Success in getting annoying someone/bot stopped

Hits coming from Cablevision IP

[slipkid]

I was getting hits on the order of 50-100 per day for many months from the following:

74.88.242.147 - - [07/Apr/2015:00:14:02 -0400] "GET / HTTP/1.0" 403 202 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10"

Whois specifies the IP is from:

Stamford Optimum Online - Cablevision Systems Corp

74.88.0.0 - 74.90.255.255
74.90.0.0/16
74.88.0.0/15

I sent an email to Cablevision at its abuse email, and to my surprise the "hits stopped coming."

I guess there is something to be said for contacting abusers and asking them nicely to stop banging away at our sites.

It would interest me to know if it was a user of the Cablevision IP or Cablevision itself.

Does anyone have an insight?

[keyplyr]

Could have been a human Cablevision subscriber for whatever reason (you didn't detail further behavior.) However it is more likely this account is compromised and being used by a third party script (bot) again for whatever reason.

Seems you've been blocking it (403) so what's the problem? I block thousands of hits each day. That's the way to handle it. Writing emails can get a bit tiresome at that level :)

[wilderness]

Do a google on 'IP Trace'.

The resulting web pages and their tools of exploration are quite varied in accuracy (the one I use still shows my IP for a provider I haven't had for more than a year (and I clean cookies and use CC Cleaner regularly).

However, for an approximate location the tools are useful.

This one shows as Passic, NJ, and likely a compromised machine (as keyplr suggested).

[keyplyr]

If you want visitors to your site, you may not want to block Cablevision ranges :)

[wilderness]

On one hand I agree with keyplr (at least regrding the complete 74.88-90 range), however on the other hand I disagree.
Just because a webmaster blocks a portion of a providers range, doesn't automatically result in denial of all that same providers ranges.
You may lessen the chance of innocents by using mod-rewrite with multiple conditions (generally IP and UA; however more conditions are viable).

In this instance
#UA contains Chrome/8.0 and comes from IP range
RewriteCond %{HTTP_USER_AGENT} Chrome/8\.0
RewriteCond %{REMOTE_ADDR} ^74\.88\.24[0-7]\.
RewriteRule .* - [F]

I'm currently using Chrome/42.?

[slipkid]

The behavior I noted is about all I can relate, other than the home page is the only file requested.

I do not block Cablevision. The IP got a 403 because of a block on the HTTP 1.0 protocol which has worked well for me in turning away bad guys.

The situation I detailed here is quite rare for me. I can count on one hand the number of instances of someone/bot banging away over an extended period of time. Generally, I ignore recurrent hit situations as this one as they usually go away. However, my reading of the Forum over the years and the attempts others have made to stop this type of behavior caused me this time to see if Cablevision would respond. As the behavior stopped, I am, of course, pleased. This was the first time I ever wrote an email asking for someone/some bot to stop banging away at my site. I was hoping the experts on the Forum had a greater insight than I had for who/it might have been culprit. The foregoing is why I posted the story. Aside from being informative, my post was a thank you for all the knowledge I have gained over the years in reading posts from folks like wilderness and keyplyr, among many others.

Thaks for the IP trace suggestion. I will look into it.

[keyplyr]

If you're blocking HTTP 1.0 you are blocking thousands of humans. Been there, done that... but then maybe you don't care.

[wilderness]

If you're blocking HTTP 1.0 you are blocking thousands of humans. Been there, done that... but then maybe you don't care.

Quite an exaggeration for somebody whom has not seen slipkid's raw logs. Perhaps you've been blessed with ESP ;)

[keyplyr]

Wilderness, let's do without the snide remarks OK?

I'm fully aware that blocking HTTP 1.0 is one of the strategies for filtering bad bots, and depending on your audience, it can be partially effective. However, I tried it for 6 months on several sites (all different themes) and blocked thousands of human visitors.

It all depends on your audience. If you have international visitors, it may be unwise to block HTTP 1.0. If you have visitors from schools, libraries, city & state gov'ts it may be unwise to block HTTP 1.0. The list goes on.

There are many environments that still use the HTTP 1.0 protocol. Hardly an "exaggeration."

[wilderness]

There are many environments that still use the HTTP 1.0 protocol. Hardly an "exaggeration."

Quite an exaggeration for somebody whom has not seen slipkid's raw logs.

[wilderness]

On one site, and the first four days of April.
Less than 50 visits with HTTP/1.0.
Half are from commoncrawl
one-third are from wikipedia
Most of the remaining from mj12
Two (four requests) are what might be considered 'actual visitors UA's', one from LACNIC (Venezuela), and another from a colo.

[Angonasec]

I also heartily recommend blocking HTTP/1.0

RewriteCond %{SERVER_PROTOCOL} ^HTTP/1\.0$ [NC,OR]

[keyplyr]

How can anyone actually recommend blocking people? When you block people they usually don't return. They don't understand why they couldn't access the site and probably think your site is broken or infected with a virus.

Because they don't return, you will never know the actual number of legit human users who, for a wide variety of reasons, are still using the HTTP 1.0 protocol. They don't share your site with others or place links to you on their sites. It's a downhill spiral.

I for one like traffic. My sites make me money :)