Friday, December 07, 2007

Traffic Patterns - How Hackers Work

Here's how hackers are working their bots or whatever right now to generate traffic by hiting a site about 5-6 times in a row in groups from different IPs. These groups of IPs are related in more ways than one.

We have a site that gets very low traffic and pretty much has nothing linking to it and nobody looking at it. And yet somehow this site gets blocks of hits in a row out of nowhere - 5 or 6 at a time - then stops for another hour.

Here's an example:

12/7/2007 4:08:58 PM 218.234.21.33
12/7/2007 4:09:04 PM 68.189.175.164
12/7/2007 4:09:25 PM 24.0.54.125
12/7/2007 4:09:33 PM 207.172.248.72
12/7/2007 4:09:36 PM 70.236.22.31
12/7/2007 4:09:43 PM 70.236.22.31

Here's an exmaple of traffic from the Ukraine which is probably hackers hitting that same site:

80.91.186.250

inetnum: 80.91.186.0 - 80.91.186.255
netname: INTERCONNECTIONS-DATAGROUP
descr: Subnets /30 for interconnections to DATAGROUP's clients
country: UA

I'm guessing all these IPs are related bots and hackers that hit this site in Decemeber:

1 172.129.227.254 12
1 193.47.80.38 12
2 200.107.59.51 12
1 200.226.134.53 12
1 200.226.134.53 12
1 200.226.134.53 12
2 200.226.134.53 12
1 200.88.114.166 12
2 202.115.130.23 12
1 202.115.130.23 12
1 203.88.192.104 12
1 207.172.248.72 12
1 218.234.21.33 12
1 218.246.118.22 12
2 218.249.83.87 12
1 221.100.70.25 12
1 222.221.6.144 12
1 24.0.54.125 12
2 24.164.91.236 12
1 58.65.235.194 12
1 58.65.235.194 12
1 58.65.235.194 12
1 61.247.217.35 12
4 61.61.132.129 12
2 62.85.45.65 12
2 62.85.45.65 12
4 62.85.45.72 12
1 64.22.93.154 12
3 64.22.93.154 12
1 64.246.161.30 12
3 64.86.69.5 12
3 65.32.175.224 12
1 66.56.149.238 12
1 67.100.29.213 12
2 68.166.98.6 12
1 68.189.175.164 12
2 70.236.22.31 12
1 72.232.25.226 12
3 72.36.134.242 12
3 72.36.134.242 12
1 75.125.47.162 12
1 76.168.39.111 12
3 77.50.7.167 12
2 80.91.186.250 12
3 80.91.186.250 12
3 80.91.186.250 12
3 83.31.185.72 12
3 85.114.133.77 12
1 85.194.127.10 12
1 85.21.125.100 12
1 85.228.96.63 12
1 86.123.67.229 12
1 87.111.102.25 12
3 87.118.106.4 12
2 87.118.116.8 12
2 87.240.5.90 12
1 88.131.106.2 12
1 97.76.5.224 12

Here's the same type of traffic from November:

