Heard back from planet-lab: See below. However I don't buy the "We ensure that we only send active probes to prefixes that receive traffic from PlanetLab, and we probe every prefix at most once every 5 minutes if the prefix is reachable and at most three times in a 5 minute period if we do not receive responses to our probes."
Hi Kathleen, Apologies for not resolving this sooner. We believe we found a likely source behind the traffic you've been referring to. As you may know, PlanetLab is a distributed systems research test bed with 1000+ machines world wide. These machines may share access to both research, local and public Internet. These services are actively managed by researchers granted access to PlanetLab accounts. Since your site is hosted by Google, the IP addresses that you use are not unique to you, but are shared among many Google hosted services. Many experiments on PlanetLab nodes sent significant volume of legitimate traffic to these IP addresses and finding the subset of this traffic that corresponds to your service is a bit more involved. We have however identified a likely experiment that is responsible, it is ucr_web slice, run by researchers at University of California, Riverside, who are cc'ed on this email. The researchers provide a description of their work as: """ This slice is being used to perform measurements to detect outages on paths on which traffic is served from PlanetLab. We passively observe traffic outgoing from PlanetLab to see which prefixes are receiving TCP traffic from PlanetLab, and then use a combination of passive monitoring and active probing to detect outages on paths to these prefixes.<br>We ensure that we only send active probes to prefixes that receive traffic from PlanetLab, and we probe every prefix at most once every 5 minutes if the prefix is reachable and at most three times in a 5 minute period if we do not receive responses to our probes. """ On Friday, August 10, 2012 1:37:33 PM UTC-4, Kate wrote: > > Thanks!@ I have used up my 100 entries and haven't got all of them! > > Haven't heard back from planet-lab.org! > > Will keep you informed! > > > On Friday, August 10, 2012 4:41:06 AM UTC-4, alex wrote: >> >> - subnet: 134.117.0.0/16 >> description: Carleton University >> - subnet: 147.228.0.0/14 >> description: Brno University of Technology >> - subnet: 206.23.0.0/16 >> description: Tennessee Board of Regents >> - subnet: 160.193.0.0/16 >> description: Osaka City University >> - subnet: 138.246.0.0/16 >> description: Ludwig-Maximilians-Universitaet Muenchen >> - subnet: 129.242.0.0/16 >> description: University of Tromso >> - subnet: 206.12.0.0/16 >> description: BCnet Vancouver >> - subnet: 152.3.0.0/16 >> description: Duke University >> - subnet: 195.37.0.0/16 >> description: Extranet der Universitaet Passau >> >> >> On Friday, August 10, 2012 4:10:24 AM UTC+2, Kate wrote: >>> >>> Done, >>> >>> Actually I have some more. Can you "subnet" any of these? all planet-lab >>> ones >>> >>> - subnet: 134.117.226.181 >>> - subnet: 147.229.10.250 >>> - subnet: 