Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site that is getting bombarded by requests from and I couldn't find where these servers are. What is the best way to regulate this? I could just deny those IP's but I have a feeling it would just start using other IP's.

Any suggestions would be helpful.

share|improve this question

migrated from Oct 15 '10 at 14:33

This question came from our site for professional and enthusiast programmers.

Maybe some of your local machines got a trojan? – Arman Oct 15 '10 at 14:45
Where are you seeing these addresses? TCP connections to your server (if so, what port or service)? "Received:" headers in messages? Somewhere else? – Gerald Combs Oct 15 '10 at 16:29
up vote 6 down vote accepted

The IP addresses to are reserved for private networks, i.e. the traffic you see is coming somewhere from your internal network, so try to figure out which machines those are, or contact your hosting provider and have them poke around what their machine is doing.

share|improve this answer
If Jason is behind a NAT'ing firewall, it could be NAT'ing an external address that's sending spam. Alternatively, it could also just be something else that's hosted by the same provider. – Richard Gadsden Oct 15 '10 at 17:20
While it's most likely true that those IPs he is seeing are on his LAN, my company is currently about to cut loose an ISP that is exposing THEIR IPs to -our- LAN which is also on Highly annoying. – Cypher Oct 16 '10 at 4:42

You can't figure out where those servers are on the Internet because that's an internal Intranet IP address. Whoever is spamming you is apparently on the same network as you. You might want to look into that.

share|improve this answer

In response to the other answers here: It could also be forged IP headers. Ask your ISP to do a proper job (ie, block spoofed IP's).

share|improve this answer

Those are rfc1918 private address blocks, and cannot be used on the internet, and generally are not routable, though I suppose that it may well be that you can forge them as a from address and not have them dropped.

These are either from your local network (if it is using a private adress space because internet access is NATed), or you can just drop them (include all the rfc1918 address spaces).

share|improve this answer
+1 for RFC citation. Give a man a fish... – AndyN Oct 15 '10 at 16:44
"We've traced the call. It's coming from inside the house." – Gerald Combs Oct 15 '10 at 18:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.