Re: Stats spike
JC Dill <[email protected]>
| Newsgroups | gmane.org.operators.internet-access |
|---|---|
| Message-ID | <[email protected]> |
Steve VanDevender wrote: > JC Dill writes: > > A site (located in Georgia, USA) on a service I'm doing consulting for > > had a sudden surge in hits. They had over 40k hits in one day (for > > these sites, that's a big surge), all from 66.131.100.81 which resolves to: > > > > modemcable081.100-131-66.mc.videotron.ca > > > > My first thought was that someone had mirrored the site. But the user > > agent was: > > > > > sorted and uniq'ified: > > > > > > Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) > > > Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET) > > > Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) > > > Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR > > > 1.1.4322; InfoPath.1) > > > Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR > > > 1.1.4322; .NET CLR 2.0.50727) > > > Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.7) > > > Gecko/20060909 Firefox/1.5.0.7 > > > > Any ideas what this might be? > > It seems like you could figure out more by looking at the access logs to > see what that host was trying to access. We already did that - it accessed all the pages of the site which is why "my first thought was that someone had mirrored the site". What we want to figure out is how, and why. The site has bandwidth limits and the site's owner is concerned about hitting the limits. This particular hit didn't bring the site up to the limits, but we are mystified why this IP hit the site in this way. That's a LOT of different user agents from a single IP that appears to be a single Cable Modem customer. It would be very unusual to have 7 different users with 7 different browsers using the same cable modem service and all scarfing the entire contents of this one site. I can't find any logical explanation for it, which is why I asked here. jc -- Eat sushi frequently. - Avi [email protected] is the human contact address. [email protected] is the list posting address. See below URL for subscribe/unsubscribe and list options: http://inet-access.net/mailman/listinfo/list