206.23.240.29 >>> - subnet: 160.193.163.106 >>> - subnet: 138.246.99.249 >>> - subnet: 129.242.19.197 >>> - subnet: 206.12.16.154 >>> - subnet: 160.193.163.106 >>> - subnet: 152.3.138.6 >>> - subnet: 195.37.16.121 >>> >>> I am up to 100 now because of these individual ones. >>> >>> >>> On Thursday, August 9, 2012 5:37:41 PM UTC-4, alex wrote: >>>> >>>> Actually, scratch last three lines (starting from # these belong to...) >>>> and replace with >>>> >>>> - subnet: 141.0.0.0/8 >>>> >>>> >>>> On Thursday, August 9, 2012 11:32:03 PM UTC+2, alex wrote: >>>>> >>>>> A lot of those IPs are assigned to universities, like almost literally >>>>> all of them. More than 50% are US universities. This really looks like a >>>>> big distributed bot network to me. >>>>> >>>>> Anyway, here you go (some IPs are from the same net block so there are >>>>> less than 100 entries): >>>>> >>>>> >>>>> - subnet: 82.179.176.0/20 >>>>> - subnet: 83.230.96.0/19 >>>>> - subnet: 88.2.0.0/16 >>>>> - subnet: 128.10.0.0/16 >>>>> - subnet: 128.84.0.0/16 >>>>> - subnet: 128.42.0.0/16 >>>>> - subnet: 128.36.0.0/16 >>>>> - subnet: 128.111.0.0/16 >>>>> - subnet: 128.114.0.0/16 >>>>> - subnet: 128.138.0.0/16 >>>>> - subnet: 128.227.0.0/16 >>>>> - subnet: 128.208.0.0/16 >>>>> - subnet: 128.151.0.0/16 >>>>> - subnet: 128.223.0.0/16 >>>>> - subnet: 128.232.0.0/16 >>>>> - subnet: 129.10.0.0/16 >>>>> - subnet: 129.15.0.0/16 >>>>> - subnet: 129.74.0.0/16 >>>>> - subnet: 129.82.0.0/16 >>>>> - subnet: 129.93.0.0/16 >>>>> - subnet: 129.97.0.0/16 >>>>> - subnet: 129.108.0.0/16 >>>>> - subnet: 129.130.0.0/16 >>>>> - subnet: 129.237.0.0/16 >>>>> - subnet: 130.37.0.0/16 >>>>> - subnet: 130.83.0.0/16 >>>>> - subnet: 130.104.0.0/16 >>>>> - subnet: 130.216.0.0/16 >>>>> - subnet: 130.253.0.0/16 >>>>> - subnet: 130.195.4.0/24 >>>>> - subnet: 130.237.0.0/18 >>>>> - subnet: 131.179.0.0/16 >>>>> - subnet: 131.188.0.0/16 >>>>> - subnet: 132.64.0.0/13 >>>>> - subnet: 132.72.0.0/14 >>>>> - subnet: 134.151.0.0/16 >>>>> - subnet: 138.4.0.0/16 >>>>> - subnet: 138.250.0.0/15 >>>>> - subnet: 138.48.0.0/16 >>>>> - subnet: 139.165.0.0/16 >>>>> - subnet: 140.109.0.0/16 >>>>> - subnet: 143.225.0.0/16 >>>>> - subnet: 155.245.0.0/16 >>>>> - subnet: 160.80.0.0/16 >>>>> - subnet: 161.106.0.0/16 >>>>> - subnet: 192.16.124.0/22 >>>>> - subnet: 192.38.0.0/17 >>>>> - subnet: 192.41.132.0/22 >>>>> - subnet: 192.42.42.0/23 >>>>> - subnet: 193.1.0.0/16 >>>>> - subnet: 193.138.2.0/24 >>>>> - subnet: 193.196.0.0/15 >>>>> - subnet: 193.166.0.0/15 >>>>> - subnet: 193.136.0.0/15 >>>>> - subnet: 193.166.0.0/15 >>>>> - subnet: 193.204.0.0/15 >>>>> - subnet: 193.226.0.0/19 >>>>> - subnet: 194.29.176.0/22 >>>>> - subnet: 194.167.0.0/16 >>>>> - subnet: 194.254.0.0/16 >>>>> - subnet: 195.130.124.0/22 >>>>> - subnet: 203.110.240.0/24 >>>>> - subnet: 212.51.208.0/20 >>>>> - subnet: 213.73.32.0/19 >>>>> - subnet: 213.131.0.0/19 >>>>> - subnet: 136.159.0.0/16 >>>>> - subnet: 132.170.0.0/16 >>>>> - subnet: 132.181.0.0/16 >>>>> - subnet: 133.0.0.0/8 >>>>> - subnet: 203.0.0.0/8 >>>>> - subnet: 198.82.0.0/16 >>>>> - subnet: 