Apache question - how do you block your site from being surfed by someone using an anonymizer?

[dderidex]

Basically, I've got picks of myself and friends and family on my site, brief bio stuff, etc - kinda irks me to see a lot of requests from someone clearly running an anonymizer (for example, the tiled images on one of my pages being sent each to one of 4 alternate IP addresses, no referer, etc).

Obviously, it's pretty easy to block traffic from a 'no referer', but if the referer field is bogus....? And is there any way to make Apache somewhat intelligent about the IP addresses requesting information?

 

[GagHalfrunt]

Somewhat intelligent? Not really, on it's own it's not going to be able to determine what IP address is legit and which is a proxy, anonymizer or spoof. You can use your .htaccess to block out IP ranges once you find that they're bogus or to find out the IP addresses of your trusted visitors and only allow those specific addresses.

That's the hard way though, if the site isn't meant to be public and has only limited visitors you're better off just password protecting the pages.

 

[dderidex]

As far as I understand, there are only so many 'anonymizer' services out there - I mean, you can't just totally put a bogus IP in the 'from' field, or the packets from the site would never get back to you.

There are services that you basically type the address you want to visit into, and they use a half dozen different servers to access it, put the data together, and send to "you".

It's the IP addresses of those anonymizer services I want to block.

(Obviously, someone can always create their own 'anonymizer' service by hacking a bunch of different PCs and browsing from them, but I'm sure that's not what's happening.)

 

[GagHalfrunt]

Originally posted by: dderidex
As far as I understand, there are only so many 'anonymizer' services out there

Good luck There are thousands of anonymizers that any retard can use and tens of thousands more proxies that a semi-intelligent person can use.

Why are you insisting upon doing this the hard and stupid way when a password is 100 times easier and 1000 times more secure? You are NEVER EVER going to come close to being able to block out every faked IP.

 

[Crusty]

There are thousands upon thousands of anonymous proxies that open for use, you just need to know where to look (ie google )

It's so easy to setup an anonymous proxy on a linux box, I can do it in just a few minutes.

Whoever is doing this is most likely just using proxies instead of "anonymizer" services. It's almost impossible to determine just from the IP whether or not they are using a proxy or not.

Check this site out:
http://www.samair.ru/proxy/proxychecker/

It will give information about the requests you are making from your computer, it might give you more of an idea of what to look for.

 

[Red and black]

If you put stuff on a regular web page, it is public. Expect it to be downloaded, cached, indexed, and seached. You can put in a robots.txt to ask some people not to look, but who's to say they'll follow it?

If you want it private, serve it via https and put a password on it.

 

[skace]

Just curious, what is the big deal if someone uses an anonymizer or not to view your site?

 

[dderidex]

Originally posted by: skace
Just curious, what is the big deal if someone uses an anonymizer or not to view your site?

Just anoying, that's all. I put (not terribly, but somewhat) personal information up on my page.

Basically, I put up info to show the world part of who I am. They really want to check out that info (digging around the site in detail), but don't want to reveal who THEY even ARE.

It's the difference between a stranger walking up to you in a bar and going 'hey, I'd like to get to know you better' vs a stranger digging through your trash, peeping in your windows and night, and following you around in a trench-coart trying to stay out of sight.

One is normal and expected, the other's just creepy.

 

[RaiderJ]

Originally posted by: dderidex

Originally posted by: skace
Just curious, what is the big deal if someone uses an anonymizer or not to view your site?

Just anoying, that's all. I put (not terribly, but somewhat) personal information up on my page.

Basically, I put up info to show the world part of who I am. They really want to check out that info (digging around the site in detail), but don't want to reveal who THEY even ARE.

It's the difference between a stranger walking up to you in a bar and going 'hey, I'd like to get to know you better' vs a stranger digging through your trash, peeping in your windows and night, and following you around in a trench-coart trying to stay out of sight.

One is normal and expected, the other's just creepy.

Put you've put that information on a WEBSITE - which is the equivalent of a billboard. What you'd like to do is hand out special filter googles to only certain people. Silly!

 

[Barfo]

what was your site's url again?