Comments on: Bad Behavior 2.0.22

By: Peter

Peter — Sun, 24 Aug 2008 11:24:30 +0000

Great! Version 2.0.23 successfully installed. Thanks a lot, Michael.

By: Bad Behavior / Bad Behaviour: Bad Behavior 2.0.23

Bad Behavior / Bad Behaviour: Bad Behavior 2.0.23 — Sun, 24 Aug 2008 01:20:47 +0000

[...] FAQ « Bad Behavior 2.0.22 [...]

By: Michael Hampton

Michael Hampton — Sun, 24 Aug 2008 00:34:47 +0000

Peter,

With regard to your first issue, the requests coming from those IP addresses are people (or bots) using services such as Google Web Accelerator, Language Tools, Google’s WAP proxy, and other such services. Such requests are not normally blocked, as Google’s proxies don’t mangle any of the necessary headers or do anything unusual.

You got lucky and spotted a few unusual ones, it seems. These requests would have been blocked even if if the user had connected directly to your site, and the user (if they are indeed human beings) should follow the same instructions to solve the problem.

The second issue is a bug in Bad Behavior and will be fixed in the next release.

By: Peter

Peter — Sat, 23 Aug 2008 12:16:33 +0000

Hi,

in the last couple of days Bad Behavior has blocked several access attempts from machines that appear to belong to Google Inc., e. g. IPs 74.125.16.2, 66.249.84.11, 72.14.195.33. Bad Behavior says the cause is that the “Required header ‘Accept’ [is] missing”. The User Agent String is “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)”.

It’s a bit scary that Google should be blocked. Are you sure that these aren’t legitimate attempts by Google to check that pages are accessible to ordinary users? Or does this have something to do with someone using some Google service (like Web Accelerator) as a proxy?

I also got one blocked visit today where BB says “User-Agent claimed to be Googlebot, claim appears to be false.” The User Agent is “DoCoMo/1.0/N505i/c20/TB/W20H10 (compatible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)” and the IP No. is 72.14.199.23, which seems to be Google.

Thanks in advance for helping. (And for the plugin of course.)

By: All Pumped Up! » Bad Behavior+Project Honey Pot Can Even Lock You Out

All Pumped Up! » Bad Behavior+Project Honey Pot Can Even Lock You Out — Tue, 19 Aug 2008 13:24:17 +0000

[...] Bad Behavior v2.0.22 lets you integrate the resources of Project Honey Pot (PHP) in the fight against the bad guys. It all sounds very good, doesn’t it? It should so too. But when I actually registered on PHP and entered my key on BB, Little was I to realize that I was putting myself into deeper mess. [...]

By: Michael Hampton

Michael Hampton — Wed, 13 Aug 2008 08:26:35 +0000

Richard, your web site redirects somewhere else. This is probably the primary cause of your problems. Bad Behavior affects neither Google nor FeedBurner.

By: R. Richard Hobbs

R. Richard Hobbs — Wed, 13 Aug 2008 03:13:05 +0000

well, since I upgraded BB from 2.019 to 2.022 and added the honeypot key google cant verify my site and feedburner cant retrieve my feed everything is timing out. not sure if is related to BB but definitely curious, seems awfully coincidental not too much else changed during this period.

By: Susann

Susann — Tue, 12 Aug 2008 15:46:34 +0000

Thanks for this great plugin !
I just upgraded to Bad Behavior v.2.0.22 and noticed the http Bl feature.
As soon as I activeted it I get blocked.
So if your IP is already in the project honeypot database listen you need to chance the threat level to a higher number to get again access to your site.

By: Michael Hampton

Michael Hampton — Fri, 08 Aug 2008 20:15:57 +0000

You no longer need the http:BL plugin if you’re using Bad Behavior.

But you still need to keep your randomly named .php file around; that’s your honeypot!

By: Mark

Mark — Fri, 08 Aug 2008 19:46:52 +0000

I installed the new version and it is working fine for me, thanks for the quick update!

You said that BB now incorporates honeypot data, should we remove the http: BL plugin and the controloffer.php file? Or is controloffer.php needed by BB?