1

I am seeing almost 3000 entries in access_log of my VPS for 408 status code.

Here is an example.

86.220.66.228 - - [03/Apr/2016:08:39:12 -0400] "GET /?p=444 HTTP/1.1" 200 5748 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:44.0) Gecko/20100101 Firefox/44.0"
86.220.66.228 - - [03/Apr/2016:08:40:09 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:41:02 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:41:55 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:42:48 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:43:41 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:44:33 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:45:25 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:46:19 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:47:13 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:48:05 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:48:59 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:49:51 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:50:44 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:51:36 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:52:27 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:54:35 -0400] "-" 408 0 "-" "-"
86.220.66.228 - - [03/Apr/2016:08:55:26 -0400] "-" 408 0 "-" "-"

Most of the time, the IPs that cause 408 error, first connect to a page on my server successfully and then generates 408 code with a specific interval, as seen above log.

And most of the IPs originate from a web server with strange domains:

nslookup 86.220.66.228

Non-authoritative answer:
228.66.220.86.in-addr.arpa  name = ACaen-653-1-95-228.w86-220.abo.wanadoo.fr.

Those 3000 entries are generated by around 180 different IPs, mostly again by the servers, not normal user IPs.

Do you think this is done by malicious reasons or is there something misconfigured on my server?

  • 1
    This may help you to understand: checkupdown.com/status/E408.html This error is highly unusual. There are two general causes, server load or a client failure of some sort. Check to see if your server is loaded when this happens. Please also understand that *.wanadoo.fr is heavily populated in my abuse database. This means that a lot of bad behaviors have been seen from this ISP. I would suggest blocking this IP address (assuming that server load is not the issue). I cannot infer intent. It could just be a broken bot. – closetnoc Apr 3 '16 at 18:50
  • Thanks @closetnoc for your help. My server is not under heavy load. I see those 408 entries regularly almost every day. Because the pattern is executed by almost 180 IPs every day, I think they are trying to click bomb or something. – NecNecco Apr 3 '16 at 19:03
  • 1
    It is very likely some kind of abuse. I agree with that! If all 180 IP addresses are within one or a few IP address blocks, you can still easily block them using .htaccess or something like it. If can get very specific or just wildcard the IP addresses. I suggest wildcarding for an immediate effect. – closetnoc Apr 3 '16 at 19:07
  • 1
    You can also use something like Fail2Ban or Mod_Security. I do not have any expertise on these. I have my own processes based upon my automated database. – closetnoc Apr 3 '16 at 19:26
  • 1
    BTW- I block single IP addresses automatically as they come along. However, it is just as a simple process to block IP address blocks. I have two whole networks blocked now. I do this by hand. I will update my blocking code and IP address database for public use at some point. It requires updating code to work in the wild. – closetnoc Apr 3 '16 at 19:30
2

It has been a long time since I have posted blocking code. I have not updated my IP database in a fairly long time. I have somewhat shutdown my abuse list after 8 years. But this should be close enough. It is certainly an example at least.

I recommend looking halfway down for the heading Block by IP Address Block.

The .htaccess code should work. I am relying on others example code for the rest. I am sure they all work with the possible exception of blocking by IP address block using IIS. It may still work. I have not tested it. I am sure there is a far better way to write the IIS code. Sorry.

Of course you can just wildcard your block code using something like this:

RewriteCond %{REMOTE_ADDR} ^86\.220\.*$ [NC]
RewriteRule .* - [F,L]

Block by IP Address

Apache .htaccess File

RewriteCond %{REMOTE_ADDR} ^86\.220\.66\.228$ [NC]
RewriteRule .* - [F,L]

Cisco Firewall

access-list deny-86-220-66-228-32 deny ip 86.220.66.228 any
permit ip any any

Nginx

Edit nginx.conf and insert include blockips.conf; if it does not exist. Edit blockips.conf and add the following:

deny 86.220.66.228;

Microsoft IIS Web Server

<rule name="abort ip address 86.220.66.228/32" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^86\.220\.66\.228$" />
  </conditions>
 <action type="AbortRequest" />
</rule>

Windows netsh ADVFirewall Firewall

netsh advfirewall firewall add rule name="block-ip-86-220-66-228-32" dir=in interface=any action=block remoteip=86.220.66.228/32

IP Address Range:

86.207.0.0 - 86.221.255.255

NetMask:

Block: 86.207.0.0/16
Base Address: 86.207.0.0
Broadcast Address: 86.207.255.255
Net Mask: 255.255.0.0
Host Mask: 0.0.255.255
Bits: 16
Size: 65536
2nd Element: 86.207.0.2

Block: 86.208.0.0/13
Base Address: 86.208.0.0
Broadcast Address: 86.215.255.255
Net Mask: 255.248.0.0
Host Mask: 0.7.255.255
Bits: 13
Size: 524288
2nd Element: 86.208.0.2

Block: 86.216.0.0/14
Base Address: 86.216.0.0
Broadcast Address: 86.219.255.255
Net Mask: 255.252.0.0
Host Mask: 0.3.255.255
Bits: 14
Size: 262144
2nd Element: 86.216.0.2

