65.102.17.89 just tripped a site trapdoor

this IP appears in a removed message?

[amznVibe]

Someone just violated my robots.txt rule and tripped my site trap door. They used a valid agent:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

The previous message thread here with the ip 65.102.17.89
was removed so I cannot checkup on it.
Can't find anything about this block other than it belongs to US West.
Anyone have any other info?

Trying 65.102.17 at ARIN

OrgName: U S WEST Internet Services
OrgID: USW

NetRange: 65.100.0.0 - 65.103.255.255
CIDR: 65.100.0.0/14
NetName: USW-INTERACT99-2BLK
NetHandle: NET-65-100-0-0-1
Parent: NET-65-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.USWEST.NET
NameServer: NS2.DNVR.USWEST.NET
NameServer: NS3.MN.USWEST.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2001-01-03
Updated: 2002-08-12

TechHandle: ZU24-ARIN
TechName: U S WEST ISOps
TechPhone: [phone]
TechEmail: [e-mail]

[jdMorgan]

amznVibe,

Going direct to ARIN [arin.net] reveals this IP as belonging to our "friends" at WebContent International.

Jim

[amznVibe]

Ah thanks JD!

Would you know the proper rule to block the
entire range 65.102.17.88 - 65.102.17.95
instead of just this?

SetEnvIf Remote_Addr ^65\.102\.17\.89$ ban

is the following correct? (my best educated guess)

SetEnvIf Remote_Addr ^65\.102\.17\.(8[8-9]¦9[0-5])$ ban

-aV-

[jdMorgan]

Good guess...
If it gives any errors, try surrounding it with " quotes.
Jim

[blockwci]

I just got beat on by the same and did a Google search on
their IP and wound up here. I think I'll ban them for life
no matter where they move.

To keep track of their IP addresses, I go to
[ws.arin.net...] and enter
"web content international" in the search field.
I receive a list that looks something like this:

(WCI-12)
USW-WEBCO-INTL (NET-63-227-217-192-1) 63.227.217.192 - 63.227.217.199
USW-WEBCOI (NET-63-227-221-8-1) 63.227.221.8 - 63.227.221.15
WEBCOI-1 (NET-65-102-12-224-1) 65.102.12.224 - 65.102.12.231
WEBCOI-7-1 (NET-63-229-140-40-1) 63.229.140.40 - 63.229.140.47
WEBCOI-7-2 (NET-65-100-40-32-1) 65.100.40.32 - 65.100.40.39
WEBCOI-7-4 (NET-63-230-174-24-1) 63.230.174.24 - 63.230.174.31
WEBCO-4-3-PDX (NET-65-102-23-160-1) 65.102.23.160 - 65.102.23.167
WEBCO-DSL-3 (NET-65-102-17-40-1) 65.102.17.40 - 65.102.17.47
WEBCO-DSL-4 (NET-65-102-17-88-1) 65.102.17.88 - 65.102.17.95
WEBCO-DSL-5 (NET-65-102-17-56-1) 65.102.17.56 - 65.102.17.63
WEBCO-4-2-PDX (NET-65-102-23-152-1) 65.102.23.152 - 65.102.23.159
WEBCO-DSL-1 (NET-65-102-17-64-1) 65.102.17.64 - 65.102.17.71
WEBCO-DSL-6 (NET-65-102-17-48-1) 65.102.17.48 - 65.102.17.55
WEBCO-DSL-7 (NET-65-102-17-32-1) 65.102.17.32 - 65.102.17.39
WEBCO-DSL-8 (NET-65-102-17-104-1) 65.102.17.104 - 65.102.17.111

Then, I plunk this into Apache's httpd.conf

# Web content International bozos USW-WEBCO-INTL
Deny from 63.227.217.192/29
Deny from 63.227.221.8/29
Deny from 63.229.140.40/29
Deny from 63.230.174.24/29
Deny from 65.100.40.32/29
Deny from 65.102.12.224/29
Deny from 65.102.17.0/24
Deny from 65.102.23.152/29
Deny from 65.102.23.160/29

and I stick a yellow postit with "web content international"
on my monitor that I can look at if I ever feel too calm.

Cheers!

[pardo]

I'm pretty new and also been visitid by webcontent international. Who are they and what are they doing with the pages?

[amznVibe]

Pardo, this google groups thread says it all (or what's really known)
[groups.google.com...]

[DavidT]

I just got hit tonight by webcontent, can someone, hopefully JDMorgan, remind me again how to block an IP address and an IP _range_ using:
RewriteCond %{REMOTE_ADDR}

I know it's in other threads, cant find it.

