ban proxy-using intruder

[stefan009]

cache-mtc-am04.proxy.aol.com
----------------------------

I am getting a lot of the above entries with varying middle 4 digits starting with "a****x" e.g. am04. (as above) basically producing a lot of file not found errors as he searches for weak points in the file structure by the look of it. Trouble is it is going on.

As each entry is different.. does anyone know a way to ban this user using the cgi-bin/trap.cgi which I have installed, or just hard code something into the htaccess? any help appreciated.

regards, Steve.

[wkitty42]

ummm... methinks you need to look at that url a bit closer before hollaring wolf... AOL uses proxies to gather content for their users... what it seems that you are seeing is AOL refreshing their proxy cache and not someone looking for holes in your file structure... i suppose it is possible that that is what is being done by an AOL user but would seem to me to be pretty unlikely...

if you really want to block them, just block *.proxy.aol.com or even just *.aol.com but that's your choice...

have you moved things around on your site recently?

how long have you had the domain?

have you recently switched ip numbers?

there are numerous possible reasons why you are seeing the traffic that you are... that's all i'm trying to point out... if you really believe that someone is trying to hack your site, gather those logs and get hold of AOL's abuse department and let them know... maybe they can catch the culprit in the act...

[stefan009]

Yes,

there are entries in the log such as "/trial-use/trial-use.txt" for example, but there is no such file on the system, for some reason someone has typed a few exploratory lines in the address bar and received a file not found response.

The trouble is, and partly because of no spiders logged by awstats around that date, I put 2+2 together and got 5!

I will shut away my pet rotteiler trap.cgi for a little longer, he he!

thanks