Forum Moderators: open
68.37.53.113 - - [13/Aug/2002:02:15:22 -0400] "GET /_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=2614&STRMVER=4&CAPREQ=0 HTTP/1.1" 302 306 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
68.37.53.113 - - [13/Aug/2002:02:15:22 -0400] "GET /error_docs/not_found.html HTTP/1.1" 200 1453 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
68.37.53.113 - - [13/Aug/2002:02:15:22 -0400] "GET /MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=2614&STRMVER=4&CAPREQ=0 HTTP/1.1" 302 306 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
68.37.53.113 - - [13/Aug/2002:02:15:22 -0400] "GET /error_docs/not_found.html HTTP/1.1" 200 1453 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
I obviously don't want this joker poking around my site looking for exploits. BUT how would I ban him/her?
I can't ban everyone with Mozilla/4.0 or ban everyone who comes from that IP address (which belongs to Comcast Cable Communications by the way).
What to do....
Also, you can contact your host and inform them - they can ban the person/ip from entire server.
[webmasterworld.com...]
[incidents.org...]
This is no average joe I am afraid. He also was looking for /formail.cgi as well..
The info was appreciated.
<Limit GET>
Order Allow,Deny
Allow from all
Deny from 68.37.53.113
</Limit>
Since its comcast, that's most likely a static IP on cable. You wouldn't ban anyone else. It won't matter the UA or the file requested. That IP will be banned from all GET requests.
deny from user.host.com
Specifically, how do I:
deny from user.host.com?
Right now the IP resolves to:
bgp453514bgs.avenel01.nj.comcast.net
Isn't that just banning the same IP?
If its a proxy cache, then, yes, that will ban a bunch of users. (doesn't look like it though). And if they're on a router, yes, it could ban an entire company or anyone on the same intranet.
PS for frontpage..
If you don't have formmail anywhere around, then this is probably a waste of time anyway. That user will just get 404's anyway.
deny from bgp453514bgs.avenel01.nj.comcast.net
Isn't that just banning the same IP?
Nope, it is not. I am using Cox High Speed Internet [and I love it - about 3mbps + speed here :)] and I am sharing IP with *quite a few people*, however, I have a ipxx.xx.xx.xx.ok.ok.cox.net and other person is more likely to have different name [as far as I have seen]. So if you were to ban my IP, then you are blocking many other people, however if you ban my hostname, you are only blocking me :(
remember, by using above line, you are not blocking the whole IP. Now if the person is using dialup, then more likely he can still come back, but if he is using cable internet, than he is blocked cuz, he *cannot* [as far as what I know] change the hostname [he will have to ask for IP change or will have to change/move his address or pay more for another line ;)] easily.
I am sure you know how to make .htaccess file. [also if you are using front page, then your .htaccess file will already have some codes in it, just add the line at the bottom]
Hope this will help.
This configuration will cause the server to perform a reverse DNS lookup on the client IP address, regardless of the setting of the HostnameLookups directive.
Of course, if the server is not set to do reverse DNS lookups, the user.host.com won't be looked up. If it is, it will put an extra burden on the server.
The deny directive:
This directive allows access to the server to be restricted based on hostname, IP address, or environment variables. The arguments for the Deny directive are identical to the arguments for the Allow directive.
Isn't that just banning the same IP?
