- This topic is empty.
-
Posts
-
Hi,
maybe somebody can shed some light on this.
We were crawled last night by this IP: 66.197.153.37
It caused over 13GB of traffic alone. Because of this, our database was overloaded and could not be displayed on the site. We only realised this morning and have now blocked that IP.
However, I would really like to know who this is and what it was doing.. anybody have any idea?
I have tried to trace it, but end up with so many different results – first in the UK, then in Nevada, then some Island somewhere..
Any ideas?
Thanks
several tries on whois did give me this:
OrgName: Network Operations Center Inc.
OrgID: NOC
Address: PO Box 591
City: Scranton
StateProv: PA
PostalCode: 18501-0591
Country: USNetRange: 66.197.128.0 – 66.197.255.255
CIDR: 66.197.128.0/17
NetName: HOSTNOC-2BLK
NetHandle: NET-66-197-128-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.HOSTNOC.NET
NameServer: NS2.HOSTNOC.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2001-11-01
Updated: 2003-08-08TechHandle: SMA4-ARIN
TechName: Arcus, S. Matthew
TechPhone: +1-570-343-8551
TechEmail: nic@hostnoc.netOrgTechHandle: SMA4-ARIN
OrgTechName: Arcus, S. Matthew
OrgTechPhone: +1-570-343-8551
OrgTechEmail: nic@hostnoc.netWell, just from getting into search engine optimization and learning about both white and black hat methods, I know that some people can attempt to knock you out of the SERPs by running bots designed to eat up your bandwidth. Once your page is shut down for several days to a week, the search engines drop your rankings.
I have absolutely no idea how to verify this, or how to do anything about it if this is indeed the case, but just wanted to throw that possibility out there…
This exact same thing has happened on some of my high traffic websites including http://www.wheretobet.com.
I have a feeling someone is doing a very poor attempt of a DOS attack, but have no proof.
peralis wrote:Hi,maybe somebody can shed some light on this.
We were crawled last night by this IP: 66.197.153.37
It caused over 13GB of traffic alone. Because of this, our database was overloaded and could not be displayed on the site. We only realised this morning and have now blocked that IP.
However, I would really like to know who this is and what it was doing.. anybody have any idea?
I have tried to trace it, but end up with so many different results – first in the UK, then in Nevada, then some Island somewhere..
Any ideas?
Thanks
I see this when tracing to it: 66.197.153.37 bathost.co.uk
Who Is:
Blacklist Status: Clear
Whois History: 3 records stored
Oldest: 2005-02-27
Newest: 2005-10-15
Record Type: IP Address
IP Location: United States – Nevada – Reno – Resellermatrix
Reverse IP: Web server hosts 88 websites (reverse ip tool requires free login)
Reverse DNS: bathost.co.ukAnd the same IP Hosts these sites – I think you might want to speak with the webmaster of them – Sounds to me like a very poor DOS or site scrape Peralis.
Website
http://www.All-news.net
http://www.Allhealthnews.net
http://www.Allscienctnews.net
http://www.Allsportnews.net
http://www.Allworldnews.net
http://www.Baccarat-history.com
http://www.Bjkcasino.com
http://www.Black-jack-rules.net
http://www.Blackjack-history.com
http://www.Borcasino.com
http://www.Busines-news.net
http://www.Casino-neo.net
http://www.Casinogamepg.com
http://www.Casinoofluck.com
http://www.Casinopgs.com
http://www.Easypokergames.info
http://www.Entertainment-news.net
http://www.Epay-net.biz
http://www.Fouracesclub.com
http://www.Freepokerparty.net
http://www.Gamblingrate.com
http://www.Gamblstar.com
http://www.Gndcasino.com
http://www.Grand-forex.com
http://www.Grand-fortune.com
http://www.Igamblingpage.com
http://www.Indiancarpets.info
http://www.Indiasilk.biz
http://www.Indiasilktradition.com
http://www.Infocasinopage.com
http://www.Jdms.info
http://www.Kennedyshistory.com
http://www.Lancewright.org
http://www.Lottetymark.com
http://www.Luckcasino.biz
http://www.Markcasino.com
http://www.Markloto.com
http://www.Newyorkmoney.org
http://www.Odd-news.net
http://www.Onecasinoguide.com
http://www.Onlinecasinopage.com
http://www.Onlinegambling-guide.com
http://www.Onlinesale.biz
http://www.Orientalcarpets-online.com
http://www.P8q.net
http://www.Persian-carpets.biz
http://www.Persiancarpetkinds.com
http://www.Poker-theboardgame.com
http://www.Pokerenlinea.com
http://www.Pokeressentials.net
http://www.Pokerluck.biz
http://www.Pokerman.biz
http://www.Pokermark.com
http://www.Pokeroffer.com
http://www.Pokeromaha.com
http://www.Pokerpage.biz
http://www.Pokerpartnership.com
http://www.Pokerred.com
http://www.Pokersilver.com
http://www.Pokerslot.biz
http://www.Pokersmile.com
http://www.Pokervictory.biz
http://www.Pokerwish.biz
http://www.Queenpoker.biz
http://www.Realypoker.com
http://www.Rockycasino.com
http://www.Roosevelthistory.com
http://www.Royalvillacasino.com
http://www.Rugs-dyeing-shop.com
http://www.Rugstechniques-shop.com
http://www.Silverelephant.biz
http://www.Sweetpoker.biz
http://www.Technologiesnews.net
http://www.Thebestrugsofamerica.com
http://www.Thepersiancarpet.biz
http://www.Tibetiancarpets.com
http://www.Tournamentpoker.biz
http://www.Treasureshome.com
http://www.Turkishcarpets.biz
http://www.Turkishrugs-history.com
http://www.Ultrapoker.biz
http://www.Used-rugs-shop.com
http://www.Vegasstarclub.com
http://www.Wallmarketings.com
http://www.Washington-george.com
http://www.Web-industry.com
http://www.Wildacepoker.com
http://www.Wowpoker.bizThanks a lot fr taking time to check this out.
I had a feeling that it may be a scrape attempt or an attack of sme sorts – the only thing that made me wonder about that was that it was so easy to stop.
I guess like yu guys said.. a very poor attempt.
I will try and get into contact with the owner of thse sites Webzcas! Thanks!
peralis wrote:Thanks a lot fr taking time to check this out.I had a feeling that it may be a scrape attempt or an attack of sme sorts – the only thing that made me wonder about that was that it was so easy to stop.
I guess like yu guys said.. a very poor attempt.
I will try and get into contact with the owner of thse sites Webzcas! Thanks!
If you get no joy. Request the assistance of your own hosting company. I’m sure they don’t like the idea of their servers being inundated with a scrape or an attack of this sort and will be more than happy to deal direct with this webmaster’s own hosting company.
The same happened to my site too. With the same IP. (66.197.153.37)
The referrer was the pokerlistings.com directory.
Maybe it could be a bot going through link directories and sites…
So I’d like to hear the outcome of this.
Ever since I learned about these bandwidth eating programs (the one I know about is written in Visual Basic . NET and is extremely simple to run), I’ve wondered how to go about stopping them.
I guess it’s good to be low profile sometimes.
PS: Quite a collection of smileys that you moderators have given us – I can’t even find the simple smiley face to insert! But I digress…
