mail.ru has long been known for sending unsavoury bots ;o)
I have all of RU and former republics blocked. For my sites it makes sense; a) because of all the crap coming from these locations b) the average Joe/Jane Tovarish is more likely to search in their own language than in english I have as yet not missed one genuine visitor from these locations
Pfui
3:02 pm on Oct 29, 2011 (gmt 0)
I have all of RU and former republics blocked.
Ditto. And .rs and .ua and .kz and on and on. FWIW re OP's CIDR:
You forgot .su itself. Now used only for fake referers ;) I assume the same goes for .sa unless you have the world's most bland and innocuous family-friendly site. (Are they even allowed on the internet? News to me...)
keyplyr
11:36 pm on Oct 29, 2011 (gmt 0)
@ dstiles
Well what I'm looking at says that the route of netBridge Services is 217.69.128.0/20 but that the range allocated to mail.ru is just 217.69.128.0/21. Thanks for the heads-up and if I see more problems above that, I'll widen the block.
dstiles
9:58 pm on Oct 30, 2011 (gmt 0)
Lucy - I've never seen SU in a DNS record so it's never been a problem. SA I've included above. The codes I've used are the IANA country identifiers which are not always the same as the domain extension: main example: GB for .UK. Although UK is possible I've never seen it in a DNS record.
Pfui
12:16 am on Oct 31, 2011 (gmt 0)
dstiles: I'm not sure if this is what you mean you haven't seen, but I did last year:
tor-exit.aof.su Opera/9.20 (Windows NT 5.1; U; en)
