Actually, scratch last three lines (starting from # these belong to...) and replace with
- subnet: 141.0.0.0/8 On Thursday, August 9, 2012 11:32:03 PM UTC+2, alex wrote: > > A lot of those IPs are assigned to universities, like almost literally all > of them. More than 50% are US universities. This really looks like a big > distributed bot network to me. > > Anyway, here you go (some IPs are from the same net block so there are > less than 100 entries): > > > - subnet: 82.179.176.0/20 > - subnet: 83.230.96.0/19 > - subnet: 88.2.0.0/16 > - subnet: 128.10.0.0/16 > - subnet: 128.84.0.0/16 > - subnet: 128.42.0.0/16 > - subnet: 128.36.0.0/16 > - subnet: 128.111.0.0/16 > - subnet: 128.114.0.0/16 > - subnet: 128.138.0.0/16 > - subnet: 128.227.0.0/16 > - subnet: 128.208.0.0/16 > - subnet: 128.151.0.0/16 > - subnet: 128.223.0.0/16 > - subnet: 128.232.0.0/16 > - subnet: 129.10.0.0/16 > - subnet: 129.15.0.0/16 > - subnet: 129.74.0.0/16 > - subnet: 129.82.0.0/16 > - subnet: 129.93.0.0/16 > - subnet: 129.97.0.0/16 > - subnet: 129.108.0.0/16 > - subnet: 129.130.0.0/16 > - subnet: 129.237.0.0/16 > - subnet: 130.37.0.0/16 > - subnet: 130.83.0.0/16 > - subnet: 130.104.0.0/16 > - subnet: 130.216.0.0/16 > - subnet: 130.253.0.0/16 > - subnet: 130.195.4.0/24 > - subnet: 130.237.0.0/18 > - subnet: 131.179.0.0/16 > - subnet: 131.188.0.0/16 > - subnet: 132.64.0.0/13 > - subnet: 132.72.0.0/14 > - subnet: 134.151.0.0/16 > - subnet: 138.4.0.0/16 > - subnet: 138.250.0.0/15 > - subnet: 138.48.0.0/16 > - subnet: 139.165.0.0/16 > - subnet: 140.109.0.0/16 > - subnet: 143.225.0.0/16 > - subnet: 155.245.0.0/16 > - subnet: 160.80.0.0/16 > - subnet: 161.106.0.0/16 > - subnet: 192.16.124.0/22 > - subnet: 192.38.0.0/17 > - subnet: 192.41.132.0/22 > - subnet: 192.42.42.0/23 > - subnet: 193.1.0.0/16 > - subnet: 193.138.2.0/24 > - subnet: 193.196.0.0/15 > - subnet: 193.166.0.0/15 > - subnet: 193.136.0.0/15 > - subnet: 193.166.0.0/15 > - subnet: 193.204.0.0/15 > - subnet: 193.226.0.0/19 > - subnet: 194.29.176.0/22 > - subnet: 194.167.0.0/16 > - subnet: 194.254.0.0/16 > - subnet: 195.130.124.0/22 > - subnet: 203.110.240.0/24 > - subnet: 212.51.208.0/20 > - subnet: 213.73.32.0/19 > - subnet: 213.131.0.0/19 > - subnet: 136.159.0.0/16 > - subnet: 132.170.0.0/16 > - subnet: 132.181.0.0/16 > - subnet: 133.0.0.0/8 > - subnet: 203.0.0.0/8 > - subnet: 198.82.0.0/16 > - subnet: 200.0.0.0/8 > - subnet: 192.107.171.0/24 > - subnet: 140.112.0.0/12 > - subnet: 140.123.0.0/16 > - subnet: 142.103.0.0/16 > - subnet: 143.89.0.0/16 > - subnet: 139.78.0.0/16 > - subnet: 155.246.0.0/16 > - subnet: 156.56.0.0/16 > - subnet: 156.62.0.0/16 > - subnet: 157.92.0.0/16 > - subnet: 169.226.0.0/16 > - subnet: 165.91.0.0/16 > - subnet: 165.230.0.0/16 > - subnet: 192.1.0.0/16 > - subnet: 192.12.33.0/24 > - subnet: 169.229.0.0/16 > - subnet: 141.219.0.0/16 > # these belong to a too big block > - subnet: 141.11.0.162 > - subnet: 141.20.103.211 > > > > On Thursday, August 9, 2012 10:21:03 PM UTC+2, Kate wrote: >> >> >> I did that but don't think it will catch them all. >> >> I had a list of 100 individual ones, see below. Can you recognize subnets >> in them? >> blacklist: >> - subnet: 