Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have been using the http:BL to block bad IP's from accessing my site.

If a malicious IP (comment spammer) trys to hit the site I just exit the web script which implicitly returns a 200 OK response.

Other responses I could return:

404 - Not found?

If I return a 404 maybe the robots will think "this is a waste of time, lets move on to attack another site" which would reduce the load on the site (I currently get about 2 spam-hits per second).

However

  • I'm reluctant to return 404's on urls that, under normal circumstances, can be found.
  • I'm not sure if spam robots can 'waste time'. i.e Why would a bot writer be bothered to code for 404's when they just blitz the web anyway?

401 Unauthorized?

Blocking a bad IP is not quite the same as "resource requires user authentication 1) which has not yet been provided or 2) which has been provided but failed authorization tests"


In general I feel that 'responding to the bad-bots according to proper http protocol' gives the bad guys the upper hand. In the sense that I play by the rules while they do not (a bit like Britain in the EU - ha, ha). On some days I feel like I should do something clever to divert these bot's away. On other days I just think that I should not take it personally and just ignore them. Accepting it as par for the course of running a web site.

I dunno - what are your thoughts? How do you respond when you know its a bad IP?

share|improve this question
7  
Personally I'd like to return a lightning bolt but I haven't figured out how to do that over the internet yet. –  the Tin Man Nov 25 '10 at 4:09
    
A few years ago, I observed on a french PR7 website opened to comments that if we didn't remove the 3-4 new spam comments in the first 36H, the spammer sent 100-300 more comments. So they sent a probe, verified that it would be a good target and then sent the real attack. There were numerous IP involved back then. How do your attackers work? –  FelipeAls Nov 25 '10 at 6:33
    
I feel like there are only about a maximum of 2 or 3 organisations behind 99% of the spam-hits. They do not appear to do probing cos none of their thousands of submissions have ever gone live on my site. Its all a pretty pointless situation - they spend their time achieving nothing, I spend time deleting spam. –  JW01 Nov 25 '10 at 14:48
4  
Return '402 Payment Required' :) –  keppla Jul 20 '11 at 6:56

2 Answers 2

up vote 16 down vote accepted

If you want to play by the rules, 403 Forbidden, or 403.6 IP address rejected (IIS specific) would be the correct response.

Giving a 200 response (and ignoring the comment) may just increase the load on the server, as the spam bot will presumably continue submitting spam on future occasions, unaware that it is having no effect. A 4XX response at least says "go away you need to check your facts" and is likely to diminish future attempts.

In the unlikely event you have firewall access, then a block of blacklisted IP addresses at the firewall would minimize server load / make it appear that your server didn't exist to the spammer.

I was going to suggest using a 302 Temporary Redirect to the spammer's own IP address - but this would probably have no effect as there would be no reason for the bot to follow the redirect.

If dealing with manually submitted spam, making the spam only visible by the IP address that submitted it is a good tactic. The spammer goes away happy and contented (and does not vary his approach to work around your defences), and the other users never see the spam.

share|improve this answer
    
Thanks. I'd never heard of Status 403.6. With regards to re-direct back to their IP: Yes, I considered holding up a mirror so everything thrown at us is bounced back to them...but then I realised that duplicating bad traffic wasn't a bright idea. 403, then, is probably the sensible way to go. –  JW01 Nov 25 '10 at 2:13
    
I like 403, or 404, leaning toward 404. 403 might encourage them to try different tactics. 404 implies the page just isn't there at all and it's a bad URL. I've written a lot of spiders for past jobs, and seldom saw 403, but ran into lots of 404s. Either way my code would remove the URL from the queue, but that's because I was trying to play fair. I'm also thinkin' doing a permanent redirect to 127.0.0.1 might be better than to their own IP, though I haven't played with it. To bad we can't redirect them to a true black-hole. –  the Tin Man Nov 25 '10 at 4:15
    
ha ha. I've just re-read my first comment "Thanks. I'd never heard of Status 403.6." - i think that is one of the geekiest things I've said. –  JW01 Nov 25 '10 at 14:53
2  
+1 for the firewall suggestion –  Larry Coleman Nov 25 '10 at 15:53
1  
@JW01: On dedicated or virtual machines it is. It can't be part of a shared host as it would affect the other users. If you have root access, tweak away. –  d-_-b Mar 25 '11 at 6:13

I don't know whether it's a bad practice, but I'd configure server not to send any response at all.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.