Can anyone help with a regular expression problem? (Wordpress site)

[Clinton]

I have the Jorgee bot blocked in htaccess via a mod_rewrite ... but it doesn't seem to be working.

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} xenu [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ZmEu [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Jorgee [NC]
RewriteRule !^robots\.txt$ - [F]
</IfModule>

I'm still seeing Jorgee in my Wordfence "Live Traffic" view ... and it's hitting hundreds of pages! If it's blocked in htaccess, each of those Jorgee requests shouldn't even be loading WP, should it? How come Jorgee is still appearing in the Wordfence live view logs?

I've got a block in Wordfence itself for Jorgee, but it's such a badly behaved bot that I don't want it even getting that far (as that involves executing the WP code for every stupid page request it makes).

Any suggestions?

 

[Nico Albrecht]

Can't you just check your server log files and look up the IP addresses and ban the bots that way? I would once a week check the server logs anyway and ban accordingly

 

[Clinton]

Huh? Did you read the OP? I'm looking to ban a particular user agent, not whatever IP it happens to be using this week. In any case, the question was about why WP is executing for those requests despite the block in htaccess.

 

[Nico Albrecht]

Not a big fan of Wordpress but feel free if this rule works any better to block it. It is very similar.

I assume you use ssl and maybe the rewrite in htaccess there causes the issue

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^.*(Jorgee|ZmEu|xenu).*$ [NC]
RewriteRule .* - [F,L]

 

[The Byre]

https://moonshotcentral.com/jorgee-malware-solve-problem/

 

[Clinton]

@TheByre, thanks but that code does pretty much the same thing in terms of blocking before WP is loaded (albeit they've got all the bots on one line and haven't made any exception for their robots.txt file).

 

[The Byre]

Then have a shoofti at this lot - I have to admit that I have not tried any of their 'solutions', but it looks vaguely promising (busy morning - no time to bend my seven brain cells around WP problems!)

https://github.com/szepeviktor/wordpress-fail2ban/tree/master/block-bad-requests

 

[Xpress Docs]

Sneakily, it looks like the user agent isn't just Jorgee. A quick look around the net indicated that this change to your original post should work (until said user agent is changed)

RewriteCond %{HTTP_USER_AGENT} Mozilla/5\.0\ Jorgee [NC]

My regex isn't great, but maybe dropping the mozilla part, and using Jorgee$ would be a better option?

 

[Clinton]

RewriteCond %{HTTP_USER_AGENT} Mozilla/5\.0\ Jorgee [NC]

My regex isn't great...

Thanks, I've seen that version online as well ...but that doesn't work either (maybe it is, as you suggest, the syntax).

My htaccess works fine for everything else (so it's not the mod_rewrite that's the problem).

 

[Xpress Docs]

Can you copy & paste a line from the log which has the Jorgee reference on it please?

 

[Clinton]

I'd need to FTP to my server logs for the raw data and I can't do that from this machine, but here's an extract from Wordfence:
IP: 42.200.240.198 Hostname: 42-200-240-198.static.imsbiz.com
Browser: undefined
Mozilla/5.0 Jorgee

It keeps asking for /pma2017 /pma2018 and all kinds of other non-existent URLs.

 

[Xpress Docs]

I only asked about the raw logs, as it may have been something sneaky with the use of white space in the user agent string. That doesn't seem to have any. The only other syntax that I can find that makes any sense is

RewriteCond %{HTTP_USER_AGENT} ^.*(jorgee).* [NC]
RewriteRule ^(.*)$ - [L,R=403]

This should give jorgee an access forbidden message as well, rather than divert it to your robots.txt file.

 

[Clinton]

Apache.

This bot keeps changing IP, but the useragent is always the same. Anyway, I've got it sorted now. Thanks everyone.

 

[Xpress Docs]

Glad to hear you're sorted. What did you have to do in the end?