Results 1 to 8 of 8
  1. #1

    128.138.134.9 do you know anything about this IP

    Hello

    today i check awstat stats and check that some guy (or may be robot) from this ip 128.138.134.9 for 2 days make 4.5b traffic me.

    i try to check who is this and find such a information

    128.138.0.0 - 128.138.255.255
    University of Colorado
    Information Technology Services
    3645 Marine Street
    Boulder, CO
    US

    do u know anything about this guys
    is it any robot ... or something else

    agree with me , for 2 days 4.5gb traffic it's not a small

    when i try to close access of my site from this site, i got tons of errors .... something like this

    [Mon May 23 22:49:51 2005] [error] [client 128.138.134.9] client denied by server configuration: /home/***l/public_html/comments.php

    from May 23 22:50:10 =>23 22:49:50 i got 389 errors (connections from this ip).

    thank you
    Your Health Encyclopedia
    Medical and health consumer information resources containing comprehensive and unbiased information in patient-friendly language

  2. #2
    Well man, this is probably one (or more) pranksters at University of Colorado. If you want send them an email, maybe they'll pin him down

    Also check referrer if your stats have it and check the page itself -- to see where there coming from.

    Here's my WHoIS on that IP:
    ....
    Administrative Contact:
    Kenneth J. Klingenstein
    University of Colorado at Boulder
    Campus Box 455
    Boulder, CO 80309-0455
    UNITED STATES
    (303) 492-8178
    [email protected]


    Technical Contact:
    David CM Wood
    University of Colorado at Boulder
    Information Technology Services
    3645 Marine Street Campus Box 455
    Boulder, CO 80309-0455
    UNITED STATES
    (303) 492-4905
    [email protected]

  3. #3
    Also check referrer if your stats have it and check the page itself -- to see where there coming from.

    Here's my WHoIS on that IP:
    Yes, i check whois info and send email them

    but i cann't understand what's the reason of such intensive crawling or may be grabbing?

    any idea?

    btw. i have db overloading on this site. [here the post - http://www.webhostingtalk.com/showth...hreadid=406607]

    may be the reason of this isn't googlebot (as i thought before) and are guys like this pranksters?
    Your Health Encyclopedia
    Medical and health consumer information resources containing comprehensive and unbiased information in patient-friendly language

  4. #4
    Join Date
    Jun 2002
    Location
    Texas
    Posts
    7,953
    Moved to the technical Forum. I would review your logs for any new uploads or have an admin look over the server.

    I get some pretty big hits very now and then from german sites hotliking images.

  5. #5
    Join Date
    Jul 2004
    Posts
    73
    128. is a popular range for skript kiddies to try and crack, the access to comment.php suggests it's possibly a comment spammer, my guess is someones set off a blog comment spammer and it has itself stuck in an infinite loop, while the admin is getting his act together (which may never happen) try sticking
    Code:
    <?php
    if($_SERVER['REMOTE_ADDR']=="128.138.134.9") { die(''); }
    ?>
    at the top of the PHP scripts it tries to access, this will the script to exit as soon as anyone with the I.P. address "128.138.134.9" tries to access it.

    Hope this helps.

  6. #6
    Moved to the technical Forum. I would review your logs for any new uploads or have an admin look over the server
    20-22 hours ago i close access for this IP from my cpanel.

    during 6 hours after this i check this ip access (in my error log stats) => all they are redirected to error.html page

    then is stopped.

    now when i checking my awstat logs, i check that during 21.22.23 my they make 9.18gb! traffic on my server /

    it's good, that i'm not on sharing host :-(

    the access to comment.php suggests it's possibly a comment spammer
    comment.php isn't the only file, they crawling all my site.

    thank you
    Your Health Encyclopedia
    Medical and health consumer information resources containing comprehensive and unbiased information in patient-friendly language

  7. #7
    Join Date
    Jul 2004
    Posts
    73
    Originally posted by 3-rx
    comment.php isn't the only file, they crawling all my site.
    It could be a comment / referrer spammer combo then, or perhaps not.

    Glad to hear it's over :-)

  8. #8
    hmm .. i close access for this IP 128.138.134.9
    and when i check my stats yesterday i view 2 new ips, which make huge traffic.

    148.244.150.58 [Mexico]

    and

    207.248.240.119 [Latin American and Caribbean IP address Regional Registry]

    for weekend this 2 ips make 2,4gb traffic. i don't know , that my site can be so popular in mexico and Caribbean Island.

    what do u think, what to do ?
    allow or close their access, as i do with University of Colorado.

    i make enought traffic limit, so i can allow them to crawl (or index, or grap ...), as i don't know what they are doing. (i'm looking in awstat results)

    btw this week google is crawling my site, but i think it's not a googlebot ip.
    Your Health Encyclopedia
    Medical and health consumer information resources containing comprehensive and unbiased information in patient-friendly language

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •