Script to scour Apache logs for IP's performing brute-force password attacks on WordPress sites

find_attackers.pl

#!/usr/bin/env perl
use strict;
use warnings;

my %config = (
    'limit' => 20000,
    'name'  => '/var/log/apache2/blog.access.log'
);

my $lines = get_lines(\%config);
my $ip = count_lines($lines);
print_attackers($ip, 0);

sub print_attackers {
    my ($ip_address, $max_logins) = @_;
    foreach my $key (sort { $ip_address->{$b} <=> $ip_address->{$a} } keys %$ip_address) {
        if ($ip_address->{$key} > $max_logins) {
            print "$key : $ip_address->{$key} attempts\n";
        }
    }
}

sub get_lines {
    my $args    = shift;
    my $pattern = 'POST /wp-login.php HTTP/1.0';
    my $tail    = 'tail -' . $args->{'limit'} . q( ") . $args->{'name'} . q(");
    my $grep    = qq(grep "$pattern");
    my $cut     = qq(cut -d' ' -f1);
    my $command = "$tail | $grep | $cut";
    my @lines = `$command`;
    return \@lines;
}

sub count_lines {
    my $lines = shift;
    my %addresses;
    foreach (@$lines) {
        chomp;
        s/\s+$//;
        $addresses{$_}++;
    }
    return \%addresses;
}