Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have IIS 6.0 on a Windows Server 2003 with a ASP.NET web application. Our web application, or specifically one web page is suffering from some bot attack. Reviewing IIS logs we've detected a User-Agent that is attacking:
python-requests/0.13.2

#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status

2012-07-17 23:59:59 W3SVC336290672 192.168.2.65 POST /MyVirtualDirectory/MyFolder/wf_Page_Under_Attack.aspx - 80 - 190.232.79.70 python-requests/0.13.2 200 0 0

Is it possible on IIS to block or deny access to "python-requests/0.13.2" requests?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

There isn't built-in functionality to do what you're looking for.

One no-cost solution that would do what you want is the Ionics Isapi Rewrite Filter (IIRF) ISAPI filter module. They even have sample configuration for blocking access based on User-Agent.

A second option is Microsoft URLScan (as you indicted in you comment-- I couldn't remember if it allowed for logic based on the User-Agent or not). This blog entry describes using URLScan to block requests based on user-agent. I don't believe URLScan can match based on regular expression, but since you're looking for an exact string match it should do what you want too.

Having said all that, though, it's trivially easy for the "bot" author to change their User-Agent string to something "innocuous". You're taking the first steps in an arms race.

share|improve this answer
    
Reading further, I find URLSCAN from Microsoft, which run over IIS. Do you think it's quite the same as IIRF ISAPI? –  Jorge Jul 18 '12 at 17:59
    
I dropped on an edit. –  Evan Anderson Jul 18 '12 at 19:29
    
Thank you, Evan. –  Jorge Jul 18 '12 at 20:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.