138
#tor applied privacy austria, abuseipdb
    Require not ip 109.70.100.0/24
#110.8.3.170 skbroadband korea
    Require not ip 110.8.3
#abuseipdb - hostopia Australia - 110.173.132.17 - - [22/Jul/2021:14:33:49 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 110.173.132 110.173.133 110.173.134 110.173.135
#Bytespider
    Require not ip 110.249.201
    Require not ip 110.249.202
#chinaunicom
    Require not ip 111.162.222
    Require not ip 111.192 111.193 111.194 111.195 111.196 111.197 111.198 111.199 111.200 111.201 111.202 111.203 111.204 111.205 111.206 111.207
#Bytespider
    Require not ip 111.225.149
#abuseipdb - 113.31.114.242 - ucloud data center shanghai china
    Require not ip 113.31.114
#chinatelecom
    Require not ip 114.85.80
#petalbot
    Require not ip 114.119
#ucloudnet Beijing
    Require not ip 117.50
#chinamobileltd
    Require not ip 117.183.170
#china telecom
    Require not ip 120.36.224
#chinamobileltd
    Require not ip 120.243.136
#china telecom
    Require not ip 123.174.189
#china telecom
    Require not ip 124.135.192
#abuseipdb - Beijing teletron fixed line isp
    Require not ip 124.206.180
#china telecom
    Require not ip 125.76.175
#zenlayer diamond bar ca
    Require not ip 128.14
#university in Bonn Germany -polecat.cs.uni-bonn.de - - [12/Jul/2021:22:48:26 -0700] "GET / HTTP/1.1" 403 1443 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36"
    Require not ip 131.220.6
#bork - godaddy Ashburn VA - ip-132-148-182-32.ip.secureserver.net - - [12/Jul/2021:09:21:08 -0700] "GET / HTTP/2.0" 401 228 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 132.148.182
#134.119.180.98 abuseipdb - velia data center strasbourg
    Require not ip 134.119.180
#134.209.34.237 adbuseipdb digitalocean clifton nj
    Require not ip 134.209.34
#134.119.234.32 - domainfactory.de data center strasbourg - crawler.seokicks.de - - [17/Jul/2021:06:18:56 -0700] "GET / HTTP/1.1" 200 1713 "http://www.fastbk.com/" "Mozilla/5.0 (compatible; SEOkicks; +https://www.seokicks.de/robot.html)"
    Require not ip 134.119.234
#136.144.41.106 abuseipdb legaconetworks netherlands
    Require not ip 136.144.41
#137.117.70.183 abuiseipdb microsoft data center washington va - 137.117.70.183 - - [18/Jul/2021:16:06:59 -0700] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 247 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
    Require not ip 137.117.70
#internet observatory - researchscan36.comsys.rwth-aachen.de - - [09/Jul/2021:07:00:12 -0700] "GET / HTTP/2.0" 200 1077 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0"
    Require not ip 137.226
#abuseipdb - servermania data center atlanta ga
    Require not ip 138.128.118
#138.197.213.147 digitalocean data center santa clara
    Require not ip 138.197.213
#138.199.59.211 - datacamp poland (with unn-212-102-57-22.cdn77.com) 138.199.29.42 unn-138-199-29-42.datapacket.com datacamp uk
    Require not ip 138.199
#planetlab / internet observatory 138.246.253.0 - 138.246.253.255
    Require not ip 138.246.253 138.246.254 138.246.253
#whitelisted as global internet observatory, lots of reports abuseipdb; also shows up as planetlab24.gino-research.net.in.tum.de 138.246.253.0 - 138.246.253.255
#    Require not ip 138.246.253
#digitalocean India strikes again! 139.59.25.246 - - [10/Jul/2021:14:29:07 -0700] "GET /autodiscover/autodiscover.xml HTTP/1.1" 406 300 "http://autodiscover.daltrey.org/wp-login.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" I think all of 139. is a hotbed of evil.
    Require not ip 139
#china telecom
    Require not ip 140.75.169
#china telecom
    Require not ip 140.250.41
#ovh data center Quebec
    Require not ip 142.4.215
#abuseipdb ovh data center quebec 142.44.198.219 - - [16/Jul/2021:19:21:36 -0700] "GET /wp-content/uploads/upload_index.php?auth=f02pz3831W0DTtLgq26L HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko"
    Require not ip 142.44.198
#abuseipdb katos kansas city mo
    Require not ip 142.54.160.0/19
# working together! Kansas City 142.54.181.60 - - [08/Jul/2021:05:30:03 -0700] "GET //wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php HTTP/1.1" 503 282 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36"
#Kansas City 107.150.59.242 - - [08/Jul/2021:05:33:42 -0700] "GET //wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php HTTP/1.1" 200 11819 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36"
#    Require not ip 142.54.181.60
#142.93.214.65 digitalocean India -
    Require not ip 142.93.214
#142.93.231.26 - - [12/Jul/2021:20:45:27 -0700] "GET / HTTP/1.1" 401 228 "-" "ScamadviserExternalHit/1.0" digitalocean Netherlands
    Require not ip 142.93.231
#143.198.38.245 digitalocean toronto
    Require not ip 143.198
#143.198.41.203 digitalocean toronto
#    Require not ip 143.198.41
#143.198.187.58 digital ocean data center NYC
#    Require not ip 143.198.187
#digitalocean 143.244.145.77 - - [09/Jul/2021:11:25:51 -0700] "GET /robots.txt HTTP/1.1" 200 254 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36"
    Require not ip 143.244.145
#abuseipdb - digitalocean hosting NYC, NY - 143.244.128.164 - - [12/Jul/2021:13:50:29 -0700] "GET / HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
    Require not ip 143.244.128
#144.76.3.131 hetzner data center germany
    Require not ip 144.76.3
#bork - 144.86.173.137 - - [20/Jul/2021:04:02:37 -0700] "GET / HTTP/1.1" 406 300 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers&#39; presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com"
    Require not ip 144.86.173
#bork - 80.ip-144-217-80.net - - [09/Jul/2021:22:07:52 -0700] "GET /config HTTP/1.1" 404 6136 "https://www.daltreynet.daltrey.org/.git/config" "Go-http-client/1.1"
    Require not ip 144.217.80.80
#crawl-144-217-135-230.dataproviderbot.com - - [11/Jul/2021:17:13:15 -0700] "GET / HTTP/1.1" 200 7472 "-" "Mozilla/5.0 (Linux; Android 5.1.1; SM-G925F Build/LMY47X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.94 Mobile Safari/537.36" dataprovidebot data center Montreal Quebec
    Require not ip 144.217.135
#abuseipdb godaddy data center singapore - ip-148-72-207-220.ip.secureserver.net - - [19/Jul/2021:07:57:06 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 148.72.207
#149.3.170.98 abuiseipdb ipconnect seychelles 149.3.170.98 - - [19/Jul/2021:08:55:31 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 149.3.170
#bork - 149.28.159.157 abuseipdb vultr data center singapore - 149.28.159.157.vultr.com - - [18/Jul/2021:23:44:33 -0700] "GET / HTTP/1.1" 200 11710 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
    Require not ip 149.28.159
#149.56.150.206 dataprovider data center Montreal 
    Require not ip 149.56.150
#bork abuseipdb - v150-95-176-38.a0d9.g.tyo1.static.cnode.io - - [12/Jul/2021:08:20:41 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [150.95.176.38 GMO Internet gmo.jp Tokyo]
    Require not ip 150.95.176.38
#151.138.13.148 - - [08/Jul/2021:20:05:15 -0700] "GET / HTTP/1.1" 200 1713 "http://ecology.uga.edu" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox superpagesbot2.0"
    Require not ip 151.138.13.148
#152.89.131.53 - special internet operations srl data center washington dc - 152.89.131.53 - - [17/Jul/2021:06:37:20 -0700] "GET / HTTP/1.1" 200 1713 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
    Require not ip 152.89.131
#156.146.56.108 abuiseipdb datacamp data center Singapore unn-156-146-56-108.cdn77.com - - [20/Jul/2021:00:10:45 -0700] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 247 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36"
    Require not ip 156.146.56
#bork - 157.90.216.210 - abuseipdb - data center hetzner guzenhausen germany - static.210.216.90.157.clients.your-server.de - - [15/Jul/2021:07:20:14 -0700] "GET / HTTP/1.1" 200 8496 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
    Require not ip 157.90.216
#abuseipdb digitalocean santa clara ca 157.230.164.216 - - [19/Jul/2021:09:16:34 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 157.230.164
#159.65.0.156 abuseipdb digitalocean data center singapore
    Require not ip 159.65.0
#159.89.2.220 - - [09/Jul/2021:09:55:18 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 159.89.2.220
#161.82.181.237 abuseipdb fixed isp Thailand symphony isp
    Require not ip 161.82.181
#162.55.185.13 hetzner data center germany 162.55.0.0 - 162.55.255.255
    Require not ip 162.55
#can't resolve, so below ip is unifiedlayer.com 162-241-149-137.unifiedlayer.com - - [11/Jul/2021:14:37:46 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 162.144.8.133
