Love the post, it is accurate and useful.

Because Java bots clog up my error logs and Java bots are used in SQL injection attacks. When other user agents abuse my websites, I will block them, too.

This isn’t stupid or paranoid. It’s been successful for years; look at the date on this post.

Sure, idiots can change their user-agents, and I can use other criteria to block their malicious intent. There’s no way to escape a server log, and analysis of logs is what helps me create solutions like this.

You are wrong about not being able to choose who accesses my website. I can block whatever I want using mechanisms that are built into any modern web server.

You would be surprised to learn that lots of servers use whitelists to filter traffic, a step further than the blacklists I maintain.

Why should I tolerate attacks when the tools to block the least sophisticated are so easy to use?

You will realize how stupid your paranoia is when people change the user agent to “MSIE 9, Win7 x64″, and are able to continue crawling your site.

If you place a web site on the open internet, it´s to be accesed by any user agent, not just your preference of browsers.

I say F´You to people like you and your ilk, who don´t have a clue about what the open internet is all about.

FC

RewriteCond %{REMOTE_ADDR} 213\.93\.196\.\d\d?\d?
RewriteCond %{HTTP_USER_AGENT} Java.*
RewriteRule ^/(.*)$ /$1 [F]

\d represents a single digit in regular expressions, and a question mark ? makes that character optional

But I do it a little in another way, because
the Rewrite Enginerules rules is not convenient for blocking of ranges of IP-addresses, therefore it does a script on PHP, likely:
$block= array(
“84.120.0.0-84.123.255.255″,
“122.198.0.0-122.198.255.255″,
“205.209.128.0-205.209.191.255″
);
function checkIP($ip) {
for ($i=0; $i= $b_IP && $IP <= $e_IP) return true;
}
return false;
}

“Manually” blocking IP and UserAgent is not the best practice, so I use robots detection by pseudo-picture loading and JavaScrips evaluating. But Java-bots loaded all pseudo-pictures and evaluate JavaScrips!
One way to detect Java-bots – by UserAgent’s field, but it is not so difficult Ñ‚o change this fieled.
What to do in this case?