Recreate x.php and have it collect the IP address of anyone trying to reaching it. Then create (or modify) a .htaccess file that blocks them using Apache. The .htaccess file will look like this:

order deny,allow
deny from 123.123.123.123
deny from 353.345.345.345


Just keep appending to that file any IP address you want banned.

The x.php might look like this: (untested)

&lt;?php
    $fp = fopen('.htaccess', 'w');
    fwrite($fp, 'deny from  ' . $_SERVER['REMOTE_ADDR'] . "\n");
    fclose($fp);
?&gt;


Trigger IP ban based on request of given file?
$ch=curl_init();
$postfield = "action=login&amp;lgname=d&amp;lgpassword=Password&amp;format=json";
$url = "http://wiki.signa.com/api.php"; //url to wiki's api

curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0); 
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postfield);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);


$output = json_decode(curl_exec($ch));
curl_close($ch);

print_r($output);
$token = $output-&gt;login-&gt;token;
$session = $output-&gt;login-&gt;sessionid;

$ch=curl_init();

$postfield = "action=login&amp;lgname=d&amp;lgpassword=Password&amp;lgtoken={$token}";
$url = "http://wiki.signa.com/api.php"; //url to wiki's api

curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0); 
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postfield);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$output = curl_exec($ch);
curl_close($ch);

print_r($output);
die;


With the first request I get this object:

stdClass Object
(
    [login] =&gt; stdClass Object
        (
            [result] =&gt; NeedToken
            [token] =&gt; ad61fadb829e5cd44b0062463b7cc2d2
            [cookieprefix] =&gt; wikisign_mediawiki
            [sessionid] =&gt; ebb892881eed27554161234916d00480
        )

)


I'm using the token to do a second request, but I get result = NeedToken.  It should be success since I'm sending the token now.

I noticed the documentation says:


  Send a login request with POST, with confirmation token in body and the session cookie (e.g. enwiki_session) in header as returned from previous request.


I'm not totally clear on that.  I'm assuming I'm having issues because I'm not sending the session cookie in the header.  Do I need to set a cookie prior to the second request?