#162.241.218.196 - - [09/Jul/2021:04:02:38 -0700] "GET /wp-admin/ HTTP/2.0" 401 228 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 162.241
#ovh france range 164.132.0.0 - 164.132.255.255
    Require not ip 164.132
#165.22.51.155 digitalocean data center singapore
    Require not ip 165.22.51
#165.22.147.65 abuseipdb digitalocean santa clara
    Require not ip 165.22.147
#digitalocean data server singapore - 165.22.242.53 - - [17/Jul/2021:04:56:18 -0700] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 301 259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
    Require not ip 165.22.242
#165.227.49.243 digitalocean santa clara
#digitalocean - germany - nyc - 165.227.0.0 - 165.227.255.255 165.227.131.69 - - [22/Jul/2021:12:26:35 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 165.227
#    Require not ip 165.227.49
#abuseipdb - digitalocean data center clifton nj
    Require not ip 167.99.48
#167.99.214.242 abuseipdb digitalocean data center amsterdam
    Require not ip 167.99.214
#167.114.156.52 - ovh data center quebec - ns512853.ip-167-114-156.net - - [17/Jul/2021:08:18:56 -0700] "GET / HTTP/1.1" 200 1713 "-" "8LEGS"
    Require not ip 167.114.156
#ultiro data center NYC
    Require not ip 168.91.67
#box5182.bluehost.com - - [10/Jul/2021:05:44:33 -0700] "GET /wp-admin/ HTTP/2.0" 301 232 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36" -- launched from 162.241: 218.16; 224.119; 244.61
#Hack attempts from too many ips at "intelligence network inc." in Ashburn VA
    Require not ip 168.151
#China 171.106.194.39 - - [12/Jul/2021:23:26:12 -0700] "GET /robots.txt HTTP/1.1" 200 320 "-" "Mozilla/5.0(Linux;Android 5.1.1;OPPO A33 Build/LMY47V;wv) AppleWebKit/537.36(KHTML,link Gecko) Version/4.0 Chrome/42.0.2311.138 Mobile Safari/537.36 Mb2345Browser/9.0"
    Require not ip 171.106.194
#china telecom
    Require not ip 171.109.216
#172.70.1.139 - cloudfare
    Require not ip 172.70.1
#linode India - 172.105.50.138 - - [12/Jul/2021:23:07:11 -0700] "POST //wp1//wp-admin/admin-ajax.php HTTP/1.1" 403 1443 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36"
    Require not ip 172.105.50
#abuseipdb - linode.com hosting, Frankfurt Germany li1811-130.members.linode.com - - [12/Jul/2021:09:44:48 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 172.104.235
#bork - 172-245-208-151-host.colocrossing.com - - [18/Jul/2021:18:05:08 -0700] "GET / HTTP/1.1" 200 11710 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 172-245-208-151-host.colocrossing.com - - [18/Jul/2021:18:05:07 -0700] "GET /blog/ HTTP/1.1" 301 232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
    Require not ip 172.245
#bork - 173.245.211.29 - bandcon Singapore - 173-245-211-29.ipvanish.com - - [13/Jul/2021:17:12:31 -0700] "GET / HTTP/1.1" 200 8496 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36"
    Require not ip 173.245.211
#cantabo data center germany 173.249.32.0 - 173.249.63.255
    Require not ip 173.249.44.0/23
#172.255.125.187 abuseipdb leaseweb dallas 172.255.125.187 - - [19/Jul/2021:11:25:24 -0700] "GET /xmlrpc.php?rsd HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0"
    Require not ip 172.255.125
#just2018.justhost.com - - [10/Jul/2021:05:48:50 -0700] "GET /wp-admin/ HTTP/2.0" 301 232 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 173.254.28.216
#verizon ip - tried to log into pinkbunnybinky as admin
    Require not ip 174.204.71.62
#china telecom
    Require not ip 175.7.56
#175.44.42.69 china unicom range 175.44.32.0 - 175.44.63.255
    Require not ip 175.44.0.0/16
#178.17.171.124 trabia data center tor Moldova 
    Require not ip 178.17.171
#178.128.51.162 - - [10/Jul/2021:14:29:28 -0700] "GET /autodiscover/autodiscover.xml HTTP/1.1" 406 300 "http://autodiscover.fastbk.com/wp-login.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 178.128.51.162
#abuseipdb - Indonesia 180.250.28.34 - - [12/Jul/2021:08:51:06 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 180.250.28.34
#181.214 is netherlands and I have had too many hack attempts from the entire range. 181.214.151.135 - - [04/Jul/2021:17:44:40 -0700] "GET /ca/ HTTP/2.0" 404 234 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Mobile/15E148 Safari/604.1"
    Require not ip 181.214
#chinamobileltd
    Require not ip 183.192.233
#chinamobileltd
    Require not ip 183.200.98
#abuseipdb - Belgrade - 37.120.193.232 - - [08/Jul/2021:11:53:07 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36"
#abuseipdb - Netherlands - 181.214.206.232 - - [08/Jul/2021:11:53:37 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36"
#[mostly] Sitelocker
    Require not ip 184.154
#bork abuseipdb resolves to 0.0.0.0 so info probably spoofed godaddy data center singapore ip-184-168-96-27.ip.secureserver.net - - [20/Jul/2021:02:49:40 -0700] "GET /wp-admin/ HTTP/2.0" 301 232 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 184.168.96
#hacker pair - Phoenix, AZ 184.170.241.192 - - [11/Jul/2021:09:25:45 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0"
#Belgium - 217.138.211.242 - - [11/Jul/2021:09:26:20 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36"
    Require not ip 184.170.241.192
#bork 185.13.231.4 - parsonline isp tehran - bluedns.maroonhost.net - - [20/Jul/2021:08:45:14 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 185.13.231
#abuseipdb - Ireland - 105-233-24-185.static.servebyte.com - - [11/Jul/2021:09:57:04 -0700] "GET / HTTP/1.1" 200 1120 "-" "-"
    Require not ip 185.24.233.105
#185.49.20.75 abuseipdb ineonet france 185.49.20.75 - - [22/Jul/2021:10:13:11 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 185.49.20
#bork - abuseipdb datashield data center seychelles - onion.xor.sc - - [15/Jul/2021:22:44:41 -0700] "GET / HTTP/1.1" 200 8496 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0"
    Require not ip 185.56.80
#traffictransitsolutions france
    Require not ip 185.61.218
#abuseipdb - inulogic europe - 185.81.157.122 - - [18/Jul/2021:17:33:20 -0700] "GET /dup-installer/main.installer.php HTTP/1.1" 404 236 "-" "Python-urllib/2.7"
    Require not ip 185.81.157
#russia 
    Require not ip 185.158.112 185.158.113 185.158.114 185.158.115
#abuseipdb - anubisnetworks data center Belgium
    Require not ip 185.180.143
#bork - abuseipdb - koddos data center netherlands - 185.191.124.152 - - [19/Jul/2021:12:57:33 -0700] "GET /config HTTP/1.1" 301 231 "https://mail.fastbk.com/.git/config" "Go-http-client/1.1"
    Require not ip 185.191.124
# bork 185.220.100.254 - abuseipdb - zweibelfreunde data center Hassfurt Germany - tor-exit-3.zbau.f3netze.de - - [15/Jul/2021:22:44:36 -0700] "GET /index.php HTTP/1.1" 404 8493 "https://bork.fastbk.com/" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" [working with three other tor exits]
    Require not ip 185.220.100
#bork 185.220.101.216 - zweibelfreunde data center netherlands 185.220.101.216 - - [19/Jul/2021:12:57:47 -0700] "GET /config HTTP/1.1" 404 - "http://mail.fastbk.com/.git/config" "Go-http-client/1.1"
#bork - 185.220.101.219- abuseipdb - zweibelfreunde data center Hassfurt Germany - tor exit - 185.220.101.219 - - [15/Jul/2021:22:44:31 -0700] "GET / HTTP/1.1" 200 8496 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0"- [working with three other tor exits]
    Require not ip 185.220.101
#sakura data center Hong Kong
    Require not ip 185.245.43
#"illuminati networks (coordinated with "intelligence network, inc"  They are just making fun of us ... 185.246.173.104 - - [04/Jul/2021:17:49:37 -0700] "GET /en/ HTTP/2.0" 404 234 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Mobile/15E148 Safari/604.1"
    Require not ip 185.246
#brazil - 187.51.127.28 - - [22/Jul/2021:00:47:49 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 187.51.127.0/24
#abuseipdb - netorn russia 188.35.130.0 - 188.35.131.255
    Require not ip 188.35.130. 188.35.131
#188.68.47.96 abuseipdb netcup data center germany 188.68.47.96 - - [19/Jul/2021:09:38:10 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 188.68.47
#abuseipdb - 191.96.100.84 - - [08/Jul/2021:11:24:11 -0700] "GET /b2evo1/blog3.php/2009/01/04/prog HTTP/1.0" 404 236 "https://www.daltrey.org/b2evo1/blog3.php/2009/01/04/prog" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Edg/83.0.478.37"
    Require not ip 191.96.100.84
#192.71.44.44 - abuseipdb - resilans.se data center stockholm - 192.71.44.44 - - [17/Jul/2021:06:59:07 -0700] "GET /humans.txt HTTP/1.1" 404 236 "http://ridesbyscott.com/humans.txt" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" [multiple addresses, see abuseipdb also working with 192.36.71.133]
    Require not ip 192.36.71
    Require not ip 192.71.23
    Require not ip 192.71.36
    Require not ip 192.71.38
    Require not ip 192.71.44
#192.99.18.108 ovh data center quebec ns501158.ip-192-99-18.net
    Require not ip 192.99.18
#srt4.websitewelcome.com - - [11/Jul/2021:02:20:32 -0700] "GET /wp-admin/ HTTP/2.0" 401 228 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
#bork - Atlanta GA srt4.websitewelcome.com - - [11/Jul/2021:02:20:32 -0700] "GET /wp-admin/ HTTP/2.0" 401 228 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 192.185.82
#192.186.169.50 servermania data center NYC
    Require not ip 192.186.169
#yournetmarket, chinese site on use host
    Require not ip 192.187.111.219
#abuseipdb tidikom ukraine
    Require not ip 193.26.13
#193.118.55.170 abuseipdb - zenlayer data center netherlands - zl-ams-nl-gp1-wk128.internet-census.org - - [19/Jul/2021:02:46:00 -0700] "GET / HTTP/1.1" 301 236 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36"
    Require not ip 193.118.55
#customer-nat.pub.webpod6-cph3.one.com - - [10/Jul/2021:05:43:48 -0700] "GET /wp-admin/ HTTP/2.0" 301 232 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 193.202.110.22
#193.218.118.116 abuseipdb urdn data center urkaine
    Require not ip 193.218.118
#194.36.25.10 abuseipdb xtom data center germany 194.36.25.10 - - [18/Jul/2021:05:02:08 -0700] "GET /.env HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
    Require not ip 194.36.25
#194.127.179.142 abuseipdb clouvider data center netherlands 194.127.179.142 - - [18/Jul/2021:06:33:21 -0700] "GET /style.php?sig=beima&domain=anonymousfox.net&shell_file=qcivlupzkrs&file_name=/imam.zoneh.php HTTP/1.1" 404 236 "-" "Python-urllib/2.7"
    Require not ip 194.127.179
#abuseipdb - ionos data center Germany. There are a lot of attacks from entire 195, I have a lot of blocks in the old deny list and maybe all of 195 should be blocked.195.20.240.196 - - [18/Jul/2021:16:29:22 -0700] "GET /wp-content/plugins/t_file_wp/t_file_wp.php?test=hello HTTP/1.1" 301 236 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"
    Require not ip 195.20.224.0/19
#196.44.176.55 yoafrica zimbabwe - dagga.yoafrica.com - - [21/Jul/2021:19:04:42 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 196.44.176
#estnoc cambodia range 195.80.149.0 - 195.80.149.255
    Require not ip 195.80
#195.133.40.201 des.capital data center madrid - 
    Require not ip 195.133
#195-246-120-102-static.serverhotell.net - - [20/Jul/2021:17:12:45 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 403 1443 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20121202 Firefox/17.0 Iceweasel/17.0.1"
    Require not ip 195.246.120
#195.123.226.182 abuseipdb itldc data center bulgaria
    Require not ip 195.123.226
#196.16.162.12 netstyleservers Kansas City MO
    Require not ip 196.16.162
#namecheap.com - must be parked domain hosting or somethingn
    Require not ip 198.54.117
#tek7.tektonik.com - - [10/Jul/2021:05:52:05 -0700] "GET /wp-admin/ HTTP/2.0" 301 232 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
    Require not ip 198.100.150.163
#198.204.234.252 - - [09/Jul/2021:08:10:15 -0700] "GET //wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36"
    Require not ip 198.204.234.252
#bork - 199.26.192.2 - abuseipdb - eqservers data server Wilmington Delaware -hosted-by.eqservers.com - - [15/Jul/2021:21:58:34 -0700] "GET / HTTP/1.1" 200 8496 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
    Require not ip 199.26.192
#abuseipdb - quintex alliance consulting data center San Angelo TX tor58.quintex.com - - [10/Jul/2021:23:46:43 -0700] "GET /assets/ckfinder/core/connector/php/connector.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.3945.117 Safari/537.36"
    Require not ip 199.249.230
#confluence virgin islands 
    Require not ip 204.11.56 204.11.57
#bork - 204.145.69.221 - abuseipdb - bizbudding Hackettstown NJ - hostingsource.dmarc2.ewr1.atlanticmetro.net - - [13/Jul/2021:07:49:23 -0700] "GET /install.php?step=2 HTTP/1.1" 401 228 "-" "Python-urllib/2.7"
    Require not ip 204.145.69
#abuseipdb digitalocean NYC - 206.81.5.38 - - [22/Jul/2021:11:18:58 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
    Require not ip 206.81.0.0/19
#206.253.224.14 iss.net atlanta 206.253.224.14 - - [19/Jul/2021:07:25:01 -0700] "GET /robots.txt HTTP/1.1" 200 254 "-" "Mozilla/5.0 (compatible; oBot/2.3.1; http://www.xforce-security.com/crawler/)"
    Require not ip 206.253.224
#per abuseipdb mail.semanticsystems.com - - [07/Jul/2021:17:37:17 -0700] "GET /rsc/AD005_screenshot.png HTTP/2.0" 200 128740 "https://www.google.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.106 Safari/537.36"
    Require not ip 207.148.248.143
#207.180.251.227 abuseipdb contabo data center munich
    Require not ip 207.180.251
#208.110.85.68 admin hack tsinghua university kansas city mo - wholesale internet inc.
    Require not ip 208.110.85 208.110.64.0/19
#broadnnet korea
    Require not ip 211.176 211.177
#211.249.246.130 dreamline isp Korea
    Require not ip 211.249
#212.102.63.151 datacamp data center london
    Require not ip 212.102.63
#212.192.241.68 serverion netherlands range 212.192.240.0 - 212.192.243.255
    Require not ip 212.192.240 212.192.241 212.192.242 212.192.243
#bork - abuseipdb - dauction.ru moscow russia - 213.166.92.141 - - [16/Jul/2021:09:24:06 -0700] "HEAD /js/jquery/jquery-migrate.js HTTP/1.1" 404 - "https://ridesbyscott.com/wp-includes/js/jquery/jquery-migrate.js" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/51.0"
    Require not ip 213.166.92
#213-178-40-145.clients.smr.100megabit.ru abuseipdb fixed line isp russia
    Require not ip 213.178.40
#parsonline tehran
    Require not ip 213.217.34
#abuseipdb - websitewelcome.com - Provo Utah - br484.hostgator.com.br - - [12/Jul/2021:09:17:49 -0700] "GET / HTTP/2.0" 401 228 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36" [linked with 108.179.193.10, same host???]
    Require not ip 216.172.172
#colocrossing chicago
    Require not ip 216.246.0.0/17
#dotbot
    Require not ip 216.244.66
#hacker pair - Phoenix, AZ 184.170.241.192 - - [11/Jul/2021:09:25:45 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0"
#Belgium 217.138.211.242 - - [11/Jul/2021:09:26:20 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" m247 brussels 217.138.211.0 - 217.138.211.255
    Require not ip 217.138.211
#china telecom
    Require not ip 218.31.194
#bytespider
    Require not ip 220.243.135
#bytespider
    Require not ip 220.243.136
#abusipdb China 221.226.50.162 - - [08/Jul/2021:04:50:06 -0700] "GET / HTTP/1.1" 200 1713 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36"
    Require not ip 221.226.50
#china telecom
    Require not ip 222.90.58
#china telecom
    Require not ip 222.218.130
#chinamobileltd
    Require not ip 223.67.129
    Require not host 34.77.162 34.86.35 34.96.130 92.118.160
    Require not host 163data amazonaws azdigi biriga cdn77 clientshostname colocrossing contabo ctinets darknet dataproviderbot datapacket digitalocean dnspure  domaintools
    Require not host example fetcher googleusercontent greenhousedata hn.kd.ny.adsl hviv
    Require not host internet-census lankaemarketing41 mbelichenko netsystems quadranet quintex  selectureship seokicks seznam sogou spheral vultr websitewelcome your-server
    Require not host sitelock mail.semanticsystems.com seostar.com netcraft.com fbsv.net semrush okitup.net aachen twingly boardwalkhat ohris network-crm planetlab web-hosting 

</RequireAll>

<Files 403.shtml>
order allow,deny
allow from all
</Files>

ErrorDocument 403 /403.html


#!!!WARNING!!! Deny/Allow is deprecated in apache > 2.4 and slated to be removed in future

deny from .amazonaws.com
deny from .googleusercontent.com
deny from .internet-census.org
deny from .popularglee.com
deny from .seznam.cz
deny from .sogou.com
deny from .y3k0.com
deny from .ny.adsl

#wp-login Malaysia
deny from 1.9.153.148
#1.14.191.23 - - [05/Jul/2021:13:24:07 -0700] "GET / HTTP/1.1" 200 3272 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0"
deny from 1.14.191.23
deny from 2.90.228.179
#wp hacker
deny from 3.0.115.255
deny from 5.9.62.130
deny from 5.9.88.103
deny from 5.9.89.170
deny from 5.9.104.83
deny from 5.9.111.70
#abuseipdb - 59% - Amsterdam
deny from 5.39.217.208
deny from 5.104.241.0/24
deny from 5.104.241.
