swintec
Premium
join:2003-12-19
Alfred, ME
 ·RapidVPS
·surpasshosting
 ·Sprint Mobile Broa..
 ·VoicePulse
 ·RoadRunner Cable
|  Malicious Visitors, Maybe????
Maybe I am just being paranoid over nothing.but here is my issue...A portion of my site which is run with a PHP FAQ system (PHPMyFAQ) has seem to become quite popular with over seas visitors. To the point that at any given time I check, there is always at least 1 or 2 users visiting at any given time. When I view the log, I notice that the visitors happen to have pretty much the same IP address...they all start with "82.99.30.XX" and the last set of digits will be something between 2 and 60 or so...in most cases one off from each other. WHOIS info naturally just says RIPE Network Coordination Centre....Why have they started to essentially stay at this portion of my site? Are they looking for exploits? I just think something is up only because there is always two visitors now in that IP range. I could be over reacting...but I just wanted to ask, since a lot of malicious things and scams originate over there. 
--
BlockNews.Net- Quality Usenet Block And Unlimited Accounts |
|
twizlar
I dont think so.
Premium
join:2003-12-24
Brantford, ON | Check your raw apache logs, and see what exact urls they are visiting.
--
Intel Q6600 | 8800GTX | Ipods suck |
|
swintec
Premium
join:2003-12-19
Alfred, ME
·RapidVPS
·surpasshosting
·Sprint Mobile Broa..
·VoicePulse
·RoadRunner Cable
| said by twizlar  :Check your raw apache logs, and see what exact urls they are visiting. I just checked, it doesnt seem to be anything out of the ordinary I guess, just them bouncing around from FAQ to FAQ. Its just kinda odd to me the way all of the IP addresses are so close and seem to be there all the time. At first it was the Yahoo Search Bots visiting a lot, which I do not have to much of an issue with..but these make me wonder.
--
BlockNews.Net- Quality Usenet Block And Unlimited Accounts |
|
johnnyboyct
join:2003-06-11
Newington, CT | reply to swintec
Whats the content and how much? Maybe your being scrapped? |
|
swintec
Premium
join:2003-12-19
Alfred, ME
·RapidVPS
·surpasshosting
·Sprint Mobile Broa..
·VoicePulse
·RoadRunner Cable
| said by johnnyboyct :Whats the content and how much? Maybe your being scrapped? The content is just frequently asked questions specific to my service....if you want to see, »faq.blocknews.net As far as scrapped, are you referring to screen scrapping? I do not know a lot about that, but with it are you able to navigate around, or are you limited to a static page that you specify before you start scrapping?
Essentially what I am worried about is that there is a group of machines out there (which would explain the IP addresses so close together) that is attempting to exploit something in the FAQ system. It may be nothing at all and I am just paranoid..its just the foreign IPs make me uneasy.
--
BlockNews.Net- Quality Usenet Block And Unlimited Accounts |
|
myla
@t-ipconnect.de
thumbs down from:
swintec
| found this: »www.munax.com/crawlingfaq.htm |
|
swintec
Premium
join:2003-12-19
Alfred, ME | Good find! |
|
