# author: tom hudson
# email:  tomhudson411@yahoo.com
# my rewrite rules to kill off probes
# original idea from tenor at macosxhints forum
# replace "REPLACE_YOUR_SERVERS_IP" with either your server's
# ip, or if you don't have a (semi)static ip,
# a dns alias from one of the free dns services
# (no-ip.com, afraid,org, dyndns.org)


	RewriteEngine on
	RedirectMatch permanent (.*)command.com(.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=command.com"
	RedirectMatch permanent (.*)COMMAND.COM(.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=command.com"
	RedirectMatch permanent (.*)command.exe(.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=command.exe"
	RedirectMatch permanent (.*)COMMAND.EXE(.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=command.exe"
	RedirectMatch permanent (.*)cmd.exe(.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=cmd.exe"
	RedirectMatch permanent (.*)CMD.EXE(.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=cmd.exe"
	RedirectMatch permanent (.*)root.exe(.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=root.exe"
	RedirectMatch permanent (.*)ROOT.EXE(.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=root.exe"
	RedirectMatch permanent (.*)[\\|\/]_vti_bin[\\|\/](.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=vtibin"
	RedirectMatch permanent (.*)[\\|\/]_VTI_BIN[\\|\/](.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=vtibin"
	RedirectMatch permanent (.*)[\\|\/]winnt[\\|\/](.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=winnt"
	RedirectMatch permanent (.*)[\\|\/]WINNT[\\|\/](.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=winnt"
	RedirectMatch permanent (.*)[\\|\/]scripts[\\|\/]\.\.(.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=scripts"
	RedirectMatch permanent (.*)[\\|\/]SCRIPTS[\\|\/]\.\.(.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=scripts"
	RedirectMatch permanent (.*)[\\|\/]_mem_bin[\\|\/](.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=membin"
	RedirectMatch permanent (.*)[\\|\/]_MEM_BIN[\\|\/](.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=membin"
	RedirectMatch permanent (.*)[\\|\/]msadc[\\|\/](.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=msadc"
	RedirectMatch permanent (.*)[\\|\/]MSADC[\\|\/](.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=msadc"
	RedirectMatch permanent (.*)[\\|\/]x90[\\|\/](.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=webdav+attack"
	RedirectMatch permanent (.*)[\\|\/]X90[\\|\/](.*)$ "http://REPLACE_WITH_YOUR_SERVERS_IP/goaway.php?cmd=webdav+attack"

    Source: geocities.com/tomhudson411/log_breakin_attempts

               ( geocities.com/tomhudson411)