Server Logs

Discussion in 'Hosting' started by ghost, Sep 9, 2010.

Tags:
  1. ghost

    ghost New Member

    I am having some odd behavior on one of my sites, Request's for "HEAD / HTTP/1.0" every 11 - 12 minutes since yesterday , same IP from a whole range of operating systems. I have banned the IP in htaccess. I have uploaded a sample from this mornings log file. Has any one else seen this ?. or could any one tell what it is .
     
  2. mneylon

    mneylon Administrator Staff Member

    The UserAgent strings suggest that the same IP is being used by multiple browsers and operating systems. Maybe it's a proxy of some kind?
    The WHOIS data isn't too helpful, but it looks like an IP from a range assigned to PSYCHZ-NETWORKS which is a hosting provider in the US..
     
  3. ghost

    ghost New Member

    Thanks for the reply BK, the requests have continued over the weekend its now down to one every seven minutes.
    Its like a time bomb. Looks harmless but will remain banned.
     
  4. ghost

    ghost New Member

    To Conclude this one
    It was a little time bomb, it exploded with over two thousand referrer spam hits per day.
    this is a spam trick I have not seen before .
    The spammer joins a forum creates a thread or post, drops in 3-4 links to his own sites . I am not sure how the next bit works, I get referrer hits from the forum, but with his original IP address. Of course if I follow the link to the forum I get his planted links.

    I complained to Psychz.Net and in three days the IP 173.224.218.7 stopped and these two
    173.224.218.223 and 173.224.218.248 took up the job. watch out for this guy tonygaga2010

    to Be continued .............
     
  5. mneylon

    mneylon Administrator Staff Member

    If it's on a forum it might be worth your while to look into using StopForumSpam to block signups
     

Share This Page