There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular expression. I would love to know the different regular expressions available for detecting brute-force attacks from Apache log file.

  • 1
    What kind of brute-force attack are you talking about? Do you mean attacks against your web application? Commented Jan 29, 2019 at 13:24
  • Your question is a bit vague. I don't think regexp are what you need, but with so few informations to work with... could you elaborate please ? Why do you need regexp only ? Don't you have a software to handle your logs and agregate them ?
    – Kaël
    Commented Jan 29, 2019 at 13:52
  • finding bruteforce patterns from apache log is rather vague?what kind of bruteforce are you talking about?login credentials,directory bruteforce or common fuzzing?
    – yeah_well
    Commented Jan 29, 2019 at 14:01
  • @ViliusPovilaika Yes, attacks against web application so that the log of that attack is stored in access.log file. I want to find out through log file that the brute force attack is tried in my web application.
    – Uday
    Commented Jan 30, 2019 at 1:18
  • @Kaël I am trying to test the apache log file so that the brute force attack is being tried. Yes, there are other methods too for testing brute force attack from log, though I wanna know it via regexp also.
    – Uday
    Commented Jan 30, 2019 at 1:21

3 Answers 3


You can use this oneliner:

awk '/login.php/ {print $1}' access_log | sort | uniq -c | sort -gr | head -10

What each part of the pipeline does:

awk '/login.php/ {print $1}' access_log: reads access.log, searches for every line containing login.php and prints the first word (the IP address)

sort will, well, sort.

uniq -c counts the amount of entries for every string

sort -gr will sort in reverse, by numeric value

head -10 returns the top 10 entries.

You can change the head -10 to the amount of IPs you want in the result.


High volume of traffic:

^(\S+) .+ .+ \[.*\] "(POST|GET) .+ HTTP/\d\.\d" 401 \d+ "-" ".+"$

This regular expression matches any HTTP POST or GET request that returns a 401 error and is made from the same IP address, indicating a potential brute-force attack.

Unusual user agents:

^.*"(POST|GET).*HTTP.*" 401 .*"(python|curl|wget|libwww-perl|python-requests|httrack|HTTPie)"\s*$

This regular expression matches any HTTP POST or GET request that returns a 401 error and is made by a user agent associated with automated tools like Python, curl, wget, etc.

Failed login attempts:

^.*"(POST|GET).*HTTP.*" 401 .*"[^"]*"\s*$

Multiple login attempts:

^.*"(POST|GET).*HTTP.*" 40[13] .*"[^"]*"\s*$


You can run grep against Apache access log searching for your login page, use awk to carve out the source IP address then use wc to count how many times a source IP hit your login page.

That would be a simple way to check for brute-force login attacks from a single source.

  • awk does grepping too... no need to grep | awk.
    – ThoriumBR
    Commented Feb 23, 2022 at 11:59
  • Neonprime, can you provide an example?
    – schroeder
    Commented Nov 16, 2023 at 11:19
  • @schroeder done.
    – ThoriumBR
    Commented Apr 14 at 14:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .