Multiple hits from 6 IPs to deleted image

Two IP neigborhoods

[slipkid]

Getting 40+ hits a day from 6 different IPs (two separate neighborhoods) to same deleted image for which server returns a 404.

IP neighborhood number 1
61.135.217.nn

"GET /image.jpg HTTP/1.1" 404 510 "http://www.example.com" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.79 Safari/535.11"


IP neighborhood number 2
27.18.185.nnn

"GET /image.jpg HTTP/1.1" 404 510 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; KBMINI4WD)"

This has been going on for weeks. The bad guy does not get that it is getting a 404 and should go away and get lost.

[lucy24]

My first guess would have been: just another crummy hotlink stuck on a page whose owner never bothers to look at it. If you're brave, you could check the referer. From someone else's computer, heh heh.

Except that you wouldn't want to.

The first IP is in the middle of a vast Chinese block, 61.128.0.0/10, that came up in another thread just the other day. And what do you know, the other one's China too. 27.8.0.0/13 and 27.16.0.0/12 side by side.

You could slam the door in their faces, though a 404 doesn't really use any more server resources than a 403. It's just the principle of the thing.

[phranque]

you could use mod_rewrite to supply a 410 Gone or 403 Forbidden response.
either status code is a "stronger" signal than a 404 and handling this request in mod_rewrite should take less server resources, although 40 requests/day won't hurt anything.

[slipkid]

Thought I would post this as I am trying to learn how to play in the sandbox. :)

Logs revealed today who the offending referrer is: youdao.com.

For the longest time, I got daily hits from 1.202.218.n, as if it was trying to capture Pork Chop Hill on a 2 hour schedule of attacks. Waved my magic 403 wand, but still came back. Seems gone now. Those wile Chinese.