#5.188.210.4 - - [05/Jul/2021:07:04:55 -0700] "GET /wp-includes/upload_index.php?auth=f02pz3831W0DTtLgq26L HTTP/1.0" 401 228 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36"
deny from 5.108.210.4
# abuseipdb - luxumberg (paired with 193.56.252.252 ireland) 5.253.204.102 - - [05/Jul/2021:16:03:26 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0"
deny from 5.153.204.102
#apparently bing.bot from microsoft but abuseipdb say 100% evil
deny from 13.66.139.0
#13.66.139.0 - - [29/Jun/2021:16:22:13 -0700] "GET /dDg5MzRFNHFsWTQzOTUzeXFsc2F2 HTTP/1.1" 301 255 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
deny from 13.84.217.36
#13.91.183.11 - - [18/Jun/2021:22:57:00 -0700] "GET / HTTP/1.1" 200 1713 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
deny from 13.91.183.11
#ec2-13-213-36-107.ap-southeast-1.compute.amazonaws.com - - [04/Jul/2021:07:17:04 -0700] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
deny from 13.213.36.107
# wp-login from Maylasia
deny from 14.192.211.42
#5 simultaneous requests AWS
deny from 18.188.22.250
deny from 18.197.209.15
#ec2-18-236-217-137.us-west-2.compute.amazonaws.com - - [04/Jul/2021:00:29:23 -0700] "GET / HTTP/1.1" 301 228 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
deny from 18.236.217.137
#seeking .env
deny from 20.55.0.127
#wp hack attempt - abuseipdb - 100% bad, Microsoft, Chicago
deny from 20.80.51.187
#20.84.98.195 - - [02/Jul/2021:07:53:09 -0700] "GET /_profiler/phpinfo HTTP/1.1" 404 236 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
deny from 20.84.98.195
#20.85.120.250 - - [20/Jun/2021:09:09:06 -0700] "GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
deny from 20.85.120.250
#attempt to retrieve .env
deny from 20.98.232.52
deny from 23.91.71.239
#tried to post to mail.php - colorcrossing atlanta, evil per abuseipdb
deny from 23.94.177.135
#wp hacker - colorcrossing
deny from 23.95.20.6
deny from 23.100.232.233
deny from 23.225.169.106
#23.235.210.218 my ip
#zoom-info bot 
deny from 29.51.237.35
#wp-login attack
deny from 31.209.13.28
#100% evil abuseipdb google Iowa
deny from 34.71.20.225
#34.71.71.95 - - [04/Jul/2021:06:49:46 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 34.71.71.95
#34.71.95.46 - - [18/Jun/2021:17:48:47 -0700] "GET /wp/ HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Linux; Android 5.1.1; SM-J111F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.90 Mobile Safari/537.36"
deny from 34.71.95.46
#expanse
deny from 34.77.162
#expanse
deny from 34.77.162.10
#expanse
deny from 34.77.162.13
#expanse
deny from 34.77.162.14
#expanse
deny from 34.77.162.15
#expanse internet scanner
deny from 34.77.162.26
#expanse
deny from 34.77.162.28
#expanse
deny from 34.77.162.31 
#expanse
deny from 34.86.35
#expanse
deny from 34.86.35.5
#expanse
deny from 34.86.35.6
#expanse
deny from 34.86.35.20
#expanse
deny from 34.86.35.22
#expanse
deny from 34.86.35.24
#expanse
deny from 34.86.35.27
#34.93.38.4 - - [05/Jul/2021:08:39:55 -0700] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
deny from 34.93.38.4
#expanse - evil per abuseipdb, Hong Kong. Question, why are inquries seemingly getting through this block? Now I'm putting the individual IPs back.
deny from 34.96.130
#expanse
deny from 34.96.130.5
#expanse
deny from 34.96.130.10
deny from 34.96.130.11
deny from 34.96.130.12
#expanse
deny from 34.96.130.22
#expanse
deny from 34.96.130.31
deny from 34.96.130.33
deny from 34.203.211.133
deny from 34.207.119.69
#web attack aws Denver per abuseipdb
deny from 34.211.149.251
#web attack per abuseipdb, aws Portland
deny from 34.213.161.236
#web attack per abuseipdb, aws Portland
deny from 34.215.230.37
#web attack per abuseipdb
deny from 34.220.13.221
#web attack per abuseipdb
deny from 34.220.26.12
#ec2-34-220-116-215.us-west-2.compute.amazonaws.com - - [05/Jul/2021:07:30:18 -0700] "GET /favicon.ico HTTP/1.1" 404 236 "http://ridesbyscott.com/favicon.ico" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
deny from 34.220.116.215
#ec2-34-221-206-228.us-west-2.compute.amazonaws.com - - [05/Jul/2021:07:29:43 -0700] "GET / HTTP/1.1" 200 7570 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
deny from 34.221.206.228
#snooping for autodiscover
deny from 34.245.104.10
#web attack per abuseipdb aws Portland
deny from 35.164.153.80
#web attack per ab useipdb awas Portland
deny from 35.166.214.66
#wp hacker
deny from 35.198.105.76
#wp-login hacker
deny from 35.221.181.187
#zoom info bot 
deny from 35.237.51.29
#36.110.147.100 - - [04/Jul/2021:06:44:16 -0700] "GET / HTTP/2.0" 200 1713 "http://www.sogou.com/web?query=site%3Afastbk.com" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"
deny from 36.110.147.100
deny from 37.115.112.228
deny from 37.143.123.92
#russia - .git HEAD attack
deny from 37.194.176.53
deny from 37.229.253.71
deny from 38.100.21.66
deny from 39.35.218.61
deny from 39.155.215.0/24
#wp hacker
deny from 40.71.123.71
#looking for .env from Microsoft, confirm abuseipdb
deny from 40.76.233.157
#very weird b2evo1 login request, though abuseipdb claims it is a bing bot and whitelisted
deny from 40.77.167
#40.77.167.105 - - [29/Jun/2021:16:18:35 -0700] "GET /XzU3NTd4VzYyMTVSZWk= HTTP/1.1" 301 247 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
#wp hacker
deny from 40.113.247.153
#host-41.45.98.99.tedata.net - - [03/Jul/2021:08:24:41 -0700] "GET /wp-login.php HTTP/1.1" 301 239 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/8745E8"
deny from 41.45.98.99
#attempted wp-login Nigeria
deny from 41.58.214.57
#static.41.129.55.162.clients.your-server.de - - [04/Jul/2021:06:53:13 -0700] "GET /wp-content/plugins/t_file_wp/t_file_wp.php?test=hello HTTP/1.1" 404 236 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"
deny from 41.129.55.162
#wp-login probe
deny from 42.189.69.182
deny from 42.236.10.
