Forum Moderators: phranque
Somewhat trickier is blocking access from an ISP; the output of the whois query will show you the IP range to which a particular IP belongs, and to what entity the range belongs, but won't tell you what *other* ranges that entity owns. You /can/ deny access based on the IP's hostname, but that's generally discouraged due to the (significant) performance hit your systems will take as a result.
The best course of action is likely going to be to block the range of IPs containing the IP or IPs giving you a problem. If more IPs from the same ISP (but a different range) appear in your logs, you can then add those ranges to your blacklist. One way to get a partial list of IP ranges a particular ISP is using is to run your access log through a script which does a DNS lookup on each IP address in the access log; you can then sort the list of hostnames alphabetically, and figure out which requests came from the ISP you wish to block. Use the whois tool to get the ranges to which those IPs belong, and then block those ranges.
It's never as easy as you think. ;)