82.179.176.44 >> - subnet: 83.230.127.124 >> - subnet: 88.2.234.60 >> - subnet: 128.10.19.53 >> - subnet: 128.84.154.45 >> - subnet: 128.42.142.44 >> - subnet: 128.36.233.154 >> - subnet: 128.111.52.59 >> - subnet: 128.114.63.64 >> - subnet: 128.138.207.45 >> - subnet: 128.227.150.12 >> - subnet: 128.208.4.198 >> - subnet: 128.151.65.101 >> - subnet: 128.223.8.112 >> - subnet: 128.232.103.201 >> - subnet: 129.10.120.194 >> - subnet: 129.15.78.30 >> - subnet: 129.74.74.20 >> - subnet: 129.82.12.188 >> - subnet: 129.93.229.139 >> - subnet: 129.97.74.14 >> - subnet: 129.108.202.11 >> - subnet: 129.130.252.140 >> - subnet: 129.237.161.194 >> - subnet: 130.37.193.143 >> - subnet: 130.83.166.243 >> - subnet: 130.104.72.213 >> - subnet: 130.216.1.22 >> - subnet: 130.253.21.123 >> - subnet: 130.195.4.68 >> - subnet: 130.237.50.125 >> - subnet: 131.179.150.72 >> - subnet: 131.188.44.102 >> - subnet: 132.65.240.100 >> - subnet: 132.72.23.10 >> - subnet: 132.170.3.32 >> - subnet: 132.181.10.56 >> - subnet: 133.1.74.163 >> - subnet: 133.15.59.2 >> - subnet: 133.68.253.242 >> - subnet: 134.151.255.181 >> - subnet: 138.4.0.120 >> - subnet: 138.251.214.78 >> - subnet: 136.159.220.40 >> - subnet: 138.48.3.202 >> - subnet: 139.78.141.245 >> - subnet: 139.165.12.211 >> - subnet: 140.109.17.181 >> - subnet: 140.112.107.82 >> - subnet: 140.123.230.248 >> - subnet: 141.11.0.162 >> - subnet: 141.20.103.211 >> - subnet: 141.219.252.133 >> - subnet: 142.103.2.2 >> - subnet: 143.89.49.73 >> - subnet: 143.225.229.238 >> - subnet: 155.245.47.225 >> - subnet: 155.246.12.163 >> - subnet: 156.56.250.226 >> - subnet: 156.62.231.244 >> - subnet: 157.92.44.101 >> - subnet: 160.80.221.39 >> - subnet: 161.106.240.19 >> - subnet: 169.226.40.2 >> - subnet: 169.229.50.15 >> - subnet: 165.91.55.8 >> - subnet: 165.230.49.115 >> - subnet: 192.1.249.138 >> - subnet: 192.12.33.102 >> - subnet: 192.16.125.11 >> - subnet: 192.38.109.144 >> - subnet: 192.41.135.219 >> - subnet: 192.42.43.23 >> - subnet: 192.107.171.145 >> - subnet: 193.1.201.27 >> - subnet: 193.138.2.13 >> - subnet: 193.196.39.9 >> - subnet: 193.167.187.185 >> - subnet: 193.136.19.13 >> - subnet: 193.166.167.5 >> - subnet: 193.205.215.74 >> - subnet: 193.226.19.31 >> - subnet: 194.29.178.13 >> - subnet: 194.167.254.19 >> - subnet: 194.254.215.12 >> - subnet: 195.130.124.1 >> - subnet: 198.82.160.221 >> - subnet: 200.0.206.137 >> - subnet: 200.0.206.168 >> - subnet: 200.17.202.195 >> - subnet: 200.129.132.19 >> - subnet: 202.23.159.52 >> - subnet: 202.125.215.12 >> - subnet: 202.237.248.222 >> - subnet: 202.249.37.67 >> - subnet: 203.110.240.190 >> - subnet: 203.178.133.2 >> - subnet: 212.51.218.235 >> - subnet: 213.73.40.106 >> - subnet: 213.131.1.101 >> >> Thanks >> Kate >> >> >> On Thursday, August 9, 2012 2:37:48 PM UTC-4, alex wrote: >>> >>> well, while you're notifying planetlab and whatnot you could create and >>> upload a dos.yaml for the time being with a content similar to this: >>> >>> blacklist: >>> - subnet: 132.65.0.0/16 >>> - subnet: 133.0.0.0/8 >>> description: somewhere in china >>> - subnet: 136.159.0.0/16 >>> - subnet: 138.250.0.0/15 >>> - subnet: 138.48.0.0/16 >>> - subnet: 