Results 1 to 8 of 8
Thread: apache access log question
-
08-18-2009, 06:26 PM #1WHT Addict
- Join Date
- Sep 2006
- Location
- Sheffield, UK
- Posts
- 125
apache access log question
I've seen in my logs thousands of requests from the same IP address, and it looks like it's just cycling through loads of thread and post ID's on my forum
Code:94.23.193.197 - - [18/Aug/2009:22:03:39 +0100] "GET /forum/viewtopic.php?f=39&p=123828 HTTP/1.0" 200 10948 "-" "-" 94.23.193.197 - - [18/Aug/2009:22:03:40 +0100] "GET /forum/viewtopic.php?f=39&p=123827 HTTP/1.0" 200 32842 "-" "-" 94.23.193.197 - - [18/Aug/2009:22:03:41 +0100] "GET /forum/viewtopic.php?f=39&p=123826 HTTP/1.0" 200 76362 "-" "-" 94.23.193.197 - - [18/Aug/2009:22:03:42 +0100] "GET /forum/viewtopic.php?f=39&p=123825 HTTP/1.0" 200 10948 "-" "-" 94.23.193.197 - - [18/Aug/2009:22:03:43 +0100] "GET /forum/viewtopic.php?f=39&p=123824 HTTP/1.0" 200 40654 "-" "-" 94.23.193.197 - - [18/Aug/2009:22:03:44 +0100] "GET /forum/viewtopic.php?f=39&p=123823 HTTP/1.0" 200 40654 "-" "-" 94.23.193.197 - - [18/Aug/2009:22:03:45 +0100] "GET /forum/viewtopic.php?f=39&p=123822 HTTP/1.0" 200 76362 "-" "-" 94.23.193.197 - - [18/Aug/2009:22:03:46 +0100] "GET /forum/viewtopic.php?f=39&p=123821 HTTP/1.0" 200 76362 "-" "-" 94.23.193.197 - - [18/Aug/2009:22:03:47 +0100] "GET /forum/viewtopic.php?f=39&p=123820 HTTP/1.0" 200 76362 "-" "-" 94.23.193.197 - - [18/Aug/2009:22:03:48 +0100] "GET /forum/viewtopic.php?f=39&p=123819 HTTP/1.0" 200 40654 "-" "-" 94.23.193.197 - - [18/Aug/2009:22:03:49 +0100] "GET /forum/viewtopic.php?f=39&p=123818 HTTP/1.0" 200 40654 "-" "-"
inetnum: 94.23.192.0 - 94.23.255.255
netname: OVH
descr: OVH SAS
descr: Dedicated Servers
descr: http://www.ovh.com
country: FR
admin-c: OK217-RIPE
tech-c: OTC2-RIPE
status: ASSIGNED PA
mnt-by: OVH-MNT
source: RIPE # Filtered
What would they be trying to do?
I've blocked their IP, so the requests have stopped, but this is the 3rd different IP that has done this.
Cheers,
Matt
-
08-18-2009, 06:51 PM #2WHT Addict
- Join Date
- Sep 2006
- Location
- Sheffield, UK
- Posts
- 125
Had another one start pretty much straight away, so I've blocked the whole 94.23.0.0/16 range from accessing my server.
-
08-18-2009, 07:20 PM #3Web Hosting Master
- Join Date
- Apr 2005
- Posts
- 1,767
Probably just a guy tunneling from his OVH server to browse your forums.
-
08-18-2009, 07:32 PM #4WHT Addict
- Join Date
- Sep 2006
- Location
- Sheffield, UK
- Posts
- 125
I'd agree, if it wasn't hitting a different thread post every second. And also accessing just under 4000 pages in just over an hour!
Code:root@vps [/etc/apf]# more /home/z22se/access-logs/z22se.co.uk | grep 94.23 | awk '{print $1}' | sort -n | uniq -c | sort -nr 3926 94.23.193.197 261 94.23.58.180
-
08-18-2009, 08:30 PM #5Web Hosting Master
- Join Date
- Apr 2005
- Posts
- 1,767
Now that I look closer, this might be a forum scraper. What is forum 39 on your site?
-
08-18-2009, 08:56 PM #6Junior Guru Wannabe
- Join Date
- Aug 2009
- Posts
- 38
Definately looks like a scrapper or crawler.
-
08-18-2009, 11:54 PM #7Web Hosting Master
- Join Date
- Jun 2006
- Location
- NYC / Memphis, TN
- Posts
- 1,454
Yep something scraping would be my bet. Track it down and report them to OVH abuse.
≈ PeakVPN.Com | Complete Privacy VPN | Cloud Hosting | Guaranteed Security | 1Gbps-10Gbps Unmetered
≈ PeakVPN | 31 VPN Servers | 17-Years Experience | Emergency 24/7 Support
≈ Visit us @ PeakVPN.Com (Coming SOON) | ASN: 3915
-
08-19-2009, 04:22 AM #8WHT Addict
- Join Date
- Sep 2006
- Location
- Sheffield, UK
- Posts
- 125
Similar Threads
-
Apache access restriction...
By skolagotla in forum Hosting Security and TechnologyReplies: 5Last Post: 03-15-2006, 07:50 PM -
apache access logs
By aqi32 in forum Web HostingReplies: 13Last Post: 11-15-2004, 07:43 PM -
Apache Login Access
By FunnyFo in forum Hosting Security and TechnologyReplies: 4Last Post: 04-08-2003, 08:30 AM -
setting up ftp access with apache
By mrlugal in forum Hosting Software and Control PanelsReplies: 3Last Post: 01-05-2003, 02:39 AM -
Apache Access log Question
By MGCJerry in forum Hosting Security and TechnologyReplies: 5Last Post: 03-07-2002, 08:22 PM