Snorkasaurus

Forum Replies Created

Viewing 2 replies - 1 through 2 (of 2 total)
  • Forum: Fixing WordPress
    In reply to: Lots of "/?s=" in log files
    Thread Starter Snorkasaurus

    (@snorkasaurus)

    12 years, 7 months ago

    Interestingly, last night I started getting hits on /?paged=2 from 113.64.81.138 with a TencentTraveler user-agent… then this morning it has switched to a few different IE agent strings. I have had 35 hits on it from that IP since midnight (about 8.5 hours) and can’t imagine that someone is really that interested in the posts I made from late June to late July but is not interested in hitting any other pages on my site. Also, that I do not have a single hit on /?paged=2 from any other IP address for the last few days. 🙁

    Forum: Fixing WordPress
    In reply to: Lots of "/?s=" in log files
    Thread Starter Snorkasaurus

    (@snorkasaurus)

    12 years, 7 months ago

    Hey Doug,

    Here’s a pastebin of my traffic since noon today.

    http://pastebin.ca/2456446

    I should note that this Apache access.log specifically excludes traffic from my browser and it excludes most common search engines (though you will see that Wayback and mail.ru bots are both there). Of the 283 entries since noon, 197 of them were to /?s= and 63 were to /?p=741, which means that 91.8% of my traffic in the last 6.5 hours has been these URLs. To get an idea of scale, my searchengine log file has only 8 entries in the same time period.

    The reason I don’t think they are legitimate search engine bots is because the IP addresses that are hitting these URLs are hitting no other pages on my site. The /?p=741 URL is a legitimate post of mine though it is only one short paragraph and has two links (one of which is a dead local link, after having been relocated a long time ago).

    Unfortunately I don’t think that BBQ will be effective in treating these requests since both URLs are valid (even if the /?s= request is redundant). I started compiling a list of IP’s which has since turned in to a list of the network segments they are part of, with the intention of perhaps blocking them at my firewall. I didn’t think this was going to be an issue, because they were all coming from IP ranges owned by VPS provider companies like webexxpurts.com and ovh.com – but I found one that is listed as att.net which sounds like it could contain actual customer IP’s.

    I’m mildly concerned about it being a virus that other people might be infected with, but frankly if it is a virus then it appears to be mostly harmless (other than irritating traffic levels).

    Any thoughts?

    Thanks,
    Snork.

Viewing 2 replies - 1 through 2 (of 2 total)