139.165.0.0/16 >>> - subnet: 141.219.252.0/24 >>> - subnet: 193.1.0.0/16 >>> description: planetlab >>> - subnet: 193.136.16.0/24 >>> - subnet: 193.166.167.0/24 >>> - subnet: 195.130.124.0/22 >>> - subnet: 200.17.192.0/19 >>> >>> >>> - put that file in your app root dir and do something like this from a >>> terminal: >>> >>> "appcfg.py update_dos ." >>> >>> >>> On Thursday, August 9, 2012 6:13:14 PM UTC+2, Kate wrote: >>>> >>>> They are not coming from the same IP. They are mostly in Europe but >>>> there are no subnets. >>>> >>>> There are hundreds of them and google only lets you block 100. >>>> >>>> eg >>>> >>>> 132.65.240.100 >>>> 133.15.59.2 >>>> 193.136.19.13 >>>> 139.165.12.211 >>>> 193.166.167.5 >>>> 141.219.252.133 >>>> 200.17.202.195 >>>> 195.130.124.1 >>>> 193.1.201.27 >>>> 138.48.3.202 >>>> 136.159.220.40 >>>> 138.251.214.78 >>>> >>>> >>>> all these and more within a minute. >>>> >>>> They are all different. >>>> >>>> Kate >>>> >>>> >>>> >>>> On Thursday, August 9, 2012 9:55:29 AM UTC-4, alex wrote: >>>>> >>>>> Kate, >>>>> >>>>> If barryhunter is right and all the IPs are coming from the same ISP >>>>> anyway, you can simply block the whole subnetwork ranges of that ISP (at >>>>> least temporary) using dos.yaml: >>>>> https://developers.google.com/appengine/docs/python/config/dos >>>>> >>>>> It'll be pain in the ass updating the file every time you encounter >>>>> new subnets but at least you could probably save some quota 'till you >>>>> move >>>>> somewhere else or figure something out. >>>>> >>>>> -- alex >>>>> >>>>> On Thursday, August 9, 2012 1:59:57 PM UTC+2, Kate wrote: >>>>>> >>>>>> Hi Sergey, >>>>>> >>>>>> Here is a typical example >>>>>> 2012-08-09 06:51:16.597 / 302 30ms 0kb curl/7.18.2 >>>>>> (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/3.12.2.0 zlib/1.2.3 >>>>>> libidn/0.6.14 libssh2/0.18 >>>>>> 202.125.215.12 - - [09/Aug/2012:04:51:16 -0700] "HEAD / HTTP/1.1" 302 >>>>>> 153 - "curl/7.18.2 (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/ >>>>>> 3.12.2.0 zlib/1.2.3 libidn/0.6.14 libssh2/0.18" " >>>>>> aussieclouds.appspot.com" ms=31 cpu_ms=0 api_cpu_ms=0 >>>>>> cpm_usd=0.000049 instance=00c61b117c2f994812ed63184c9c5544dea738 >>>>>> >>>>>> But the ip address varies. My code forces 302 response. Before I >>>>>> added the code they were throwing errors head method not found. But even >>>>>> though I am doing the 303 I am still getting front end time exceeded and >>>>>> these requests are taking up about 95% of my quota. So to keep the site >>>>>> alive I would have to pay for them, I have lost most of my European and >>>>>> Australian visitors because the site is down every night during those >>>>>> places daylight hours. Obviously I can't continue like this and so will >>>>>> have to move to a provider capable of blocking these requests, >>>>>> >>>>>> > On Thursday, August 9, 2012 10:21:03 PM UTC+2, Kate wrote: >> >> >> I did that but don't think it will catch them all. >> >> I had a list of 100 individual ones, see below. Can you recognize subnets >> in them? >> blacklist: >> - subnet: 82.179.176.44 >> - subnet: 83.230.127.124 >> - subnet: 88.2.234.60 >> - subnet: 