[jdMorgan]

DavidT,

Latest version with blockwci's new input:

# WebContent International
RewriteCond %{REMOTE_ADDR} ^63\.227\.217\.19[2-9]$ [OR]
RewriteCond %{REMOTE_ADDR} ^63\.227\.221\.([89]¦1[0-5])$ [OR]
RewriteCond %{REMOTE_ADDR} ^63\.229\.140\.4[0-7]$ [OR]
RewriteCond %{REMOTE_ADDR} ^63\.230\.174\.(2[4-9]¦3[01])$ [OR]
RewriteCond %{REMOTE_ADDR} ^65\.100\.40\.3[2-9]$ [OR]
RewriteCond %{REMOTE_ADDR} ^65\.102\.12\.2(2[4-9]¦3[01])$ [OR]
RewriteCond %{REMOTE_ADDR} ^65\.102\.17\.(3[2-9]¦[4-6][0-9]¦7[0-1]¦8[89]¦9[0-5]¦10[4-9]¦11[01])$
RewriteRule !^(403.*\.html¦robots\.txt)$ - [F]

This blocks WCI from all files except robots.txt and those named "403<something>.html, which are my custom 403 pages. Can't say I'm not being fair... :)

Remember to replace all the "¦" characters above with the one from your keyboard!

Jim

[DavidT]

Thankyou very much jd. You may have missed the 65.102.23 range which as I speak is banging away fruitlessly at my image folders.
Thankyou again.

[jdMorgan]

Cut-n-paste error! Doh!

add:

RewriteCond %{REMOTE_ADDR} ^65\.102\.23\.1(5[2-9]¦6[0-9])$

with [OR] as appropriate.

Fruitless attempts are fun to watch... :)

Jim

[amznVibe]

is it perfectly okay to use SetEnvIf Remote_Addr or Deny from
for these address ranges? Which is the prefered technique?

The site trapdoor code writes a SetEnvIf Remote_Addr at the top of
the .HTACCESS which I would think is the quickest way to get rid of pests?
I suppose if a site didn't have mod_rewrite SetEnvIf Remote_Addr is best?

[jdMorgan]

amznVibe,

is it perfectly okay to use SetEnvIf Remote_Addr or Deny from for these address ranges?

Yes.

Which is the prefered technique?

SetEnvIf will "feed" into a "Deny from", so you hav a choice of either "both" or "Deny From" alone. I'd say whichever works best with your file structure...

The site trapdoor code writes a SetEnvIf Remote_Addr at the top of
the .HTACCESS which I would think is the quickest way to get rid of pests?

I use a script (forum member key_master's) - probably the same one you're using. After examining the SetEnvIf statements it has added to .htaccess, I decide whether they merit a permanent ban, and if so, whether the IP address is the most effective way to ban them. If it is, I look for address ranges into which the newly-trapped address might fit, so as to combine the new with the old for better coverage - as shown by the rewrites I posted with multiple address ranges. The idea is to use as few .htaccess directives as possible to cover as many bad IP addresses as possible, without banning Joe surfer whose address happens to lie between two bad guy's addresses...

I use mod_rewrite simply because I'm more comfortable with it, and because it allows me to easily make exceptions. For example, the code I posted above still allows even presumed-bad guys to read robots.txt and to request my custom 403 pages which explain why their accesses have been blocked. Bad bots will never request the custom 403 pages, but browsers will. Since I do occasionally trap a nosy-but-otherwise innocent surfer, these custom pages explain why it happened and tell the visitor what to do to get the ban lifted. The pages also contain an apology in case an innocent visitor gets banned due to a typo or configuration error - basically a public-relations thing.

The same thing can be accomplished using the "Deny From" method:

 
SetEnvIf Remote_Addr ^216\.139\.176\.139$ getout # Fri Jan 17 06:52:17 2003
...
# Block bad-bots using "getout" variable from records written by bad_bot script
SetEnvIf Request_URI "^(/403.*\.html¦/robots\.txt)$" permit
<Files *>
order deny,allow
deny from env=getout
allow from env=permit
</Files>

One other consideration: Some servers will log denied accesses generated by "Deny From" - but not those generated by mod_rewrite - to your error log. So you may prefer one approach over the other for that reason.

I suppose if a site didn't have mod_rewrite SetEnvIf Remote_Addr is best?

It can make the "code" easier to understand and maintain, yes.

HTH,
Jim

[aodonline]

This is all new to me as I have always been on the design side of things. Now I'm doing both so I need guidence.

Whats this "tripped my site trap door" you guys are talking about. Sounds like it might be a good thing setup on my sites.

[jdMorgan]

aodonline,

Welcome to WebmasterWorld [webmasterworld.com]!

This thread [webmasterworld.com] may be useful to get you started.

Jim