Spamhuntress wrote:
> I got a visit from 65.190.197.211 and its friends:
> 84.9.48.202
> 84.9.49.254
>
> Found this post through searching, because of the oddities.
>
> Note the fake referrer. "" is not normally used. Note the revolving
> user agent. Note that these IP numbers don't load images etc. In other
> words, it's a bot.
>
> I found a document in Google's cache with a lot of inetd errors, where
> the connection was closed before the server could respond.
>
> On my site, there were usually two requests back to back for the same
> file. And the 301 came first in the log, because it was completed
> first. They're logged as happening the same second.
>
> The second requests (the ones coming back with 301) were for lower case
> URL's, even though the first request was the correct one with a mix of
> lower and upper case (wiki, so that makes sense). On URL's with no
> upper case characters, only one reqest.
>
> The IP number 65.190.197.211 is on Road Runner from Raleigh, North
> Carolina. The less used 84.9.48.202 comes back as
> host-84-9-48-202.bulldogdsl.com, which is (according to RIPE) a dynamic
> IP pool from a UK DSL provider! Same with 84.9.49.254.
Your answer has been most useful. Road Runner was one of the culprit that I
had identified several times in the past. Also, the behaviour that you
describe is the one which seems to affect me.
As you can imagine, my worry was that genuine users failed to reach pages
that they were interested and got 404's instead. Moreover, the 404's that
maculate (add noise to) my error reports make it harder for me to spot the
unusual error, which usually raise mistakes that I made.
I guess I can now completely ignore these regular 404's. I will not have
this never-ending feeling of disappointment whenever I spot one...
Many Thanks,
Roy
--
Roy S. Schestowitz
http://Schestowitz.com
|
|