128.10.19.53 >> - subnet: 128.84.154.45 >> - subnet: 128.42.142.44 >> - subnet: 128.36.233.154 >> - subnet: 128.111.52.59 >> - subnet: 128.114.63.64 >> - subnet: 128.138.207.45 >> - subnet: 128.227.150.12 >> - subnet: 128.208.4.198 >> - subnet: 128.151.65.101 >> - subnet: 128.223.8.112 >> - subnet: 128.232.103.201 >> - subnet: 129.10.120.194 >> - subnet: 129.15.78.30 >> - subnet: 129.74.74.20 >> - subnet: 129.82.12.188 >> - subnet: 129.93.229.139 >> - subnet: 129.97.74.14 >> - subnet: 129.108.202.11 >> - subnet: 129.130.252.140 >> - subnet: 129.237.161.194 >> - subnet: 130.37.193.143 >> - subnet: 130.83.166.243 >> - subnet: 130.104.72.213 >> - subnet: 130.216.1.22 >> - subnet: 130.253.21.123 >> - subnet: 130.195.4.68 >> - subnet: 130.237.50.125 >> - subnet: 131.179.150.72 >> - subnet: 131.188.44.102 >> - subnet: 132.65.240.100 >> - subnet: 132.72.23.10 >> - subnet: 132.170.3.32 >> - subnet: 132.181.10.56 >> - subnet: 133.1.74.163 >> - subnet: 133.15.59.2 >> - subnet: 133.68.253.242 >> - subnet: 134.151.255.181 >> - subnet: 138.4.0.120 >> - subnet: 138.251.214.78 >> - subnet: 136.159.220.40 >> - subnet: 138.48.3.202 >> - subnet: 139.78.141.245 >> - subnet: 139.165.12.211 >> - subnet: 140.109.17.181 >> - subnet: 140.112.107.82 >> - subnet: 140.123.230.248 >> - subnet: 141.11.0.162 >> - subnet: 141.20.103.211 >> - subnet: 141.219.252.133 >> - subnet: 142.103.2.2 >> - subnet: 143.89.49.73 >> - subnet: 143.225.229.238 >> - subnet: 155.245.47.225 >> - subnet: 155.246.12.163 >> - subnet: 156.56.250.226 >> - subnet: 156.62.231.244 >> - subnet: 157.92.44.101 >> - subnet: 160.80.221.39 >> - subnet: 161.106.240.19 >> - subnet: 169.226.40.2 >> - subnet: 169.229.50.15 >> - subnet: 165.91.55.8 >> - subnet: 165.230.49.115 >> - subnet: 192.1.249.138 >> - subnet: 192.12.33.102 >> - subnet: 192.16.125.11 >> - subnet: 192.38.109.144 >> - subnet: 192.41.135.219 >> - subnet: 192.42.43.23 >> - subnet: 192.107.171.145 >> - subnet: 193.1.201.27 >> - subnet: 193.138.2.13 >> - subnet: 193.196.39.9 >> - subnet: 193.167.187.185 >> - subnet: 193.136.19.13 >> - subnet: 193.166.167.5 >> - subnet: 193.205.215.74 >> - subnet: 193.226.19.31 >> - subnet: 194.29.178.13 >> - subnet: 194.167.254.19 >> - subnet: 194.254.215.12 >> - subnet: 195.130.124.1 >> - subnet: 198.82.160.221 >> - subnet: 200.0.206.137 >> - subnet: 200.0.206.168 >> - subnet: 200.17.202.195 >> - subnet: 200.129.132.19 >> - subnet: 202.23.159.52 >> - subnet: 202.125.215.12 >> - subnet: 202.237.248.222 >> - subnet: 202.249.37.67 >> - subnet: 203.110.240.190 >> - subnet: 203.178.133.2 >> - subnet: 212.51.218.235 >> - subnet: 213.73.40.106 >> - subnet: 213.131.1.101 >> >> Thanks >> Kate >> >> >> On Thursday, August 9, 2012 2:37:48 PM UTC-4, alex wrote: >>> >>> well, while you're notifying planetlab and whatnot you could create and >>> upload a dos.yaml for the time being with a content similar to this: >>> >>> blacklist: >>> - subnet: 132.65.0.0/16 >>> - subnet: 133.0.0.0/8 >>> description: somewhere in china >>> - subnet: 136.159.0.0/16 >>> - subnet: 138.250.0.0/15 >>> - subnet: 138.48.0.0/16 >>> - subnet: 139.165.0.0/16 >>> - subnet: 141.219.252.0/24 >>> - subnet: 193.1.0.0/16 >>> description: