Dos

find attackers

grep -F '/wiki/index.php?days=' /var/log/httpd/halfface.se.access.ssl.log | awk '{print "add blocklist " $1 "/32"}' | sort -n | uniq > /tmp/ips_$(date_file).txt

Remove iptables rule that uses ipset list if it already exists

sudo iptables -D INPUT -m set --match-set blocklist src -j DROP

Remove ipset list

sudo ipset destroy blocklist

ipset create list

sudo ipset create blocklist hash:net hashsize 2097152 maxelem 4000000 -exist

Feed ipset list

cat /tmp/ips_2026-05-16_12-36-28.txt | sudo ipset restore -exist

Use list in iptables

sudo iptables -I INPUT -m set --match-set blocklist src -j DROP