200.0.0.0/8 >>>>> - subnet: 192.107.171.0/24 >>>>> - subnet: 140.112.0.0/12 >>>>> - subnet: 140.123.0.0/16 >>>>> - subnet: 142.103.0.0/16 >>>>> - subnet: 143.89.0.0/16 >>>>> - subnet: 139.78.0.0/16 >>>>> - subnet: 155.246.0.0/16 >>>>> - subnet: 156.56.0.0/16 >>>>> - subnet: 156.62.0.0/16 >>>>> - subnet: 157.92.0.0/16 >>>>> - subnet: 169.226.0.0/16 >>>>> - subnet: 165.91.0.0/16 >>>>> - subnet: 165.230.0.0/16 >>>>> - subnet: 192.1.0.0/16 >>>>> - subnet: 192.12.33.0/24 >>>>> - subnet: 169.229.0.0/16 >>>>> - subnet: 141.219.0.0/16 >>>>> # these belong to a too big block >>>>> - subnet: 141.11.0.162 >>>>> - subnet: 141.20.103.211 >>>>> >>>>> >>>>> >>>>> On Thursday, August 9, 2012 10:21:03 PM UTC+2, Kate wrote: >>>>>> >>>>>> >>>>>> I did that but don't think it will catch them all. >>>>>> >>>>>> I had a list of 100 individual ones, see below. Can you recognize >>>>>> subnets in them? >>>>>> blacklist: >>>>>> - subnet: 82.179.176.44 >>>>>> - subnet: 83.230.127.124 >>>>>> - subnet: 88.2.234.60 >>>>>> - subnet: 128.10.19.53 >>>>>> - subnet: 128.84.154.45 >>>>>> - subnet: 128.42.142.44 >>>>>> - subnet: 128.36.233.154 >>>>>> - subnet: 128.111.52.59 >>>>>> - subnet: 128.114.63.64 >>>>>> - subnet: 128.138.207.45 >>>>>> - subnet: 128.227.150.12 >>>>>> - subnet: 128.208.4.198 >>>>>> - subnet: 128.151.65.101 >>>>>> - subnet: 128.223.8.112 >>>>>> - subnet: 128.232.103.201 >>>>>> - subnet: 129.10.120.194 >>>>>> - subnet: 129.15.78.30 >>>>>> - subnet: 129.74.74.20 >>>>>> - subnet: 129.82.12.188 >>>>>> - subnet: 129.93.229.139 >>>>>> - subnet: 129.97.74.14 >>>>>> - subnet: 129.108.202.11 >>>>>> - subnet: 129.130.252.140 >>>>>> - subnet: 129.237.161.194 >>>>>> - subnet: 130.37.193.143 >>>>>> - subnet: 130.83.166.243 >>>>>> - subnet: 130.104.72.213 >>>>>> - subnet: 130.216.1.22 >>>>>> - subnet: 130.253.21.123 >>>>>> - subnet: 130.195.4.68 >>>>>> - subnet: 130.237.50.125 >>>>>> - subnet: 131.179.150.72 >>>>>> - subnet: 131.188.44.102 >>>>>> - subnet: 132.65.240.100 >>>>>> - subnet: 132.72.23.10 >>>>>> - subnet: 132.170.3.32 >>>>>> - subnet: 132.181.10.56 >>>>>> - subnet: 133.1.74.163 >>>>>> - subnet: 133.15.59.2 >>>>>> - subnet: 133.68.253.242 >>>>>> - subnet: 134.151.255.181 >>>>>> - subnet: 138.4.0.120 >>>>>> - subnet: 138.251.214.78 >>>>>> - subnet: 136.159.220.40 >>>>>> - subnet: 138.48.3.202 >>>>>> - subnet: 139.78.141.245 >>>>>> - subnet: 139.165.12.211 >>>>>> - subnet: 140.109.17.181 >>>>>> - subnet: 140.112.107.82 >>>>>> - subnet: 140.123.230.248 >>>>>> - subnet: 141.11.0.162 >>>>>> - subnet: 141.20.103.211 >>>>>> - subnet: 141.219.252.133 >>>>>> - subnet: 142.103.2.2 >>>>>> - subnet: 143.89.49.73 >>>>>> - subnet: 143.225.229.238 >>>>>> - subnet: 155.245.47.225 >>>>>> - subnet: 155.246.12.163 >>>>>> - subnet: 156.56.250.226 >>>>>> - subnet: 156.62.231.244 >>>>>> - subnet: 157.92.44.101 >>>>>> - subnet: 160.80.221.39 >>>>>> - subnet: 161.106.240.19 >>>>>> - subnet: 169.226.40.2 >>>>>> - subnet: 169.229.50.15 >>>>>> - subnet: 165.91.55.8 >>>>>> - subnet: 165.230.49.115 >>>>>> - subnet: 192.1.249.138 >>>>>> - subnet: 