Return-Path: Delivered-To: apmail-httpd-users-archive@www.apache.org Received: (qmail 64847 invoked from network); 5 Jan 2005 22:49:21 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199) by minotaur-2.apache.org with SMTP; 5 Jan 2005 22:49:21 -0000 Received: (qmail 84036 invoked by uid 500); 5 Jan 2005 22:49:07 -0000 Delivered-To: apmail-httpd-users-archive@httpd.apache.org Received: (qmail 84021 invoked by uid 500); 5 Jan 2005 22:49:07 -0000 Mailing-List: contact users-help@httpd.apache.org; run by ezmlm Precedence: bulk Reply-To: users@httpd.apache.org list-help: list-unsubscribe: list-post: Delivered-To: mailing list users@httpd.apache.org Received: (qmail 84006 invoked by uid 99); 5 Jan 2005 22:49:07 -0000 X-ASF-Spam-Status: No, hits=0.1 required=10.0 tests=FORGED_RCVD_HELO X-Spam-Check-By: apache.org Received-SPF: pass (hermes.apache.org: local policy) Received: from 209-142-37-2.stk.inreach.net (HELO bluefish.ries-knight.net) (209.142.37.2) by apache.org (qpsmtpd/0.28) with ESMTP; Wed, 05 Jan 2005 14:49:04 -0800 Received: from [127.0.0.1] (adsl-69-225-38-192.dsl.skt2ca.pacbell.net [69.225.38.192]) by bluefish.ries-knight.net (8.9.3/8.9.3) with ESMTP id OAA18854; Wed, 5 Jan 2005 14:48:57 -0800 Message-ID: <41DC6ED2.4010801@ries-knight.net> Date: Wed, 05 Jan 2005 14:48:50 -0800 From: Steelhead User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: users@httpd.apache.org References: <41DC030D.7020902@ries-knight.net> <41DC48DE.6050104@ries-knight.net> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked Subject: Re: [users@httpd] Re: zombie hits from undesired sites X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Eric Ladner wrote: > On Wed, 05 Jan 2005 12:06:54 -0800, Steelhead wrote: > >>Thanks Eric. >> >>Yeah it is Linux and we were on hopes that someone else might have >>written a script to note the referrer section and allow us to filter >>accordingly. >> >>Thanks >> >>Bill > > > It wouldn't be hard to write a Perl script to rip through the log and > spit out the top referers, but I'd be hesitant to do that > automatically (i.e. from cron). There should be some human > intervention to make sure you don't blackhole somebody that's valid. > > There may even be a more elegant way to handle this but the iptables > filter was the first thing I thought of. > > Eric > > --------------------------------------------------------------------- > To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org > For additional commands, e-mail: users-help@httpd.apache.org > > > Yeah there is a downside... thanks for the perspective. -- Bill Ries-Knight Stockton, CA Respect life: Donate blood as you can. Donate your used parts when no longer needed. --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org For additional commands, e-mail: users-help@httpd.apache.org