homepage Welcome to WebmasterWorld Guest from 54.211.138.180
register, free tools, login, search, subscribe, help, library, announcements, recent posts, open posts,
Pubcon Website
Home / Forums Index / Code, Content, and Presentation / Apache Web Server
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL & phranque

Apache Web Server Forum

This 73 message thread spans 3 pages: < < 73 ( 1 2 [3]     
CHINANET Beijing Province Network hammering my site!
They eat 403s but keeping coming like a mad-dog!
erlandc




msg:4421783
 10:24 pm on Feb 25, 2012 (gmt 0)

Hi,
Log files for just 1 day, various times.

Why do they keep coming?
Cyberwar?
Hold the course?
Thanks,
E

1.202.218.8 - - [25/Feb/2012:02:29:22 -0800] "GET / HTTP/1.0" 403 4243 "-" "\"Mozilla/5.0"
1.202.218.8 - - [25/Feb/2012:03:16:23 -0800] "GET / HTTP/1.0" 403 4243 "-" "\"Mozilla/5.0"
1.202.218.8 - - [25/Feb/2012:04:44:25 -0800] "GET / HTTP/1.0" 403 4243 "-" "\"Mozilla/5.0"
1.202.218.8 - - [25/Feb/2012:05:33:05 -0800] "GET / HTTP/1.0" 403 4243 "-" "\"Mozilla/5.0"
1.202.218.8 - - [25/Feb/2012:06:30:51 -0800] "GET / HTTP/1.0" 403 4243 "-" "\"Mozilla/5.0"
1.202.218.8 - - [25/Feb/2012:08:19:41 -0800] "GET / HTTP/1.0" 403 4243 "-" "\"Mozilla/5.0"
1.202.218.8 - - [25/Feb/2012:08:53:46 -0800] "GET / HTTP/1.0" 403 4243 "-" "\"Mozilla/5.0"
1.202.218.8 - - [25/Feb/2012:10:11:50 -0800] "GET / HTTP/1.0" 403 4243 "-" "\"Mozilla/5.0"
1.202.218.8 - - [25/Feb/2012:12:04:56 -0800] "GET / HTTP/1.0" 403 4243 "-" "\"Mozilla/5.0"
1.202.218.8 - - [25/Feb/2012:12:14:55 -0800] "GET / HTTP/1.0" 403 4243 "-" "\"Mozilla/5.0"

 

erlandc




msg:4427633
 9:51 pm on Mar 10, 2012 (gmt 0)

is this correct?

Options +FollowSymlinks
RewriteEngine on
RewriteBase /
RewriteCond %{REMOTE_ADDR} ^1.
RewriteRule .* [churchof*****.com...] [F]

but I'd like to actually test on myself, like last night when it worked, but I guessed all my visitors were re-directed too. so I have to remove it. (BTW that IP in increasing its visits)

wilderness




msg:4427637
 10:00 pm on Mar 10, 2012 (gmt 0)

You think ten requests in ten hours is a lot?
That averages to one per hour.

Wait till somebody sends a couple hundred requests in 30-seconds or you really make somebody upset with your redirects to their site, and just to get even, they hammer your site repeatedly for 6-8 hours.
You open your logs and all you see is multiple pages of same IP, same request and same UA.

erlandc




msg:4427656
 10:52 pm on Mar 10, 2012 (gmt 0)

gee willikers - can't imagine that, the IP in question is all over the place now, & I'm going to guess some more & re-test as I can't find anything on the web, hit & miss

jmccormac




msg:4427662
 11:47 pm on Mar 10, 2012 (gmt 0)

The alternative is to deepsix the range at the firewall/IP level. More efficient but it takes out legit users and others.

Regards...jmcc

erlandc




msg:4427667
 11:53 pm on Mar 10, 2012 (gmt 0)

jm - deepsix? firewall/IP level? ya got me there.

Kinda got it working, it redirects, again, to everyone using this:


Options +FollowSymlinks
RewriteEngine on
RewriteBase /
RewriteCond %{REMOTE_ADDR} 1.202.218.8
RewriteRule .* [churchofsatan.com...] [F]

thinking of forgetting all about it. seems there's no-one on the web that has this directive that can find

jmccormac




msg:4427672
 12:03 am on Mar 11, 2012 (gmt 0)

It is an IP level block, erlandc,
Basically all traffic from the specified block of IPs will be dropped. It uses a firewall program on the server to control access.

Regards...jmcc

erlandc




msg:4427674
 12:12 am on Mar 11, 2012 (gmt 0)

thanks for the explanation that I don't really understand.

It doesn't really matter 'cos I can't seem to find any help with this problem.

jmccormac




msg:4427677
 12:21 am on Mar 11, 2012 (gmt 0)

Rewriting URLs and IPs is in the Apache docs.

[httpd.apache.org...]

Basically you will have to rewrite the IP address as ^1\.202\.218\.8

The mod_rewrite parses the IP address and the ^ tells it to start here (otherwise it would also check 111, 121 etc). The \ before the . is necessary because the "." is interpreted as "followed by".

Regards...jmcc

erlandc




msg:4427679
 12:27 am on Mar 11, 2012 (gmt 0)

egoma mattimagga ekose, meegwetch

erlandc




msg:4427680
 12:34 am on Mar 11, 2012 (gmt 0)

jmccormac, this is way over my head. trying to follow what ya'll are trying to say, but as I said, I'm no expert on this stuff.

I sent you my link & asked if you got redirected & didn't you didn't answer me, so what can I say? I dated a lawyer for 10 years, & she'd always say to me, "just answer the question", but I won't say that to you 'cos you'd take it the wrong way.

I'll ask someone else. Thanks for your time anyway.

erlandc




msg:4427686
 1:04 am on Mar 11, 2012 (gmt 0)

NOW, they are trying to fool me by requesting robots.txt. I wanna pummel them! send to h e l l!

lucy24




msg:4427701
 2:26 am on Mar 11, 2012 (gmt 0)

does escape the period mean delete?

Heh heh, no, it means precede it with a backslash. In RegularExpression-speak, you do this with any character that has a special meaning within Regular Expressions. It means "This is a literal period. I really mean it. Don't try any funny stuff." In mod_rewrite, most often used with periods \. and parentheses \( \) (for example when there are parentheses in the user-agent string).

You think ten requests in ten hours is a lot?
That averages to one per hour.

Well, it's all relative. If you strip out the robots and your log size is reduced by 2/3, that's a lot, regardless of what the actual numbers are. If someone races through so fast that they slam into the server's maximum-allowable-connections ceiling, it doesn't matter if they end up asking for 300 files or 30,000. It's a lot.

Yeah, asking for robots.txt is a dirty trick. Or possibly a feeble attempt at telling you it's really a nice guy after all. Met one just the other day that would have gone straight into the "no skin off my nose" bin thanks to requesting and obeying robots.txt... until I noticed that its total capture was 32 files in 8 seconds. 4 requests per second is not going to crash my server, and 32 is not a large number by any measure, but Nice Robots just don't do that. Take a break, go outside, smoke a cigarette, drink some coffee, make a phone call, come back after one full second.

erlandc




msg:4427707
 2:50 am on Mar 11, 2012 (gmt 0)

wow, I gotta read this one real slow

This 73 message thread spans 3 pages: < < 73 ( 1 2 [3]
Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Code, Content, and Presentation / Apache Web Server
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About
© Webmaster World 1996-2014 all rights reserved