Joomla version: 1.0.15
RSGallery version: 1.14.3
website hosted on a shared host, Apache 2.0.x, PHP 5.2.x
In the access logs of the server of my website, there were every day several hundreds of lines like these:
===
200.13.243.76 - - [15/Sep/2008:06:10:13 +0200] "GET /XXX/index.php?option=com_rsgallery2&page=inline&Itemid=49&id=308 HTTP/1.0" 200 12226 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.
Gecko/20071008 Firefox/2.0.0.8 RPT-HTTPClient/0.3-3"
121.14.37.108 - - [15/Sep/2008:06:30:04 +0200] "POST /XXX/index.php?option=com_rsgallery2&page=inline&id=308&mosmsg=Commentaar+staat+uit HTTP/1.0" 200 9145 "http://XXX/XXX/index.php?option=com_rsgallery2&page=inline&Itemid=49&id=130" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.
Gecko/20071008 Firefox/2.0.0.8 RPT-HTTPClient/0.3-3"
===
I think this is a spam bot trying to post comment spam on my gallery, but I'm not sure. Adding a few lines to .htaccess nicely blocks all these requests (status code 403 - forbidden), but there are still several hundreds of attempts per day. No users are complaining. By the way, commenting is disabled on my site.
My questions:
- What/who is RPT-HTTPClient ?
- How can I check what RPT-HTTPClient is doing ? Is there an easy way of logging all relevant data in the database, and retrieving it afterwards? Preferably without accidently DOS'ing my site of course.
- Are there other/better methods to block this kind of user agents? Or is it better not trying to block specific user agents?
For completeness: the relevant lines in .htaccess
===
RewriteCond %{HTTP_USER_AGENT} RPT-HTTPClient [OR]
# other rules
RewriteRule ^(.*)$ index.php [F,L]
===
Kind regards,
Rennie
