#==========
cat /var/www/forum.rcdesign.ru/logs/error.log | grep "limiting requests, excess" | grep "request: \"GET / HTTP/1"| awk '{print $14}'| awk -F"," '{print $1}'| sort | uniq -c | sort -nr > /tmp/botnet.blacklist

cat /dev/null > /tmp/iptables_ban.sh

#awk '{print "iptables -A INPUT -p tcp --dport 80 -s " $2 " -j DROP" }' /tmp/botnet.blacklist | head -n 50 >> /tmp/iptables_ban.sh
awk '{print "iptables -A INPUT -s " $2 " -j DROP" }' /tmp/botnet.blacklist | head -n 50 >> /tmp/iptables_ban.sh

bash /tmp/iptables_ban.sh
#cat /dev/null > /var/www/forum.rcdesign.ru/logs/error.log
#==========
cat /var/www/forum.rcdesign.ru/logs/error.log | grep "limiting connections by zone" | grep "request: \"GET / HTTP/1"| awk '{print $12}'| awk -F"," '{print $1}'| sort | uniq -c | sort -nr > /tmp/botnet.blacklist


cat /dev/null > /tmp/iptables_ban.sh

#awk '{print "iptables -A INPUT -p tcp --dport 80 -s " $2 " -j DROP" }' /tmp/botnet.blacklist | head -n 50 >> /tmp/iptables_ban.sh
awk '{print "iptables -A INPUT -s " $2 " -j DROP" }' /tmp/botnet.blacklist | head -n 50 >> /tmp/iptables_ban.sh


bash /tmp/iptables_ban.sh
cat /dev/null > /var/www/forum.rcdesign.ru/logs/error.log
#==========