deny from 42.236.104.26
#jjxy.goldmanfun.com - - [06/Jul/2021:06:28:46 -0700] "GET /config.bak.php HTTP/1.1" 404 3271 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"
#per abuseipdb - ireland
deny from 45.8.194.165
#placeholder.sitelock.com - could not resolve, this is the sitelock ip
deny from 45.60
#placeholder.sitelock.com - could not resolve, this is the sitelock ip
deny from 45.60.102.54
deny from 45.79.71.25
#rss trolling from Romania
deny from 45.86.241.2
#evil per abuseipdb, moscow, russia 45.90.44.132 - - [07/Jul/2021:17:06:17 -0700] "HEAD /js/jquery/jquery-migrate.js HTTP/1.1" 404 - "https://fastbk.com/wp-includes/js/jquery/jquery-migrate.js" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/51.0"
deny from 45.90.44.132
#tried to post to mail.php after I removed it
deny from 45.91.5.0/24
#45.91.22.220 - - [04/Jul/2021:06:58:04 -0700] "POST /xmlrpc.php HTTP/1.1" 403 228 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
deny from 45.91.22.220
deny from 45.133.154.0/24
deny from 45.133.172.124
deny from 45.135.224.0/24
deny from 45.139.70.0/24
deny from 45.145.18.0/24
deny from 46.4.97.116
deny from 46.4.116.197
deny from 46.4.120.0
deny from 46.4.123.172
#Malta - wp-login
deny from 46.11.24.166
deny from 46.118.124.89
deny from 46.118.125.174
deny from 46.118.155.165
deny from 46.119.116.109
deny from 46.161.9.22
deny from 46.161.9.61
# bork crawler-46-246-64-21.twingly.com - - [04/Jul/2021:16:46:54 -0700] "GET / HTTP/1.1" 200 234 "-" "Twingly Recon"
deny from 46.246.64.21
#wp-login probe
deny from 47.29.164.19
deny from 47.147.209.230
#sogouspider-49-7-20-65.crawl.sogou.com - - [04/Jul/2021:13:12:46 -0700] "GET / HTTP/1.1" 301 231 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
deny from 49.7.20
#sogu bot 
deny from 49.7.20.78
deny from 49.7.21
#sogu bot 
#deny from 49.7.21.76
#sogu bot 
#deny from 49.7.21.127
#sogu bot 
#deny from 49.7.21.131
deny from 49.146.33.72
deny from 50.63.202.32
#ec2-50-112-68-230.us-west-2.compute.amazonaws.com - - [04/Jul/2021:00:26:11 -0700] "GET / HTTP/1.1" 301 228 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
deny from 50.112.68.230
#deny from 51.15.38.147
#deny from 51.15.43.223
#evil per abuseipdb - Paris
#deny from 51.15.205.3
#51.83.42.161 - - [24/Jun/2021:10:23:23 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
#deny from 51.83.42.161
#ip27.ip-51-89-253.eu - - [02/Jul/2021:06:54:45 -0700] "GET /datamine/items.php?cate=10.1100' HTTP/1.1" 200 588 "-" "-" evil per abuseipdb
#deny from 51.89.253.27
#evil per abuseipdb - Paris
#deny from 51.158.98.24
#evil per abuseipdb
#deny from 51.158.103.247
#evil per abuseipdb
#deny from 51.158.108.61
#deny from 51.254.214.184
#deny from 51.255.46.254
#deny from 51.255.65.0/24
#deny from 51.255.65.49
#deny from 51.255.173.50
deny from 52.3.250.100
#ec2-52-12-119-150.us-west-2.compute.amazonaws.com - - [05/Jul/2021:08:25:10 -0700] "GET / HTTP/1.1" 200 7570 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
deny from 52.12.119.150
#ec2-52-12-168-206.us-west-2.compute.amazonaws.com - - [04/Jul/2021:07:26:33 -0700] "GET /favicon.ico HTTP/1.1" 301 244 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
deny from 52.12.168.206
deny from 52.23.177.211
deny from 52.33.237.25
#ahrefsbot
deny from 52.34.88.13
#web attack aws Denver per abuseipdb
deny from 52.36.31.206
deny from 52.87.172.202
#ec2-52-88-71-231.us-west-2.compute.amazonaws.com - - [04/Jul/2021:07:41:35 -0700] "GET /favicon.ico HTTP/1.1" 404 236 "http://ridesbyscott.com/favicon.ico" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
deny from 52.88.71.231
deny from 52.91.152.101
#attempt to access .env
deny from 52.188.9.246
#52.247.216.96 - - [04/Jul/2021:17:10:21 -0700] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
deny from 52.247.216.96
#ahrefsbot
deny from 54.36.148
#ahrefsbot
deny from 54.36.148.48
#ahrefsbot
deny from 54.36.148.55
#ahrefsbot
deny from 54.36.148.56
#ahrefsbot
deny from 54.36.148.60
#ahrefsbot
deny from 54.36.148.135
#ahrefsbot
deny from 54.36.148.168
#ahrefsbot
deny from 54.36.148.208
#ahrefsbot
deny from 54.36.148.220
#ahrefsbot
deny from 54.36.148.250
#ahrefsbot
deny from 54.36.149
#ahrefsbot
deny from 54.36.149.13
#ahrefsbot
deny from 54.36.149.105
# US - amazon.com - ec2-54-67-59-131.us-west-1.compute.amazonaws.com - abuseipdb 92% evil
#wp hacker
deny from 54.37.17.21
#ns559934.ip-54-39-105.net - - [04/Jul/2021:20:42:02 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 54.39.105.88
deny from 54.67.59.131
# attack Portland aws per abuseipdb
#deny from 54.149.111.40
# US - Ashburn VA -- c2-54-161-237-174.compute-1.amazonaws.com Mauibot all day DDoS attack (accessed legit files, 3 per sec. all day long)
#deny from 54.161.237.174
# attack, aws portland and per abuseipdb
#deny from 54.189.230.128
#attack Portland aws per abuseipdb
#deny from 54.190.41.204
#ec2-54-190-227-202.us-west-2.compute.amazonaws.com - - [04/Jul/2021:07:26:17 -0700] "GET / HTTP/1.1" 301 233 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
#deny from 54.190.227.202
#ec2-54-202-17-197.us-west-2.compute.amazonaws.com - - [04/Jul/2021:07:41:07 -0700] "GET / HTTP/1.1" 200 7570 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
#deny from 54.202.17.197
#ec2-54-213-1-227.us-west-2.compute.amazonaws.com - - [04/Jul/2021:00:26:38 -0700] "GET /favicon.ico HTTP/1.1" 301 239 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
deny from 54.213.1.227
#ec2-54-213-199-174.us-west-2.compute.amazonaws.com - - [04/Jul/2021:00:30:54 -0700] "GET /favicon.ico HTTP/1.1" 301 239 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
deny from 54.213.199.174
deny from 54.236.29.52
#linkdex.com seos
deny from 54.243.7.187
#web attack aws Portland per abuseipdb
deny from 54.244.166.191
#amazon data services Japan - Singapore
deny from 54.254.212.88
#58.8.152.207 - - [05/Jul/2021:09:24:24 -0700] "GET /?utm=semalt.com HTTP/1.1" 401 228 "https://semalt.com-----google.com/?q=semalt" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"
deny from 58.8.152.207
#evil, per abuseipdb - China
deny from 58.53.128.148
#sogu crawler
deny from 58.250.125.113
deny from 60.8.123.0/24
deny from 60.168.49.91
deny from 60.242.171.91
deny from 60.168.254.163
#61.84.145.230 - - [06/Jul/2021:17:20:58 -0700] "GET / HTTP/1.1" 200 4215 "https://bork.fastbk.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36"
deny from 61.84.145.230
#hurley.probe.onyphe.net 100% evil abuseipdb poneytelecom - france
deny from 62.4.14.198
deny from 62.138.8.181
#wp hacker germany per abuseipdb
deny from 62.171.152.145
#wp hacker
deny from 62.210.78.106
deny from 62.210.148.246
#excess b2evo1 access and abuseipdb reports / babbar.tech crawler SEO per website
deny from 62.210.189.2
deny from 62.210.215.118
deny from 62.210.215.119
deny from 62.210.247.125
#knowledge AI abuseipdb Fremont, CA
deny from 64.62.252.163
#wp-login
deny from 64.225.16.11
#64.225.79.191 - - [25/Jun/2021:06:12:49 -0700] "GET /xmlrpc.php?rsd HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
deny from 64.225.79.191
#netcraft
deny from 64.225.57.104
deny from 64.246.161.30
#abuseipdb - iraq - .20.155.242 - - [05/Jul/2021:23:11:30 -0700] "GET / HTTP/1.1" 200 1120 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36"
deny from 65.20.155.242
#in abuseipdb whitelist palo alto networks, but lots of reports and why are they knocking on sf?
deny from 65.154.226.165
#66.23.252.226 - - [23/Jun/2021:12:13:00 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 66.23.252.226
#wp-login Houston, US
deny from 66.135.187.115
#crawl-66-249-65-15.googlebot.com - - [04/Jul/2021:06:23:24 -0700] "GET /b2evo1/htsrv/login.php?action=lostpassword&redirect_to=%2Fb2evo1%2Fblog3.php%2F2019%2F09%2F%3Fdisp%3Dposts%26m%3D201909%26posts%3D100&return_to=%2Fb2evo1%2Fblog3.php%2F2019%2F09%2F%3Fdisp%3Dposts%26m%3D201909%26posts%3D100 HTTP/1.1" 200 4998 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.90 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
#attack include 15 17 and 19
deny from 66.249.65.15
deny from 66.249.65.17
deny from 66.249.65.19
#68.183.231.120 - - [25/Jun/2021:03:10:45 -0700] "GET /xmlrpc.php?rsd HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
deny from 68.183.231.120
deny from 69.30.234.2
#Reston, VA verisign.com  19% evil abuseipdb
deny from 69.58.178.56
deny from 69.58.178.59
deny from 70.119.100.27
#wp-login probe
deny from 71.48.238.186

#probe /temp/phpinfo().html ???
