homepage Welcome to WebmasterWorld Guest from 54.242.126.126
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member

Home / Forums Index / Code, Content, and Presentation / Apache Web Server
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL & phranque

Apache Web Server Forum

    
Multiple hits from 6 IPs to deleted image
Two IP neigborhoods
slipkid



 
Msg#: 4492599 posted 6:47 am on Sep 8, 2012 (gmt 0)

Getting 40+ hits a day from 6 different IPs (two separate neighborhoods) to same deleted image for which server returns a 404.

IP neighborhood number 1
61.135.217.nn

"GET /image.jpg HTTP/1.1" 404 510 "http://www.example.com" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.79 Safari/535.11"


IP neighborhood number 2
27.18.185.nnn

"GET /image.jpg HTTP/1.1" 404 510 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; KBMINI4WD)"

This has been going on for weeks. The bad guy does not get that it is getting a 404 and should go away and get lost.

 

lucy24

WebmasterWorld Senior Member lucy24 us a WebmasterWorld Top Contributor of All Time Top Contributors Of The Month



 
Msg#: 4492599 posted 8:29 am on Sep 8, 2012 (gmt 0)

My first guess would have been: just another crummy hotlink stuck on a page whose owner never bothers to look at it. If you're brave, you could check the referer. From someone else's computer, heh heh.

Except that you wouldn't want to.

The first IP is in the middle of a vast Chinese block, 61.128.0.0/10, that came up in another thread just the other day. And what do you know, the other one's China too. 27.8.0.0/13 and 27.16.0.0/12 side by side.

You could slam the door in their faces, though a 404 doesn't really use any more server resources than a 403. It's just the principle of the thing.

phranque

WebmasterWorld Administrator phranque us a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



 
Msg#: 4492599 posted 8:36 am on Sep 8, 2012 (gmt 0)

you could use mod_rewrite to supply a 410 Gone or 403 Forbidden response.
either status code is a "stronger" signal than a 404 and handling this request in mod_rewrite should take less server resources, although 40 requests/day won't hurt anything.

slipkid



 
Msg#: 4492599 posted 5:49 pm on Sep 8, 2012 (gmt 0)

Thought I would post this as I am trying to learn how to play in the sandbox. :)

Logs revealed today who the offending referrer is: youdao.com.

For the longest time, I got daily hits from 1.202.218.n, as if it was trying to capture Pork Chop Hill on a 2 hour schedule of attacks. Waved my magic 403 wand, but still came back. Seems gone now. Those wile Chinese.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Code, Content, and Presentation / Apache Web Server
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved