I am getting about 23 hits a second to a 404 page, which in no way is going to result in anything good for me, and frankly it is annoying me, since my logs look like a mess
The IP address all originate from Turk Telecom, so I am wondering how can I find out what IP space Turk Telecom was handed, so I can drop the packets at the firewall and take some stress off my HTTP server.
CODE
88.226.4.34 www.spammers-paradise.com - [17/Aug/2007:07:10:40 -0500] "GET /top/button.php?id=1108 HTTP/1.1" 404 345 "http://www.dolusex.net/can.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
85.110.108.6 www.spammers-paradise.com - [17/Aug/2007:07:10:40 -0500] "GET /top/button.php?id=1108 HTTP/1.1" 404 345 "http://www.dolusex.net/can.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.275.0)"
88.245.243.22 www.spammers-paradise.com - [17/Aug/2007:07:10:40 -0500] "GET /top/button.php?id=1073 HTTP/1.1" 404 345 "http://www.mircsitesi.com/gokhan.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
88.230.163.33 www.spammers-paradise.com - [17/Aug/2007:07:10:40 -0500] "GET /top/button.php?id=1108 HTTP/1.1" 404 345 "http://www.dolusex.net/can.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
85.110.108.6 www.spammers-paradise.com - [17/Aug/2007:07:10:40 -0500] "GET /top/button.php?id=1108 HTTP/1.1" 404 345 "http://www.dolusex.net/can.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Zango 10.0.275.0)"
88.245.243.22 www.spammers-paradise.com - [17/Aug/2007:07:10:40 -0500] "GET /top/button.php?id=1073 HTTP/1.1" 404 345 "http://www.mircsitesi.com/gokhan.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
88.230.163.33 www.spammers-paradise.com - [17/Aug/2007:07:10:40 -0500] "GET /top/button.php?id=1108 HTTP/1.1" 404 345 "http://www.dolusex.net/can.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
Oh, and before anyone jumps on me because of the name of my website (http://spammers-paradise.com/), please go visit it before attempting to lynch me. That being said, I have a script currently running just adding IP's to my firewall for anyone that has a referral of dolusex.net, so if you do visit, your attempts to visit my site after wards will NOT work.
So far I have blocked 2537 IP's, in the last 20 minutes.
Bert JW Regeer