Block An IP

[billc]

I have over the years had different ips hit my sites an unreasonable amount of times but after awhile they would stop. For over a month now IP 209.249.86.17 has hit several of my sites at all hours of the day and night. I wouldn't complain but it's happening hundreds of times everyday on several different sites.
I have read postings here where they say block the ip, but how do you do that??? I have a Pleask server.

Thanks in advance!!!

Bill C

P.S. Why would someone do this????

[wige]

It could be a DNS, or it could be a spambot that broke. Either way, you can block this through your htaccess file using a deny rule

Order allow, deny
Deny 209.249.86.17
Allow all

[kgun]

Correct if he is on an Apache server.

Related How to block a country from accessing my website? information using a PHP script etc.

[weegillis]

The UA on that IP asks for robots.txt. One supposes it would obey if you Disallow (once you find the robot name?).

We had 1 request (besides robots.txt) for the home page; that's it.

[Arctic Fox]

I do it using PHP:

<?php
if (strstr($_SERVER["REMOTE_ADDR"], "209.249.86.17"))     {exit;}
?>

Info I've found on that IP:

Visitor 209.249.86.17
IP Address 209.249.86.17
Date 06 Nov, Tue, 17:37:17
Net Speed Corporate/T1
Organization Kavam
Browser Firefox 2
Continent North America
Operating System Linux
Country United States
Screen Resolution Other
State / Region California
Screen Color 16 Bit (65K)
City Newark
Javascript Enabled



Might be the KavamRingCrawler.


ISP : ABOVENET COMMUNICATIONS
Organization : Kavam
Location : US, United States
City : San Jose, CA 95131


You could also send in a complaint to AboveNet, Kavam's ISP:

OrgName: Abovenet Communications, Inc
OrgID: ABVE
Address: 360 Hamilton Ave
City: White Plains
StateProv: NY
PostalCode: 10601
Country: US

ReferralServer: rwhois://rwhois.above.net:4321

NetRange: 209.249.0.0 - 209.249.255.255
CIDR: 209.249.0.0/16
NetName: ABOVENET-4
NetHandle: NET-209-249-0-0-1
Parent: NET-209-0-0-0-0
NetType: Direct Allocation
NameServer: NS.ABOVE.NET
NameServer: NS3.ABOVE.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 1998-06-15
Updated: 2001-04-27

RTechHandle: NOC41-ORG-ARIN
RTechName: AboveNet NOC
RTechPhone: +1-877-479-7378
RTechEmail: noc{at}above.net

OrgAbuseHandle: ABOVE-ARIN
OrgAbuseName: AboveNet Abuse
OrgAbusePhone: +1-888-636-2778
OrgAbuseEmail: abuse{at}above.net

OrgNOCHandle: NOC41-ORG-ARIN
OrgNOCName: AboveNet NOC
OrgNOCPhone: +1-877-479-7378
OrgNOCEmail: noc{at}above.net

OrgTechHandle: ABOVE1-ARIN
OrgTechName: AboveNet Engineering
OrgTechPhone: +1-888-636-2778
OrgTechEmail: arin{at}above.net

CustName: Kavam
Address: 1735 Lundy Ave
Address: San Jose, CA 95131
City: San Jose
StateProv: CA
PostalCode: 95131
Country: US
RegDate: 2006-05-01
Updated: 2006-05-01

NetRange: 209.249.86.0 - 209.249.86.255
CIDR: 209.249.86.0/24
NetName: MFN-T595-209-249-86-0-24
NetHandle: NET-209-249-86-0-1
Parent: NET-209-249-0-0-1
NetType: Reassigned
Comment: abuse{at}above.net
RegDate: 2006-05-01
Updated: 2006-05-01

RTechHandle: NOC41-ORG-ARIN
RTechName: AboveNet NOC
RTechPhone: +1-877-479-7378
RTechEmail: noc{at}above.net

OrgAbuseHandle: ABOVE-ARIN
OrgAbuseName: AboveNet Abuse
OrgAbusePhone: +1-888-636-2778
OrgAbuseEmail: abuse{at}above.net

OrgNOCHandle: NOC41-ORG-ARIN
OrgNOCName: AboveNet NOC
OrgNOCPhone: +1-877-479-7378
OrgNOCEmail: noc{at}above.net

OrgTechHandle: ABOVE1-ARIN
OrgTechName: AboveNet Engineering
OrgTechPhone: +1-888-636-2778
OrgTechEmail: arin{at}above.net

You might be able to knock on their door and tell them to stop.

Kavam.com Inc.: Private Company Information




You guys can find this information on your own, can't you? (I don't know)

[linkrapid]

May be spammers from that IP

[weegillis]

Do spammers ask for robots.txt?

[NetProwler]

These days spammers are getting "wiser" all the time. They look up robots.txt to see if there is any prohibited directory and use this information to enhance their probing.

Dig up your log file to see what requests this IP was making. That should provide a clue. If you block one IP, the spammer or whoever is showing an undue interest in your site can resurface with another IP or block of IPs. You need to find out what he is trying to.

I am not saying this is humanly possible for a large site. But I would certainly be interested if someone shows undue interest in one of my inside pages out of some 100,000 pages I have for public consumption.

[nottheusual1]

Your server should (better!!) have a firewall. Use it to accomplish the block.

If it is one company, use ARIN to get a handle on their IP block, and block the entire CIDR block. We block many /24's.

We've even had to figure out how to block accepting inbound SMTP traffic from dynamic IP's due to the spambot issues on home user machines.

Doing it at the server saves resources - both your's and the machine's.

If you don't have root access or a control panel for your server, talk to your host - that's what they are there for.