2 122.214.249.116 11
2 122.252.226.40 11
1 122.252.226.40 11
1 125.177.43.78 11
1 125.7.195.10 11
4 131.107.151.157 11
2 148.167.202.141 11
1 148.235.92.34 11
1 189.32.175.26 11
1 192.18.100.7 11
2 193.111.120.47 11
1 194.109.141.137 11
1 194.72.238.61 11
2 194.83.70.20 11
1 194.83.70.20 11
1 195.229.242.57 11
1 195.244.128.215 11
2 195.244.128.215 11
1 195.244.128.215 11
2 195.244.128.215 11
2 195.244.128.215 11
3 195.244.128.216 11
1 195.248.93.105 11
1 195.251.249.101 11
1 195.67.48.130 11
1 195.76.242.227 11
1 200.226.134.53 11
1 200.226.134.53 11
1 200.226.134.53 11
2 200.226.134.53 11
1 200.88.114.166 11
2 200.88.114.166 11
1 200.88.114.166 11
1 200.88.114.166 11
1 200.88.114.166 11
1 201.43.185.180 11
1 201.45.221.40 11
1 201.70.159.236 11
1 202.105.182.87 11
2 202.115.130.23 11
3 202.44.135.35 11
2 202.44.8.100 11
1 202.72.240.22 11
1 203.111.13.69 11
1 203.111.13.69 11
3 203.121.71.169 11
2 203.121.71.169 11
2 203.121.79.95 11
3 203.121.79.95 11
1 203.234.156.57 11
1 203.234.156.57 11
1 203.234.156.57 11
4 203.234.156.57 11
2 203.88.192.104 11
2 203.88.192.104 11
1 206.51.237.152 11
1 207.192.203.218 11
3 208.72.168.160 11
1 209.124.116.65 11
1 210.22.158.132 11
1 210.34.14.186 11
5 210.34.22.226 11
1 210.34.4.18 11
1 210.51.51.24 11
1 210.75.12.100 11
1 210.82.89.246 11
1 211.100.34.11 11
3 211.117.62.81 11
1 211.117.62.81 11
2 211.196.166.94 11
3 211.196.166.94 11
1 212.124.234.37 11
1 213.180.137.72 11
1 216.145.17.190 11
1 216.145.5.42 11
1 216.23.162.164 11
1 216.40.220.18 11
3 217.126.65.126 11
1 218.210.231.93 11
1 218.56.8.72 11
3 219.87.178.116 11
1 220.1.121.46 11
1 221.225.1.241 11
2 222.63.132.15 11
1 24.131.212.124 11
4 24.148.20.137 11
1 24.7.24.112 11
1 38.117.88.77 11
1 58.147.0.228 11
1 59.77.16.162 11
1 60.190.79.18 11
1 61.135.219.15 11
1 61.142.81.37 11
1 61.148.97.26 11
4 61.178.18.96 11
1 61.19.221.29 11
2 61.28.1.91 11
3 61.61.132.129 11
1 62.143.133.68 11
1 62.175.191.139 11
3 64.5.62.170 11
1 64.92.199.44 11
1 64.92.199.61 11
2 66.199.253.187 11
3 67.149.190.246 11
1 67.202.6.152 11
1 68.228.168.71 11
1 68.7.17.104 11
1 68.82.44.72 11
4 69.113.227.23 11
1 69.121.170.57 11
1 69.143.249.51 11
1 69.208.130.11 11
1 69.221.169.25 11
1 69.59.28.163 11
2 69.73.94.125 11
1 70.135.109.51 11
2 71.109.156.19 11
1 71.194.213.68 11
1 71.224.150.100 11
1 71.59.220.219 11
2 71.83.130.152 11
3 71.83.130.152 11
1 72.224.254.87 11
1 72.224.254.87 11
3 72.232.7.242 11
3 72.232.7.242 11
1 72.232.7.242 11
2 72.44.50.103 11
1 72.44.57.55 11
1 74.137.217.73 11
1 74.208.11.169 11
2 75.26.182.48 11
3 76.101.38.233 11
1 76.170.241.248 11
1 76.31.23.129 11
3 76.84.107.198 11
2 78.107.255.115 11
1 80.216.144.92 11
1 80.37.201.86 11
3 80.91.186.250 11
3 80.91.186.250 11
3 80.91.186.250 11
3 81.84.141.117 11
3 82.179.236.154 11
1 82.216.116.203 11
1 82.224.98.76 11
1 82.237.74.200 11
2 83.208.212.151 11
3 83.237.199.152 11
3 83.31.211.14 11
2 84.141.19.229 11
2 85.140.24.250 11
3 85.140.249.139 11
3 85.140.251.119 11
1 85.21.125.100 11
1 85.216.173.226 11
2 85.227.185.181 11
1 85.84.197.236 11
1 85.85.59.35 11
1 86.51.3.194 11
1 86.51.3.196 11
3 87.106.135.26 11
5 87.118.106.4 11
2 87.118.108.79 11
2 87.118.110.213 11
2 87.118.110.213 11
2 87.118.112.237 11
3 87.118.116.245 11
3 87.118.118.12 11
2 87.118.96.104 11
1 87.118.96.60 11
3 87.118.98.9 11
3 87.118.98.9 11
2 87.174.45.224 11
1 88.131.106.2 11
1 88.131.153.91 11
1 89.149.236.54 11
1 89.182.95.144 11
1 89.31.204.49 11
3 89.77.80.235 11
3 90.156.169.218 11
3 91.76.57.242 11

