Error log... Attack or robot

[Nerd3d]

In my error logs I will see long strings of the same IP causing hundreds of error in a row. They are tying to send IM's or enable notifications. It is always as "Guest".  Stupid robot or attack?

Code Select Expand

"128";"1030488605";"Guest";"193.231.6.45";"/Forum/index.php?action=mlall";"Sorry, you must register before using this feature."
"129";"1030488614";"Guest";"193.231.6.45";"/Forum/index.php?board=;action=imsend;to=Nerd";"Instant Messaging is only for members"
"130";"1030488634";"Guest";"193.231.6.45";"/Forum/index.php?board=13;action=display;threadid=39";"This topic doesn't exist on this board."

[snip 145 lines]

"275";"1030488954";"Guest";"193.231.6.45";"/Forum/index.php?board=5;action=notify;threadid=3;start=";"This service is only for members..."
"276";"1030488954";"Guest";"193.231.6.45";"/Forum/index.php?board=5;action=imsend;to=Waffle";"Instant Messaging is only for members"
"277";"1030488954";"Guest";"193.231.6.45";"/Forum/index.php?board=5;action=notify;threadid=4;start=";"This service is only for members..."
If this is a robot how do I craft a robots.txt to keep them from doing this while still allowing them to index the site?

Thanks!

[Daniel Hofverberg]

The IP address 193.231.6.45 does not seem to belong to any known spider (at least not a legitimate one) - A whois search comes back as belonging to Technical University of Iasi, Romania...

[Nerd3d]

Yeah, and that's not the only IP doing this. None of them trace to any known robot. SOOO, what do I do? They never seem to use the same IP twice so blocking IP's in HTACCESS won't work. Is there some way I can limit the number of "clicks" from a certain IP to 2 or 3 per minute?

64.140.49.69 (Colorado, USA)
68.0.189.98 (Georgia, USA)
217.136.141.170 (Netherlands)
80.181.133.99 (Netherlands)
80.200.99.140 (Netherlands)
194.181.60.126 (Netherlands)

All these in the past few days. The ramdomness of the IPs and the constant nature of the attack seems to indicate the IPs are spoofed.

[Chris Cromer]

You should realize that there are unregistered spiders, and "home made" spiders made in php, perl, and asp.

So it could be someone spidering your site collecting your members e-mail addresses, or they could be doing a web archive or something... or even a tiny search engine. I don't know if there is a real way to figure it out.

[Nerd3d]

OK, the dirty rotten so-'n-so I fix them. I hacked a bit in display.php

If anybody's interested I added ... if($username != "Guest") ... Around the contact and notification stuff. That will keep guests form seeing emails and should keep the spider from "clicking" a thousand links.

Actually this probably should be in the main code. Guests don't really have any busuness bugging members any way.

[Spaceman-Spiff]

agree
i think there's already a mod to hide one's mail address link

[Dr_Michael]

OK, the dirty rotten so-'n-so I fix them. I hacked a bit in display.php

If anybody's interested I added ... if($username != "Guest") ... Around the contact and notification stuff. That will keep guests form seeing emails and should keep the spider from "clicking" a thousand links.

Actually this probably should be in the main code. Guests don't really have any busuness bugging members any way.

Can you please give me some more info?

[David]

OK, the dirty rotten so-'n-so I fix them. I hacked a bit in display.php

If anybody's interested I added ... if($username != "Guest") ... Around the contact and notification stuff. That will keep guests form seeing emails and should keep the spider from "clicking" a thousand links.

Actually this probably should be in the main code. Guests don't really have any busuness bugging members any way.

Ooh, I like this idea.

[Nerd3d]

OK, I've made what I did into a MOD. This works with BoardMod from www.boardmod.org This is only tested on 1.4.1 and it's very beta. Handle with care, backup your files!

ShooBot_v0.1.mod

The ShooBot mod hides email and IM functions from guest users, this keeps email bots from harvesting your user's email addresses.

If you use this please let me know if it works, or if it doesn't.

[Gobalopper]

It would be a good idea to have it so that when guest posting is off any link that would lead the guest to posting, quoting, etc doesn't appear.

I've done this on my board and it cuts down the size of error log by quite a bit.

[Nerd3d]

Humm... Hadn't thought of that. (I allow guests to post on my board) I look at that to add to this mod later.

To save fishing around, does anybody know the name of the variable for guest posting?

[Gobalopper]

$enable_guestposting

[Nerd3d]

OK it posted as a beta now, with the changes Gobalopper suggested. the thread is here:

http://www.yabbse.org/community/index.php?board=158;action=display;threadid=20204