Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
This forum is locked: you cannot post, reply to, or edit topics.   This topic is locked: you cannot edit posts or make replies.    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel™ v2.5.x
Author Message
bsweb
Regular
Regular


Joined: Jun 19, 2006
Posts: 57

PostPosted: Sat Jul 22, 2006 4:21 am Reply with quote

Hi,

Probably a really simple question but better to be safe.

This morning Ip 64.4.8.114 belonging to MS Hotmail and 65.54.188.99 from Microsoft corporation were both blocked by Flood Blocker.

Just checking that I should remove the blocks and add their respective IP ranges to my protected list.

Cheers!
 
View user's profile Send private message
Guardian2003
Site Admin


Joined: Aug 28, 2003
Posts: 6792
Location: Ha Noi, Viet Nam

PostPosted: Sat Jul 22, 2006 7:07 am Reply with quote

Have you looked through your server logs or Sentinels tracked IP's to see what url's they were visiting and how many times they accessed your site?
 
View user's profile Send private message Send e-mail
bsweb
PostPosted: Sat Jul 22, 2006 9:59 am Reply with quote

140 pages since 16 July and 181 pages since 15 July, both looking at various pages but no reference to the page they got blocked on.

Does that help?
 
montego
Site Admin


Joined: Aug 29, 2004
Posts: 9449
Location: Arizona

PostPosted: Sat Jul 22, 2006 10:42 am Reply with quote

By the way, I've just set my 2.5.0 flood blocker to only email me so I can monitor this over time. I'll let you know if I find anything.

_________________
Only registered users can see links on this board! Get registered or login!
Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
bsweb
PostPosted: Sat Jul 22, 2006 10:53 am Reply with quote

Very wise, I think I will do likewise
 
Guardian2003
PostPosted: Sat Jul 22, 2006 1:07 pm Reply with quote

bsweb - sorry, I was asking that to see if they were actualy trying to flood the site or whether the flodd blocker setting is too high (a little too sensitive).

I think Montego's idea of setting it to just email is a good idea. At least that way it can be monitored without having to worry about accidental bannings.
 
bsweb
PostPosted: Sun Jul 23, 2006 8:53 am Reply with quote

My settings are Page delay 5 and Flood delay 2 and I have set the blocker to just email admin for the moment.

To be honest I'm not altogether sure what flood block is meant to protect me from.

I thought it might be someone pounding at the same page (trying to gain access to admin functions etc) with many different requests

I was assuming that if the two ip's mentioned were indeed search engine bots then they would access most of my pages which is what they were doing.

Is it safe to add the Microsoft/Hotmail IP ranges to Protected
Embarassed (showing how much I don't know again aren't I?)

Its not as though I am being overrun with flood blocks so I thought the settings were ok.
 
bsweb
PostPosted: Sun Jul 23, 2006 12:21 pm Reply with quote

Email flood blocker email x2 re 65.54.188.100 again part of the Microsoft corp. in case it means anything
Question
 
Guardian2003
PostPosted: Sun Jul 23, 2006 12:35 pm Reply with quote

Try the flood blocker delay at 3 and see what happens.
As you have said, you can always add those IP's to 'excluded' range but if theose IP's are behaving themselves, it would be better to strike a compromise with the actual settings.
If someone comes along to try and hack the site and spoofs those IP, your protection is going to be very limited if they are in the protected or excluded ranges.
 
bsweb
PostPosted: Sun Jul 23, 2006 12:37 pm Reply with quote

Will do, thanks Guardian2003
 
bsweb
PostPosted: Sun Jul 23, 2006 12:38 pm Reply with quote

Will do, thanks Guardian2003
Embarassed sorry duplicate post


Last edited by bsweb on Mon Jul 24, 2006 6:16 am; edited 1 time in total 
Guardian2003
PostPosted: Sun Jul 23, 2006 12:43 pm Reply with quote

No problem. I just think the settings are a little sensitive and changing them slightly will not harm the site and would be preferable for the reasons I have given.

Let us know how you get on though, it might take a few days to finesse those settings to suit your own needs.
 
bsweb
PostPosted: Mon Jul 24, 2006 3:27 am Reply with quote

Blocked 64.4.8.114 again so upped the flood delay to 4
 
montego
PostPosted: Mon Jul 24, 2006 7:25 am Reply with quote

Got a "flood" of emails yesterday from the msnbot. Hhhhmmmmm... does this bot not behave very well? I will still keep an eye on it. Not sure yet what I want to do with it. I want to see if anything else is caught at 2 seconds.
 
bsweb
PostPosted: Mon Jul 24, 2006 7:27 am Reply with quote

Glad its not just me!
 
bsweb
PostPosted: Tue Jul 25, 2006 12:45 pm Reply with quote

Still confused!

My Page Delay Setting 5 and Flood Delay 4
My Blocker Flood Setting : Email

The following is a summary of the flood reports emails received today

62.23.220.1 This IP belongs to Watford Electronic and was blocked on 27 separate pages. (No further action taken by myself)

209.8.25.66 The flood emails report for this ip indicated it was trying to post links to several pages. IP belongs to Beyond the Newtork America, Inc. Have blocked the whole IP range belonging to this company

66.235.184.132 on 4 pages. Belongs to HopeOne Internet Corp. (No action taken by me)

59.33.23.188 one report. Belongs to chinanet. Not in tracking log. (No action taken by me)

and finally two ips from Microsoft reported again, 65.54.188.99 (on 5 pages) and 65.54.188.100 (on 6 pages)

Is there any point increasing the Flood delay setting to a higher number?

Thanks
 
myrtletrees
Involved
Involved


Joined: Sep 13, 2005
Posts: 259
Location: Cornfields of Indiana

PostPosted: Wed Aug 02, 2006 6:13 am Reply with quote

montego wrote:
Got a "flood" of emails yesterday from the msnbot. Hhhhmmmmm... does this bot not behave very well? I will still keep an eye on it. Not sure yet what I want to do with it. I want to see if anything else is caught at 2 seconds.


I got a flood of them last night as well.
Same IP each time. I have flood blocker set to only email me.

I got 15 flood emails from MSNBOT at exactly 3:48AM on each and every one.

Is the msnbot freaky? Maybe it's a MS thing?
 
View user's profile Send private message
montego
PostPosted: Wed Aug 02, 2006 6:24 am Reply with quote

Thanks for reminding me! I needed to post this back. I added the following line to my robots.txt file about 4 - 5 days back and no more flood emails:

Crawl-delay: 10

This seems to work. No more emails...
 
Display posts from previous:       
This forum is locked: you cannot post, reply to, or edit topics.   This topic is locked: you cannot edit posts or make replies.    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel™ v2.5.x

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©