2018-08-06 Leeches

That’s weird:

Apache accesses are up

Server load also went up to 3-4. Let’s see what the scripts say:

$ sudo cat /var/log/apache2/access.log | bin/leech-detector | head
           IP Number       hits bandw. hits% interv. status code distrib.
		***	  25840    69K  55%    0.3s  503 (58%), 200 (22%), 206 (15%)…
		***	    904     6K   1%   16.4s  200 (40%), 404 (39%), 301 (20%)
		***	    643     6K   1%   30.4s  200 (96%), 302 (1%), 301 (0%)…
		***	    573    25K   1%   29.4s  200 (100%)
		***	    306     3K   0%   63.5s  301 (35%), 200 (32%), 302 (32%)
		***	    260    10K   0%   74.8s  200 (54%), 404 (19%), 301 (19%)…
		***	    256     2K   0%   76.4s  301 (50%), 200 (48%), 404 (0%)
		***	    238     5K   0%   80.8s  301 (54%), 200 (35%), 404 (9%)…
		***	    229     9K   0%   35.9s  200 (80%), 304 (8%), 302 (7%)…

OK, mystery IP number! What the fuck is wrong with you.

$ sudo cat /var/log/apache2/access.log.1 /var/log/apache2/access.log | grep *** | bin/time-grouping
      06/Aug/2018:08       7601    10%
      06/Aug/2018:07      13509    18%
      06/Aug/2018:06       9070    12%
      06/Aug/2018:05       6954     9%
      06/Aug/2018:04       7983    10%
      06/Aug/2018:03       8441    11%
      06/Aug/2018:02       7894    10%
      06/Aug/2018:01       8951    12%
      06/Aug/2018:00       4135     5%

Who are you?

$ whois *** | grep OrgName
OrgName:        Time Warner Cable Internet LLC

Welcome to my block list, idiots!

$ sudo ipset add blacklist ***

See 2018-07-16 Blocking IP Addresses for more about blocking IP numbers.

Tags:

Comments

Geeez.

Ynas Midgard 2018-08-06 11:11 UTC


One wonders what they were up to. Trying to see whether I’m offering any warez!? Will I be receiving a cease and desist letter, soon?

– Alex Schroeder 2018-08-06 14:45 UTC


Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit the comment page if you need to fix typos. You can subscribe to new comments by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.