iptables?
http://www.cyberciti.biz/faq/how-do-i-block-an-ip-on-my-linux-server/

Eric

On Mon, Jul 26, 2010 at 12:10 PM, Mark Phillips
<mark@phillipsmarketing.biz>wrote:

> I have a server running a school newspaper site. I keep getting hit from a
> server in Belgrade with a bad request, which creates an error and causes my
> database to grow by 1MB/hit. I am trying to track down the bug in the
> database, so my question is really about getting the guy to stop hitting my
> server with this request.
>
> The IP for the request is 212.95.54.48, and I think it is a spider as I get
> other requests from this IP for my site map, contacts page, etc. I looked up
> the IP and I got this from Whois:
>
> % This is the RIPE Database query service.
>
>
> % The objects are in RPSL format.
> %
> % The RIPE Database is subject to Terms and Conditions.
> % See http://www.ripe.net/db/support/db-terms-conditions.pdf
>
>
> % Note: This output has been filtered.
> %       To receive output for a database update, use the "-B" flag.
>
> % Information related to '212.95.54.0 - 212.95.54.255'
>
> inetnum:        212.95.54.0 - 212.95.54.255
>
>
> netname:        INFERNO-NAME-967806
> descr:          inferno.name Dedicated server customer IP
> country:        DE
> admin-c:        SA4597-RIPE
> tech-c:         SR614-RIPE
>
> status:         ASSIGNED PA
>
> mnt-by:         NETDIRECT-MNT
> mnt-lower:      NETDIRECT-MNT
> mnt-routes:     NETDIRECT-MNT
> source:         RIPE # Filtered
>
> person:         Sogreev Anton
> address:        12 Knez Mihailova
> address:        apt. 18
>
>
> address:        Belgrade
> address:        11000
> address:        Serbia
> remarks:##########################################################
> remarks:        ====  Inferno Solutions Customer ====
> remarks:        Please report abuse incidents to  [image: Email address protected from spam harvesters]
>
>
> remarks:        Messages sent to other contact addresses may not be
> remarks:        acted upon.
> remarks:##########################################################
> phone:          +1 619 684 2664
> abuse-mailbox:   [image: Email address protected from spam harvesters]
>
>
> nic-hdl:        SA4597-RIPE
> mnt-by:         NETDIRECT-MNT
> source:         RIPE # Filtered
>
> person:         Simon Roehl
> address:        netdirekt e. K.
> address:        Kleyer Strasse 79 /Tor 14
> address:        60326 Frankfurt
>
>
> address:        DE
> phone:          +49 69 90556880
> fax-no:         +49 69 905568822
> abuse-mailbox:   [image: Email address protected from spam harvesters]
>
> nic-hdl:        SR614-RIPE
> mnt-by:         NETDIRECT-MNT
> source:         RIPE # Filtered
>
> % Information related to '212.95.32.0/19AS28753'
>
> route:	        212.95.32.0/19
>
> descr:	        ORG-nA8-RIPE
> origin:	        AS28753
> org:	        ORG-nA8-RIPE
> mnt-lower:	NETDIRECT-MNT
> mnt-routes:	NETDIRECT-MNT
> mnt-by:	        NETDIRECT-MNT
> source:	        RIPE # Filtered
>
> organisation:   ORG-nA8-RIPE
>
>
> org-name:       netdirect
> org-type:       LIR
> address:        netdirekt e. K.
>                 Kleyer Strasse 79 / Tor 14
>                 60326 Frankfurt
>                 Germany
> phone:          +49 69 90556880
>
>
> fax-no:         +49 69 905568822
> admin-c:        SR614-RIPE
> admin-c:        WW200-RIPE
> mnt-ref:        NETDIRECT-MNT
> mnt-ref:        RIPE-NCC-HM-MNT
> mnt-by:         RIPE-NCC-HM-MNT
> source:         RIPE # Filtered
>
> What is the best way to handle this? Send an email to abuse@inferno.name,
> or am I just inviting more abuse? Is there a way for apache to block these
> addresses before it hits my site (apache is in front of a plone/zope
> combination)? I have a robots.txt file at the root of my site...
>
> Sitemap: http://ahsnews.com/google-sitemaps.xml
> User-agent: *
> Disallow: /
>
> but it doesn't stop him from hitting me anyway.
>
> Thanks for any suggestions you may have!
>
> Mark
>
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>