Host Name 0 Zero or localhost in your Raw Access Log

Does your raw access log display a host name of “0”, or zero? Very odd, is it not? I have been struggling with this for a couple of months, and my ISP Site5 had no answers. It turns out that one of my spammers, NFORCE_ENTERTAINMENT, puts an unprintable character into their host table, so that when my ISP looks them up, they display the unprintable character in my log as “0”.

Trying to control your site’s spam can be challenging. If you try to ban an IP that is simply 0, or a host name of “0” you will fail, because there is no zero in their host name, but an unprintable character. Ban these guys instead.

Host name = “0” – – NFORCE_ENTERTAINMENT Serverhosting NL 2016-oct-26 2016-oct-23 2016-oct-27 2016-oct-13 – 2016-oct-23 2016-oct-05
Electro Nebula ColoCrossing –
China Mobile –
Simply Transit – 2016-oct-28
Enzui 2016-dec-17

My raw access log:

0 [08/Sep/2016:03:35:41 GET /root/comment/reply/58/ HTTP/1.1 403 638
0 [08/Sep/2016:03:35:42 GET / HTTP/1.1 403 638
0 [08/Sep/2016:08:02:21 GET /root/comment/reply/58/ HTTP/1.1 403 638
0 [08/Sep/2016:16:43:34 GET / HTTP/1.1 403 638

Host Name = “localhost”
localhost is very similar. The ip address actually resolves to “localhost”. Very sneaky, as reverse lookup returns –
VietNam Post and Telecom 2017-feb-12 2017-feb-23 2017-feb-12 2017-jan-03 2016-oct-04 2016-dec-14 –
VietNam Post and Tel 2016-oct-19 2016-nov-04 2017-feb-05 2016-dec-05 2016-oct-12 2016-oct-01 2017-jan-03 2016-dec-27 2017-june-17 2016-oct-26 2016-oct-22 2017-jan-14 2016-dec-22 2016-nov-01 2016-oct-28 2017-jan-14 2016-dec-11 2016-nov-17 2017-jan-26 2017-mar-01
Viettel – 2017-jul-22 2016-dec-13 2017-may-29 2017-may-29 2017-jan-30 2017-jan-06 2016-dec-20 2016-dec-12 2016-oct-23 2016-nov-27 2016-nov-01 2017-may-14 2016-oct-27 2017-apr-03 2017-feb-17 2017-may-08 2016-dec-11 2017-mar-01 2016-nov-28
Hanoi Post and Tel – 2016-nov-06 2016-dec-01
Omonia TRIPRO Hr

Madhav Cement 2017-jan-09
Giriraj Concrete 2017-mar-03

host name = “no PTR record”
host command returns “no PTR record”. I’m unsure how this displays in the log. It might display zero as well.
CachedNet 2016-oct-26
Avante Hosting Services – 2016-oct-25 2016-oct-23 2016-oct-23 2016-oct-23 2016-nov-13 2017-aug-28 2016-nov-16 2016-nov-07 2016-nov-06 2016-dec-13 2017-apr-08 2016-nov-07 2016-dec-05 2016-nov-14 2016-nov-28 2016-nov-17 2016-nov-07 2016-nov-04 2016-nov-04 2016-nov-12 2016-nov-15 2016-nov-16 2016-dec-07
Telehouse 2016-oct-26 2016-oct-28 2016-oct-23 2016-oct-20 2016-oct-21
Level 3 – 2016-oct-20
Cloudflare 2017-jan-16
MyRepublic Sg – 2016-nov-27 2016-oct-23 2016-nov-01 2016-oct-25
CHINA UNICOM Shanghai – 2016-oct-23 2017-may-20
China Unicom Hebei 2017-oct-18
Kiwi Networks ViveDigital Mx
EBOX – 2017-jan-29 2017-feb-10 2017-sept 22 2017-mar-08
Craw-Kan Tel –
Dalmia Bharat In –
Astute Hosting – 2016-dec-15 2017-feb-15 2016-dec-15 2016-dec-16
New Wave –
A.G.E. NETWORKS 2016-nov-25
Blizoo 2017-jan-31 2016-dec-10 2017-feb-03
Finecom Tel Quickline Ch
Hunter Region Mail Centre AU –
FR-PROXAD – 2017-feb-11
Starnet Servicii Lir –
Quickline CH
Microsoft Singapore
Integra Tel
Internap Network Services
Philippine Telelgraph & Telephone
Versaweb 2017-feb-03
Corporation of the County of Simcoe
DIRECTEL Za 2017-feb-23
KW Datacenter 2017-feb-23
SPA Impulse 2017-feb-27
EONIX 2017-mar-03
Dadeh Gostar Ir
Hydro One Telecom 2017-mar-08
Wanriau Indoxp Id
Pinpoint Communications Us

TekSavvy –

Host Name = “”
China Mobile – 2016-dec-05 2017-june-17 2016-nov-20 2016-nov-11 2017-apr-03 2016-nov-03 2017-jan-14 2017-feb-23 2016-dec-05 2017-jan-05
Colocrossing 2017-feb-23 2016-nov-02
Global Layer –
NForce 2016-nov-14
SOLUTION PRO – – 2016-dec-11 2017-jan-09 2017-feb-12 2017-jan-21 2017-jan-17 2017-jan-17 2017-feb-12 2017-feb-12 2017-jan-29 2016-nov-20 2017-jan-19
OpenITC MPP 2016-dec-02 2016-dec-26
Kingston Online – 2016-dec-05
Key Information Systems
Istanbul Datacenter, Tr

Host Name = “unassigned” or “UNASSIGNED”
M247 IT 2016-dec-14
Stichting BOA –

Host Name = “-”
Contabo –

Referrer = “(null)”
Digital Ocean 2016-nov-02 2016-dec-13 2016-nov-02 2016-nov-29

Host Name = “no-data”
China Unicom Tianjin 2017-feb-26 2017-feb-26 2017-jan-16

Host Name = “domain.not.configured”
University of Evansville
ZSCALER 2017-feb-23 2017-apr-18
Machine Zone emptyaddr

Host Name = ""

Host Name = ""
Quasi Networks, SC

Leave a Reply

Your email address will not be published. Required fields are marked *