I have been attacked for weeks by the same spambot trying to brute force the login page. I have a login security module now installed on my Drupal 6 website and it bans on IP after x amount of attempts. It's been going on for ever and I have banned about 1000 IP addresses.

Is there any point in me banning on IP due to the spambot having access to unlimited IP addresses or will they run out of them eventually?

  • Have you looked at your raw access logs is there anything else you can ban them based on other than IP? If you could block them sooner it would help your server. Letting them get to the login page and only banning them after X amount of attempts is more like passive security than active. – Anagio Dec 5 '12 at 7:44
  • To answer your question about spam bots having access to unlimited passwords yes. Aside from dictionary attacks which could have hundreds of thousands of word and word combinations they can have settings to brute force every combination of letters numbers and characters on a keyboard. – Anagio Dec 5 '12 at 7:47
  • oh sorry Anagio my title is a typo and i will edit it. I meant IP Addressess not passwords.I never knew about the raw access log. i will go check it out. brb – Reg Gordon Dec 5 '12 at 7:56
  • excellent Anagio i think its some ukranian bot called ahrefs. they tell me on their site to add this to my robots txt. do i just add it at the bottom of my robots file as it is? user-agent: AhrefsBot disallow: – Reg Gordon Dec 5 '12 at 8:11
  • actually i should be blocking them by htaccess shouldnt i? sorry this is ff topic. i will mark it as fixed – Reg Gordon Dec 5 '12 at 8:13

In your robots.txt file put

user-agent: AhrefsBot
disallow: /

from http://ahrefs.com/robot/

| improve this answer | |
  • thanks Anagio. Truth be told that was the wrong thing. The fella is still at it. - - [05/Dec/2012:05:40:24 -0500] "POST /welcome?destination=welcome HTTP/1.1" 302 20 "onlinebanter.com" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv: Gecko/20060909 Firefox/" – Reg Gordon Dec 5 '12 at 10:44
  • his IP is changing every time. I cant find a way to stop him at all. He's beginning to wear me down :( – Reg Gordon Dec 5 '12 at 10:45
  • in my error logs i have this. this is another domain that i host for my sister. i dont know if it is related. it doesnt look good to me – Reg Gordon Dec 5 '12 at 11:19
  • 2012-12-05 06:08:26.581 [INFO] [HTAccess] Updating configuration from [/home/xxxxx/public_html/sites/default/files/.htaccess] 2012-12-05 06:07:58.417 [INFO] [HTAccess] Updating configuration from [/home/onlineba/public_html/.htaccess] 2012-12-05 06:07:12.111 [INFO] [HTAccess] Updating configuration from [/home/xxxxx/public_html/kittys-boutique.co.uk/.htaccess] 2012-12-05 06:07:12.111 [INFO] [HTAccess] Configuration file [/home/xxxxx/public_html/kittys-boutique.co.uk/.htaccess] changed – Reg Gordon Dec 5 '12 at 11:21
  • 1
    phew sorry abou the above i realised what i did wrong. i tried to connect via https lol i can laugh now as i thought they where taking me down. again phew. – Reg Gordon Dec 5 '12 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.