deny from 71.172.156.10
deny from 71.215.102.132
deny from 73.157.93.235
#wp hacker
deny from 75.119.198.100
deny from 76.28.253.21
#100% abuseipdb - 76.72.172.167 - - [05/Jul/2021:06:35:24 -0700] "GET / HTTP/2.0" 206 1713 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0"
deny from 76.72.172.167
#seznam
deny from 77.75
#seznam bot Czech Republic
#77-75-76-166
#deny from 77.75.76.171
#deny from 77.75.76.172
#seznam bot 
#deny from 77.75.77
#deny from 77.75.77.17
#deny from 77.75.77.72
#seznam bot 
#deny from 77.75.78
#deny from 77.75.78.161
#deny from 77.75.78.166
#deny from 77.75.78.167
#deny from 77.75.78.169
#deny from 77.75.78.170
#seznam
#deny from 77.75.79.72
#seznam
#deny from 77.75.79.119
#wp-config probe
deny from 77.247.181.163
deny from 78.11.209.225
deny from 78.46.174.19
deny from 78.47.224.245
# Greece - hosted-by.enahost.com - synapsecom.gr wordpress attack
deny from 78.108.46.132
#delta.veridyen.com - - [03/Jul/2021:07:20:27 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 78.142.209.104
#wp-login probe
deny from 79.106.209.245
deny from 81.198.190.41
#web01.extendeez.com - - [04/Jul/2021:21:25:43 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 82.97.10.156
deny from 82.115.13.165
#wp hacker
deny from 82.156.101.17
deny from 82.193.102.149
deny from 83.136.45.172
#wp-login probe
deny from 83.139.133.45
deny from 85.195.118.42
# semrush bot
deny from 85.208.98.2*
#deny from 85.208.98.22
#deny from 85.208.98.27
# spare.namesco.net - attempted to access admin wordpress file
deny from 85.233.160.31
#web attack Romania per abuseipdb
deny from 86.104.194.104
#ukraine - abuseipdb - 100% evil
deny from 86.110.117.10
#wp-login probe
deny from 86.194.106.202
deny from 86.238.153.183
#mail.sinask.ir - - [05/Jul/2021:16:12:09 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 87.107.124.28
deny from 87.250.20.164
#wp-login probe
deny from 89.42.216.96
#hacker abuseipdb - Romania
deny from 89.136.31.149
deny from 89.234.157.254 
#apache3.cp247.net - - [03/Jul/2021:01:04:43 -0700] "GET /wordpress/wp-admin/ HTTP/1.1" 301 247 "http://daltrey.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36"
deny from 89.238.188.8
deny from 91.121.86.136
deny from 91.121.97.49
#ServerAstra Hungary
deny from 91.219.236.171
deny from 91.227.33.3
#netsystemsresearch - evil per abuseipdb
deny from 92.118.160
#netsystems research
deny from 92.118.160.1
#netsystemsresearch
deny from 92.118.160.9
#autodiscover attack - evil per abuseipdb
deny from 92.118.160.13
#netsystemsresearch
deny from 92.118.160.45
#netsystemsresearch
deny from 92.118.160.57
#"GET /:8880/get_password.php HTTP/1.0" 404 236 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
deny from 94.23.33.67
deny from 93.115.95.206
#93.158.91.247 - - [06/Jul/2021:12:12:32 -0700] "GET / HTTP/1.1" 200 1713 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11.1; rv:84.0) Gecko/20100101 Firefox/84.0" abuseipdb - sweden
deny from 93.158.91.247
#kd02.stebio.at abuseipdb 100% evil vienna
deny from 93.189.30.194
deny from 94.189.139.139
#wp-login probe
deny from 95.32.64.243
deny from 95.88.251.12
#fetcher16-31.go.mail.ru - - [02/Jul/2021:11:01:57 -0700] "GET /site_map.xml HTTP/1.1" 406 300 "-" "Mozilla/5.0 (compatible; Linux x86_64; Mail.RU_Bot/2.0; +http://go.mail.ru/help/robots)"
deny from 95.163.255.180
#fetcher16-40.go.mail.ru - - [02/Jul/2021:11:01:55 -0700] "GET /robots.txt HTTP/1.0" 406 300 "-" "Mozilla/5.0 (compatible; Linux x86_64; Mail.RU_Bot/2.0; +http://go.mail.ru/help/robots)"
deny from 95.163.255.189
#wp-login probe
deny from 97.107.135.87
#mm-101-254-57-86.static.mgts.by - - [02/Jul/2021:08:44:34 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 101.254.57.86
deny from 103.41.36.48
#wp-login probe
deny from 103.106.98.112
# "GET /wp-login.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
deny from 103.200.39.6
#103.241.205.82 - - [05/Jul/2021:08:42:14 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 103.241.205.82
deny from 104.25.20.37
deny from 104.130.124.209
deny from 104.140.4.136
deny from 104.140.4.238
#US -  Glenview IL - intelium.com - unidentified bot, questionable per abuseipdb
deny from 104.192.74.43
deny from 104.193.88.243
deny from 104.193.88.244
#zoom info bot 
deny from 104.196.17.158
#wp hacker
deny from 104.197.165.66
deny from 104.227.112.142
deny from 104.238.248.15
#sogu
deny from 106.38.241
#deny from 106.38.241.118
#sogouspider-106-38-241-170.crawl.sogou.com - - [04/Jul/2021:09:27:36 -0700] "GET / HTTP/1.1" 200 1120 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
#sogu
#deny from 106.38.241.182
deny from 107.21.1.8
deny from 107.150.59.98
deny from 107.152.196.243
deny from 107.152.254.91
deny from 107.172.134.148
deny from 107.172.150.61
#wp-admin probe
deny from 108.167.188.185
deny from 109.202.107.20
#110.249.201.70 - - [05/Jul/2021:07:22:34 -0700] "GET /robots.txt HTTP/1.1" 403 228 "-" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)"
deny from 110.249.201
#deny from 110.249.201.0/24
deny from 110.249.202.0/24
#china hacking on b2evo1
deny from 111.197
#111.202.100.82 - - [03/Jul/2021:18:23:04 -0700] "GET / HTTP/1.1" 200 1120 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
deny from 111.202.100.82
#china hacking on b2evo1
deny from 111.225
#deny from 111.225.149.0/24
#china, reported abuseipdb
deny from 112.5.234.143
#china, reported abuseipdb
deny from 112.5.236.207
# SEO from China
deny from 112.5.248.142
deny from 112.111.184.153
deny from 112.111.184.176
deny from 112.111.188.15
deny from 112.111.189.180
deny from 112.111.191.141
deny from 112.111.191.182
deny from 115.89.123.121
deny from 115.221.19.191
deny from 117.26.242.143
deny from 117.26.242.191
#Bangladesh - wp-login
deny from 117.103.86.14
#ThinkBot test phase 
deny from 118.24.106.70
#92.118.160.57.netsystemsresearch.com - - [04/Jul/2021:06:25:10 -0700] "GET / HTTP/1.1" 403 228 "-" "NetSystemsResearch studies the availability of various services across the internet. Our website is netsystemsresearch.com"
deny from 92.118.160.57
deny from 119.94.190.82
deny from 119.188.64.4
#Hanghou, Zeijiang China - aliyun.com 50% evil abuseipdb / active attack on pdf systems
deny from 120.78.72.59
#wp-login probe
deny from 120.239.27.31
#wp-login probe
deny from 121.42.138.121
#121.180.254.117 - - [22/Jun/2021:08:46:17 -0700] "GET /wp-login.php HTTP/1.1" 404 236 "http://fastbk.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/A45269"
deny from 121.180.254.117
deny from 121.200.54.100
deny from 121.207.88.248
deny from 123.30.175.
