Welcome to WebmasterWorld Guest from 54.167.23.178

Forum Moderators: DixonJones & mademetop

Message Too Old, No Replies

What are they after?

Hitting the same page every single hour...

     
9:38 pm on Feb 3, 2005 (gmt 0)

New User

10+ Year Member

joined:Jan 28, 2004
posts:10
votes: 0


On a commerce site we run, I've noticed 2 new entries in our log files. Both IP's are hitting a single page (one hits index, the other hits our usage policy), over and over, for the past 3 weeks. One (with a Russian address) hits every hour, at the same time. 8:02, 9:02, 10:02, etc. The other hits every 1-2 hours at different times. No referrer information, never any hits to another page.

I've checked on several search engines for specific strings of text that we use, but haven't seen them listed anywhere suspicious.

Any idea what these guys are trying to attempt?

7:12 pm on Feb 5, 2005 (gmt 0)

Administrator from US 

WebmasterWorld Administrator incredibill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Jan 25, 2005
posts:14650
votes: 94


Based on the timing, it almost appears someone is monitoring your site for uptime.
7:54 pm on Feb 5, 2005 (gmt 0)

Preferred Member

10+ Year Member

joined:Apr 25, 2002
posts:470
votes: 0


Just an idea but... our merchant service provider requires that we have our privacy policy and terms of service registered with them at all times (they have base requirements for all their merchants).

Perhaps someone with whom you have a similar relationship (or someone who could benefit somehow by your downtime) is checking to see if either of these documents go down or move.

7:56 pm on Feb 5, 2005 (gmt 0)

Moderator from US 

WebmasterWorld Administrator keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 26, 2001
posts:6660
votes: 128


Most likely, the person has thier bot scheduled and forgot about it.
3:35 am on Feb 6, 2005 (gmt 0)

Administrator from US 

WebmasterWorld Administrator incredibill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Jan 25, 2005
posts:14650
votes: 94


just block the IP and see what happens :)
10:41 am on Feb 6, 2005 (gmt 0)

Junior Member

10+ Year Member

joined:Jan 7, 2005
posts:94
votes: 0


A russian address? Like srv003.*******.ru?
2:48 pm on Feb 7, 2005 (gmt 0)

New User

10+ Year Member

joined:Jan 28, 2004
posts:10
votes: 0


No... a whois of the site came up with a russian address. The IP didn't have a reverse DNS entry.

I spoke with our ISP and had them block the IP addresses... now I'll see if anyone yells :)

Thanks for the thoughts and ideas!