[geeks] HTTP GET with method?

[Mouse]

>> Oh, the source IPs are all over the place.  Because these are
>> tripping my automated defenses, each IP is getting only one crack
>> per week at me, but I'm still seeing significant numbers of them, on
>> a par with the number of hosts requesting /ftp/... or /crawl/...
>> (both of which used to exist, but haven't in years; crawlers seem
>> _really_ slow to grasp the notion that they're gone).

> I had that problem last month when these things where hitting a
> machine that's the caching frontend to a hierarchical storage system
> where retrievals cost me actual money.  They weren't pummeling, but
> they were diligently coordinating a crawl of the whole thing.

Recently, I've been seeing numerous disparate hosts asking for /ip,
temporally coordinated in a way that makes me reasonably sure it's a
botnet or something like it.

I reported a bunch of them.  Nothing happened.  I reported a bunch
more.  More nothing happened.  So I've added two more abuse-reporting
addresses to my `broken abuse handling' list.  (All APNIC, curiously.)
I've now got 49300523 v4 IPs - about three /8s worth, though they're
not nicely clumped into three /8s - in my manually-maintained border
blocks.  (For the curious,
{ftp,http}://ftp.rodents-montreal.org/mouse/misc/border-blocks/ has
files giving the full list: a README and one file each for v4 and v6.)

In a way, I'm grateful to them; they've let me find some very badly
behaved (with respect to abuse report handling) providers at relatively
low cost.

> I tried an HTTP tarpit, and that kept them busy.  For a while, I had
> 8000 of them connected, downloading random trash at 0.1 bytes/second,
> and I kept having to add new subnets to the deny-list.

I've been tempted to set up something like that, but it seems to me
that for my purposes it's more effective to border-block them; I see no
reason to talk to botnet members over any protocol.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		mouse at rodents-montreal.org
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B