[rusia-repo]
name=CentOS-$releasever – rusia packages for $basearch
baseurl=http://centos.alt.ru/repository/centos/5/$basearch/
enabled=1
gpgcheck=0
protect=1

rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/$(uname -m)/epel-release-5-3.noarch.rpm

yum install nginx php-fpm

<?php
$real_ip = getenv('HTTP_X_FORWARDED_FOR');
if(isset($real_ip)){
        shell_exec("echo $real_ip >> real_ip.txt");
        shell_exec("echo $_SERVER['REMOTE_ADDR'] >> proxy.txt");
}else{
        shell_exec("echo $_SERVER['REMOTE_ADDR'] >> ips.txt");  
}

echo '服务器受到攻击，正在收集攻击源，请在5分钟后访问本站，5分钟内多次访问本站有可能会被当作攻击源封掉IP。谢谢合作！';
?>

rewrite (.*) /ip.php;

Lighttpd规则：复制内容到剪贴板代码:
url.rewrite = (
"^/(.+)/?$" => "/ip.php"
)

shell_exec(“echo $_SERVER['HTTP_HOST'] >> domain.txt”);

<?
$threshold = 10;
$ips = array_count_values(file('ips.txt'));
$ban_num = 0;
foreach($ips as $ip=>$num){
    if($num > $threshold){
                $ip = trim($ip);
                $cmd = "iptables -I INPUT -p tcp --dport 80 -s $ip -j DROP";
        shell_exec($cmd);
        echo "$ip baned!\n";
        $ban_num ++;
        }
}

$proxy_arr = array_unique(file('proxy.txt'));
foreach($proxy_arr as $proxy){
    proxy = trim($proxy);
    $cmd = "iptables -I INPUT -p tcp --dport 80 -s $proxy -j DROP";
    shell_exec($cmd);
    echo "$proxy baned!\n";
    $ban_num ++;
}

echo "total: $ban_num ips\n";
?>