Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Tons of bad bots hit our servers every day and I have tools to instantaneously block them (i.e. modsecurity and a C++ tool of my own.) These block the bots so no data is sent back and they are banned on my firewall so any extra hit is immediately turned down. On one of my server (small one!) I get over 20 such blocks (IPs) per day and that server only gets ~3,000 hits a month.

Now, the IP block is temporary mainly to avoid crowding my firewall (1,000's of IPs in your firewall will make it really slow!)

However, I'm wondering now... What do you do on your end? Block everything at once or send the bot to la la land with a redirect? I'm thinking that I could have a tiny HTML page with nothing on it (you know, something like a title and a body which say "Thanks" and voilà).

Which do you think is best? I've seen that redirections did not seem to deter any robots so firewalling them has been my best solution so far... but I was wondering what others do in this situation?

share|improve this question

migrated from stackoverflow.com Sep 22 '10 at 23:52

This question came from our site for professional and enthusiast programmers.

    
While this seems an interesting question, it also seems more appropriate to the remit of serverfault.com, +1 though –  David Thomas Sep 22 '10 at 23:42
    
Dang it, I accidentally down voted this (via misclick) and now sf not letting me take it back. Sorry about that, it wasn't intentional. Apparently I can remove the down vote if the question is edited. –  rthomson Apr 13 '11 at 3:21
add comment

2 Answers

A bot may not necessarily follow a redirect. It's not human, after all. In fact, if your server responds with an alternative address prompt (or responds at all), it may just ignore it and be motivated to dig deeper into your domain, or it may scrape both you and your redirect with added frenzy at getting any response at all.

The best thing you can do is block the IP once it starts behaving suspiciously (typical admin urls like php-mysql, following every single link, etc). Otherwise, just don't stress and let them do their thing. As long as your site has adequate security to block out unauthorized access to sensitive content and has frequent contingency backups just in case, you needn't worry.

share|improve this answer
add comment

It does depend on what is hitting your firewall. IME, blackholing the traffic has the best effect.

I recently had a flood of DNS queries on my domain server from a small number of addresses. Someone had decided it offered a valid enough response for a root-server query (it's not an open resolver) that it was then made available to a DDoS tool to use. A bit of discussion with the owner of one of the IP addresses showed that it was a spoofed packet and any response was going to do the intended DDoS. So I blackholed them as soon as I spotted them. They've all gone away now.

If it had been someone mistakenly thinking it was an open resolver, then sending back misleading information might have been effective. Certainly confusing!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.