What was going on? Looking at my server log.

Discussion in 'Site & Server Administration' started by mdvaldosta, Feb 17, 2006.

0
  1. #1 
    72.29.67.86 - - [17/Feb/2006:10:01:54 -0500] "GET /forums/image-vp13045.html HTTP/1.1" 200 15457 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
72.29.67.84 - - [17/Feb/2006:10:01:59 -0500] "GET /forums/image-vp3721.html HTTP/1.1" 200 28398 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
72.29.67.86 - - [17/Feb/2006:10:02:00 -0500] "GET /forums/image-vp12944.html HTTP/1.1" 200 23524 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
72.29.65.240 - - [17/Feb/2006:10:02:05 -0500] "GET /forums/4-vf7.html?topicdays=0&start=75 HTTP/1.1" 200 30394 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
72.29.67.90 - - [17/Feb/2006:10:02:08 -0500] "GET /forums/image-vp3294.html HTTP/1.1" 200 34395 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
72.29.67.82 - - [17/Feb/2006:10:02:11 -0500] "GET /forums/3-vf7.html?topicdays=0&start=50 HTTP/1.1" 200 30069 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
72.29.65.240 - - [17/Feb/2006:10:02:20 -0500] "GET /forums/5-vf7.html?topicdays=0&start=100 HTTP/1.1" 200 13936 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
72.29.67.82 - - [17/Feb/2006:10:02:20 -0500] "GET /forums/viewtopic.php?t=941&view=next HTTP/1.1" 200 20878 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
72.29.67.90 - - [17/Feb/2006:10:02:21 -0500] "GET /forums/image-vp1346.html HTTP/1.1" 200 17875 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
    Code (markup):
    I noticed a butloat of different IP's coming from the same blocks rummaging through one of my sites. Is that winhttp stuff a scraper?
     
    mdvaldosta, Feb 17, 2006 IP
  2. forkqueue

    forkqueue Guest

    Messages:
    401
    Likes Received:
    21
    Best Answers:
    0
    Trophy Points:
    0
    #2
    It's a library often used by scraper-creators.
     
    forkqueue, Feb 18, 2006 IP
  3. AWD1

    AWD1 Peon

    Messages:
    191
    Likes Received:
    12
    Best Answers:
    0
    Trophy Points:
    0
    #3
    It would certainly appear to be a scraper.

    And, from the good people at Sam Spade (rockin' site for looking domains and IPs up):
    Now here's a shocker. It's a HostDime IP. HostDime, for those who don't know, is a host that's been around for years and is noted for hosting illegal content, hackers, code crackers, slackers, wastin' time with all the chatroom yakkers.

    For more information, this WHT thread might be useful. TheGAME1264 is me, and the other people are...well, I dunno.

    So...you're not too likely to ever get anything resolved by talking to the HostDime/DimeHost/whatever their nom du jour is these days. Just block the /24 or the /16 if you can and hopefully that will solve your scraper issue.
     
    AWD1, Feb 18, 2006 IP