Abusive HTTP Watch

Abusive HTTP Watch is a Perl daemon that tails a web access log, detects malicious HTTP probes via a curated regex token set, and writes offending source IPs to an append-only blocklist file. That file is then consumed by the firewall (pf table, Apache Require list, nginx deny list, etc.).

In this section

• Quickstart — Install the daemon, point it at an access log, see IPs accumulate in the blocklist within minutes.
• Configuration — Full environment-variable reference, whitelist file format, and how the blocklist is consumed by the firewall layer.
• Operations — Log-rotation handling, syslog events, daemon lifecycle under rc.d, troubleshooting common issues seen in production.

When you need this

You run a web server (Apache, nginx, OpenLiteSpeed, whatever) and the access log is full of probes for wp-login.php, .env, /etc/passwd, PHP exploitation tokens, and SQL-injection attempts. You want those source IPs blocked at the firewall before they cost you bandwidth, CPU, or — worse — find an actual vulnerability.

If that is your situation, this is what the daemon is for.

Prerequisites

• A modern POSIX system (OpenBSD, FreeBSD, or Linux).
• Perl 5 (the daemon uses only standard library modules).
• A firewall capable of consuming a flat list of IPs:
  • OpenBSD pf with a <abusive> table
  • Linux nftables set or ipset
  • Apache mod_authz_host with Require not ip ...
  • nginx deny directive blocks
• Write access to a runtime directory for the blocklist file.

If you have all of that, the Quickstart is roughly ten minutes of work.