#china, abuseipdb
deny from 123.114.7.7
#abuseipdb - Beijing - 123.125.67.163 - - [05/Jul/2021:15:09:38 -0700] "GET /robots.txt HTTP/1.1" 200 254 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36"
deny from 123.125.67
#baidu spider
deny from 123.125.71.107
#sogouspider-123-183-224-15.crawl.sogou.com - - [02/Jul/2021:05:37:40 -0700] "GET / HTTP/1.1" 200 1113 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
deny from 123.183.224
#deny from 123.183.224.15
#sogu
#deny from 123.183.224.89
#sogouspider-123-183-224-96.crawl.sogou.com - - [02/Jul/2021:09:25:37 -0700] "GET / HTTP/1.1" 200 1113 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
deny from 124.72.196.247
deny from 124.72.196.135
#zl-dal-us-gp1-wk122.internet-census.org - - [06/Jul/2021:11:29:13 -0700] "GET / HTTP/1.1" 200 1713 "http://www.fastbk.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36" - see abuseipdb
deny from 128.14.209.242
deny from 128.68.143.181
deny from 129.121.176.186
#129.213.147.45 - - [04/Jul/2021:23:30:43 -0700] "GET /wp-admin/install.php HTTP/1.1" 301 242 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
deny from 129.213.147.45
#wp-admin probe
deny from 131.153.37.2
#polecat.cs.uni-bonn.de - - [03/Jul/2021:22:43:38 -0700] "GET / HTTP/1.1" 200 1120 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36"
#evil per abuseipdb
deny from 131.220.6.152
#netcraft
deny from 134.122.3.187
#netcraft
deny from 134.122.7.14
#-digital ocean netcraft survey agent
deny from 134.122.9.28
#wp hacker
deny from 134.122.28.82
deny from 136.243.152.18
deny from 137.74.203.0/24
#wp-login probe
deny from 138.59.24.134
#wp hacker
deny from 138.128.178.194
deny from 138.197.111.146
#139.180.135.194.vultr.com - - [05/Jul/2021:17:28:01 -0700] "GET //sito/wp-includes/wlwmanifest.xml HTTP/1.1" 301 259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
#deny from 139.180.135.194
#deny from 139.199.62.227
#deny from 139.199.63.33
#141-8-142-67.spider.yandex.com - - [04/Jul/2021:13:10:58 -0700] "GET /3ja2B38656rja2xO1001Aa HTTP/1.1" 404 236 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"
deny from 141.8.142.67
#wp hacker
deny from 142.4.30.31
deny from 142.4.218.156
#searching for .env
deny from 142.93.212.48
#zoom bot 
deny from 143.106.73.34
deny from 144.76.7.106
deny from 144.76.8.132
deny from 144.76.29.66
deny from 144.76.4.148
deny from 144.172.195.90
#wp hacker
deny from 145.131.25.136
#wp hacker
deny from 146.70.25.76
#St Petersburg sazonhost.net 77% abuseipdb
deny from 146.185.223.150
deny from 146.185.223.240
deny from 149.56.97.122
#St. Petersburg, Russian Federation, sazonhost.net, 85% evil abuseipdb
deny from 146.185.223.252 
#ip-148-72-215-37.ip.secureserver.net - - [04/Jul/2021:07:58:00 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 148.72.215.37
deny from 149.154.71.233
deny from 150.107.0.113
#252.ip-151-80-141.eu - - [04/Jul/2021:06:41:27 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 151.80.141.252
#belarus, chacking favicon only
deny from 151.249.145.207
#multiple wp phrases: 152.67.52.194 - - [03/Jul/2021:10:50:40 -0700] "GET /wp-login.php HTTP/1.1" 401 228 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 152.67.52.194
#bork - 152.67.251.185 - - [05/Jul/2021:20:14:58 -0700] "GET / HTTP/1.1" 200 3645 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
deny from 152.67.251.185
#wp-login probe
deny from 152.168.255.232
#tried to post to mail.php, evil per abuseipdb, datacamp, france
deny from 156.146.63.156
#microsoft hong kong - 1% evil but listed as white listed abuseipdb
deny from 157.55.39
#157.55.39.120 - - [29/Jun/2021:16:22:18 -0700] "GET /ddfsw5610pdfsqK1001K HTTP/1.1" 301 247 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
#157.55.39.120 - - [29/Jun/2021:16:30:39 -0700] "GET /MWxkbGE5NzIxTWxkQTQwNTEzVGRscWlr HTTP/1.1" 301 263 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
#netcraft
deny from 157.245.124.17
#wp uploader attack
deny from 158.69.101.124
#zoominfo bot 
deny from 158.96.237.35
#158.101.112.12 - - [22/Jun/2021:01:19:33 -0700] "GET /.env HTTP/1.1" 404 236 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
deny from 158.101.112.12
#netcraft
deny from 159.65.160.143
#netcraft
deny from 159.65.165.186
#unknown wp-login search
deny from 159.65.219.142
#bork - 159.75.134.201 - - [05/Jul/2021:14:45:07 -0700] "GET / HTTP/1.1" 200 3645 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0"
deny from 159.75.134.201
#looking for wp-login
deny from 159.203.105.141
#159.242.234.47 - - [22/Jun/2021:01:22:39 -0700] "GET /xmlrpc.php?rsd HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
deny from 159.242.234.47
#looking for .env
deny from 159.242.234.67
deny from 160.153.147.153
#netcraft
deny from 161.35.134.128
#netcraft
deny from 161.35.134.170
#netcraft
deny from 161.35.141.66
#netcraft
deny from 161.35.176.71
#netcraft
deny from 161.35.188.84
#ninja-crawler103.webmeup.com - - [02/Jul/2021:16:40:28 -0700] "GET /robots.txt HTTP/1.1" 406 300 "-" "Mozilla/5.0 (compatible; BLEXBot/1.0; +http://webmeup-crawler.com/)"
#abuseipdb - germany - adiaboreha.com - - [06/Jul/2021:02:17:26 -0700] "GET //wp1//installer.php HTTP/1.1" 403 1269 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0"
deny from 161.97.175.100
deny from 162.55.85.222
deny from 164.132.161.0/24
deny from 164.132.162.0/24
deny from 163.172.4.153
deny from 163.172.32.175
deny from 163.172.35.99
deny from 163.172.149.96
deny from 163.172.64.0/24
deny from 163.172.65.0/24
deny from 163.172.66.0/24
deny from 163.172.68.121
deny from 163.172.71.0/24
deny from 163.172.161.0/24
deny from 164.132.161.60
deny from 164.132.162.0/24
#162.55.129.41 - - [04/Jul/2021:06:57:10 -0700] "POST /wp-includes/css/wp-config.php HTTP/1.1" 403 228 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"
deny from 162.55.129.41
#165.22.209.132 - - [05/Jul/2021:09:12:55 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 165.22.209.132
#66.160.140.184 - - [06/Jul/2021:03:51:42 -0700] "GET /robots.txt HTTP/1.1" 200 255 "-" "The Knowledge AI"
deny from 66.160.140.184
#wp hacker
deny from 167.71.69.173
#netcraft
deny from 167.99.114.225
#wp hacker
deny from 167.114.156.15
deny from 171.12.10.121

deny from 173.208.157.186
deny from 173.212.207.251
deny from 173.234.153.122
deny from 173.234.159.250
#wp hacker
deny from 173.236.170.203
#ipvanish vpn 173-245-202-60.ipvanish.com - - [04/Jul/2021:12:06:24 -0700] "GET /b2evo1/blog1.php/brother-mfc6920dw-won-t-turn HTTP/2.0" 404 236 "https://www.google.com/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
deny from 173.245.202.60
#thinkbot test phase
deny from 175.24.232.97
# ukraine hack 100%
deny from 176.8.89.33
deny from 176.9.10.227
deny from 176.112.49.187
#ukraine
deny from 176.122.2.143
#brazil, looking for exploit in the etm software
deny from 177.37.140.192
deny from 177.141.155.64
deny from 178.63.19.22
deny from 178.63.19.148
#178.128.14.204 - - [04/Jul/2021:20:50:13 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 178.128.14.204
deny from 178.137.83.166
deny from 178.159.37.112
#abuseipdb - Moldova ae0-3101.cr01.ch.md.as43289.net - - [05/Jul/2021:22:41:25 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36"
deny from 178.175.129.41
deny from 178.184.223.136
deny from 178.210.90.90
#wp-login probe
deny from 179.220.52.128
deny from 179.158.81.96
#all of following 180.76 claim to be baidu spiders, they just are annoying and won't go away
deny from 180.76.15.
