mel_the_snowbird - 8:20 pm on Dec 13, 2012 (gmt 0)

Hi Wilderness:

I understand very little of regex and nothing of htaccess, and I 'ran away' from your solution a few months ago.

What I *did do* was 'Deny All' to my affected web site, then Allow aaa.bbb.ccc.ddd to a selected few (about 20) people.

Now, this person(s) is using the 'baidu' method of attacking me. I've inserted a few lines of this below.

I've blocked *this* url but he keeps on coming, then starts again on a completely different IP address -- which I have to 'Deny' in addition because his line doesn't specify my *actual* web site.

Of course I have no file on my site that matches his attack URL (?)


This goes on for day-after-day :(

I'm still frightened of using htaccess in the httpd.conf file.

But, thanks for your help anyway.

-Mel Smith
Mesa, Arizona

*************************
54.242.122.129 - - [13/Dec/2012:11:44:02 -0700] "GET / HTTP/1.1" 403 202 "http://www.baidu.com/s?wd=jasper%2 etc.

54.242.122.129 - - [13/Dec/2012:11:44:08 -0700] "GET / HTTP/1.1" 403 202 "http://www.baidu.com/s?wd=jasper%2 etc.

54.242.122.129 - - [13/Dec/2012:11:44:14 -0700] "GET / HTTP/1.1" 403 202 "http://www.baidu.com/s?wd=jasper%2 etc

54.242.122.129 - - [13/Dec/2012:11:44:20 -0700] "GET / HTTP/1.1" 403 202 "http://www.baidu.com/s?wd=jasper%2 etc

... and the last of the example lines in full:

54.242.122.129 - - [13/Dec/2012:11:44:29 -0700] "GET / HTTP/1.1" 403 202 "http://www.baidu.com/s?wd=jasper%20golf%20hotel&pn=60&ie=utf-8&usm=1&rsv_page=1" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; HPNTDF)"