Re: Stats spike
JC Dill <[email protected]>
| Newsgroups | gmane.org.operators.internet-access |
|---|---|
| Message-ID | <[email protected]> |
Jon Lewis wrote: > On Mon, 31 Mar 2008, JC Dill wrote: > >> A site (located in Georgia, USA) on a service I'm doing consulting for >> had a sudden surge in hits. They had over 40k hits in one day (for >> these sites, that's a big surge), all from 66.131.100.81 which >> resolves to: >> >> modemcable081.100-131-66.mc.videotron.ca >> >> My first thought was that someone had mirrored the site. But the user >> agent was: > > What does the access_log say this IP was requesting? Webmail brute > force password guessing perhaps? They (apparently) mirrored the whole site. They didn't grab the images, just the html. Since this is a site full of photos, that makes it pretty weird. There was no brute force password guessing. The problem is why would 7 different user agents be used to "mirror" 40k files from the site, from a cable modem user in Canada? There isn't anything worth mirroring. It's a photographer's event photo site. The photos are not of interest to anyone except the people who competed in the event. There's no value in mirroring the site, there's nothing to crack, no password protected data on that site, etc. It wasn't my site, but it was a site similar to mine: http://equinephotoart.exposuremanager.com/g/ If this was an attempt to spider the site to scarf email addresses, they gained - at most - one email address. It's just very weird. Is there any value in complaining to abuse@videotron or is that just sending the complaint into a black hole? jc -- Eat sushi frequently. - Avi [email protected] is the human contact address. [email protected] is the list posting address. See below URL for subscribe/unsubscribe and list options: http://inet-access.net/mailman/listinfo/list