And here's October...

1 123.236.96.154 10
4 124.128.248.88 10
5 131.107.151.157 10
2 144.118.29.81 10
1 147.29.152.239 10
1 147.29.152.239 10
2 17.149.0.104 10
1 189.52.78.146 10
1 190.7.62.202 10
1 193.137.239.115 10
5 193.219.28.144 10
5 193.219.28.146 10
2 195.2.114.1 10
2 195.2.114.1 10
3 195.2.114.1 10
3 195.2.114.1 10
2 195.2.114.33 10
1 195.2.114.33 10
1 195.76.242.227 10
1 196.20.65.210 10
1 200.130.24.21 10
1 200.206.242.52 10
2 200.83.4.3 10
1 200.83.4.3 10
1 200.83.4.6 10
2 200.88.114.166 10
2 201.220.124.165 10
1 202.28.27.3 10
1 203.113.137.131 10
2 203.121.71.169 10
2 203.121.71.169 10
2 203.121.71.169 10
2 203.121.79.95 10
1 203.213.211.206 10
1 203.69.39.251 10
1 203.88.192.104 10
1 207.38.5.194 10
1 207.44.238.95 10
1 209.10.61.194 10
1 209.59.180.114 10
1 210.21.12.94 10
1 210.34.22.226 10
1 210.42.140.5 10
2 211.117.62.81 10
1 211.117.62.81 10
1 211.140.138.39 10
1 211.214.198.55 10
1 211.239.150.148 10
2 211.239.150.148 10
1 211.239.150.148 10
1 212.11.191.67 10
1 212.72.30.140 10
1 212.72.30.140 10
1 213.180.137.71 10
1 213.180.137.73 10
1 213.61.157.93 10
1 216.145.14.142 10
3 217.127.161.223 10
1 217.171.176.46 10
3 217.174.98.198 10
1 218.233.166.197 10
2 218.234.21.33 10
1 218.234.21.33 10
3 218.234.21.33 10
2 218.234.21.33 10
1 218.234.21.33 10
1 218.58.136.4 10
1 218.58.136.4 10
1 218.58.136.4 10
1 218.63.252.219 10
1 218.66.103.253 10
1 218.71.136.105 10
1 218.71.136.105 10
1 219.148.197.154 10
1 219.240.36.173 10
1 220.202.69.18 10
1 220.75.215.78 10
4 221.142.222.235 10
1 221.232.159.112 10
1 221.233.134.87 10
1 221.233.134.87 10
1 222.221.6.144 10
1 222.221.6.144 10
2 222.231.63.18 10
1 222.231.63.18 10
1 24.13.0.209 10
1 24.131.61.205 10
4 24.161.224.99 10
3 24.179.161.48 10
1 24.37.128.57 10
1 24.98.188.175 10
1 41.204.194.181 10
2 58.127.102.142 10
1 59.17.63.2 10
3 59.17.63.2 10
1 59.77.17.173 10
3 59.77.21.250 10
1 59.77.21.250 10
1 60.12.17.10 10
2 60.190.228.93 10
2 60.190.79.18 10
1 60.190.79.18 10
1 61.139.37.12 10
1 61.142.81.37 10
3 61.144.78.167 10
1 61.144.78.190 10
1 61.144.78.190 10
1 61.27.78.51 10
3 62.141.52.219 10
2 62.141.58.167 10
3 62.141.58.167 10
1 62.231.243.139 10
1 62.231.243.139 10
1 62.94.22.196 10
1 62.94.22.196 10
