Forum Moderators: phranque

Message Too Old, No Replies

What is this? One IP, Many, Many 404's

Coming from Google Reader

         

mayest

10:34 pm on Jul 9, 2008 (gmt 0)

10+ Year Member



I'm looking at a referrer log in my CMS (can't access real server logs as I'm on shared hosting). I have been seeing one particular IP address that is repeatedly sent to my 404 page. The referrer is always Google Reader. I've clicked my posts in Reader and I have no problem accessing the posts, so I don't think this is an error on Reader's part.

The strange thing is that this particular IP address has been doing this for awhile. I thought it was odd, so I banned the IP in .htaccess for about a week. Then, as a test, I removed the ban yesterday. Today I checked the log again and the same IP is back again generating more 404's.

I wouldn't have noticed this in the first place, but there seems to be a pattern. He hits the 404 page several times in close succession very early in the morning, and then about every 30-35 minutes or so throughout the day.

The IP (last part masked off) is 76.31.48.xx. I looked up that IP on Project Honey Pot and there was no exact match, but it seems that there are some known baddies nearby. The user-agent is

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0

Which is identical to mine, except that I'm using Firefox 3 on Vista.

So, is this some bot that is spoofing a user-agent and referrer? I can't imagine that a real human user would hit the site this often and not bother to contact me asking why they can't get anything other than a 404 page.

g1smd

10:08 am on Jul 12, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



It's a ComCast IP. Beyond that, I have no ideas for you.

I haven't had that issue here.

mayest

6:03 pm on Jul 12, 2008 (gmt 0)

10+ Year Member



Thanks. It's an odd situation, so I'll just leave that IP banned.

g1smd

5:17 pm on Jul 13, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I see that one whois service! says the IP range is currently blacklisted.

I don't remember seeing that message when I looked a few days ago.

mayest

5:55 pm on Jul 13, 2008 (gmt 0)

10+ Year Member



Well, it gets curiouser and curiouser. :-) I'm glad that I blocked it.

If you have a minute, could you possibly sticky me with the name/URL of the service that you used?

Thanks!