Done, Actually I have some more. Can you "subnet" any of these? all planet-lab ones
- subnet: 134.117.226.181 - subnet: 147.229.10.250 - subnet: 206.23.240.29 - subnet: 160.193.163.106 - subnet: 138.246.99.249 - subnet: 129.242.19.197 - subnet: 206.12.16.154 - subnet: 160.193.163.106 - subnet: 152.3.138.6 - subnet: 195.37.16.121 I am up to 100 now because of these individual ones. On Thursday, August 9, 2012 5:37:41 PM UTC-4, alex wrote: > > Actually, scratch last three lines (starting from # these belong to...) > and replace with > > - subnet: 141.0.0.0/8 > > > On Thursday, August 9, 2012 11:32:03 PM UTC+2, alex wrote: >> >> A lot of those IPs are assigned to universities, like almost literally >> all of them. More than 50% are US universities. This really looks like a >> big distributed bot network to me. >> >> Anyway, here you go (some IPs are from the same net block so there are >> less than 100 entries): >> >> >> - subnet: 82.179.176.0/20 >> - subnet: 83.230.96.0/19 >> - subnet: 88.2.0.0/16 >> - subnet: 128.10.0.0/16 >> - subnet: 128.84.0.0/16 >> - subnet: 128.42.0.0/16 >> - subnet: 128.36.0.0/16 >> - subnet: 128.111.0.0/16 >> - subnet: 128.114.0.0/16 >> - subnet: 128.138.0.0/16 >> - subnet: 128.227.0.0/16 >> - subnet: 128.208.0.0/16 >> - subnet: 128.151.0.0/16 >> - subnet: 128.223.0.0/16 >> - subnet: 128.232.0.0/16 >> - subnet: 129.10.0.0/16 >> - subnet: 129.15.0.0/16 >> - subnet: 129.74.0.0/16 >> - subnet: 129.82.0.0/16 >> - subnet: 129.93.0.0/16 >> - subnet: 129.97.0.0/16 >> - subnet: 129.108.0.0/16 >> - subnet: 129.130.0.0/16 >> - subnet: 129.237.0.0/16 >> - subnet: 130.37.0.0/16 >> - subnet: 130.83.0.0/16 >> - subnet: 130.104.0.0/16 >> - subnet: 130.216.0.0/16 >> - subnet: 130.253.0.0/16 >> - subnet: 130.195.4.0/24 >> - subnet: 130.237.0.0/18 >> - subnet: 131.179.0.0/16 >> - subnet: 131.188.0.0/16 >> - subnet: 132.64.0.0/13 >> - subnet: 132.72.0.0/14 >> - subnet: 134.151.0.0/16 >> - subnet: 138.4.0.0/16 >> - subnet: 138.250.0.0/15 >> - subnet: 138.48.0.0/16 >> - subnet: 139.165.0.0/16 >> - subnet: 140.109.0.0/16 >> - subnet: 143.225.0.0/16 >> - subnet: 155.245.0.0/16 >> - subnet: 160.80.0.0/16 >> - subnet: 161.106.0.0/16 >> - subnet: 192.16.124.0/22 >> - subnet: 192.38.0.0/17 >> - subnet: 192.41.132.0/22 >> - subnet: 192.42.42.0/23 >> - subnet: 193.1.0.0/16 >> - subnet: 193.138.2.0/24 >> - subnet: 193.196.0.0/15 >> - subnet: 193.166.0.0/15 >> - subnet: 193.136.0.0/15 >> - subnet: 193.166.0.0/15 >> - subnet: 193.204.0.0/15 >> - subnet: 193.226.0.0/19 >> - subnet: 194.29.176.0/22 >> - subnet: 194.167.0.0/16 >> - subnet: 194.254.0.0/16 >> - subnet: 195.130.124.0/22 >> - subnet: 203.110.240.0/24 >> - subnet: 212.51.208.0/20 >> - subnet: 213.73.32.0/19 >> - subnet: 213.131.0.0/19 >> - subnet: 136.159.0.0/16 >> - subnet: 132.170.0.0/16 >> - subnet: 132.181.0.0/16 >> - subnet: 133.0.0.0/8 >> - subnet: 203.0.0.0/8 >> - subnet: 198.82.0.0/16 >> - subnet: 200.0.0.0/8 >> - subnet: 192.107.171.0/24 >> - subnet: 140.112.0.0/12 >> - subnet: 140.123.0.0/16 >> - subnet: 142.103.0.0/16 >> - subnet: 143.89.0.0/16 >> - subnet: 139.78.0.0/16 >> - subnet: 155.246.0.0/16 >> - subnet: 156.56.0.0/16 >> - subnet: 156.62.0.0/16 >> - subnet: 157.92.0.0/16 >> - subnet: 169.226.0.0/16 >> - subnet: 165.91.0.0/16 >> - subnet: 165.230.0.0/16 >> - subnet: 192.1.0.0/16 >> - subnet: 192.12.33.0/24 >> - subnet: 169.229.0.0/16 >> - subnet: 141.219.0.0/16 >> # these belong to a too big block >> - subnet: 141.11.0.162 >> - subnet: 141.20.103.211 >> >> >> >> On Thursday, August 9, 2012 10:21:03 PM UTC+2, Kate wrote: >>> >>> >>> I did that but don't think it will catch them all. >>> >>> I had a list of 100 individual ones, see below. Can you recognize >>> subnets in them? >>> blacklist: >>> - subnet: 82.179.176.44 >>> - subnet: 83.230.127.124 >>> - subnet: 88.2.234.60 >>> - subnet: 128.10.19.53 >>> - subnet: 128.84.154.45 >>> - subnet: 128.42.142.44 >>> - subnet: 128.36.233.154 >>> - subnet: 128.111.52.59 >>> - subnet: 128.114.63.64 >>> - subnet: 128.138.207.45 >>> - subnet: 128.227.150.12 >>> - subnet: 128.208.4.198 >>> - subnet: 128.151.65.101 >>> - subnet: 128.223.8.112 >>> - subnet: 128.232.103.201 >>> - subnet: 129.10.120.194 >>> - subnet: 129.15.78.30 >>> - subnet: 129.74.74.20 >>> - subnet: 129.82.12.188 >>> - subnet: 129.93.229.139 >>> - subnet: 129.97.74.14 >>> - subnet: 129.108.202.11 >>> - subnet: 129.130.252.140 >>> - subnet: 129.237.161.194 >>> - subnet: 130.37.193.143 >>> - subnet: 130.83.166.243 >>> - subnet: 130.104.72.213 >>> - subnet: 130.216.1.22 >>> - subnet: 130.253.21.123 >>> - subnet: 130.195.4.68 >>> - subnet: 130.237.50.125 >>> - subnet: 131.179.150.72 >>> - subnet: 131.188.44.102 >>> - subnet: 132.65.240.100 >>> - subnet: 132.72.23.10 >>> - subnet: 132.170.3.32 >>> - subnet: 132.181.10.56 >>> - subnet: 133.1.74.163 >>> - subnet: 133.15.59.2 >>> - subnet: 133.68.253.242 >>> - subnet: 134.151.255.181 >>> - subnet: 138.4.0.120 >>> - subnet: 138.251.214.78 >>> - subnet: 136.159.220.40 >>> - subnet: 138.48.3.202 >>> - subnet: 139.78.141.245 >>> - subnet: 139.165.12.211 >>> - subnet: 140.109.17.181 >>> - subnet: 140.112.107.82 >>> - subnet: 140.123.230.248 >>> - subnet: 141.11.0.162 >>> - subnet: 141.20.103.211 >>> - subnet: 141.219.252.133 >>> - subnet: 142.103.2.2 >>> - subnet: 143.89.49.73 >>> - subnet: 143.225.229.238 >>> - subnet: 155.245.47.225 >>> - subnet: 155.246.12.163 >>> - subnet: 156.56.250.226 >>> - subnet: 156.62.231.244 >>> - subnet: 157.92.44.101 >>> - subnet: 160.80.221.39 >>> - subnet: 161.106.240.19 >>> - subnet: 169.226.40.2 >>> - subnet: 169.229.50.15 >>> - subnet: 