What is going on with theses IP's

Community TechTalk
1

Anyone shed some light please. My Visits log is filling up from hits from these 3 ip’s since the new year:
ip’s:205.234.235.86, 87.230.0.180 about every half hour like clockwork & previously 64.14.68.21
The logs have gone from about 25 hits a day to over 550
Somethings not right here? Please help?

11/01/2006 3:32:57 PM 205.234.235.86 --N/A–
11/01/2006 3:32:57 PM 87.230.0.180 --N/A–
11/01/2006 3:29:39 PM 66.249.71.67 --N/A–
11/01/2006 3:02:55 PM 68.142.250.176 --N/A–
11/01/2006 3:02:26 PM 87.230.0.180 --N/A–
11/01/2006 3:02:24 PM 205.234.235.86 --N/A–
11/01/2006 2:46:45 PM 203.12.97.94 --N/A–
11/01/2006 2:32:31 PM 87.230.0.180 --N/A–
11/01/2006 2:32:21 PM 205.234.235.86 --N/A–
11/01/2006 2:14:07 PM 150.229.8.86 --N/A–
11/01/2006 2:02:30 PM 205.234.235.86 --N/A–
11/01/2006 2:02:30 PM 87.230.0.180 --N/A–
11/01/2006 1:56:56 PM 150.229.8.86 --N/A–
11/01/2006 1:41:39 PM 150.229.8.86 --N/A–
11/01/2006 1:32:31 PM 87.230.0.180 --N/A–
11/01/2006 1:32:16 PM 205.234.235.86 --N/A–
11/01/2006 1:09:12 PM 202.9.3.10 --N/A–
11/01/2006 1:02:45 PM 87.230.0.180 --N/A–
11/01/2006 1:02:33 PM 205.234.235.86 --N/A–
11/01/2006 12:54:04 PM 202.9.3.10 --N/A–
11/01/2006 12:54:02 PM 202.9.3.10 --N/A–
11/01/2006 12:54:02 PM 202.9.3.10 --N/A–
11/01/2006 12:40:40 PM 202.9.3.10 --N/A–
11/01/2006 12:35:06 PM 68.142.250.156 --N/A–
11/01/2006 12:32:36 PM 87.230.0.180 --N/A–
11/01/2006 12:32:18 PM 205.234.235.86 --N/A–
11/01/2006 12:29:07 PM 202.9.3.10 --N/A–
11/01/2006 12:26:20 PM 203.12.97.94 --N/A–
11/01/2006 12:02:30 PM 205.234.235.86 --N/A–
11/01/2006 12:02:29 PM 87.230.0.180

2

Are they leaving “spam” in your refferr logs?

3

thanx for your reply Stephen , I’m not sure what i should be looking for though…in my logs/domain.com/ folder thier is aws stats folder & 9 log files eg. ex060103

I have downloaded & opened 1 of the log files…what should i look for? or am i looking in the wrong place?

4

log shows
#Software: H-Sphere log plugin
#Date: 2006-01-10 00:02:15
#Fields: date time c-ip cs-username s-sitename s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken cs-version cs(User-Agent) cs(Cookie) cs(Referer)
2006-01-10 00:02:15 205.234.235.86 - W3SVC718 USER-XA5G8QLHT5 204.10.107.3 80 HEAD /default.asp - 200 0 342 112 78 HTTP/1.0 BHR-Uptime+(v.1.2+ http://uptime.besthostratings.com ) - -
2006-01-10 00:02:29 87.230.0.180 - W3SVC718 USER-XA5G8QLHT5 204.10.107.3 80 HEAD /default.asp - 200 0 342 112 94 HTTP/1.0 BHR-Uptime+(v.1.2+ http://uptime.besthostratings.com ) - -
2006-01-10 00:02:41 64.14.68.21 - W3SVC718 USER-XA5G8QLHT5 204.10.107.3 80 HEAD /default.asp - 200 0 342 112 47 HTTP/1.0 BHR-Uptime+(v.1.2+ http://uptime.besthostratings.com ) - -
2006-01-10 00:03:32 64.14.68.21 - W3SVC718 USER-XA5G8QLHT5 204.10.107.3 80 HEAD /default.asp - 200 0 342 112 47 HTTP/1.0 BHR-Uptime+(v.1.2+ http://uptime.besthostratings.com ) - -
2006-01-10 00:04:27 64.14.68.21 - W3SVC718 USER-XA5G8QLHT5 204.10.107.3 80 HEAD /default.asp - 200 0 342 112 47 HTTP/1.0 BHR-Uptime+(v.1.2+ http://uptime.besthostratings.com ) - -
2006-01-10 00:05:27 64.14.68.21 - W3SVC718 USER-XA5G8QLHT5 204.10.107.3 80 HEAD /default.asp - 200 0 342 112 47 HTTP/1.0 BHR-Uptime+(v.1.2+ http://uptime.besthostratings.com ) - -
2006-01-10 00:06:12 218.107.197.134 - W3SVC718 USER-XA5G8QLHT5 204.10.107.3 80 GET /reply.asp - 200 0 312 200 1391 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1) - -
2006-01-10 00:06:13 218.107.197.134 - W3SVC718 USER-XA5G8QLHT5 204.10.107.3 80 POST /signup&plan_id=10548&signup=yes&template_name=signup/begin.html - 404 3 1819 367 0 HTTP/1.0 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1) ASPSESSIONIDCARTBQQT=IINJMJJBAHNJEKDBFEOOFEDD -
2006-01-10 00:06:34 64.14.68.21 - W3SVC718 USER-XA5G8QLHT5 204.10.107.3 80 HEAD /default.asp - 200 0 342 112 110 HTTP/1.0 BHR-Uptime+(v.1.2+ http://uptime.besthostratings.com ) - -

5

ok, looks like someone submitted me…could be a good thing, shows 100% uptime Monitored since: 29 December 2005

congrats due to JH for that.

6

from http://uptime.besthostratings.com
“We verify each web host uptime by checking several sites hosted by that provider on a regular basis (2-4 times per hour). We run the checks from several geographic locations. If we have negative result from one location we compare the same sample to the other locations that we have and in case that 50% or more of the locations report the site to be up, then we consider the site as up and running. We use HEAD HTTP requests to monitor a site uptime. Once a day our system verifies if the site domain is still registered and if it is still pointed to the same web hosting provider. In case something has changed, the site is put temporary on hold for manual intervention. The HEAD requests are requesting only the response headers of a web server, and we actually only read the first line of the response so there should not be any bandwidth or server resources usage overhead for the monitored sites.”
So your site is being monitored, don’t you think? 550 hits a day doesn’t sound like it should cause any problems.

edit: see you spotted that :slight_smile:

7

The look like a new service to me, as I saw MANY hosts with a Dec 29 start date, either they or new, or someone went wild evaluating some hosts.