From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org)
	by finch.gentoo.org with esmtp (Exim 4.60)
	(envelope-from <gentoo-user+bounces-82984-garchives=archives.gentoo.org@lists.gentoo.org>)
	id 1KRr5v-0004Ci-D0
	for garchives@archives.gentoo.org; Sat, 09 Aug 2008 16:15:07 +0000
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id A4634E04F8;
	Sat,  9 Aug 2008 16:15:05 +0000 (UTC)
Received: from rv-out-0708.google.com (rv-out-0708.google.com [209.85.198.243])
	by pigeon.gentoo.org (Postfix) with ESMTP id 66521E04F8
	for <gentoo-user@lists.gentoo.org>; Sat,  9 Aug 2008 16:15:05 +0000 (UTC)
Received: by rv-out-0708.google.com with SMTP id b17so1268536rvf.46
        for <gentoo-user@lists.gentoo.org>; Sat, 09 Aug 2008 09:15:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=domainkey-signature:received:received:message-id:date:from:to
         :subject:in-reply-to:mime-version:content-type
         :content-transfer-encoding:content-disposition:references;
        bh=72WDzvsafItnOM/3ogLnj83XLfhS1fe//EyLBGQc2CI=;
        b=L05aN0xUz+mglzm7T3Aog3UIlRH+Xvt38GRgxSquWeDpV9SGTUrX3x+IyR4y0znX9a
         HlLVkNv7nJI2NCIHq7xaNgZktwi4MRLg1rUJF5SO6iPeZ2EXJbJg8ld1uw3aYiILUdps
         cZBtrsKU/Jnhjs4nEmB1XY8313+L7tdUsMpYI=
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references;
        b=Xv8caln+kx5caQ8BBP4FJQSyRWRgHxuhdHhUsyhc/lU+AItWlHwggaadVfF/EHBGkr
         d5djK4R/yyzySnU3LLlvIE3HigByOcshKCT3IitU8CZuwKQv9LISs4lRqTv4dlcc5LRp
         zVlaOeiCnptu54h6uCp0esTt6qZFKaZFNINq0=
Received: by 10.114.145.18 with SMTP id s18mr2595918wad.26.1218298504838;
        Sat, 09 Aug 2008 09:15:04 -0700 (PDT)
Received: by 10.115.110.19 with HTTP; Sat, 9 Aug 2008 09:15:04 -0700 (PDT)
Message-ID: <49bf44f10808090915j326072d0ldc64d898bac93869@mail.gmail.com>
Date: Sat, 9 Aug 2008 09:15:04 -0700
From: Grant <emailgrant@gmail.com>
To: "Gentoo mailing list" <gentoo-user@lists.gentoo.org>
Subject: [gentoo-user] Re: Dealing with scrapers - Help!
In-Reply-To: <49bf44f10808090908radd58bcl2283b7589dcd10e9@mail.gmail.com>
Precedence: bulk
List-Post: <mailto:gentoo-user@lists.gentoo.org>
List-Help: <mailto:gentoo-user+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-user+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-user+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-user.gentoo.org>
X-BeenThere: gentoo-user@lists.gentoo.org
Reply-to: gentoo-user@lists.gentoo.org
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <49bf44f10808090908radd58bcl2283b7589dcd10e9@mail.gmail.com>
X-Archives-Salt: ee3dd711-e815-437d-809b-63f630a7daf0
X-Archives-Hash: 413525bef45c3aab6d49582213de8edc

> My apache web server has been very slow lately and webalizer charts
> show page accesses at 5x normal with other stats normal.  I'm thinking
> scrapers?  How do you guys deal with this?  Do you identify the IP
> (how?) and ban it (how?)?
>
> - Grant

I used netstat to identify the IP and I see that I can use it with
"deny from" in httpd.conf.  It seems to be over now, but this type of
thing happens periodically.  How can I be alerted to this type of
situation when it starts so I can block the IP right away?

- Grant