165.91.55.8 >>> - subnet: 165.230.49.115 >>> - subnet: 192.1.249.138 >>> - subnet: 192.12.33.102 >>> - subnet: 192.16.125.11 >>> - subnet: 192.38.109.144 >>> - subnet: 192.41.135.219 >>> - subnet: 192.42.43.23 >>> - subnet: 192.107.171.145 >>> - subnet: 193.1.201.27 >>> - subnet: 193.138.2.13 >>> - subnet: 193.196.39.9 >>> - subnet: 193.167.187.185 >>> - subnet: 193.136.19.13 >>> - subnet: 193.166.167.5 >>> - subnet: 193.205.215.74 >>> - subnet: 193.226.19.31 >>> - subnet: 194.29.178.13 >>> - subnet: 194.167.254.19 >>> - subnet: 194.254.215.12 >>> - subnet: 195.130.124.1 >>> - subnet: 198.82.160.221 >>> - subnet: 200.0.206.137 >>> - subnet: 200.0.206.168 >>> - subnet: 200.17.202.195 >>> - subnet: 200.129.132.19 >>> - subnet: 202.23.159.52 >>> - subnet: 202.125.215.12 >>> - subnet: 202.237.248.222 >>> - subnet: 202.249.37.67 >>> - subnet: 203.110.240.190 >>> - subnet: 203.178.133.2 >>> - subnet: 212.51.218.235 >>> - subnet: 213.73.40.106 >>> - subnet: 213.131.1.101 >>> >>> Thanks >>> Kate >>> >>> >>> On Thursday, August 9, 2012 2:37:48 PM UTC-4, alex wrote: >>>> >>>> well, while you're notifying planetlab and whatnot you could create and >>>> upload a dos.yaml for the time being with a content similar to this: >>>> >>>> blacklist: >>>> - subnet: 132.65.0.0/16 >>>> - subnet: 133.0.0.0/8 >>>> description: somewhere in china >>>> - subnet: 136.159.0.0/16 >>>> - subnet: 138.250.0.0/15 >>>> - subnet: 138.48.0.0/16 >>>> - subnet: 139.165.0.0/16 >>>> - subnet: 141.219.252.0/24 >>>> - subnet: 193.1.0.0/16 >>>> description: planetlab >>>> - subnet: 193.136.16.0/24 >>>> - subnet: 193.166.167.0/24 >>>> - subnet: 195.130.124.0/22 >>>> - subnet: 200.17.192.0/19 >>>> >>>> >>>> - put that file in your app root dir and do something like this from a >>>> terminal: >>>> >>>> "appcfg.py update_dos ." >>>> >>>> >>>> On Thursday, August 9, 2012 6:13:14 PM UTC+2, Kate wrote: >>>>> >>>>> They are not coming from the same IP. They are mostly in Europe but >>>>> there are no subnets. >>>>> >>>>> There are hundreds of them and google only lets you block 100. >>>>> >>>>> eg >>>>> >>>>> 132.65.240.100 >>>>> 133.15.59.2 >>>>> 193.136.19.13 >>>>> 139.165.12.211 >>>>> 193.166.167.5 >>>>> 141.219.252.133 >>>>> 200.17.202.195 >>>>> 195.130.124.1 >>>>> 193.1.201.27 >>>>> 138.48.3.202 >>>>> 136.159.220.40 >>>>> 138.251.214.78 >>>>> >>>>> >>>>> all these and more within a minute. >>>>> >>>>> They are all different. >>>>> >>>>> Kate >>>>> >>>>> >>>>> >>>>> On Thursday, August 9, 2012 9:55:29 AM UTC-4, alex wrote: >>>>>> >>>>>> Kate, >>>>>> >>>>>> If barryhunter is right and all the IPs are coming from the same ISP >>>>>> anyway, you can simply block the whole subnetwork ranges of that ISP (at >>>>>> least temporary) using dos.yaml: >>>>>> https://developers.google.com/appengine/docs/python/config/dos >>>>>> >>>>>> It'll be pain in the ass updating the file every time you encounter >>>>>> new subnets but at least you could probably save some quota 'till you >>>>>> move >>>>>> somewhere else or figure something out. >>>>>> >>>>>> -- alex >>>>>> >>>>>> On Thursday, August 9, 2012 1:59:57 PM UTC+2, Kate wrote: >>>>>>> >>>>>>> Hi Sergey, >>>>>>> >>>>>>> Here is a typical example >>>>>>> 2012-08-09 06:51:16.597 / 302 30ms 0kb curl/7.18.2 >>>>>>> (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/3.12.2.0 zlib/1.2.3 >>>>>>> libidn/0.6.14 libssh2/0.18 >>>>>>> 202.125.215.12 - - [09/Aug/2012:04:51:16 -0700] "HEAD / HTTP/1.1" >>>>>>> 302 153 - "curl/7.18.2 (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/ >>>>>>> 3.12.2.0 zlib/1.2.3 libidn/0.6.14 libssh2/0.18" " >>>>>>> aussieclouds.appspot.com" ms=31 cpu_ms=0 api_cpu_ms=0 >>>>>>> cpm_usd=0.000049 instance=00c61b117c2f994812ed63184c9c5544dea738 >>>>>>> >>>>>>> But the ip address varies. My code forces 302 response. Before I >>>>>>> added the code they were throwing errors head method not found. But >>>>>>> even >>>>>>> though I am doing the 303 I am still getting front end time exceeded >>>>>>> and >>>>>>> these requests are taking up about 95% of my quota. So to keep the site >>>>>>> alive I would have to pay for them, I have lost most of my European and >>>>>>> Australian visitors because the site is down every night during those >>>>>>> places daylight hours. Obviously I can't continue like this and so will >>>>>>> have to move to a provider capable of blocking these requests, >>>>>>> >>>>>>> >> On Thursday, August 9, 2012 10:21:03 PM UTC+2, Kate wrote: >>> >>> >>> I did that but don't think it will catch them all. >>> >>> I had a list of 100 individual ones, see below. Can you recognize >>> subnets in them? >>> blacklist: >>> - subnet: 82.179.176.44 >>> - subnet: 83.230.127.124 >>> - subnet: 88.2.234.60 >>> - subnet: 128.10.19.53 >>> - subnet: 128.84.154.45 >>> - subnet: 128.42.142.44 >>> - subnet: 128.36.233.154 >>> - subnet: 128.111.52.59 >>> - subnet: 128.114.63.64 >>> - subnet: 128.138.207.45 >>> - subnet: 128.227.150.12 >>> - subnet: 128.208.4.198 >>> - subnet: 128.151.65.101 >>> - subnet: 128.223.8.112 >>> - subnet: 128.232.103.201 >>> - subnet: 129.10.120.194 >>> - subnet: 129.15.78.30 >>> - subnet: 129.74.74.20 >>> - subnet: 129.82.12.188 >>> - subnet: 129.93.229.139 >>> - subnet: 129.97.74.14 >>> - subnet: 129.108.202.11 >>> - subnet: 129.130.252.140 >>> - subnet: 129.237.161.194 >>> - subnet: 130.37.193.143 >>> - subnet: 130.83.166.243 >>> - subnet: 130.104.72.213 >>> - subnet: 130.216.1.22 >>> - subnet: 130.253.21.123 >>> - subnet: 130.195.4.68 >>> - subnet: 130.237.50.125 >>> - subnet: 131.179.150.72 >>> - subnet: 131.188.44.102 >>> - subnet: 