Who Is This Visitor?

unusual activity

[cyberdyne]

Does anyone host at [snip] or have any information on them please?

Would anyone know why they visit my site, sometimes as often as 4 times a day but do not actually pull any documents, pages or images?

I've emailed their support and abuse contacts but have had no reply in two weeks.

Many thanks

[edited by: phranque at 3:21 am (utc) on Dec. 11, 2009]
[edit reason] hosting specifics [/edit]

[phranque]

i'm not sure i understand your question.
why do you think the hosting company is visiting your site?
it is more likely that one of their customers is the visitor.
how did you identify the visitor?
how do you define a site visit?
the only "site visit" i can think of is a HTTP request for a document or a document head.
what was requested?
the robots.txt file?
the default index document for the root directory?

[cyberdyne]

I understand. My apologies.

Here's a snippet of my logs with the IP's edited, which might explain my question a little better. No other file hits are omitted,the visits below are the only hits received.

Many thanks for your reply.

---.45.109.18 - - [08/Nov/2009:23:59:28 +0000] "GET / HTTP/1.1" 200 16632 "-" "MSIE 7.0"
---.45.109.18 - - [08/Nov/2009:23:59:28 +0000] "GET / HTTP/1.1" 200 16632 "-" "MSIE 7.0"
---.45.109.18 - - [11/Nov/2009:01:39:38 +0000] "GET / HTTP/1.1" 403 290 "-" "MSIE 7.0"
---.45.109.18 - - [11/Nov/2009:01:39:38 +0000] "GET / HTTP/1.1" 403 290 "-" "MSIE 7.0"
---.45.109.18 - - [11/Nov/2009:04:59:01 +0000] "GET / HTTP/1.1" 403 288 "-" "-"
---.45.109.18 - - [11/Nov/2009:04:59:01 +0000] "GET / HTTP/1.1" 403 288 "-" "-"
---.45.109.18 - - [27/Nov/2009:21:33:22 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [27/Nov/2009:21:33:24 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [27/Nov/2009:22:40:40 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [27/Nov/2009:22:40:44 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [28/Nov/2009:09:34:48 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [28/Nov/2009:09:34:50 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [28/Nov/2009:12:24:01 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [28/Nov/2009:12:24:02 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.114.178 - - [28/Nov/2009:13:50:56 +0000] "GET / HTTP/1.1" 403 1241 "-" "-"
---.45.114.178 - - [28/Nov/2009:13:50:57 +0000] "GET / HTTP/1.1" 403 1241 "-" "-"
---.45.114.178 - - [29/Nov/2009:00:00:45 +0000] "GET / HTTP/1.1" 403 1241 "-" "-"
---.45.114.178 - - [29/Nov/2009:00:00:49 +0000] "GET / HTTP/1.1" 403 1241 "-" "-"
---.45.114.178 - - [29/Nov/2009:01:54:21 +0000] "GET / HTTP/1.1" 403 1241 "-" "-"
---.45.114.178 - - [29/Nov/2009:01:54:23 +0000] "GET / HTTP/1.1" 403 1241 "-" "-"
---.45.109.18 - - [29/Nov/2009:03:52:56 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [29/Nov/2009:03:53:01 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [29/Nov/2009:03:52:56 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [29/Nov/2009:03:53:01 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [29/Nov/2009:04:24:45 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [29/Nov/2009:04:24:47 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [30/Nov/2009:15:19:45 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [30/Nov/2009:15:19:46 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [30/Nov/2009:15:19:45 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [30/Nov/2009:15:19:46 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [30/Nov/2009:15:39:14 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [30/Nov/2009:15:39:17 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.114.178 - - [30/Nov/2009:16:49:48 +0000] "GET / HTTP/1.1" 403 1241 "-" "-"
---.45.114.178 - - [30/Nov/2009:16:49:51 +0000] "GET / HTTP/1.1" 403 1241 "-" "-"
---.45.114.178 - - [30/Nov/2009:17:04:03 +0000] "GET / HTTP/1.1" 403 1241 "-" "-"
---.45.114.178 - - [30/Nov/2009:17:04:05 +0000] "GET / HTTP/1.1" 403 1241 "-" "-"
---.45.109.18 - - [09/Dec/2009:21:16:00 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [09/Dec/2009:21:16:01 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [10/Dec/2009:13:46:52 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"
---.45.109.18 - - [10/Dec/2009:13:46:58 +0000] "GET / HTTP/1.1" 403 1240 "-" "-"

[cyberdyne]

I should mention that both IP's above belong to the same web hosting company. Also, the 403's are a result of my 'Deny from' blocking them via .htaccess after receiving hits such as the above for quite some time.

Thanks.

[bill]

Could it be someone on one of their shared hosting accounts scanning for locally vulnerable accounts?

[cyberdyne]

Well this was my initial worry, hence the email to their abuse team, but I've had no reply at all and the hits continue.

[cyberdyne]

The question is, what can I do about it if the host won't respond?

[phranque]

but do not actually pull any documents, pages or images

just to clarify this statement, the "GET /" is a HTTP request to "GET the default directory index document for the root directory" aka the "home page".

[jdMorgan]

> The question is, what can I do about it if the host won't respond?
> the 403's are a result of my 'Deny from' blocking them via .htaccess

Sounds like you've already done what you can do.

If you are only getting one scraper from one hosting company, then you're quite lucky.

For the ones that hit you really hard, ask your host to block them at the firewall. If that's not an option, consider making your 403 error document very much shorter, or serving a different 403 error document to 'servers' than you do to browsers (e.g. use mod_rewrite based on the user-agent).

Jim

[jomaxx]

Phranque is right, it's just some user or site that is retrieving your homepage every once in a while. You actually mailed the ISP's abuse team over a few page loads every day? Chill out.

Maybe it's a site that links to you that is verifying that the page is still valid. Maybe it's an enthusiastic individual who has "subscribed" to the page and gets an notification whenever it changes. There are scads of other innocent possibilities. All you can do is develop a thick skin and try not to micromanage how every single person interacts with your site.

[cyberdyne]

Bill, phranque, jdMorgan,thank you for your responses.

[anallawalla]

There could be many possibilities. Another customer runs a web proxy server there and visits your site. Does your site have something of interest to a visitor? I hope so, as the visitor could even be an employee of the host company who likes your site. Or it could be part of a check they are making if your site is consuming too many resources in a shared environment.

[cyberdyne]

anallamalla, the user only ever pulls the root ( / ), no images, no html. The visits are approx 8 per day now.

[Frank_Rizzo]

Could it be a website "Up" monitoring service?