& could never match a real Referer header, and re-saving compounded it. And a malformed IP range — anything that was not two valid addresses of the same type — matched every visitor at or below its upper bound, banning the whole audience. Malformed ranges no longer match anybody, and are dropped at the first save.