#deny from 180.76.15.0/24
#deny from 180.76.15.5
#deny from 180.76.15.6
#deny from 180.76.15.8
#deny from 180.76.15.9
#deny from 180.76.15.11
#deny from 180.76.15.16
#deny from 180.76.15.10
#deny from 180.76.15.19
#deny from 180.76.15.20
#deny from 180.76.15.21
#deny from 180.76.15.22
#deny from 180.76.15.23
#deny from 180.76.15.24
#deny from 180.76.15.25
#deny from 180.76.15.26
#deny from 180.76.15.28
#deny from 180.76.15.29
#deny from 180.76.15.30
#deny from 180.76.15.33
#deny from 180.76.15.34
#deny from 180.76.15.35
#deny from 180.76.15.134
#deny from 180.76.15.135
#deny from 180.76.15.138
#deny from 180.76.15.139
#deny from 180.76.15.141
#deny from 180.76.15.143
#deny from 180.76.15.144
#deny from 180.76.15.146
#deny from 180.76.15.150
#deny from 180.76.15.151
#deny from 180.76.15.155
#deny from 180.76.15.156
#deny from 180.76.15.158
#deny from 180.76.15.159
#deny from 180.76.15.161
#deny from 180.76.15.162
#deny from 180.76.15.163
#deny from 180.76.15.154
#deny from 180.76.106.145
#Beijing baidu spider login/install.php attack
deny from 180.76.115.13
deny from 180.97.35.165
deny from 180.191.126.238
deny from 183.160.1.109
deny from 183.160.3.206
deny from 183.160.121.235
deny from 183.160.122.195
#snooping around for .js in _sf?? claims sometimes to be sitelock
#deny from 184.154.76.35
#deny from 184.154.139.18
#deny from 184.154.139.19
#suspicious - "http://www.google.com/url?url=www.daltrey.org&yahoo.com" - claims to be sitelock crawler, abuseipdb says bad at least 18-21
#deny from 184.154.139.21
deny from 185.2.4.118
#<br>vps-64243.fhnet.fr - - [06/Jul/2021:15:30:10 -0700] "GET / HTTP/1.1" 200 4215 "-" "Mozilla 5.0" aka 185.13.37.134 france
deny from 185.13.37.134
#hack probing from latvia
deny from 185.29.8.34
deny from 185.38.14.215
deny from 185.53.44.188
deny from 185.93.182.134
# netherlands - s10.domeinwinkel.nl - attempted to retrieve wordpress admin file
deny from 185.103.173.100
#wp-login probe
deny from 185.121.211.53
#100% evil per abuseipdb - Brussels
deny from 185.180.143.148
#semrush 100% evil per abuseipdb
deny from 185.191.171
#wp-login
deny from 185.213.170.15
#185.220.101.201 - - [05/Jul/2021:11:58:05 -0700] "GET /.git/config HTTP/1.1" 404 236 "-" "Go-http-client/1.1"
deny from 185.220.101.201
deny from 185.234.218.249
# hm2504.locaweb.com.br - attempted wordpress admin file
deny from 187.45.193.159
#wp-login probe
deny from 187.67.31.163
deny from 187.137.68.166
#wp-login probe
deny from 187.188.9.211
deny from 188.163.75.37
#vss125.yakoo.com.hk - - [03/Jul/2021:08:48:30 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 188.166.247.170
deny from 188.186.60.31
#wp hacker
deny from 188.225.40.162
#bace8db8.virtua.com.br - - [06/Jul/2021:15:22:23 -0700] "GET / HTTP/1.1" 200 4215 "http://drjuicepharma.co.uk/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36"
deny from 189.6.48.3
deny from 189.216.166.40
#190.119.238.15 - - [04/Jul/2021:07:53:35 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 190.119.238.15
#191.96.100.239 - - [02/Jul/2021:06:36:46 -0700] "GET /.env HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
deny from 191.96.100.239
#fastbk hijack user from Brussels
deny from 192.71.249.158
deny from 192.126.157.145
deny from 192.126.166.241
deny from 192.126.163.122
deny from 192.151.149.10
deny from 192.160.102.165
#server.premiumchex.com - - [03/Jul/2021:08:47:05 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 192.185.130.170
deny from 192.187.104.235
deny from 192.241.210.101
deny from 192.243.53.51
deny from 193.33.94.3
deny from 193.41.60.108
#abuseipdb - ireland - 193.56.252.252 - - [05/Jul/2021:16:03:46 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36"
#paired with 5.253.204.102 - - [05/Jul/2021:16:03:26 -0700] "GET /linux/DBFlashRC58.exe HTTP/1.1" 200 406528 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0"
deny from 193.56.252.252
# Ukraine - infiumhost.com - 100% evil, abuseipdb
deny from 193.106.30.98
deny from 193.106.30.99
#romania - checking rss (all of the 193.169's)
deny from 193.169.20.68
deny from 193.169.20.185
deny from 193.169.20.220
deny from 193.169.21.58
deny from 193.169.21.139
deny from 193.169.21.165
deny from 193.169.21.201
deny from 193.169.21.243
# autodiscover probe
deny from 193.169.145.194
#romania
deny from 193.178.224.127
deny from 193.178.224.237
deny from 193.178.225.235
deny from 194.6.202.0/24
#194.99.24.205 - - [05/Jul/2021:07:32:30 -0700] "GET /__media__/js/netsoltrademark.php?d=kt5hwmpbzu.com HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
deny from 194.99.24.205
deny from 194.187.248.10
deny from 195.0.0.0/8
deny from 195.2.219.48
deny from 195.28.182.35
deny from 195.93.140.3
deny from 195.128.188.3
deny from 195.154.161.171
deny from 195.210.44.203
deny from 195.254.141.0/24
#South Africa - vts-connect-gw.telkom-ipnet.co.za - - [05/Jul/2021:10:56:21 -0700] "GET /administrator/ HTTP/1.1" 301 241 "http://fastbk.com/administrator/" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36"
deny from 196.25.251.106
# cpanel7.mywebserver.co.za - cybersmart.co.za - South Africa -- attempted wordpress admin file
deny from 196.41.123.146
deny from 196.196.253.83
#198-23-221-30-host.colocrossing.com - - [05/Jul/2021:13:13:30 -0700] "GET / HTTP/1.1" 200 3272 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.9.5483.20 Safari/537.36"
deny from 198.23.221.30
#looking for wp-login
deny from 198.27.69.82
deny from 198.245.49.215
deny from 199.19.104.163
#wp hacker
deny from 199.188.204.131
#zequn - China - reported as spammer at abuseipdb
deny from 202.46.48.91
#looking for adminstrator, from Cambodia
deny from 203.80.171.67
#wp-login probe
deny from 203.128.31.153
deny from 203.158.160.14
deny from 204.79.180.4
deny from 204.85.191.31
deny from 204.152.203.157
#sf1 hack attempt abuseipdb centurylink arkansas
deny from 205.169.39.8
deny from 205.234.159.77
deny from 206.214.82.186
#bing bot abuseipdb thinks whitelist, but definitely evil per logs
deny from 207.46.13
#207.46.13.165 - - [29/Jun/2021:16:18:20 -0700] "GET /2gemcS18082Vgemp770jemc HTTP/1.1" 301 250 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
#207.46.13.109 - - [29/Jun/2021:16:29:43 -0700] "GET /ODB1OGxRNTEyNjVZMHU4bHEvNTI1NEJ1OGw= HTTP/1.1" 301 267 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
#wp-login probe
deny from 207.99.15.4
#207.154.215.89 - - [04/Jul/2021:21:24:21 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 207.154.215.89
deny from 207.244.149.106
#softlayer San Jose - attacked /admin
deny from 208.83.1.168
#wp hacker
deny from 208.92.244.35
deny from 208.110.93.76
#ip-208-109-8-126.ip.secureserver.net - - [03/Jul/2021:07:40:55 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 208.109.8.126
#fsndc1.fastnet.my.id - - [05/Jul/2021:10:32:18 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 209.126.13.151
#fedorait network lvstreamthenet Las Vegas 97% highly reported abouse
deny from 209.141.45.6
#Winnepeg, Manitoba - mega repeated hits on blog
deny from 209.177.100.29
#vm2413703.nvme.had.wf - - [04/Jul/2021:12:16:07 -0700] "GET / HTTP/1.0" 200 1120 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36" see abuseipdb
deny from 212.8.246.4
deny from 212.47.229.189
#monica.probe.onyphe.net - 100% evil, abuseipdb - France
deny from 212.83.146.233
deny from 212.83.158.95
#France - Paris - iliad - 212-83-178-172.rev.poneytelecom.eu 100% evil per abuseipdb
deny from 212.83.178.172
#212-83-183-215.rev.poneytelecom.eu - - [03/Jul/2021:10:02:38 -0700] "GET /wp-login.php HTTP/1.1" 406 300 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
deny from 212.83.183.215
#Sweden - looking for wp-login 
deny from 213.64.73.190
deny from 213.251.182.115
deny from 213.251.184.38
#mozbot seo spammer
deny from 216.244.66
#216.244.66.227
#deny from 216.244.66.228
#dot.bot, SEO spammer Moz, Inc.
deny from 216.244.66.241
#mail.ru
deny from 217.69.133.
deny from 217.182.132.27
#china trackback spam
deny from 219.136.75.198
#china action unclear
deny from 220.181.108.111
#china - excess b2evo1 queries, possible login attempte
deny from 220.243.135.0/24
deny from 220.243.136.0/24
deny from 220.243.188
#pakistan wp-login hack
deny from 221.120.215.18
deny from 221.175.239.205
deny from 221.175.255.86
deny from 222.97.39.100
#wp hacker
deny from 223.204.101.199