RE: Stats spike

It sounds to me like someone running a spider and doing some data or
address harvesting.  Be ready for lots of spam to any email addresses
posted on the site.   

> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of JC Dill
> Sent: Monday, March 31, 2008 1:53 PM
> To: [email protected]
> Subject: Re: Stats spike
> 
> Steve VanDevender wrote:
> > JC Dill writes:
> >  > A site (located in Georgia, USA) on a service I'm doing 
> consulting 
> > for  > had a sudden surge in hits.  They had over 40k hits 
> in one day 
> > (for  > these sites, that's a big surge), all from 
> 66.131.100.81 which resolves to:
> >  >
> >  > modemcable081.100-131-66.mc.videotron.ca
> >  >
> >  > My first thought was that someone had mirrored the site. 
>  But the 
> > user  > agent was:
> >  >
> >  > > sorted and uniq'ified:
> >  > >
> >  > > Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)  > > 
> > Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET)  > > 
> > Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 
> > 1.1.4322)  > > Mozilla/4.0 (compatible; MSIE 6.0; Windows 
> NT 5.1; SV1; 
> > .NET CLR  > > 1.1.4322; InfoPath.1)  > > Mozilla/4.0 
> (compatible; MSIE 
> > 6.0; Windows NT 5.1; SV1; .NET CLR  > > 1.1.4322; .NET CLR 
> 2.0.50727)  
> > > > Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; 
> rv:1.8.0.7)  > > 
> > Gecko/20060909 Firefox/1.5.0.7  >  > Any ideas what this might be?
> > 
> > It seems like you could figure out more by looking at the 
> access logs 
> > to see what that host was trying to access.
> 
> We already did that - it accessed all the pages of the site 
> which is why "my first thought was that someone had mirrored 
> the site".  What we want to figure out is how, and why.
> 
> The site has bandwidth limits and the site's owner is 
> concerned about hitting the limits.  This particular hit 
> didn't bring the site up to the limits, but we are mystified 
> why this IP hit the site in this way. 
> That's a LOT of different user agents from a single IP that 
> appears to be a single Cable Modem customer.  It would be 
> very unusual to have 7 different users with 7 different 
> browsers using the same cable modem service and all scarfing 
> the entire contents of this one site.  I can't find any 
> logical explanation for it, which is why I asked here.
> 
> jc
> --
> Eat sushi frequently. - Avi
> [email protected] is the human contact address.
> [email protected] is the list posting address.
> See below URL for subscribe/unsubscribe and list options:
> http://inet-access.net/mailman/listinfo/list
> 
-- 
Eat sushi frequently. - Avi
[email protected] is the human contact address.
[email protected] is the list posting address.
See below URL for subscribe/unsubscribe and list options:
http://inet-access.net/mailman/listinfo/list