192.12.33.102 >>>>>> - subnet: 192.16.125.11 >>>>>> - subnet: 192.38.109.144 >>>>>> - subnet: 192.41.135.219 >>>>>> - subnet: 192.42.43.23 >>>>>> - subnet: 192.107.171.145 >>>>>> - subnet: 193.1.201.27 >>>>>> - subnet: 193.138.2.13 >>>>>> - subnet: 193.196.39.9 >>>>>> - subnet: 193.167.187.185 >>>>>> - subnet: 193.136.19.13 >>>>>> - subnet: 193.166.167.5 >>>>>> - subnet: 193.205.215.74 >>>>>> - subnet: 193.226.19.31 >>>>>> - subnet: 194.29.178.13 >>>>>> - subnet: 194.167.254.19 >>>>>> - subnet: 194.254.215.12 >>>>>> - subnet: 195.130.124.1 >>>>>> - subnet: 198.82.160.221 >>>>>> - subnet: 200.0.206.137 >>>>>> - subnet: 200.0.206.168 >>>>>> - subnet: 200.17.202.195 >>>>>> - subnet: 200.129.132.19 >>>>>> - subnet: 202.23.159.52 >>>>>> - subnet: 202.125.215.12 >>>>>> - subnet: 202.237.248.222 >>>>>> - subnet: 202.249.37.67 >>>>>> - subnet: 203.110.240.190 >>>>>> - subnet: 203.178.133.2 >>>>>> - subnet: 212.51.218.235 >>>>>> - subnet: 213.73.40.106 >>>>>> - subnet: 213.131.1.101 >>>>>> >>>>>> Thanks >>>>>> Kate >>>>>> >>>>>> >>>>>> On Thursday, August 9, 2012 2:37:48 PM UTC-4, alex wrote: >>>>>>> >>>>>>> well, while you're notifying planetlab and whatnot you could create >>>>>>> and upload a dos.yaml for the time being with a content similar to this: >>>>>>> >>>>>>> blacklist: >>>>>>> - subnet: 132.65.0.0/16 >>>>>>> - subnet: 133.0.0.0/8 >>>>>>> description: somewhere in china >>>>>>> - subnet: 136.159.0.0/16 >>>>>>> - subnet: 138.250.0.0/15 >>>>>>> - subnet: 138.48.0.0/16 >>>>>>> - subnet: 139.165.0.0/16 >>>>>>> - subnet: 141.219.252.0/24 >>>>>>> - subnet: 193.1.0.0/16 >>>>>>> description: planetlab >>>>>>> - subnet: 193.136.16.0/24 >>>>>>> - subnet: 193.166.167.0/24 >>>>>>> - subnet: 195.130.124.0/22 >>>>>>> - subnet: 200.17.192.0/19 >>>>>>> >>>>>>> >>>>>>> - put that file in your app root dir and do something like this from >>>>>>> a terminal: >>>>>>> >>>>>>> "appcfg.py update_dos ." >>>>>>> >>>>>>> >>>>>>> On Thursday, August 9, 2012 6:13:14 PM UTC+2, Kate wrote: >>>>>>>> >>>>>>>> They are not coming from the same IP. They are mostly in Europe but >>>>>>>> there are no subnets. >>>>>>>> >>>>>>>> There are hundreds of them and google only lets you block 100. >>>>>>>> >>>>>>>> eg >>>>>>>> >>>>>>>> 132.65.240.100 >>>>>>>> 133.15.59.2 >>>>>>>> 193.136.19.13 >>>>>>>> 139.165.12.211 >>>>>>>> 193.166.167.5 >>>>>>>> 141.219.252.133 >>>>>>>> 200.17.202.195 >>>>>>>> 195.130.124.1 >>>>>>>> 193.1.201.27 >>>>>>>> 138.48.3.202 >>>>>>>> 136.159.220.40 >>>>>>>> 138.251.214.78 >>>>>>>> >>>>>>>> >>>>>>>> all these and more within a minute. >>>>>>>> >>>>>>>> They are all different. >>>>>>>> >>>>>>>> Kate >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Thursday, August 9, 2012 9:55:29 AM UTC-4, alex wrote: >>>>>>>>> >>>>>>>>> Kate, >>>>>>>>> >>>>>>>>> If barryhunter is right and all the IPs are coming from the same >>>>>>>>> ISP anyway, you can simply block the whole subnetwork ranges of that >>>>>>>>> ISP >>>>>>>>> (at least temporary) using dos.yaml: >>>>>>>>> https://developers.google.com/appengine/docs/python/config/dos >>>>>>>>> >>>>>>>>> It'll be pain in the ass updating the file every time you >>>>>>>>> encounter new subnets but at least you could probably save some quota >>>>>>>>> 'till >>>>>>>>> you move somewhere else or figure something out. >>>>>>>>> >>>>>>>>> -- alex >>>>>>>>> >>>>>>>>> On Thursday, August 9, 2012 1:59:57 PM UTC+2, Kate wrote: >>>>>>>>>> >>>>>>>>>> Hi Sergey, >>>>>>>>>> >>>>>>>>>> Here is a typical example >>>>>>>>>> 2012-08-09 06:51:16.597 / 302 30ms 0kb curl/7.18.2 >>>>>>>>>> (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/3.12.2.0 zlib/1.2.3 >>>>>>>>>> libidn/0.6.14 libssh2/0.18 >>>>>>>>>> 202.125.215.12 - - [09/Aug/2012:04:51:16 -0700] "HEAD / HTTP/1.1" >>>>>>>>>> 302 153 - "curl/7.18.2 (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/ >>>>>>>>>> 3.12.2.0 zlib/1.2.3 libidn/0.6.14 libssh2/0.18" " >>>>>>>>>> aussieclouds.appspot.com" ms=31 cpu_ms=0 api_cpu_ms=0 >>>>>>>>>> cpm_usd=0.000049 instance=00c61b117c2f994812ed63184c9c5544dea738 >>>>>>>>>> >>>>>>>>>> But the ip address varies. My code forces 302 response. Before I >>>>>>>>>> added the code they were throwing errors head method not found. But >>>>>>>>>> even >>>>>>>>>> though I am doing the 303 I am still getting front end time exceeded >>>>>>>>>> and >>>>>>>>>> these requests are taking up about 95% of my quota. So to keep the >>>>>>>>>> site >>>>>>>>>> alive I would have to pay for them, I have lost most of my European >>>>>>>>>> and >>>>>>>>>> Australian visitors because the site is down every night during >>>>>>>>>> those >>>>>>>>>> places daylight hours. Obviously I can't continue like this and so >>>>>>>>>> will >>>>>>>>>> have to move to a provider capable of blocking these requests, >>>>>>>>>> >>>>>>>>>> >>>>> On Thursday, August 9, 2012 10:21:03 PM UTC+2, Kate wrote: >>>>>> >>>>>> >>>>>> I did that but don't think it will catch them all. >>>>>> >>>>>> I had a list of 100 individual ones, see below. Can you recognize >>>>>> subnets in them? >>>>>> blacklist: >>>>>> - subnet: 82.179.176.44 >>>>>> - subnet: 83.230.127.124 >>>>>> - subnet: 88.2.234.60 >>>>>> - subnet: 128.10.19.53 >>>>>> - subnet: 128.84.154.45 >>>>>> - subnet: 128.42.142.44 >>>>>> - subnet: 128.36.233.154 >>>>>> - subnet: 128.111.52.59 >>>>>> - subnet: 128.114.63.64 >>>>>> - subnet: 128.138.207.45 >>>>>> - subnet: 128.227.150.12 >>>>>> - subnet: 128.208.4.198 >>>>>> - subnet: 128.151.65.101 >>>>>> - subnet: 128.223.8.112 >>>>>> - subnet: 128.232.103.201 >>>>>> - subnet: 129.10.120.194 >>>>>> - subnet: 129.15.78.30 >>>>>> - subnet: 129.74.74.20 >>>>>> - subnet: 129.82.12.188 >>>>>> - subnet: 129.93.229.139 >>>>>> - subnet: 129.97.74.14 >>>>>> - subnet: 129.108.202.11 >>>>>> - subnet: 129.130.252.140 >>>>>> - subnet: 129.237.161.194 >>>>>> - subnet: 130.37.193.143 >>>>>> - subnet: 130.83.166.243 >>>>>> - subnet: 130.104.72.213 >>>>>> - subnet: 130.216.1.22 >>>>>> - subnet: 130.253.21.123 >>>>>> - subnet: 130.195.4.68 >>>>>> - subnet: 130.237.50.125 >>>>>> - subnet: 131.179.150.72 >>>>>> - subnet: 131.188.44.102 >>>>>> - subnet: 132.65.240.100 >>>>>> - subnet: 