How to find bandwidth theft

Discussion in 'Security' started by rambo, Feb 26, 2008.

0
  1. #1
    I m running a blog and i have 3k UV per day but the problem is that i m facing bandwidth theft and as i m using distributed server from lunarpages.com they are saying that i m using too much resources, some how i stopped the hotlinks, now i want to know how to find the bandwidth theft, I never know who is copying my content with the help of rss and is it possible any leak in wordpress.
     
    rambo, Feb 26, 2008 IP
  2. micksss

    micksss Notable Member

    Messages:
    4,427
    Likes Received:
    268
    Best Answers:
    1
    Trophy Points:
    285
    #2
    You could check to see if there is one single IP address that is accessing and see if it's connected to a site. Then ban access from that IP.
     
    micksss, Feb 26, 2008 IP
  3. rambo

    rambo Peon

    Messages:
    50
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Yes but is there any hope for any alert type thing
     
    rambo, Feb 26, 2008 IP
  4. ccb056

    ccb056 Peon

    Messages:
    169
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Look in your logs, if you have awstats try to find the most common accessed files.
     
    ccb056, Feb 29, 2008 IP
  5. fbnewtz

    fbnewtz Peon

    Messages:
    160
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #5
    Monit might be able to help you out with an alert. It is scriptable and allows you to send email alerts. I don't know what you use to monitor your bandwidth, but if you can make Monit recongnize it, then you can setup an alert when you are going over the limits you specify. I love it. It works great. But I don't have bandwidth problems so I don't monitor my bandwidth.

    Thanks,

    Fred
     
    fbnewtz, Mar 11, 2008 IP
  6. mrki

    mrki Active Member

    Messages:
    206
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    53
    #6
    An usual way is to track your domain log files, if you find an IP or domain you want to block you can use different ways to do it: mod_access, mod_rewritten or iptables.
    I like to use tail (Linux) via ssh to track my log files in real time:
    #tail -f domain.log
    Those command returns always the last 10 records within your log file. Catch the IP and ban it ;)
     
    mrki, Mar 16, 2008 IP
  7. SSANZ

    SSANZ Peon

    Messages:
    861
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    0
    #7
    enable hotlinking protection.

    Ask your host for some assistance, they sound useless to me.
     
    SSANZ, Mar 26, 2008 IP
  8. zebulon

    zebulon Well-Known Member

    Messages:
    198
    Likes Received:
    13
    Best Answers:
    0
    Trophy Points:
    130
    #8
    1) install mod_security
    2) place this rule in your mod_security file - SecFilterSelective “HTTP_REFERER” “(giga|gigaloader.com|gigaloader)”
    This rule will stop those skiddies who like to flood using the above. This solves most cases.
    3) figure out where the bandwidth raping is coming from -
    direct admin: /etc/httpd/logs/domains/domain.log
    cpanel: /usr/local/apache/domlogs/domain.log
    4) For attacks/bandwidth raping coming from other domains (hot linking or etc) simply: SecFilterSelective “HTTP_REFERER” “(newdomains.com|new.com|newdomains)”
    5) You can also you this rule in your .htaccess but I suggest using it server wide :D
    6) For further assistance PM me or contact me @ zsecure.net
     
    zebulon, Mar 28, 2008 IP