Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have wordpress site that is under some kind of bot attack. I checked apache logs and there's get request to a single post on my blog every second (sometimes there's more than one per second). When i block ip address of attacker in htaccess file, requests continue but it's one every 5-10 seconds. If i unblock it, after few minutes it get's back to 1 or more every second.

IP Address of attacker is changing once or twice every day.

I have wordfence plugin installed that blocks attacks, i also manualy add ip adresses to htaccess, but i'm interested if there's another way to block this guy for good...

He's always identified as blank user agent, always get same page and it's always only one single page request.

Here's part of apache log with attack.

178.222.186.246 - - [20/May/2013:02:35:46 -0500] "GET /2012/01/19/skembici-u-saftu/ HTTP/1.1" 200 48097 "-" "-"
178.222.186.246 - - [20/May/2013:02:35:55 -0500] "GET /2012/01/19/skembici-u-saftu/ HTTP/1.1" 200 47939 "-" "-"
178.222.186.246 - - [20/May/2013:02:35:59 -0500] "GET /2012/01/19/skembici-u-saftu/ HTTP/1.1" 200 47970 "-" "-"
share|improve this question
1  
apps.db.ripe.net/search/… - is the whois for that IP. The abuse email address is on there if you wish to report the issue to the ISP –  Tim Fountain May 20 '13 at 12:17
    
Thanks Tim. I already know who's provider, i sent them several e-mails and call them few times, but people who work in tech support don't even know what i'm talking about and even less how to stop that... To be even worse, that's biggest internet provider in my country... –  onedevteam.com May 20 '13 at 14:55
add comment

1 Answer 1

up vote 2 down vote accepted

Since the user agent is blank, you could use that to trigger a block:

RewriteEngine On  
SetEnvIfNoCase User-Agent "^-?$" bad_user
Deny from env=bad_user

I put in -? in case the user agent being sent is actually a dash. It is very hard to tell from your logs whether it is actually blank, or if it is a dash.

The linked resource on StackOverflow has examples of several other rules based on User-Agent and Referrer as well.

share|improve this answer
    
I added this code to my site and in next few days i'll see if this is final solution for my problem. –  onedevteam.com May 20 '13 at 10:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.