Subject: Re: access_log?
From: Jon (champoux@mediaone.net)
Date: Wed Jan 23 2002 - 21:29:16 MST
on 1/23/02 7:21 PM, Zeke Runyon at zrunyon@mac.com wrote:
>
> On Wednesday, January 23, 2002, at 07:12 PM, Jon wrote:
>
>> The thing about blocking the IP is that it chages every request. I
>> would
>> end up blocking hundreds of IP's
>
> That isn't entirely true- I've had the same IPs hit me different times
> and dates. But I do agree that blocking the IPs wouldn't be very
> efficient, it would be nice if we could just block the requests
> themselves...
>
> I noticed that most of the offending IPs are in the form of 65.*.*.*, 65
> in the first set of numbers in the IP... I'm on roadrunner, which is
> 65.31.*.*, but some of the requests are from other ISPs. Any certain
> pattern to the IPs that attack your servers?
>
> :::
>
> # Zeke Runyon, zrunyon@mac.com
> # web: communistsquirrel.home.dhs.org (formerly zekeworld)
> # linux: gloin.dyn.dhs.org
> # Mac OS X 10.1.2 5P48 | OS 9.2.1 | Yellow Dog Linux 2.1
> # Communist squirrels shall rule the world.
>
Yes, roadrunner, mediaone, attbi....
For New England, I think all ip's start with 24.128....at least for now.
That is where all the request are coming from. I sent in the edited access
log to mediaone abuse. I know someone has a creative way of blocking the
request but it's not very high on my priority list. I was just floored when
I saw 2mb ( not really that big, but for a not public web server it is..) in
the accerss log.
This archive was generated by hypermail 2a24 : Wed Jan 23 2002 - 21:44:55 MST