Forum Moderators: phranque
the link doesn't give me any answers (that I can understand), but I noticed this ip:
192.168.0.0 ...similar to my router.
So is somebody simply accessing my site from their home network?
The "referring page" is always something strange like:
*.*.*.*:*/cgi-bin/blockOptions.cgi
or
*.*.*.*:*/cgi/warn.cgi
They appear 2-4 times a month, each and have been for the past 6+ months.
If I block all 10.* IPs via htaccess, will I also block people with IPs like:
65.10.... etc. etc...
The [address blocks you mentioned] are reserved for use on private networks, and should never appear in the public Internet. There are hundreds of thousands of such private networks (for example home firewalls sometimes make use of them). The IANA has no record of who uses these address blocks. Anyone may use these address blocks within their own network without any prior notification to IANA.from: [iana.org...]
The blackhole servers are part of IANA that you normally shouldn't see. The servers respond to inverse queries regarding non-routable IPs. (private IPs) Basically, if your network is asking the internet for something that's not supposed to be out there, the blackhole servers will respond. A local address of 192.* or 10.* should not be leaking out from your local network, and since they are, someone has to answer the DNS's question. The DNS asks what server those IPs belong to, and the answer to that comes from the IANA.org servers. You need to get your network admin to look at this because it appears that your local IPs are "leaking" onto the internet.
Instead of looking at the referrer IP address, it's generally more useful to look at the requesting IP address.
Jim
If you mean to catch them when they're online, I've never been able to spot them in action to see if the person's IP was the same. Is there a way to check some sort of logs for that?
