How do you block an IP if it is spoofed? - GoFuckYourself.com

RMG · 11-18-2002, 06:10 AM

I'm getting loads of shit hitbot/leech traffic from

n167068.ap.plala.or.jp
219.165.167.68

This is obviously BS information because I've blocked this ip in my htaccess and the shit is still comming in.

Any ideas?

notjoe · 11-18-2002, 06:12 AM

Quote:

Originally posted by RMG
I'm getting loads of shit hitbot/leech traffic from

n167068.ap.plala.or.jp
219.165.167.68

This is obviously BS information because I've blocked this ip in my htaccess and the shit is still comming in.

Any ideas?

Use ipfw (if you're running fbsd) or some sort of firewall tool and just drop the ip. see if you still get hits from it. If you're running FreeBSD i can give you some rules to ensure non spoofing ips only connect to your machine.

RMG · 11-18-2002, 07:01 AM

Is there a way to find out and block it in htaccess?

I have no idea what is, but its saying one of my other sites is sending hundreds of raw hits per hour to another one of my sites.

On the site supposedly sending these hits, there is nothing funny looking in the trade admin at all.

wsjb78 · 11-18-2002, 07:29 AM

you can ignore it with HTAcccess... or even redirect it.... it's somewhere in the "Deny" section.... I'd need to look the correct syntax up.

RMG · 11-18-2002, 07:40 AM

i'm all ears.

right now i have

order deny,allow
deny from 219.165.167.68
allow from all

and i'm still getting the shit.

pr0 · 11-18-2002, 08:35 AM

Thats not spoofed

When you start getting hits from...

6.6.6.6

and

1.3.3.7

Thats a spoof bot/attack

NetRodent · 11-18-2002, 09:23 AM

Even if you "block" an ip in htaccess, the request will still go into the logs. If it is properly blocked, the response code should be something like 403 instead of 200.

11-18-2002, 06:10 AM	#1
RMG Confirmed User Join Date: Apr 2002 Posts: 542	How do you block an IP if it is spoofed? I'm getting loads of shit hitbot/leech traffic from n167068.ap.plala.or.jp 219.165.167.68 This is obviously BS information because I've blocked this ip in my htaccess and the shit is still comming in. Any ideas?

11-18-2002, 09:23 AM	#7
NetRodent Confirmed User Join Date: Jan 2002 Location: In the walls of your house. Posts: 3,985	Even if you "block" an ip in htaccess, the request will still go into the logs. If it is properly blocked, the response code should be something like 403 instead of 200. __________________ "Every normal man must be tempted, at times, to spit on his hands, hoist the black flag, and begin slitting throats." --H.L. Mencken

11-18-2002, 07:01 AM	#3
RMG Confirmed User Join Date: Apr 2002 Posts: 542	Is there a way to find out and block it in htaccess? I have no idea what is, but its saying one of my other sites is sending hundreds of raw hits per hour to another one of my sites. On the site supposedly sending these hits, there is nothing funny looking in the trade admin at all.

11-18-2002, 07:29 AM	#4
wsjb78 Confirmed User Join Date: Jun 2002 Location: Cyberspace Posts: 594	you can ignore it with HTAcccess... or even redirect it.... it's somewhere in the "Deny" section.... I'd need to look the correct syntax up.

11-18-2002, 07:40 AM	#5
RMG Confirmed User Join Date: Apr 2002 Posts: 542	i'm all ears. right now i have order deny,allow deny from 219.165.167.68 allow from all and i'm still getting the shit.

11-18-2002, 08:35 AM	#6
pr0 rockin tha trailerpark Industry Role: Join Date: May 2001 Location: ~Coastal~ Posts: 23,088	Thats not spoofed When you start getting hits from... 6.6.6.6 and 1.3.3.7 Thats a spoof bot/attack