ip banning

how do you know when?

[twtnyc]

this ip

<snip>

was on one of my sites for over four hours today '<snip>'

how do you know when to ban an ip, and when you read your access logs how do you recognize 'bad traffic/bots/etc'

[edited by: trillianjedi at 12:26 pm (utc) on June 8, 2007]
[edit reason] No specifics as per TOS, please [/edit]

[trillianjedi]

Hi twtnyc,

how do you know when to ban an ip, and when you read your access logs how do you recognize 'bad traffic/bots/etc'

Assuming you're doing this manaully, 75% gut instinct (experience) and 25% tell-tale signs. If automated, by setting bot traps - areas of the site that robots shouldn't be entering and humans will never see (hidden A tags in pages).

Tell tale signs are anything that indicates it's unlikely to be human - pulling pages too fast, pulling the HTML but no images (watch out, some genuine users will do that and there are some funny browsers out there). Unusual usage patterns (pulling every single page from a site or from a section).

Find out who owns the IP and do some digging.

What does your gut instinct tell you about it?

[twtnyc]

i've been watching the access logs and i think it's a competitor ...

this chick emailed me a month or so ago about some stuff that just made me lol and bounce her email to my lawyer, cuz she's out of her mind or stupid or possibly both.

i blocked it and things have calmed down back to normal.