66.98.210.44

2004-09-02 (Last Modified: 2004-09-02)

Not entirely sure what’s going on, but lately I’ve got a ton of fake referrer entries from various sites’ mt-comments.cgi — and they all come from one IP: 66.98.210.44 .

Luckily, I know the magic of .htaccess, so now nobody from “Everyone’s Internet” can read my page. And good damn riddance.

Here’s an example of the log files:

66.98.210.44 - - [02/Sep/2004:20:05:43 -0400] “GET /mt/archives/002005.html HTTP/1.1” 200 16969 “http://WWW.katiehood.COM/cgi/mt-comments.cgi” “Windows XP Internet Explorer 6.x” 66.98.210.44 - - [02/Sep/2004:21:22:24 -0400] “GET /mt/archives/001302.html HTTP/1.1” 200 17057 “http://zero12.securesites.net/cgi-bin/mt/mt-comments.cgi" “Windows XP Internet Explorer 6.x” 66.98.210.44 - - [02/Sep/2004:21:39:55 -0400] “GET /mt/archives/001981.html HTTP/1.1” 200 17365 “http://www.thoughtbomb.net/cgi-bin/mt/mt-comments.cgi" “Windows XP Internet Explorer 6.x” 66.98.210.44 - - [02/Sep/2004:22:26:51 -0400] “GET /mt/archives/001467.html HTTP/1.1” 200 16895 “http://www.graysathletic.co.uk/cgi-bin/mt/mt-comments.cgi" “Windows XP Internet Explorer 6.x”

And the .htaccess file (doesn’t block EI’s whole range, but it’s good enough):
order allow,deny deny from 66.98.210 allow from all