Blocking IP addresses in .htaccess

[Stecyk]

Hi,

I have the following .htaccess file in my root directory (xdomainname). I added an entry today on 8 Jan 2008 but it doesn't seem to be working. Upon closer inspection, I noticed that 20 Oct 07 and 08 Jan 08 are the same ip address. I must be doing something wrong.

Please note, xxx represents numbers that I have chosen to disguise. And zzz in the 20 Oct 07 and 08 Jan 08 are meant to represent the same values. That is, 08 Jan08 is a duplicate of 20 Oct 07.

Any ideas where I goofed?

Thank you.

Best regards,
Kevin

# Last Update 08 Jan 2008


Order Allow,Deny
Allow from all

Deny from 66.xxx.xx.xx

# 9 Jul 2006
Deny from 72.232.xx.xxx

# 28 Dec 2006
Deny from 72.232.xxx.xxx

# 3 Jan 2007
Deny from 222.122.xxx.xxx

# 02 Feb 2007 (note 50 is a problem...51 to 65 might not be)
Deny from 81.xx.144.50
Deny from 81.xx.144.51
Deny from 81.xx.144.52
Deny from 81.xx.144.53
Deny from 81.xx.144.54
Deny from 81.xx.144.55
Deny from 81.xx.144.56
Deny from 81.xx.144.57
Deny from 81.xx.144.58
Deny from 81.xx.144.59
Deny from 81.xx.144.60
Deny from 81.xx.144.61
Deny from 81.xx.144.62
Deny from 81.xx.144.63
Deny from 81.xx.144.64
Deny from 81.xx.144.65
Deny from 81.xx.144.66
Deny from 81.xx.144.67
Deny from 81.xx.144.68
Deny from 81.xx.144.69
Deny from 81.xx.144.70
Deny from 81.xx.146.162
Deny from 70.xx.173.186
Deny from 195.xxx.xxx.xx
Deny from 65.xx.xx.xxx

# 04 Mar 2007 (getting more aggressive:
# http://www.dnsstuff.com/tools/whois.ch?ip=81.95.xxx.xx

Deny from 81.xx.144.
Deny from 81.xx.145.
Deny from 81.xx.146.
Deny from 81.xx.147.
Deny from 81.xx.148.
Deny from 81.xx.149.
Deny from 81.xx.150.
Deny from 81.xx.151.
Deny from 81.xx.152.
Deny from 81.xx.153.
Deny from 81.xx.154.
Deny from 81.xx.155.
Deny from 81.xx.156.
Deny from 81.xx.157.
Deny from 81.xx.158.
Deny from 81.xx.159.

# 30 Mar 2007: Always deny
Deny from 216.xxx.xxx.xx

# 03 Apr 2007: Deny
Deny from 84.28.xx.xx

# 18 & 28 Apr 2007: Deny from Ukraine
# Information related to '85.xxx.xxx.0 - 85.xxx.xxx.255'
# http://www.dnsstuff.com/tools/whois.ch?ip=85.xxx.xxx.84

Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.
Deny from 85.xxx.xxx.


# 03 Jul 2007: Deny from Russia
# http://www.dnsstuff.com/tools/whois.ch?ip=89.188.xxx.xxx&email=on
# 89.188.xxx.x - 89.188.xxx.xxx

Deny from 89.188.xxx.
Deny from 89.188.xxx.
Deny from 89.188.xxx.
Deny from 89.188.xxx.

# 12 Jul 2007: Deny from Russia
# Just going to hit one ip address
Deny from 72.9.xxx.xxx

# 19 Jul 2007: Deny from USA
# Just going to hit one ip address
Deny from 64.69.xx.xx

# 01 Oct 2007:
# Just going to hit one ip address
Deny from 70.85.xxx.xxx

# 20 Oct 2007
# Just going to hit two ip addresses
Deny from 65.200.zzz.zzz
Deny from 65.200.xxx.xxx

# 08 Jan 2008
# Excessively hitting rss and posts
Deny from 65.200.zzz.zzz

[Arthur]

I added an entry today on 8 Jan 2008 but it doesn't seem to be working What makes you think it's not working? I'm seeing that IP receiving a 403 Forbidden message every time.

If you deny access, the server will still accept the connection -responding with a 403 Forbidden- and the access attempt will still be logged.

-Arthur

[Stecyk]

Hi Arthur,

I had to add the same command to another .htaccess file inside my blog directory. Before, it was still registering.

Now, it is stopped with the 403.

Best regards,
Kevin

[Stecyk]

Hi Arthur,

I removed the block in the blog directory.

You'll notice that the ip address is once again getting through. That ip address often comes in looking for an xml file. That's where it gets through. When it goes for a php file, I stop it through another means.

To recap:

xml - currently getting through
php - stopped because "stupid_bot"

I would have thought the .htaccess file in the root directory with its ip block would have stopped it. Something is amiss, though I have no idea what it might be. If you or others have suggestions, I'd love to read them.

Best regards,
Kevin

[Terra]

Couple things:

Your xdom/.htaccess file:
1) is littered with CRLF, please re-upload in ASCII mode
2) there is no blank line at the bottom... The last line must have a LF, otherwise the parser won't read it...

Once that is done, we'll check it again...

[Stecyk]

Couple things:

Your xdom/.htaccess file:
1) is littered with CRLF, please re-upload in ASCII mode
2) there is no blank line at the bottom... The last line must have a LF, otherwise the parser won't read it...

Once that is done, we'll check it again...

Thank you Terra. I'll modify it shortly.