headers check

[wilderness]

On a whim (it's been posted many times), I decided to test the lines in this thread [webmasterworld.com] (Apache forum).

Some twelve hours later (course my site is not rumbling with activity) there have been two denies, both AOL users.
One coming from an AOL IP, and the other from a private IP.

Anybody have a clue if something in these lines catches AOL?

I use to have volumes of AOL users amongst the widget folks, these days its rare. Most have switched to mobile.

[keyplyr]

To get a definitive answer to your question, you'd probably need to post the 2 headers that were invalid according to the script. Were any of the server variables blank?

[wilderness]

according to the script

Thanks keyplr.

don't use any doggone scripts.

In any event, I've bigger dragons to sleigh temporarily.

Can I add an exception for UA's? to the header lines?

Don

[phranque]

those headers are typically sent by proxy servers and AOL users typically access web pages through proxy servers.

[keyplyr]

Don, try removing all instances of:

%{HTTP:XPROXY_CONNECTION}

[lucy24]

those headers are typically sent by proxy servers and AOL users typically access web pages through proxy servers.

Any way to distinguish between proxy users who can't help it and proxies that are up to no good?

I recently had to de-block one fairly loathsome IP because my local county government uses them as a proxy. Personally I wouldn't give a squat-- the government offices that visit my own site tend to be several thousand miles away-- but I have to let them into the art studio's site. They pay its rent. And we share that part of our htaccess.

[wilderness]

Thanks phran and keyplr.

Don

[keyplyr]

I use a mod_rewrite condition/rule to block prox(i|y) in UA and referrer. The AOL traffic doesn't display any of that (only in headers) so the ones that do are using a proxy service by choice, presumably to hide something.

[dstiles]

There are some proxy identifiers I've always found bad - I block those. But in any case I log all uses of a proxy and manually flip through them to check for abuse. G and Y feature prominently. :(

[wilderness]

I've had four valid users coming in on four valid searches.

They may be using proxies, however their certainly NOT do anything devious.