How to report Internet Abuse

[Mark Phillips]

Is that a better solution than an apache rewrite rule to block a range of
addresses? Just trying to learn!

Thanks,

Mark

On Mon, Jul 26, 2010 at 12:13 PM, Eric Cope <eric.cope at gmail.com> wrote:

> iptables?
> http://www.cyberciti.biz/faq/how-do-i-block-an-ip-on-my-linux-server/
>
> Eric
>
> On Mon, Jul 26, 2010 at 12:10 PM, Mark Phillips <
> mark at phillipsmarketing.biz> wrote:
>
>> I have a server running a school newspaper site. I keep getting hit from a
>> server in Belgrade with a bad request, which creates an error and causes my
>> database to grow by 1MB/hit. I am trying to track down the bug in the
>> database, so my question is really about getting the guy to stop hitting my
>> server with this request.
>>
>> The IP for the request is 212.95.54.48, and I think it is a spider as I
>> get other requests from this IP for my site map, contacts page, etc. I
>> looked up the IP and I got this from Whois:
>>
>> % This is the RIPE Database query service.
>>
>>
>>
>> % The objects are in RPSL format.
>> %
>> % The RIPE Database is subject to Terms and Conditions.
>> % See http://www.ripe.net/db/support/db-terms-conditions.pdf
>>
>>
>>
>> % Note: This output has been filtered.
>> %       To receive output for a database update, use the "-B" flag.
>>
>> % Information related to '212.95.54.0 - 212.95.54.255'
>>
>> inetnum:        212.95.54.0 - 212.95.54.255
>>
>>
>>
>> netname:        INFERNO-NAME-967806
>> descr:          inferno.name Dedicated server customer IP
>> country:        DE
>> admin-c:        SA4597-RIPE
>> tech-c:         SR614-RIPE
>>
>>
>> status:         ASSIGNED PA
>>
>> mnt-by:         NETDIRECT-MNT
>> mnt-lower:      NETDIRECT-MNT
>> mnt-routes:     NETDIRECT-MNT
>> source:         RIPE # Filtered
>>
>> person:         Sogreev Anton
>> address:        12 Knez Mihailova
>> address:        apt. 18
>>
>>
>>
>> address:        Belgrade
>> address:        11000
>> address:        Serbia
>> remarks:##########################################################
>> remarks:        ====  Inferno Solutions Customer ====
>> remarks:        Please report abuse incidents to  [image: Email address protected from spam harvesters]
>>
>>
>>
>> remarks:        Messages sent to other contact addresses may not be
>> remarks:        acted upon.
>> remarks:##########################################################
>> phone:          +1 619 684 2664
>> abuse-mailbox:   [image: Email address protected from spam harvesters]
>>
>>
>>
>> nic-hdl:        SA4597-RIPE
>> mnt-by:         NETDIRECT-MNT
>> source:         RIPE # Filtered
>>
>> person:         Simon Roehl
>> address:        netdirekt e. K.
>> address:        Kleyer Strasse 79 /Tor 14
>> address:        60326 Frankfurt
>>
>>
>>
>> address:        DE
>> phone:          +49 69 90556880
>> fax-no:         +49 69 905568822
>> abuse-mailbox:   [image: Email address protected from spam harvesters]
>>
>> nic-hdl:        SR614-RIPE
>> mnt-by:         NETDIRECT-MNT
>> source:         RIPE # Filtered
>>
>> % Information related to '212.95.32.0/19AS28753'
>>
>>
>> route:	        212.95.32.0/19
>>
>> descr:	        ORG-nA8-RIPE
>> origin:	        AS28753
>> org:	        ORG-nA8-RIPE
>> mnt-lower:	NETDIRECT-MNT
>> mnt-routes:	NETDIRECT-MNT
>> mnt-by:	        NETDIRECT-MNT
>> source:	        RIPE # Filtered
>>
>> organisation:   ORG-nA8-RIPE
>>
>>
>>
>> org-name:       netdirect
>> org-type:       LIR
>> address:        netdirekt e. K.
>>                 Kleyer Strasse 79 / Tor 14
>>                 60326 Frankfurt
>>                 Germany
>> phone:          +49 69 90556880
>>
>>
>>
>> fax-no:         +49 69 905568822
>> admin-c:        SR614-RIPE
>> admin-c:        WW200-RIPE
>> mnt-ref:        NETDIRECT-MNT
>> mnt-ref:        RIPE-NCC-HM-MNT
>> mnt-by:         RIPE-NCC-HM-MNT
>> source:         RIPE # Filtered
>>
>>
>> What is the best way to handle this? Send an email to abuse at inferno.name,
>> or am I just inviting more abuse? Is there a way for apache to block these
>> addresses before it hits my site (apache is in front of a plone/zope
>> combination)? I have a robots.txt file at the root of my site...
>>
>> Sitemap: http://ahsnews.com/google-sitemaps.xml
>> User-agent: *
>> Disallow: /
>>
>> but it doesn't stop him from hitting me anyway.
>>
>> Thanks for any suggestions you may have!
>>
>> Mark
>>
>>
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>
>
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss/attachments/20100726/966aadc4/attachment.html>