1 64.127.57.5 10
1 64.237.57.194 10
2 64.246.161.190 10
1 64.246.165.160 10
1 64.246.187.42 10
2 64.5.62.170 10
1 64.5.62.170 10
2 64.59.139.153 10
2 65.102.234.72 10
1 65.196.51.21 10
1 65.44.66.100 10
3 66.232.100.156 10
1 66.232.125.138 10
1 66.249.2.50 10
1 66.25.72.150 10
2 66.250.64.30 10
1 67.159.44.8 10
6 67.202.12.183 10
1 67.202.4.188 10
1 67.62.84.180 10
1 68.106.204.9 10
1 68.197.36.143 10
1 68.199.229.88 10
1 68.74.112.43 10
1 68.81.222.236 10
3 69.121.127.225 10
1 69.141.53.8 10
2 69.141.53.8 10
1 69.245.195.3 10
1 69.245.195.3 10
1 69.250.241.42 10
1 69.36.158.19 10
1 69.74.165.135 10
1 69.9.167.198 10
2 70.255.107.115 10
1 70.48.115.231 10
3 70.84.55.194 10
1 70.87.230.66 10
2 70.87.7.56 10
1 71.109.113.203 10
1 71.158.214.55 10
1 71.193.86.213 10
1 71.59.220.219 10
1 71.65.60.93 10
1 71.87.113.228 10
1 72.232.61.162 10
2 74.52.245.146 10
1 75.3.9.109 10
3 75.43.208.130 10
3 75.53.1.246 10
1 75.69.76.233 10
3 75.69.76.233 10
1 76.101.38.233 10
1 76.190.177.232 10
1 76.210.34.207 10
1 76.25.195.169 10
2 76.25.195.169 10
1 76.26.251.165 10
3 76.73.131.148 10
1 76.98.227.200 10
3 77.50.7.167 10
3 80.91.186.250 10
3 80.91.186.250 10
3 80.91.186.250 10
3 80.91.186.250 10
3 80.96.191.144 10
3 80.96.191.144 10
3 80.96.191.144 10
3 81.0.232.77 10
1 81.190.75.54 10
3 81.29.251.17 10
1 82.158.197.63 10
1 82.230.82.38 10
1 82.232.80.128 10
1 82.243.246.184 10
1 82.247.201.64 10
1 82.67.175.47 10
3 83.10.100.89 10
1 83.141.161.100 10
2 83.149.95.109 10
3 83.167.116.7 10
3 83.31.183.135 10
2 83.31.254.59 10
1 84.108.215.96 10
2 84.112.144.174 10
2 84.16.227.85 10
3 84.16.235.197 10
3 84.19.188.158 10
2 84.240.45.110 10
2 85.140.181.5 10
1 85.65.22.214 10
1 85.69.127.206 10
5 87.118.106.4 10
5 87.118.106.4 10
2 87.118.110.213 10
2 87.118.112.237 10
2 87.118.112.237 10
2 87.118.112.25 10
3 87.118.112.25 10
3 87.118.112.25 10
2 87.118.112.30 10
2 87.118.112.30 10
3 87.118.116.8 10
3 87.118.116.8 10
3 87.118.98.9 10
3 87.230.30.38 10
1 87.240.14.95 10
3 87.99.76.124 10
1 88.131.153.91 10
1 88.198.25.14 10
2 89.149.202.137 10
2 89.77.80.235 10
3 91.124.141.47 10
3 91.124.163.50 10
3 91.124.163.50 10
3 91.124.163.50 10
3 91.124.163.50 10
3 91.192.104.2 10
1 91.90.183.53 10
1 98.194.76.111 10