2

I see a great deal of spam (comment attempts, forum registration attempts, dictionary attacks, etc.) on my sites coming from the IP 127.0.0.1

I know that this is a local ip, so it doesn't make sense that it is coming through the in the user IP server variables.

Would it make sense to block all traffic with that address, or would I be blocking legit users by doing so?

Also, is it better to RESPOND to blocked requestors with a 403, or just serve them nothing/an empty page (in this case I define "better" as the method that reduces the likelihood of that blocked requestor from making additional requests).

Improve this question
1
  • I wonder if it's other people who share your server running bots to generate spam. The server knows that your domain is on the same server as they are and just routes it locally.
    – paulmorriss
    Commented Jan 6, 2012 at 14:21

1 Answer 1

Reset to default
2

Do you have a cache like e.g. Varnish running? Or another proxy software. Then this would be a reason why you have many requests from 127.0.0.1.

I would not block them just like this. You seem to have other problems on your server.

Check if someone hacked your server and does now make local requests.

Improve this answer
6
  • Thanks all for the responses. Regarding the suggestion of having a problem coming from the same server - I had not thought of that. The site runs on a shared MS (iis6) server owned by Godaddy Inc. There are 790 other domains/sites hosted on that machine's IP address. What other troubleshooting could I do to either confirm this theory or rule it out?
    – GWR
    Commented Jan 9, 2012 at 16:54
  • What kind of access do you have to the server? Can you log in and see all processes etc?
    – Raffael Luthiger
    Commented Jan 9, 2012 at 22:36
  • Unfortunately no. It is basic shared hosting. I have limited IIS control via a web admin. I guess I could always open a ticket. I wonder If I can capture any additional useful info via scripting?
    – GWR
    Commented Jan 10, 2012 at 15:50
  • In this case you have to ask your hosting company why the traffic is coming from your local address. They are responsible for this server. They can tell you as well if there is some proxy software running on the server.
    – Raffael Luthiger
    Commented Jan 10, 2012 at 15:57
  • 1
    yes, it is 100% certain. You have real requests and not just single IP packets so they can not be faked like this.
    – Raffael Luthiger
    Commented May 14, 2012 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.