I'm running Apache on my local windows machine and I've been having problems with what appears to be a hacking attempt. The requests for some reason actually seem to render my internet very slow [returns to normal when i shut off the webserver]. The access logs look a bit like this:
109.230.216.22 - - [15/May/2011:11:31:03 -0500] "GET /webdav/sip2.php?&IP=82.5.233 HTTP/1.1" 200 15 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
109.230.216.22 - - [15/May/2011:11:31:06 -0500] "GET /webdav/sip2.php?&IP=82.5.15 HTTP/1.1" 200 15 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
109.230.216.22 - - [15/May/2011:11:31:07 -0500] "GET /webdav/sip2.php?&IP=82.6.89 HTTP/1.1" 200 15 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
109.230.216.22 - - [15/May/2011:11:31:07 -0500] "GET /webdav/sip2.php?&IP=82.6.198 HTTP/1.1" 200 15 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
This has been going on for weeks. I've entered the offending IP in window's firewall for good measure, but primarily was trying to rely on the following in my httpd.conf file:
<Directory "C:/xampp/htdocs">
Options Indexes FollowSymLinks Includes ExecCGI
AllowOverride All
Order deny,allow
Deny from all
Allow from MY.IP.ADDRESS.HERE
</Directory>
I gave it a quick test by SSHing to a remote server and trying to access a page via wget - and got a 403 response as expected. The request showed up in access.log
also as a 403, as expected.
The unexpected part is the requests from 109.230.216.22
continue, unabated and are returning a status code of 200.
How do I block this thing?