Block: 86.220.0.0/15
Base Address: 86.220.0.0
Broadcast Address: 86.221.255.255
Net Mask: 255.254.0.0
Host Mask: 0.1.255.255
Bits: 15
Size: 131072
2nd Element: 86.220.0.2

Block by IP Address Block

Apache .htaccess File

RewriteCond %{REMOTE_ADDR} ^86\.(2*[0-2]+[7890123456789]+)\.([0-2]+[0-2]+[0-5]+[0-5]+)\.([0-2]+[0-5]+[0-5]+)$ [NC]
RewriteRule .* - [F,L]

Cisco Firewall

access-list deny-86-207-0-0-16 deny ip 86.207.0.0 0.1.255.255 any
access-list deny-86-208-0-0-13 deny ip 86.208.0.0 0.1.255.255 any
access-list deny-86-216-0-0-14 deny ip 86.216.0.0 0.1.255.255 any
access-list deny-86-220-0-0-15 deny ip 86.220.0.0 0.1.255.255 any
permit ip any any

Nginx

Edit nginx.conf and insert include blockips.conf; if it does not exist. Edit blockips.conf and add the following:

deny 86.207.0.0/16;
deny 86.208.0.0/13;
deny 86.216.0.0/14;
deny 86.220.0.0/15;

How to block by IP address block using Linux IPTables Firewall.

**Note: Use with caution.

/sbin/iptables -A INPUT -s 86.207.0.0/16 -j DROP
/sbin/iptables -A INPUT -s 86.208.0.0/13 -j DROP
/sbin/iptables -A INPUT -s 86.216.0.0/14 -j DROP
/sbin/iptables -A INPUT -s 86.220.0.0/15 -j DROP

Microsoft IIS Web Server

<rule name="abort ip address block 86.207.0.0/16" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^86\.221\..*\..*$" />
  </conditions>
 <action type="AbortRequest" />
</rule>
<rule name="abort ip address block 86.208.0.0/13" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^86\.221\..*\..*$" />
  </conditions>
 <action type="AbortRequest" />
</rule>
<rule name="abort ip address block 86.216.0.0/14" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^86\.221\..*\..*$" />
  </conditions>
 <action type="AbortRequest" />
</rule>
<rule name="abort ip address block 86.220.0.0/15" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^86\.221\..*\..*$" />
  </conditions>
 <action type="AbortRequest" />
</rule>

Windows netsh ADVFirewall Firewall

netsh advfirewall firewall add rule name="block-ip-block-86-207-0-0-16" dir=in interface=any action=block remoteip=86.207.0.0/16
netsh advfirewall firewall add rule name="block-ip-block-86-208-0-0-13" dir=in interface=any action=block remoteip=86.208.0.0/13
netsh advfirewall firewall add rule name="block-ip-block-86-216-0-0-14" dir=in interface=any action=block remoteip=86.216.0.0/14
netsh advfirewall firewall add rule name="block-ip-block-86-220-0-0-15" dir=in interface=any action=block remoteip=86.220.0.0/15
  • Looks great @closetnoc. I use CentOS and LAMP. Do you have any recommendation code to check access_log for successive 408 entries and blocking the generator IP? These guys have a pattern of successive 408 entries. I can that way exclude them from legitimate IPs. What do you think? – NecNecco Apr 3 '16 at 19:52
  • 1
    @NecNecco LAMP is Linux, Apache, MySQL, PERL/PHP In this case, .htaccess is typically used. For something dynamic, I can recommend looking at Fail2Ban or Mod_Security. Both have excellent reputations. – closetnoc Apr 3 '16 at 22:15
  • Thanks again. I used to Fail2Ban but for this specific case, Fail2Ban needs to real all access_log by a specific interval and find the repeating pattern. I think it will increase load times. Do you think I should block all IPs whose nslookup returns a server information by a bash script? That way I am thinking to exclude bot servers. Of course I need to add some exceptions for Google, Bing and Yahoo. Do you think this approach is feasible? – NecNecco Apr 4 '16 at 0:38
  • 1
    Cleaver. You might find it difficult to determine what sub-domains are server versus subscriber. You may be able to modify the syslog entry for Apache so that you can feed another app as well as the log file. You can use something like Perl, Java, or other code that can run as a process at boot. Syslog can feed this app with data. I understand that log files can get long and reading them gets intensive. Look at Mod_Security - seriously! It does not ping the log file. It is integrated into Apache. It may be just what you need. – closetnoc Apr 4 '16 at 1:50
  • 1
    Yeah. The configuration is a bear!! Admittedly. I think the default will do what you want. I am not sure. I am not an expert. I had my own systems in place when Mod_Security came out. I am planning to use it on my next install. It should replace some of my existing code. All I need are HDs and I am ready to build a ridiculously fast server for my sad websites. ;-) It is like riding a Harley... not really. Maybe in geekdom it is. – closetnoc Apr 4 '16 at 2:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.