planetlab >>> - subnet: 193.136.16.0/24 >>> - subnet: 193.166.167.0/24 >>> - subnet: 195.130.124.0/22 >>> - subnet: 200.17.192.0/19 >>> >>> >>> - put that file in your app root dir and do something like this from a >>> terminal: >>> >>> "appcfg.py update_dos ." >>> >>> >>> On Thursday, August 9, 2012 6:13:14 PM UTC+2, Kate wrote: >>>> >>>> They are not coming from the same IP. They are mostly in Europe but >>>> there are no subnets. >>>> >>>> There are hundreds of them and google only lets you block 100. >>>> >>>> eg >>>> >>>> 132.65.240.100 >>>> 133.15.59.2 >>>> 193.136.19.13 >>>> 139.165.12.211 >>>> 193.166.167.5 >>>> 141.219.252.133 >>>> 200.17.202.195 >>>> 195.130.124.1 >>>> 193.1.201.27 >>>> 138.48.3.202 >>>> 136.159.220.40 >>>> 138.251.214.78 >>>> >>>> >>>> all these and more within a minute. >>>> >>>> They are all different. >>>> >>>> Kate >>>> >>>> >>>> >>>> On Thursday, August 9, 2012 9:55:29 AM UTC-4, alex wrote: >>>>> >>>>> Kate, >>>>> >>>>> If barryhunter is right and all the IPs are coming from the same ISP >>>>> anyway, you can simply block the whole subnetwork ranges of that ISP (at >>>>> least temporary) using dos.yaml: >>>>> https://developers.google.com/appengine/docs/python/config/dos >>>>> >>>>> It'll be pain in the ass updating the file every time you encounter >>>>> new subnets but at least you could probably save some quota 'till you >>>>> move >>>>> somewhere else or figure something out. >>>>> >>>>> -- alex >>>>> >>>>> On Thursday, August 9, 2012 1:59:57 PM UTC+2, Kate wrote: >>>>>> >>>>>> Hi Sergey, >>>>>> >>>>>> Here is a typical example >>>>>> 2012-08-09 06:51:16.597 / 302 30ms 0kb curl/7.18.2 >>>>>> (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/3.12.2.0 zlib/1.2.3 >>>>>> libidn/0.6.14 libssh2/0.18 >>>>>> 202.125.215.12 - - [09/Aug/2012:04:51:16 -0700] "HEAD / HTTP/1.1" 302 >>>>>> 153 - "curl/7.18.2 (i386-redhat-linux-gnu) libcurl/7.18.2 NSS/ >>>>>> 3.12.2.0 zlib/1.2.3 libidn/0.6.14 libssh2/0.18" " >>>>>> aussieclouds.appspot.com" ms=31 cpu_ms=0 api_cpu_ms=0 >>>>>> cpm_usd=0.000049 instance=00c61b117c2f994812ed63184c9c5544dea738 >>>>>> >>>>>> But the ip address varies. My code forces 302 response. Before I >>>>>> added the code they were throwing errors head method not found. But even >>>>>> though I am doing the 303 I am still getting front end time exceeded and >>>>>> these requests are taking up about 95% of my quota. So to keep the site >>>>>> alive I would have to pay for them, I have lost most of my European and >>>>>> Australian visitors because the site is down every night during those >>>>>> places daylight hours. Obviously I can't continue like this and so will >>>>>> have to move to a provider capable of blocking these requests, >>>>>> >>>>>> -- You received this message because you are subscribed to the Google Groups "Google App Engine" group. To view this discussion on the web visit https://groups.google.com/d/msg/google-appengine/-/CD7NTIaf7NEJ. To post to this group, send email to google-appengine@googlegroups.com. To unsubscribe from this group, send email to google-appengine+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/google-appengine?hl=en.