132.72.23.10 >>>>>> - subnet: 132.170.3.32 >>>>>> - subnet: 132.181.10.56 >>>>>> - subnet: 133.1.74.163 >>>>>> - subnet: 133.15.59.2 >>>>>> - subnet: 133.68.253.242 >>>>>> - subnet: 134.151.255.181 >>>>>> - subnet: 138.4.0.120 >>>>>> - subnet: 138.251.214.78 >>>>>> - subnet: 136.159.220.40 >>>>>> - subnet: 138.48.3.202 >>>>>> - subnet: 139.78.141.245 >>>>>> - subnet: 139.165.12.211 >>>>>> - subnet: 140.109.17.181 >>>>>> - subnet: 140.112.107.82 >>>>>> - subnet: 140.123.230.248 >>>>>> - subnet: 141.11.0.162 >>>>>> - subnet: 141.20.103.211 >>>>>> - subnet: 141.219.252.133 >>>>>> - subnet: 142.103.2.2 >>>>>> - subnet: 143.89.49.73 >>>>>> - subnet: 143.225.229.238 >>>>>> - subnet: 155.245.47.225 >>>>>> - subnet: 155.246.12.163 >>>>>> - subnet: 156.56.250.226 >>>>>> - subnet: 156.62.231.244 >>>>>> - subnet: 157.92.44.101 >>>>>> - subnet: 160.80.221.39 >>>>>> - subnet: 161.106.240.19 >>>>>> - subnet: 169.226.40.2 >>>>>> - subnet: 169.229.50.15 >>>>>> - subnet: 165.91.55.8 >>>>>> - subnet: 165.230.49.115 >>>>>> - subnet: 192.1.249.138 >>>>>> - subnet: 192.12.33.102 >>>>>> - subnet: 192.16.125.11 >>>>>> - subnet: 192.38.109.144 >>>>>> - subnet: 192.41.135.219 >>>>>> - subnet: 192.42.43.23 >>>>>> - subnet: 192.107.171.145 >>>>>> - subnet: 193.1.201.27 >>>>>> - subnet: 193.138.2.13 >>>>>> - subnet: 193.196.39.9 >>>>>> - subnet: 193.167.187.185 >>>>>> - subnet: 193.136.19.13 >>>>>> - subnet: 193.166.167.5 >>>>>> - subnet: 193.205.215.74 >>>>>> - subnet: 193.226.19.31 >>>>>> - subnet: 194.29.178.13 >>>>>> - subnet: 194.167.254.19 >>>>>> - subnet: 194.254.215.12 >>>>>> - subnet: 195.130.124.1 >>>>>> - subnet: 198.82.160.221 >>>>>> - subnet: 200.0.206.137 >>>>>> - subnet: 200.0.206.168 >>>>>> - subnet: 200.17.202.195 >>>>>> - subnet: 200.129.132.19 >>>>>> - subnet: 202.23.159.52 >>>>>> - subnet: 202.125.215.12 >>>>>> - subnet: 202.237.248.222 >>>>>> - subnet: 202.249.37.67 >>>>>> - subnet: 203.110.240.190 >>>>>> - subnet: 203.178.133.2 >>>>>> - subnet: 212.51.218.235 >>>>>> - subnet: 213.73.40.106 >>>>>> - subnet: 213.131.1.101 >>>>>> >>>>>> Thanks >>>>>> Kate >>>>>> >>>>>> >>>>>> On Thursday, August 9, 2012 2:37:48 PM UTC-4, alex wrote: >>>>>>> >>>>>>> well, while you're notifying planetlab and whatnot you could create >>>>>>> and upload a dos.yaml for the time being with a content similar to this: >>>>>>> >>>>>>> blacklist: >>>>>>> - subnet: 132.65.0.0/16 >>>>>>> - subnet: 133.0.0.0/8 >>>>>>> description: somewhere in china >>>>>>> - subnet: 136.159.0.0/16 >>>>>>> - subnet: 138.250.0.0/15 >>>>>>> - subnet: 138.48.0.0/16 >>>>>>> - subnet: 139.165.0.0/16 >>>>>>> - subnet: 141.219.252.0/24 >>>>>>> - subnet: 193.1.0.0/16 >>>>>>> description: planetlab >>>>>>> - subnet: 193.136.16.0/24 >>>>>>> - subnet: 193.166.167.0/24 >>>>>>> - subnet: 195.130.124.0/22 >>>>>>> - subnet: 200.17.192.0/19 >>>>>>> >>>>>>> >>>>>>> - put that file in your app root dir and do something like this from >>>>>>> a terminal: >>>>>>> >>>>>>> "appcfg.py update_dos ." >>>>>>> >>>>>>> >>>>>>> On Thursday, August 9, 2012 6:13:14 PM UTC+2, Kate wrote: >>>>>>>> >>>>>>>> They are not coming from the same IP. They are mostly in Europe but >>>>>>>> there are no subnets. >>>>>>>> >>>>>>>> There are hundreds of them and google only lets you block 100. >>>>>>>> >>>>>>>> eg >>>>>>>> >>>>>>>> 132.65.240.100 >>>>>>>> 133.15.59.2 >>>>>>>> 193.136.19.13 >>>>>>>> 139.165.12.211 >>>>>>>> 193.166.167.5 >>>>>>>> 141.219.252.133 >>>>>>>> 200.17.202.195 >>>>>>>> 195.130.124.1 >>>>>>>> 193.1.201.27 >>>>>>>> 138.48.3.202 >>>>>>>> 136.159.220.40 >>>>>>>> 138.251.214.78 >>>>>>>> >>>>>>>> >>>>>>>> all these and more within a minute. >>>>>>>> >>>>>>>> They are all different. >>>>>>>> >>>>>>>> Kate >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Thursday, August 9, 2012 9:55:29 AM UTC-4, alex wrote: >>>>>>>>> >>>>>>>>> Kate, >>>>>>>>> >>>>>>>>> If barryhunter is right and all the IPs are coming from the same >>>>>>>>> ISP anyway, you can simply block the whole subnetwork ranges of that >>>>>>>>> ISP >>>>>>>>> (at least temporary) using dos.yaml: >>>>>>>>> https://developers.google.com/appengine/docs/python/config/dos >>>>>>>>> >>>>>>>>> It'll be pain in the ass updating the file every time you >>>>>>>>> encounter new subnets but at least you could probably save some quota >>>>>>>>> 'till >>>>>>>>> you move somewhere else or figure something out. >>>>>>>>> >>>>>>>>> -- alex >>>>>>>>> >>>>>>>>> On Thursday, August 9, 2012 1:59:57 PM UTC+2, Kate wrote: >>>>>>>>>> >>>>>>>>>> Hi Sergey, >>>>>>>>>> >>>>>>>>>> Here is a typical example >>>>>>>>>> 2012-08-09 06:51:16.597 / 302 30ms 0kb curl/7.18.2 >>>>>>>>>> (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/3.12.2.0 zlib/1.2.3 >>>>>>>>>> libidn/0.6.14 libssh2/0.18 >>>>>>>>>> 202.125.215.12 - - [09/Aug/2012:04:51:16 -0700] "HEAD / HTTP/1.1" >>>>>>>>>> 302 153 - "curl/7.18.2 (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/ >>>>>>>>>> 3.12.2.0 zlib/1.2.3 libidn/0.6.14 libssh2/0.18" " >>>>>>>>>> aussieclouds.appspot.com" ms=31 cpu_ms=0 api_cpu_ms=0 >>>>>>>>>> cpm_usd=0.000049 instance=00c61b117c2f994812ed63184c9c5544dea738 >>>>>>>>>> >>>>>>>>>> But the ip address varies. My code forces 302 response. Before I >>>>>>>>>> added the code they were throwing errors head method not found. But >>>>>>>>>> even >>>>>>>>>> though I am doing the 303 I am still getting front end time exceeded >>>>>>>>>> and >>>>>>>>>> these requests are taking up about 95% of my quota. So to keep the >>>>>>>>>> site >>>>>>>>>> alive I would have to pay for them, I have lost most of my European >>>>>>>>>> and >>>>>>>>>> Australian visitors because the site is down every night during >>>>>>>>>> those >>>>>>>>>> places daylight hours. Obviously I can't continue like this and so >>>>>>>>>> will >>>>>>>>>> have to move to a provider capable of blocking these requests, >>>>>>>>>> >>>>>>>>>> -- You received this message because you are subscribed to the Google Groups "Google App Engine" group. To view this discussion on the web visit https://groups.google.com/d/msg/google-appengine/-/Kg_ioXnNrL8J. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/google-appengine?hl=en.
