Mickey,
Basic understanding and use of anchors should be a primary requirement of mod_rewrite.
1)begins with
2)ends with
3)contains
4) exactly as
5) any combination of the above
Regards your User-Agent inquiry (xpymep)
You may use the
entire UA or any
portion of the UA. You may also utilize
anchors accordingly. Your third example of
xpymep.exe would either not work or generate a syntax error, as you failed to escape the period (see forum charter).
RewriteCond %{HTTP_USER_AGENT} ^109\.230\.246\.6
Needs to change to REMOTE_ADDR and the ends with anchor need to be added.
RewriteCond %{REMOTE_ADDR} ^109\.230\.246\.6$
Honing in on Class D's (in the above example "6") is a bad practice and the visitor will return almost immediately from another range within that same class.
One solution is to either deny the entire Class D, or the entire provider and/or backbone range.
You may also utilize multiple criteria in you denies.
EX:
# UA "contains and comes from IP
RewriteCond %{HTTP_USER_AGENT} ^xpymep\.exe [NC]
RewriteCond %{REMOTE_ADDR} ^109\.230\.246\.
RewriteRule .* - [F]
You may also include EXCEPTs in your primary data line:
# UA "contains and does NOT come from IP
RewriteCond %{HTTP_USER_AGENT} ^xpymep\.exe [NC]
RewriteCond %{REMOTE_ADDR} !^109\.230\.246\.
RewriteRule .* - [F]
