Flood Blocked Microsoft IP

Regular Joined: Jun 19, 2006 Posts: 57

Hi,

Probably a really simple question but better to be safe.

This morning Ip 64.4.8.114 belonging to MS Hotmail and 65.54.188.99 from Microsoft corporation were both blocked by Flood Blocker.

Just checking that I should remove the blocks and add their respective IP ranges to my protected list.

Cheers!

Posted: Sat Jul 22, 2006 7:07 am

Have you looked through your server logs or Sentinels tracked IP's to see what url's they were visiting and how many times they accessed your site?

Posted: Sat Jul 22, 2006 9:59 am

140 pages since 16 July and 181 pages since 15 July, both looking at various pages but no reference to the page they got blocked on.

Does that help?

Posted: Sat Jul 22, 2006 10:42 am

By the way, I've just set my 2.5.0 flood blocker to only email me so I can monitor this over time. I'll let you know if I find anything.

Posted: Sat Jul 22, 2006 10:53 am

Very wise, I think I will do likewise

Posted: Sat Jul 22, 2006 1:07 pm

bsweb - sorry, I was asking that to see if they were actualy trying to flood the site or whether the flodd blocker setting is too high (a little too sensitive).

I think Montego's idea of setting it to just email is a good idea. At least that way it can be monitored without having to worry about accidental bannings.

Posted: Sun Jul 23, 2006 8:53 am

My settings are Page delay 5 and Flood delay 2 and I have set the blocker to just email admin for the moment.

To be honest I'm not altogether sure what flood block is meant to protect me from.

I thought it might be someone pounding at the same page (trying to gain access to admin functions etc) with many different requests

I was assuming that if the two ip's mentioned were indeed search engine bots then they would access most of my pages which is what they were doing.

Is it safe to add the Microsoft/Hotmail IP ranges to Protected
Embarassed

(showing how much I don't know again aren't I?)

Its not as though I am being overrun with flood blocks so I thought the settings were ok.

Posted: Sun Jul 23, 2006 12:21 pm

Email flood blocker email x2 re 65.54.188.100 again part of the Microsoft corp. in case it means anything
Question

Posted: Sun Jul 23, 2006 12:35 pm

Try the flood blocker delay at 3 and see what happens.
As you have said, you can always add those IP's to 'excluded' range but if theose IP's are behaving themselves, it would be better to strike a compromise with the actual settings.
If someone comes along to try and hack the site and spoofs those IP, your protection is going to be very limited if they are in the protected or excluded ranges.

Posted: Sun Jul 23, 2006 12:37 pm

Will do, thanks Guardian2003

Posted: Sun Jul 23, 2006 12:38 pm

Will do, thanks Guardian2003
Embarassed

sorry duplicate post

Posted: Sun Jul 23, 2006 12:43 pm

No problem. I just think the settings are a little sensitive and changing them slightly will not harm the site and would be preferable for the reasons I have given.

Let us know how you get on though, it might take a few days to finesse those settings to suit your own needs.

Posted: Mon Jul 24, 2006 3:27 am

Blocked 64.4.8.114 again so upped the flood delay to 4

Posted: Mon Jul 24, 2006 7:25 am

Got a "flood" of emails yesterday from the msnbot. Hhhhmmmmm... does this bot not behave very well? I will still keep an eye on it. Not sure yet what I want to do with it. I want to see if anything else is caught at 2 seconds.

Posted: Mon Jul 24, 2006 7:27 am

Glad its not just me!

Posted: Tue Jul 25, 2006 12:45 pm

Still confused!

My Page Delay Setting 5 and Flood Delay 4
My Blocker Flood Setting : Email

The following is a summary of the flood reports emails received today

62.23.220.1 This IP belongs to Watford Electronic and was blocked on 27 separate pages. (No further action taken by myself)

209.8.25.66 The flood emails report for this ip indicated it was trying to post links to several pages. IP belongs to Beyond the Newtork America, Inc. Have blocked the whole IP range belonging to this company

66.235.184.132 on 4 pages. Belongs to HopeOne Internet Corp. (No action taken by me)

59.33.23.188 one report. Belongs to chinanet. Not in tracking log. (No action taken by me)

and finally two ips from Microsoft reported again, 65.54.188.99 (on 5 pages) and 65.54.188.100 (on 6 pages)

Is there any point increasing the Flood delay setting to a higher number?

Thanks

Posted: Wed Aug 02, 2006 6:13 am

montego wrote:

Got a "flood" of emails yesterday from the msnbot. Hhhhmmmmm... does this bot not behave very well? I will still keep an eye on it. Not sure yet what I want to do with it. I want to see if anything else is caught at 2 seconds.

I got a flood of them last night as well.
Same IP each time. I have flood blocker set to only email me.

I got 15 flood emails from MSNBOT at exactly 3:48AM on each and every one.

Is the msnbot freaky? Maybe it's a MS thing?

Posted: Wed Aug 02, 2006 6:24 am

Thanks for reminding me! I needed to post this back. I added the following line to my robots.txt file about 4 - 5 days back and no more flood emails:

Crawl-delay: 10

This seems to work. No more emails...