homepage Welcome to WebmasterWorld Guest from 54.196.197.153
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Pubcon Platinum Sponsor 2014
Home / Forums Index / Code, Content, and Presentation / Apache Web Server
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL & phranque

Apache Web Server Forum

    
Multiple hits from 6 IPs to deleted image
Two IP neigborhoods
slipkid




msg:4492601
 6:47 am on Sep 8, 2012 (gmt 0)

Getting 40+ hits a day from 6 different IPs (two separate neighborhoods) to same deleted image for which server returns a 404.

IP neighborhood number 1
61.135.217.nn

"GET /image.jpg HTTP/1.1" 404 510 "http://www.example.com" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.79 Safari/535.11"


IP neighborhood number 2
27.18.185.nnn

"GET /image.jpg HTTP/1.1" 404 510 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; KBMINI4WD)"

This has been going on for weeks. The bad guy does not get that it is getting a 404 and should go away and get lost.

 

lucy24




msg:4492610
 8:29 am on Sep 8, 2012 (gmt 0)

My first guess would have been: just another crummy hotlink stuck on a page whose owner never bothers to look at it. If you're brave, you could check the referer. From someone else's computer, heh heh.

Except that you wouldn't want to.

The first IP is in the middle of a vast Chinese block, 61.128.0.0/10, that came up in another thread just the other day. And what do you know, the other one's China too. 27.8.0.0/13 and 27.16.0.0/12 side by side.

You could slam the door in their faces, though a 404 doesn't really use any more server resources than a 403. It's just the principle of the thing.

phranque




msg:4492611
 8:36 am on Sep 8, 2012 (gmt 0)

you could use mod_rewrite to supply a 410 Gone or 403 Forbidden response.
either status code is a "stronger" signal than a 404 and handling this request in mod_rewrite should take less server resources, although 40 requests/day won't hurt anything.

slipkid




msg:4492699
 5:49 pm on Sep 8, 2012 (gmt 0)

Thought I would post this as I am trying to learn how to play in the sandbox. :)

Logs revealed today who the offending referrer is: youdao.com.

For the longest time, I got daily hits from 1.202.218.n, as if it was trying to capture Pork Chop Hill on a 2 hour schedule of attacks. Waved my magic 403 wand, but still came back. Seems gone now. Those wile Chinese.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Code, Content, and Presentation / Apache Web Server
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved