Forum Moderators: phranque
The ip address resolves to different ip addresses that belong to 3 or four different isp's. I basically want to ban the whole country.
You've got a big job ahead of you :). I'll start you off with the first IP block (using the SetEnvIf method).
SetEnvIf Remote_Addr ^61\.[0-3]\. ban<Files ~ "^.*$">
order allow,deny
allow from all
deny from env=ban
</Files>
Then stick the .htaccess file in the root directory of your site.
or try the NMS version, v1.87 - May 24, 2002
[scriptarchive.com...]
anyone know of other replacements out there that are even more robust?
Key_Master, and what's next? What about other IP blocks? There are the whole bunch. :( Is there any easier method?
Also I would like to know how to ban just a small IP range. Lets say I want to ban 10.10.10.150 - 10.10.10.255. If I just put 10.10.10. it will ban the entire map, but I just want to ban only those starting from 150 and up to 255. Is there a way to do it without "SetEnvIf Remote_Addr" thing?
Keymaster,
Looking at the first block, did you extrapolate the first numbers from this?
61.0.0.0-61.3.255.255
And, also, How would I proceed to the next block, should I duplicate all the file endings and closings, or put the next ip range beneath the previous?
SetEnvIf Remote_Addr ^61\.[0-3]\. ban
SetEnvIf Remote_Addr ^61\.11[0-127]\. ban
<Files ~ "^.*$">
order allow,deny
allow from all
deny from env=ban
</Files>
or
SetEnvIf Remote_Addr ^61\.[0-3]\. ban
<Files ~ "^.*$">
order allow,deny
allow from all
deny from env=ban
SetEnvIf Remote_Addr ^61\.11[0-127]\. ban
<Files ~ "^.*$">
order allow,deny
allow from all
deny from env=ban
</Files></Files>
[edited by: heini at 3:04 pm (utc) on Jan. 30, 2003]
[edit reason] fixed missing BBS code [/edit]
martinibuster, you got the right idea with your first example. Except the block should look like:
SetEnvIf Remote_Addr ^61\.11\.([0-9]¦[1-9][0-9]¦1[0-1][0-9]¦12[0-7])\. ban
The red portion bans numbers that fall between 0-9
The blue portion bans numbers that fall between 10-99
The green portion bans numbers that fall between 100-119.
The last blue portion bans numbers that fall between 120-127.
Remember, the broken pipe (¦) needs to be replaced with a solid vertical pipe.
Thus, there are three very simple defenses against these scans:
1) use the latest version of formmail
2) rename the cgibin folder into something random like eftesfge
3) rename formail to something either random or descriptive like OrderMail
So, there's really no need to block any IPs
If you follow the above advice, the scanners will just get 404s
yours in happy hacking
Bjarne, Danmark
order allow,deny
allow from all
deny from 61.0.0.0/14
deny from 61.11.0.0/17
But unless you block the whole world you'll only cut down a bit on the number of formmail scans. Like Bjarne suggests, a more reasonable solution for this is to make sure your scripts are safe, and to name them something other than formmail.
It's not so much hacking. No one's hacking my formmail. I'm just receiving bogus form submissions from India.
As I mentioned in an earlier post, this is not about formmail scans. My formmail is secure.
This is some sissy in India who is acting like a little girl, and making phony submissions.
The little bugger is blocked now, though. Heh-heh.
...acting like a little girl, and making phony submissions.
So you ban an entire continent? Well, sub-continent, but none the less what's next? Oakland?
T
In fact it would be undeniably stupid to do it that way ;-)
First off, why are you going to block entire countries? Why don't you just block the actual form submissions?
I mean unless you actually dislike traffic :-)
You need a script that will resolve the source country from the IP address and then dicard form submissions based on that data. You can either do this on the fly (will cause a minor slowdown) or perodically in the background.
This is easier to do in PHP than in Perl but either will work.
Lol... There is never a reason to ban an entire country! Filter all you want, but don't ban.
unless you actually dislike traffic :-)
India is undisputably one of the great countries of the world with one of the richest, most beautiful history and culture. I have a high regard for India and for it's people.
However, the web site is local to the U.S. It's exclusively a U.S. market. No skin off my b*tt to ban India.
So what you have is some code that has to run every single time a request is made to your site (instead of just for form submissions)... and it doesn't really work in the first place ;-)
I was getting about 20 forms a day with stuff like:
"ho ho happy day. Good job is important"
It was driving me nuts...
I'd love to know what it was all about and what the motivation was.
what the motivation was.
Insecure little girl.
No MAN would do something like that.
Has to be a little girl.
:) Y
The red portion bans numbers that fall between 0-9
The blue portion bans numbers that fall between 10-99
The green portion bans numbers that fall between 100-119.
The last blue portion bans numbers that fall between 120-127.
Remember, the broken pipe (?) needs to be replaced with a solid vertical pipe.
==== this is a reply on above code ==============
i want to banned certain ip adresses all coming from:
UserAgent: FAST-WebCrawler/3.6 (atw-crawler at fast dot no; [fast.no...]
IP address: 66.77.73.151
i get way to many visits from this spiderbot
There all coming from: 66.77.73.01 up to 66.77.73.251 or even higer
is there a sort wilcdard to block them all at once ...
i now try this:
SetEnvIf Remote_Addr ^66\.77\.73\.([0-9]¦[1-9][0-9]¦1[0-1][0-9]¦12[0-9]¦13[0-9]¦14[0-9]¦15[0-9]¦16[0-9]¦17[0-9]¦18[0-9]¦19[0-9])$ ban
but it only blocks thill 01 to 199 and its a long line ...
why is this not working?
SetEnvIf Remote_Addr ^66\.77\.73\.*$ ban * is often used as wildcard it would be a lot easyewr but it aint working ;-(
or can i write something like:
SetEnvIf Remote_Addr ^66\.77\.73\.([0-300])$ ban is this posible?
SetEnvIf Remote_Addr ^66\.77\.73\. ban
i am kinda all new to this ...
but i know there had to be a shorter way to block them all coming from this provider ;-)
this forum rules...
i learn a lot from it
