Hi,
I've been pestered by spammers from latvia, Russia, etc for months and have another burst in the last 24 hours - about 50 mailform submissions from 188.143.232.80. This IP address is blocked using the Apache IP Manager in my CNC. Here are the log entries for each submission:
188.143.232.80 - - [22/Apr/2011:03:33:22 -0400] "POST /cgi-sys/mailform HTTP/1.1" 302 318 "http://www.esl-lounge.com/premium/guest-survey.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 188.143.232.80 - - [22/Apr/2011:03:33:29 -0400] "GET /premium/survey-thanks.php HTTP/1.1" 403 310 "http://www.esl-lounge.com/premium/guest-survey.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
I presume the 403 code on the second one means the IP manager is doing its job, but with the mailform residing above my root, I can't prevent the original mailform submissions. Is there anything I can do?
Regards
Neil esl-lounge.com
sorry, wrong mailing list! oops
On 22/04/2011 12:52, Neil Coghlan wrote:
Hi,
I've been pestered by spammers from latvia, Russia, etc for months and have another burst in the last 24 hours - about 50 mailform submissions from 188.143.232.80. This IP address is blocked using the Apache IP Manager in my CNC. Here are the log entries for each submission:
188.143.232.80 - - [22/Apr/2011:03:33:22 -0400] "POST /cgi-sys/mailform HTTP/1.1" 302 318 "http://www.esl-lounge.com/premium/guest-survey.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 188.143.232.80 - - [22/Apr/2011:03:33:29 -0400] "GET /premium/survey-thanks.php HTTP/1.1" 403 310 "http://www.esl-lounge.com/premium/guest-survey.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
I presume the 403 code on the second one means the IP manager is doing its job, but with the mailform residing above my root, I can't prevent the original mailform submissions. Is there anything I can do?
Regards
Neil esl-lounge.com
-
Neil Coghlan