How to stop a botnet attack exploiting Apache ProxyRequests

botnet-apache-proxy-blocker.sh

#!/usr/bin/env sh

tail -f /var/log/apache2/gosquared*access.log | awk '
BEGIN { blocked_ips="" }
/ http/ {
  if (! index(blocked_ips, $1)) {
    // append this ip to our internal blocked_ips list
    blocked_ips = blocked_ips " " $1

    "date" | getline current_time
    close("date")

    print current_time " :: blocking " $1

    ufw_block = "ufw insert 1 deny from "$1
    system(ufw_block)
    close(ufw_block)
  }
}'