Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

quick one for Apache gurus - how to block a hostname that is simply: . -without blocking anything else. Not sure how they managed to achieve this but it seems to be a bot that doesn't want to be identified. Latest IP is 204.45.209.208 uses various OS in user agent string. cheers rob

share|improve this question
2  
Can you clarify where that hostname is coming from? A host header on a request, or the hostname of that 204.45.209.208 address? – Shane Madden Mar 5 '11 at 21:39
Hi Shane - Yes, its the hostname of the address 204.45.209.208 – Rothbert Mar 5 '11 at 21:59
wow. everything from the 209.xxx that I tried resolves to '.' – egorgry Mar 5 '11 at 22:21

1 Answer

up vote 1 down vote

You could block it with IP-tables.

iptables -I INPUT -s 204.45.209.208 -j DROP
share|improve this answer
@Rothbert says that the latest IP is 204.45... so there are clearly more that have resolved to ., so iptables may not be a good solution. – Iain♦ Mar 5 '11 at 22:30
@Iain @TiZon - that's correct, coming from a range of IPs. Wondered if there's a rewrite that would do the trick something like: RewriteCond %{HTTP_HOST} !^. ? – Rothbert Mar 6 '11 at 1:39
1  
Can't he just block whole subnetwork in iptables? – Ency Mar 6 '11 at 9:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.