Help - Am I attacked?

[newbies]

Hello,

Recently I found that my site gets tons of hits from this IP 220.95.221.* (the last digit varies) which takes up to 3G bandwidth every day and sometimes cramps my server. I could not find whom the IPs belong to. Are they from crawler or attackers? If it is attack, can I block the IP?

Thank you for your help.

[Jazeker]

Hi,

crawlers are unlikely to eat 3 gigs of bandwith. It might be an infected system. Anyway, if you use apache you can use the 'Deny from x.x.x.x' clause belonging to mod_access.

Have a look at [http.apache.org...]

(the module is in every standard apache install)

[mole]

The address block 220.88.0.0 - 220.95.255.255 is owned by Korea Telecom.
I would block the range which is troubling you and forget about them.

[new_shoes]

Mole, how did you find out who the ip range belonged to?

[mole]

well, first was just a hunch about where the 220.x.x.x range might be - I see it so often.
So I went to the APNIC site and used their whois tool.

[Matt Probert]

If you are going to block an IP address, or range of addresses, then ask your host to do it with iptables or whatever firewall they are running. That way you keep the client from even accessing the http server - which is what you want.

Matt