Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I see a great deal of spam (comment attempts, forum registration attempts, dictionary attacks, etc.) on my sites coming from the IP 127.0.0.1

I know that this is a local ip, so it doesn't make sense that it is coming through the in the user IP server variables.

Would it make sense to block all traffic with that address, or would I be blocking legit users by doing so?

Also, is it better to RESPOND to blocked requestors with a 403, or just serve them nothing/an empty page (in this case I define "better" as the method that reduces the likelihood of that blocked requestor from making additional requests).

share|improve this question
    
I wonder if it's other people who share your server running bots to generate spam. The server knows that your domain is on the same server as they are and just routes it locally. –  paulmorriss Jan 6 '12 at 14:21

1 Answer 1

up vote 1 down vote accepted

Do you have a cache like e.g. Varnish running? Or another proxy software. Then this would be a reason why you have many requests from 127.0.0.1.

I would not block them just like this. You seem to have other problems on your server.

Check if someone hacked your server and does now make local requests.

share|improve this answer
    
Thanks all for the responses. Regarding the suggestion of having a problem coming from the same server - I had not thought of that. The site runs on a shared MS (iis6) server owned by Godaddy Inc. There are 790 other domains/sites hosted on that machine's IP address. What other troubleshooting could I do to either confirm this theory or rule it out? –  robarwebservices Jan 9 '12 at 16:54
    
What kind of access do you have to the server? Can you log in and see all processes etc? –  Raffael Luthiger Jan 9 '12 at 22:36
    
Unfortunately no. It is basic shared hosting. I have limited IIS control via a web admin. I guess I could always open a ticket. I wonder If I can capture any additional useful info via scripting? –  robarwebservices Jan 10 '12 at 15:50
    
In this case you have to ask your hosting company why the traffic is coming from your local address. They are responsible for this server. They can tell you as well if there is some proxy software running on the server. –  Raffael Luthiger Jan 10 '12 at 15:57
    
thanks for the response. I will check with them. So to confirm, since it is showing as 127.0.0.1, does that mean that is for sure coming from the same host, with 100% certainty, or could an external machine be masking it's IP with 127.0.0.1 somehow? –  robarwebservices May 14 '12 at 13:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.