PHP Forum

**ZoC** · 03-23-2010, 10:51 AM

hello there,
few days ago i have some flood on my website with doshttp ... and i found php script that block the attack ... but the problem is it blocking the google, yahoo and msn bots ...

and i want to alow one class of ips example

$allowed_ips = array(
'66.249.', //Google
'204.236.235.', //Alexa
);

but didant work ... can someone tell me how i can alow this class ips ?

**lynxus** · 03-23-2010, 11:14 AM

While i dont know how you do it on your script.

But i will say..
Google do not just one (one) class of IP's

They have MANY! ranges all of different sizes.

**ZoC** · 03-23-2010, 11:57 AM

all the google bot ips who indexing my website was just from this class 66.249.

the script block all the ips who make more than 20 hits on 10 sec, i use anti_ddos

i just need to know how i can add the class example 66.249.*.* so this script will not block anymore the google class ip, because i have problems with my website indexing on google search, and if i remove the script my website again will be down ...

if i add example

$allowed_ips = array(
'66.249.18.65', //Google
'204.236.235.13', //Alexa
);

is working ... is not block that 2 ips anymore but this is meaning to i add so many ips there

**tripy** · 03-23-2010, 12:05 PM

And how could we tell you that without knowing the source code of the script you use ?

**ZoC** · 12:50 PM

PHP Code:


			
<?php
$cookie = $_COOKIE['yourcookie'];
$othercookie = $_COOKIE['yourothercookie'];
$othercookie = $_COOKIE['1211598493'];
$othercookie = $_COOKIE['2c07863737b385b4c3567f0ecfa6d480'];
$othercookie = $_COOKIE['3bc52aba5f6ed8a19cfafdc777ad1b1f'];
$allowed_ips = array(
    '66.249.', //Google
    '204.236.235.', //Alexa
    '209.234.171.38',
    '209.234.171.36'
);

if($cookie && $othercookie > 0) $iptime = 20; // Minimum number of seconds between visits for users with certain cookie
else $iptime = 10; // Minimum number of seconds between visits for everyone else


$ippenalty = 60; // Seconds before visitor is allowed back


if($cookie && $othercookie > 0)$ipmaxvisit = 30; // Maximum visits, per $iptime segment
else $ipmaxvisit = 20; // Maximum visits per $iptime segment


$iplogdir = "./iplog/";
$iplogfile = "iplog.dat";

$ipfile = substr(md5($_SERVER["REMOTE_ADDR"]), -2);
$oldtime = 0;
if (file_exists($iplogdir.$ipfile)) $oldtime = filemtime($iplogdir.$ipfile);

$time = time();
if ($oldtime < $time) $oldtime = $time;
$newtime = $oldtime + $iptime;

if (($newtime >= $time + $iptime*$ipmaxvisit) && (!in_array($_SERVER['REMOTE_ADDR'], $allowed_ips)))
{
touch($iplogdir.$ipfile, $time + $iptime*($ipmaxvisit-1) + $ippenalty);
$oldref = $_SERVER['HTTP_REFERER'];
header("HTTP/1.0 503 Service Temporarily Unavailable");
header("Connection: close");
header("Content-Type: text/html");
echo "<html><body bgcolor=#999999 text=#ffffff link=#ffff00>
<font face='Verdana, Arial'><p><b>
<h1>Temporary Access Denial</h1>Too many quick page views by your IP address (more than ".$ipmaxvisit." visits within ".$iptime." seconds).</b>";
echo "<br />Please wait ".$ippenalty." seconds and reload. Warning by Administration</p></font></body></html>";
touch($iplogdir.$iplogfile); //create if not existing
$fp = fopen($iplogdir.$iplogfile, "a");
$yourdomain = $_SERVER['HTTP_HOST'];
if ($fp)
{
$useragent = "<unknown user agent>";
if (isset($_SERVER["HTTP_USER_AGENT"])) $useragent = $_SERVER["HTTP_USER_AGENT"];
fputs($fp, $_SERVER["REMOTE_ADDR"]." ".date("d/m/Y H:i:s")." ".$useragent."\n");
fclose($fp);
$yourdomain = $_SERVER['HTTP_HOST'];