132.65.240.100 >>> - subnet: 132.72.23.10 >>> - subnet: 132.170.3.32 >>> - subnet: 132.181.10.56 >>> - subnet: 133.1.74.163 >>> - subnet: 133.15.59.2 >>> - subnet: 133.68.253.242 >>> - subnet: 134.151.255.181 >>> - subnet: 138.4.0.120 >>> - subnet: 138.251.214.78 >>> - subnet: 136.159.220.40 >>> - subnet: 138.48.3.202 >>> - subnet: 139.78.141.245 >>> - subnet: 139.165.12.211 >>> - subnet: 140.109.17.181 >>> - subnet: 140.112.107.82 >>> - subnet: 140.123.230.248 >>> - subnet: 141.11.0.162 >>> - subnet: 141.20.103.211 >>> - subnet: 141.219.252.133 >>> - subnet: 142.103.2.2 >>> - subnet: 143.89.49.73 >>> - subnet: 143.225.229.238 >>> - subnet: 155.245.47.225 >>> - subnet: 155.246.12.163 >>> - subnet: 156.56.250.226 >>> - subnet: 156.62.231.244 >>> - subnet: 157.92.44.101 >>> - subnet: 160.80.221.39 >>> - subnet: 161.106.240.19 >>> - subnet: 169.226.40.2 >>> - subnet: 169.229.50.15 >>> - subnet: 165.91.55.8 >>> - subnet: 165.230.49.115 >>> - subnet: 192.1.249.138 >>> - subnet: 192.12.33.102 >>> - subnet: 192.16.125.11 >>> - subnet: 192.38.109.144 >>> - subnet: 192.41.135.219 >>> - subnet: 192.42.43.23 >>> - subnet: 192.107.171.145 >>> - subnet: 193.1.201.27 >>> - subnet: 193.138.2.13 >>> - subnet: 193.196.39.9 >>> - subnet: 193.167.187.185 >>> - subnet: 193.136.19.13 >>> - subnet: 193.166.167.5 >>> - subnet: 193.205.215.74 >>> - subnet: 193.226.19.31 >>> - subnet: 194.29.178.13 >>> - subnet: 194.167.254.19 >>> - subnet: 194.254.215.12 >>> - subnet: 195.130.124.1 >>> - subnet: 198.82.160.221 >>> - subnet: 200.0.206.137 >>> - subnet: 200.0.206.168 >>> - subnet: 200.17.202.195 >>> - subnet: 200.129.132.19 >>> - subnet: 202.23.159.52 >>> - subnet: 202.125.215.12 >>> - subnet: 202.237.248.222 >>> - subnet: 202.249.37.67 >>> - subnet: 203.110.240.190 >>> - subnet: 203.178.133.2 >>> - subnet: 212.51.218.235 >>> - subnet: 213.73.40.106 >>> - subnet: 213.131.1.101 >>> >>> Thanks >>> Kate >>> >>> >>> On Thursday, August 9, 2012 2:37:48 PM UTC-4, alex wrote: >>>> >>>> well, while you're notifying planetlab and whatnot you could create and >>>> upload a dos.yaml for the time being with a content similar to this: >>>> >>>> blacklist: >>>> - subnet: 132.65.0.0/16 >>>> - subnet: 133.0.0.0/8 >>>> description: somewhere in china >>>> - subnet: 136.159.0.0/16 >>>> - subnet: 138.250.0.0/15 >>>> - subnet: 138.48.0.0/16 >>>> - subnet: 139.165.0.0/16 >>>> - subnet: 141.219.252.0/24 >>>> - subnet: 193.1.0.0/16 >>>> description: planetlab >>>> - subnet: 193.136.16.0/24 >>>> - subnet: 193.166.167.0/24 >>>> - subnet: 195.130.124.0/22 >>>> - subnet: 200.17.192.0/19 >>>> >>>> >>>> - put that file in your app root dir and do something like this from a >>>> terminal: >>>> >>>> "appcfg.py update_dos ." >>>> >>>> >>>> On Thursday, August 9, 2012 6:13:14 PM UTC+2, Kate wrote: >>>>> >>>>> They are not coming from the same IP. They are mostly in Europe but >>>>> there are no subnets. >>>>> >>>>> There are hundreds of them and google only lets you block 100. >>>>> >>>>> eg >>>>> >>>>> 132.65.240.100 >>>>> 133.15.59.2 >>>>> 193.136.19.13 >>>>> 139.165.12.211 >>>>> 193.166.167.5 >>>>> 141.219.252.133 >>>>> 200.17.202.195 >>>>> 195.130.124.1 >>>>> 193.1.201.27 >>>>> 138.48.3.202 >>>>> 136.159.220.40 >>>>> 138.251.214.78 >>>>> >>>>> >>>>> all these and more within a minute. >>>>> >>>>> They are all different. >>>>> >>>>> Kate >>>>> >>>>> >>>>> >>>>> On Thursday, August 9, 2012 9:55:29 AM UTC-4, alex wrote: >>>>>> >>>>>> Kate, >>>>>> >>>>>> If barryhunter is right and all the IPs are coming from the same ISP >>>>>> anyway, you can simply block the whole subnetwork ranges of that ISP (at >>>>>> least temporary) using dos.yaml: >>>>>> https://developers.google.com/appengine/docs/python/config/dos >>>>>> >>>>>> It'll be pain in the ass updating the file every time you encounter >>>>>> new subnets but at least you could probably save some quota 'till you >>>>>> move >>>>>> somewhere else or figure something out. >>>>>> >>>>>> -- alex >>>>>> >>>>>> On Thursday, August 9, 2012 1:59:57 PM UTC+2, Kate wrote: >>>>>>> >>>>>>> Hi Sergey, >>>>>>> >>>>>>> Here is a typical example >>>>>>> 2012-08-09 06:51:16.597 / 302 30ms 0kb curl/7.18.2 >>>>>>> (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/3.12.2.0 zlib/1.2.3 >>>>>>> libidn/0.6.14 libssh2/0.18 >>>>>>> 202.125.215.12 - - [09/Aug/2012:04:51:16 -0700] "HEAD / HTTP/1.1" >>>>>>> 302 153 - "curl/7.18.2 (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/ >>>>>>> 3.12.2.0 zlib/1.2.3 libidn/0.6.14 libssh2/0.18" " >>>>>>> aussieclouds.appspot.com" ms=31 cpu_ms=0 api_cpu_ms=0 >>>>>>> cpm_usd=0.000049 instance=00c61b117c2f994812ed63184c9c5544dea738 >>>>>>> >>>>>>> But the ip address varies. My code forces 302 response. Before I >>>>>>> added the code they were throwing errors head method not found. But >>>>>>> even >>>>>>> though I am doing the 303 I am still getting front end time exceeded >>>>>>> and >>>>>>> these requests are taking up about 95% of my quota. So to keep the site >>>>>>> alive I would have to pay for them, I have lost most of my European and >>>>>>> Australian visitors because the site is down every night during those >>>>>>> places daylight hours. Obviously I can't continue like this and so will >>>>>>> have to move to a provider capable of blocking these requests, >>>>>>> >>>>>>> -- You received this message because you are subscribed to the Google Groups "Google App Engine" group. To view this discussion on the web visit https://groups.google.com/d/msg/google-appengine/-/4yqhjGDv55QJ. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/google-appengine?hl=en.
