This guy (64.242.88.50) is back again. 14,702 times and counting since last midnight. He apparently ignors robots.txt I asked my ISP to block him at the firewall early this morning, but he apparently did not. (Today's log file for this URL is 27MB and counting.)
But another character started out: 208.27.31.145 www.smarteryellowpages.com - [31/Jan/2005:11:35:46 -0800] "GET /MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=5606&STRMVER=4&CAPREQ=0 HTTP/1.1" 302 233 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)" and then did 208.27.31.145 www.smarteryellowpages.com - [31/Jan/2005:11:35:47 -0800] "GET /MSOffice/index.cfm HTTP/1.1" 302 233 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)" 31,758 times and counting. The first 208.27.31.145 looks like an attempt at SQL Injection. Is it? We don't run asp here (perhaps fortunately). The second looks something like a DOS attack. All this brings to my mind whether I should develop a ColdFusion application that counts hits from IP addresses, emails me the top 5 or 10 every hour, and offers me the opportunity to block an IP address in application.cfm on the fly. Anyone ever do anything like this? best, paul >Date: Thu, 13 Jan 2005 12:51:50 -0800 >To: [EMAIL PROTECTED] >From: Paul Smith <[EMAIL PROTECTED]> >Subject: Block a Spyder > >What do I put in robots.txt to block this guy: > >64.242.88.50 www.smarteryellowpages.com - [12/Jan/2005:00:00:55 -0800] >"GET /hl/shl/index.cfm?in.8259/cd.10335593/cn.21277304/hd.2666000/al.I.htm >HTTP/1.1" 200 7534 "" "Mozilla/4.0 compatible ZyBorg/1.0 Dead Link Checker >([EMAIL PROTECTED]; http://www.WISEnutbot.com)" >64.242.88.50 www.smarteryellowpages.com - [12/Jan/2005:00:00:58 -0800] >"GET >/HL/LL/LO/index.cfm?IN.1882/CD.10332492/CN.86320180/HD.3675000/AL.O/or.141677.htm > >HTTP/1.1" 200 6379 "" "Mozilla/4.0 compatible ZyBorg/1.0 Dead Link Checker >([EMAIL PROTECTED]; http://www.WISEnutbot.com)" >64.242.88.50 www.smarteryellowpages.com - [12/Jan/2005:00:00:59 -0800] >"GET /emailfriend/index.cfm?in.5762/cd.10331370/cn.1817190.htm HTTP/1.1" >200 7114 "" "Mozilla/4.0 compatible ZyBorg/1.0 Dead Link Checker >([EMAIL PROTECTED]; http://www.WISEnutbot.com)" > >Whenever it comes around it brings my web server down (whereas Googlebot >does not) > >best, paul ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Find out how CFTicket can increase your company's customer support efficiency by 100% http://www.houseoffusion.com/banners/view.cfm?bannerid=49 Message: http://www.houseoffusion.com/lists.cfm/link=i:4:192511 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