//the @ symbol before @mail means 'supress errors' so you wont see errors on the page if email fails.
if($_SESSION['reportedflood'] < 1 && ($newtime < $time + $iptime + $iptime*$ipmaxvisit))
@mail('support@adulttubexxx.com', 'Ip '.$cookie.' - flooded-DDOS '.$_SERVER['REMOTE_ADDR'],'http://'.$yourdomain.' you are attacked by IP '.$_SERVER['REMOTE_ADDR'].' on http://'.$yourdomain.$_SERVER['REQUEST_URI'].' Referal link '.$oldref.' agent '.$_SERVER['HTTP_USER_AGENT'].' '.$cookie.' '.$othercookie, "From: ".$yourdomain."\n");
$_SESSION['reportedflood'] = 1;
}
exit();
}
else $_SESSION['reportedflood'] = 0;

//echo("loaded ".$cookie.$iplogdir.$iplogfile.$ipfile.$newtim e);
touch($iplogdir.$ipfile, $newtime); //this just updates the IP file access date or creates a new file if it doesn't exist in /iplog
?>

this is the script what im using

**chrishirst** · 03-23-2010, 12:24 PM

You do of course realise that bots don't "do" cookies.

**ZoC** · 03-23-2010, 12:31 PM

and why if i add this

$allowed_ips = array(
'66.249.18.65', //Google
'204.236.235.13', //Alexa
);

will not block anymore that ips ?

**ZoC** · 05:35 PM

and if you say bots dont make "cookies" why this script block that ips ?

look one mail what i receive

Ip - flooded-DDOS 66.249.68.49

**chrishirst** · 03-23-2010, 01:02 PM

I'd just get a new firewall, that blocked REAL attacks. Blocking DOS/DDOS attacks with PHP is locking the stable door well after the horse has gone.

Quote:

why this script block that ips

Because it defaults to 10 seconds without a cookie.

**ZoC** · 01:11 PM

so i really can`t allow that class ip ? so i dont have anymore problems with the google bots ?

i just need to know if i can or not ... because if i can`t i will just add all that ips manually but is kinda crazy because all time that ips from class is change ...

example:

$allowed_ips = array(
'66.249.231.423', //Google
'66.249.49.42', //Google
);

its working ... but ...

i try to add the code like this

$allowed_ips = array(
'66.249.', //Google
);

and its not working ... any idea ?

**chrishirst** · 02:14 PM

IPs haven't been "classed" since 1993 BTW

It is IP ranges that you are looking at.

But why not block them with htaccess? It will be less resource heavy than PHP is. Your method is actually ADDING to the problem.

http://diveintomark.org/archives/200..._to_go_to_hell

**ZoC** · 03-23-2010, 01:45 PM

and how will i know what programs they are using for doshttp ? so i can block that programs ... because im kinda scare to remove this script from my website ... i have this problems for 2 weeks ...

because this i was thinking to i try to add "class ips" on this program so i allow just google / yahoo and msn to can access so fast my website ...

anyway i have many attach from many ips ...

**chrishirst** · 03-23-2010, 03:45 PM

DOS attacks are not done using "programs" they are simply done with an anonymous script that makes continuous requests to the URI being attacked, so the server is overloaded.

Using PHP ADDS to this load.

Does your server have a firewall that can block the "attacking" IP before any webserver requests are made.

**lynxus** · 03-23-2010, 04:29 PM

iptables on linux will do a very good job of blocking these ranges.
then again, even windows firewall will do it just as well.

**ZoC** · 03-24-2010, 08:21 AM

i try today like this

$allowed_ips = array(
'66.249.*.*', // Google
'*.googlebot.com', // Google
'66.196.*.*', // Yahoo
'204.236.235.*.', // Alexa
);

and i see is working ... hope is working ok :P
i didant recive any msg with google ip block