How to Ban a site/server from our server... (somewhat challenging actually)

[djinn80]

Hello all,

 

There is something pretty odd going on with our server.  There is a site who shows up on our server stat usage that uses around 1 GB of bandwidth from our server monthly - yet it accesses 0 files.

 

On previous months when we didn't reboot our server it showed only 1 visit 46711 hits and used over 1GB of data.

 

This month we rebooted our server 5 times and banned every IP we could find related to their server - but they still keep coming back.  So far this month they have visited 7 times, accessed 0 files, used 440MB and gave us 20792 hits.

 

Now the hostname is "mandrake.crtelecom.com" and we could not ping that hostname so we did a look up of crtelecom.com on robtex.com and basically banned every IP related to crtelecom.com's server and netnetation that we could find (285 ips so far that we banned).  But they still keep coming back to our server.

 

I'm not actually sure how to tell what they are pinging or doing to use so much bandwidth - does anyone know how I can tell what they are attempting to access?  We have a Fedora 4.0 system using Plesk as our Cpanel.

 

So basically I'm curious how we can stop their domain ie mandrake.crtelecom.com (or the whole *.crtelecom.com) from accessing or pinging our site.  Its just wierd because it could say 1 visit for the whole month and 1GB of data pulled throughout the month (not all at once either). 

 

Anyone have any ideas about this or experience something similar?  Thanks for your suggestions and help!

[apacheguy]

Have you tried mod_dosevasive?

 

This eliminates the need for banning individual ip's.  The module works by automatically blocking access to certain ip's that exceed a given number of hits per minute.