conducent ip?

[coffeebean]

I'm getting over 3,000 POST requests a day that look like this:

http:/contents.conducent.com:80/BeginSession

They come from 172.197.158.162 and previously from 172.197.190.141. Both IPs owned by AOL.

The server returns 405.

It always starts with a POST to /cgi-bin/vcp.cgi followed by GET for http:/bootstraps.conducent.com:80/scripts/BootstrapServer.dll

1) What is this thing?
2) What action should I take to make it go away?

Thanks

[sidyadav]

Welcome to WebmasterWorld, coffeebean!

First check if its causing any sort of desortion to your site (ie. Bandwidth etc.) and if it is and you truely want to remove it, make a .htaccess file if you already have one or made one, put this code anywhere in the .htaccess file:

<Limit GET>
order allow,deny
allow from all
deny from 172.197.158.162
deny from 172.197.190.141
</LIMIT>

and there you go! you've just banned the IP.

But the problem is this IP is from AOL. And it could be that this is not a bad IP.

What is the HTTP User-Agent string of it?

Sid

[coffeebean]

Thanks sidyadav! Yes I worry about banning legit traffic from AOL. No user-agent, just a "-".

[sidyadav]

hhmmm... Might be a suspicous one. What I'd do is see if you get many hits from other things from AOL and other IPs from AOL, if this is the only one, I'd suggest you ban it.

But, Not forgetting that this can be a IP actually coming from someone from AOL for some sort of use.

Its very hard Identifying a spider with its IP.

Sid

[BlueSky]

This will only block out GET requests not the POST ones. You need to add that one as well. If they are using HEAD or any other requests then add them to the directive too.

I recommend you file a complaint with AOL and send them a copy of your logs pertaining to this. Request they track down their abusive customer and terminate him.