are these ips websense?

[leoo24]

I've been visited by these two ips everyday atleast once for a good while now, anybody know them?
64.156.198.76
64.156.198.74
i dont have user agents on my log analizer (using a lite version), but the browsers were nestcape, and os was linux.
Both gave a unknown.level3.net, here's the traceroute results
while i'm here can somebody point me in the right direction for banning ips, i saw a couple guys says they just greeted certain ip's with a 403, how would i do that?
cheers guys :)

traceroute to 64.156.198.74 (64.156.198.74), 30 hops max, 40 byte packets
1 xisco.ocea.es (62.22.150.1) 2.135 ms 1.72 ms 1.627 ms
2 Loopback0.GW1.MAD3.ALTER.NET (146.188.1.45) 11.421 ms 11.28 ms 11.29 ms
3 so-2-1-0.XR1.MAD3.ALTER.NET (146.188.8.229) 11.323 ms 11.273 ms 11.358 ms
4 so-0-0-0.TR2.MAD3.ALTER.NET (146.188.8.109) 11.344 ms 11.282 ms 11.333 ms
5 so-2-0-0.IR2.NYC12.ALTER.NET (146.188.8.178) 113.257 ms 113.17 ms 113.24 ms
6 0.so-1-0-0.IL2.NYC9.ALTER.NET (152.63.23.69) 113.231 ms 113.198 ms 113.233 ms
7 0.so-3-0-0.TL2.NYC9.ALTER.NET (152.63.9.186) 113.265 ms 113.246 ms 113.25 ms
8 0.so-1-2-0.XL2.NYC4.ALTER.NET (152.63.21.13) 113.468 ms 113.466 ms 113.442 ms
9 0.so-7-0-0.BR1.NYC4.ALTER.NET (152.63.21.81) 113.477 ms 113.602 ms 113.451 ms
10 so-0-0-0.edge1.NewYork1.Level3.net (209.244.160.181) 113.47 ms 124.204 ms 113.433 ms
11 so-4-0-0.gar2.NewYork1.Level3.net (209.244.17.81) 114.088 ms 113.514 ms 113.576 ms
12 so-7-0-0.mp2.NewYork1.Level3.net (64.159.1.185) 113.735 ms 122.262 ms 124.553 ms
13 so-0-0-0.mp2.SanDiego1.level3.net (64.159.0.254) 195.093 ms 192.25 ms 188.514 ms
14 gigabitethernet10-1.hsipaccess1.SanDiego1.Level3.net (64.159.3.94) 188.69 ms 188.674 ms 188.637 ms
15 unknown.Level3.net (209.245.121.110) 189.154 ms 189.077 ms 189.175 ms

[hakre]

can't tell you if these are websense, but your tracert is not complete to the ip you wrote about on top and infos about blocking specific ips can be found in this thread for example:

[webmasterworld.com...]

here is a quick workaround for your .htaccess:

Order Deny,Allow
Deny from 64.156.198.74
Deny from 64.156.198.76

good luck!

[wilderness]

leoo24,

The UA for that IP is "Mozilla/5.0 (X11; Linux i686; en-US; rv:1.0rc5; OBJR)"

I've had them denied for some time know. They really don't offer and explantion of who they are or their intent. And yet they continue (or at least attempt) to spider.
In addition the backbone provider is Level 3 which offers a variety of pests

[edited by wilderness 02/23/03]

here's an old thread on this IP
[webmasterworld.com...]

[leoo24]

cheers for the replies, yeah the tracert started just showing three stars after nš 15?
i looked at my htaccess and there's this line of code:

order deny,allow
allow from all
AuthType Basic
AuthName "Estadisticas Urchin"
AuthUserFile .htpasswd
<Limit GET POST>
require user me.mysite.com
</Limit>

but in the file it has black square boxes between each line, and its all on one line

should i put the deny ip at the end, and remove the "allow from all", or replace the allow from all with the deny?

oh yeah, and the htaccess file i found on my server was in
statistics-->urchin-->.htaccess
is that the right place?

[wilderness]

<snip>oh yeah, and the htaccess file i found on my server was in statistics-->urchin-->.htaccess
is that the right place? </snip>

Any htaccess in that particular folder would be specific to that folder and its sub-folders.

You should work with an htacess in your ROOT folder.

<snip>should i put the deny ip at the end</snip>

Any denies would be inserted BETWEEN these lines Ex:
order deny,allow
deny from 64.156.198.
allow from all

[Edited by wilderness 02/23/03]

BTW the black squares you referred to are because your viewing the file in NotePad and the black squares are line breaks.

I generally open the file in Wordpad and save it as a text file and it solves this viewing issue the next time I open with NotePad. Neither had I had any problem with line break conflicts as a result of this procedure.

[leoo24]

cheers wilderness, couldnt have wanted a clearer answer :)

[weesnich]

It looks like our "friends" now try different UA's like:

Mozilla/5.0 (compatible; Konqueror/3.0-rc5; i686 Linux; 20020704)
Mozilla/5.0 (compatible; Konqueror/3.1-rc3; i686 Linux; 20020903)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312464)

Only for the first UA I got the IP 64.156.198.76, the other where resolved to unknown.level3.net, but they fit into previous access-patterns.

On the one hand I'm pleased to see that they finally got the message of months of 403's, but I would prefer that they simply stop trying to access my site instead of lying even more (I deny them by IP anyway).

[wilderness]

Weesnich,
Since I have them 403'd I stopped paying attention to the UA's :(
I looked at my yesterday visits from "those folks" :) and saw two of the UA's you mentioned.

Thanks for the heads up

Don

[jdMorgan]

Here are the regex patterns I'm using:

^63\.212\.171\.(12[89]¦1[3-9][0-9]¦2[0-4][0-9]¦25[0-4])$
^64\.156\.198\.(7[4-8]¦80)$

63.212.171.128-199, 63.212.171.200-254, 64.156.198.74-78, 64.156.198.80

Jim