I see a great deal of spam (comment attempts, forum registration attempts, dictionary attacks, etc.) on my sites coming from the IP

I know that this is a local ip, so it doesn't make sense that it is coming through the in the user IP server variables.

Would it make sense to block all traffic with that address, or would I be blocking legit users by doing so?

Also, is it better to RESPOND to blocked requestors with a 403, or just serve them nothing/an empty page (in this case I define "better" as the method that reduces the likelihood of that blocked requestor from making additional requests).

  • I wonder if it's other people who share your server running bots to generate spam. The server knows that your domain is on the same server as they are and just routes it locally. Jan 6 '12 at 14:21

Do you have a cache like e.g. Varnish running? Or another proxy software. Then this would be a reason why you have many requests from

I would not block them just like this. You seem to have other problems on your server.

Check if someone hacked your server and does now make local requests.

  • Thanks all for the responses. Regarding the suggestion of having a problem coming from the same server - I had not thought of that. The site runs on a shared MS (iis6) server owned by Godaddy Inc. There are 790 other domains/sites hosted on that machine's IP address. What other troubleshooting could I do to either confirm this theory or rule it out?
    – GWR
    Jan 9 '12 at 16:54
  • What kind of access do you have to the server? Can you log in and see all processes etc? Jan 9 '12 at 22:36
  • Unfortunately no. It is basic shared hosting. I have limited IIS control via a web admin. I guess I could always open a ticket. I wonder If I can capture any additional useful info via scripting?
    – GWR
    Jan 10 '12 at 15:50
  • In this case you have to ask your hosting company why the traffic is coming from your local address. They are responsible for this server. They can tell you as well if there is some proxy software running on the server. Jan 10 '12 at 15:57
  • 1
    yes, it is 100% certain. You have real requests and not just single IP packets so they can not be faked like this. May 14 '12 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.