Don wrote:
[snip]
So, if IP's are changing all the time how can I accomplish this.
Suppose maybe, I can ban an IP range. Will that work?
[Conjecture. Practicality not assured. Regulars: feel free to flame away.]
In principle, yes. If you can't quite determine the range, you should
be able to use a regional registry (like ARIN or RIPE) to determine
the range held by the provider.
However, there is an obvious risk: if the necessary range involves a
major ISP or proxy, you're going to block a *lot* of people. In that
case, use the registry information to find the provider and determine
if the user's actions violate their terms of service. If so, make sure
your server has the correct time (record the discrepancy, if
necessary, including timezone) and wait for an attack to appear in
your logs. You can then send the record to the provider and they
should be able to trace who it is and terminate their account[1].
Reporting is probably a better route, assuming the attacker isn't
already spoofing their IP. If they find themselves banned, they might
then start spoofing and it will be difficult to try reporting then.
Good luck,
Mike
[1] Well, assuming the provider cares about violators. I've
encountered false abuse addresses, or at least unmonitored
mailboxes. There's not much you can do then unless the
provider has been leased their IP range from another
company.
--
Michael Winter
Replace ".invalid" with ".uk" to reply by e-mail.
