Forum Moderators: open

Message Too Old, No Replies

No IP

IP of bot just a dot

         

farflappin

3:30 pm on Jul 23, 2008 (gmt 0)

10+ Year Member



Starting from today, I have been hit three times by a bot with the IP -

. - -

and using - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Any ideas as I can't get a Whois or do anything sensible with it to even start to pin it down. It seems to love a forum.

Anyone else or any ideas?

wilderness

8:27 pm on Jul 23, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Welcome to Webmaster World.

The omission of IP is likley just a server error.

I get them occassionally on my "el cheapo" host.
And had them previously on a host which rather than providing raw logs, provided some generated logs via a script.

Don

farflappin

9:18 pm on Jul 23, 2008 (gmt 0)

10+ Year Member



Cheers Don and thanks for the welcome.

Funny you should say server error as I've let them know about it but in truth, this is the first one that I've had with my server. That's with this site and one that I ran with them, previously, for a couple of years.

The update is that it's now four hits, hitting about 30 each time at 3 a second.

It's coming in on Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

This might be spoofed as I'm not certain if this one should have the compatible; bit. I don't pretend to understand these.

It's a tad worrying when you can't get a bit of a handle on the IP.

Ray

wilderness

9:33 pm on Jul 23, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



It's a tad worrying when you can't get a bit of a handle on the IP.

Not sure if this will work?

# deny if IP equals - -
#keep_out (or whatever term you use)
deny from " - -" keep_out

jdMorgan

12:06 am on Jul 24, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



It's impossible to get a response from a server if you don't tell it who (IP address) to respond to. This is a logging error, plain and simple.

Jim

farflappin

12:56 am on Jul 24, 2008 (gmt 0)

10+ Year Member



wilderness, many thanks but I'm going along with server log error as a fresh set of logs show differences in the Mozilla ref. So, perhaps the hits are coming from different sources. With that, I've got to go with Don and Jim, that it's down to logging errors.

Again, many thanks for your all your help.

Ray

thetrasher

8:38 am on Jul 24, 2008 (gmt 0)

10+ Year Member



. - -

"." = Reverse DNS
Disable automatic reverse DNS lookup!

farflappin

3:21 pm on Jul 24, 2008 (gmt 0)

10+ Year Member



Ah Ha! I say, in ignorance. I'm fairly up on general site cobbling such as php and sql and that extends a bit to htaccess use of IPs and such like but I hold my hand up to only a scant knowledge of the actual nuts and bolts of DNS MX and things of such ilk.

What would the effect be of disabling auto reverse DNS lookup in this instance? Also, would it affect my logs for example or other aspects of site monitoring?