Return-Path: Delivered-To: apmail-mirrors-archive@www.apache.org Received: (qmail 39274 invoked from network); 15 Sep 2005 18:33:55 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199) by minotaur.apache.org with SMTP; 15 Sep 2005 18:33:55 -0000 Received: (qmail 61759 invoked by uid 500); 15 Sep 2005 18:33:54 -0000 Delivered-To: apmail-mirrors-archive@apache.org Received: (qmail 61749 invoked by uid 500); 15 Sep 2005 18:33:53 -0000 Mailing-List: contact mirrors-help@apache.org; run by ezmlm Precedence: bulk Reply-To: mirrors@apache.org list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list mirrors@apache.org Received: (qmail 61736 invoked by uid 99); 15 Sep 2005 18:33:53 -0000 Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 15 Sep 2005 11:33:53 -0700 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Received-SPF: pass (asf.osuosl.org: local policy) Received: from [81.169.169.193] (HELO h5400.serverkompetenz.net) (81.169.169.193) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 15 Sep 2005 11:34:02 -0700 Received: from NBK34020 (p5480A41C.dip0.t-ipconnect.de [84.128.164.28]) by h5400.serverkompetenz.net (Postfix) with ESMTP id 2EFB3C30062 for ; Thu, 15 Sep 2005 20:33:49 +0200 (CEST) Message-ID: <000601c5ba24$04145ec0$18b2a8c0@ehharms.de> From: "Thorsten Neckel" To: References: <005701c5ba05$916782d0$4d01a8c0@ehharms.de> <4329A745.9070503@gdi-tech.com> <200509151317.47822.gespinosa@inca.gob.mx> Subject: Re: Mirrors under attack? Date: Thu, 15 Sep 2005 20:33:48 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Virus-Checked: Checked by ClamAV on apache.org X-Spam-Rating: minotaur.apache.org 1.6.2 0/1000/N Hi! > I usually block the > offending class C via iptables/pf and go from there. (Flushing blocks > every 6 months). Currently I use Order Deny,Allow via .htaccess to block such subnets. > I have the same problem here, but looks like is a spybot, just like the > google > or altavista uses to search pages. Not in my case. They download the whole file. >looks like it does not consume a lot of resources, No, about 1 GByte every 30 minutes. At time writing the only solution is to block these guys. regards thorsten