Hi,

I'm currently in a situation where we identified a "sort of" botnet like approach to spam a webserver system of mine. The requests alone look pretty normal, the interesting thing is when one looks for the user agents and other identifiers and realizes, that all those requests never hit more than ~4x a day, they always only get a single HTTP request without loading any content, style sheets etc. so some sort of bot behavior and come from a huge amount of various IP addresses.

Digging further one sees, that the IPs are rapidly changing as well as the URLs (it's always random URLs from the site from different paths, products etc.) and they rotate user agents as well. As soon as I logged all requests to a REAL old Opera version, I could make them visible a lot better as the IPs came back after hours with their single hits but a completely different user agent, language setting etc.

So my question is about the following possibility:

• use one or two old user agents as "bait" for fail2ban to "watch" for IPs
• check if those IPs come back with another user agent
• when switching through e.g. 3 different user agents, ban them
• increase ban time when they come back in yet another random UA & URI combo

Is there a way to let fail2ban "remember" some key-value-pairing or DBentry of an IP with some "tripwire" UA like "Opera 8.x / X11" and make it "ban" when the IP comes back with another UA (and another and another)?

Or is there perhaps another/better way to set this up?

Cheers
\jens