Partial 403 bans...

when banned by IP?

[pendanticist]

This puzzles me.

Why is it that only certain formmail queries are banned via 403 when I have the IP itself banned?

202.30.243.63 - - [17/Mar/2003:09:44:31 -0800] "POST /cgi-local/FormMail.pl HTTP/1.0" 200 876 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:31 -0800] "POST /cgi-bin/FormMail.cgi HTTP/1.0" 200 876 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:31 -0800] "POST /cgi-bin/FormMail.pl HTTP/1.0" 200 876 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:31 -0800] "POST /cgi-bin/Formmail.pl HTTP/1.0" 200 876 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:31 -0800] "POST /cgi-local/FormMail.cgi HTTP/1.0" 200 876 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:33 -0800] "POST /cgi-bin/Form.pl HTTP/1.0" 403 213 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:33 -0800] "POST /cgi-bin/Form.cgi HTTP/1.0" 403 214 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:33 -0800] "POST /cgi-local/Form.pl HTTP/1.0" 403 215 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:33 -0800] "POST /cgi-local/Form.cgi HTTP/1.0" 403 216 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:33 -0800] "POST /cgi-local/Formmail.pl HTTP/1.0" 200 876 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:33 -0800] "POST /cgi-local/Formmail.cgi HTTP/1.0" 200 876 "-" "Mozilla/4.06 (Win95; I)"
202.30.243.63 - - [17/Mar/2003:09:44:33 -0800] "POST /cgi-bin/Formmail.cgi HTTP/1.0" 200 876 "-"

Anyone?

Pendanticist.

[Jack_Straw]

A little pattern recognition test?

Look closely to discover that the requests that are 403ed are for a different program name ( Form.* instead of FormMail.* ). Maybe FormMail is caught by a special filter and processed differently?

That can't addres the issue of the IP ban not working. I have no clue about that.