Comments on: Check your logs http://www.jimcarson.com/2004/check-your-logs/ Three standard deviations from the mean Sat, 13 Mar 2010 18:12:46 -0800 http://wordpress.org/?v=2.9.2 hourly 1 By: Pauly http://www.jimcarson.com/2004/check-your-logs/comment-page-1/#comment-890 Pauly Tue, 27 Jul 2004 11:47:52 +0000 http://www.jimcarson.com/2004/check-your-logs/#comment-890 Just got an error on trying to post, couldn't open a file somewhere Rebuild failed: Writing to '/home/carson/www/archives/000147.shtml.new' failed: Opening local file '/home/carson/www/archives/000147.shtml.new' failed: Permission denied Just got an error on trying to post, couldn’t open a file somewhere

Rebuild failed: Writing to ‘/home/carson/www/archives/000147.shtml.new’ failed: Opening local file ‘/home/carson/www/archives/000147.shtml.new’ failed: Permission denied

]]> By: Pauly http://www.jimcarson.com/2004/check-your-logs/comment-page-1/#comment-889 Pauly Tue, 27 Jul 2004 11:44:17 +0000 http://www.jimcarson.com/2004/check-your-logs/#comment-889 Just got an error on trying to post, couldn't open a file somewhere Just got an error on trying to post, couldn’t open a file somewhere

]]> By: Pauly http://www.jimcarson.com/2004/check-your-logs/comment-page-1/#comment-888 Pauly Tue, 27 Jul 2004 11:43:25 +0000 http://www.jimcarson.com/2004/check-your-logs/#comment-888 Got lots of the same problems here, hadn't thought about redirecting those requests... I am blocking from some machine because of their constant referer spamming like so: <Limit GET HEAD POST> order allow,deny deny from 66.230.218.66 deny from 66.230.218.67 deny from 211.157.8.47 deny from cache1-pete.server.ntli.net deny from zeus4-a6-colo7-spsc.jupiterhosting.com allow from all </LIMIT> Getting at least one an hour from jupiterhosting zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:09:25:11 +0100] "GET / HTTP/1.1" 403 286 "http://www.vinegarlemonshots.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:09:41:40 +0100] "GET / HTTP/1.1" 403 286 "http://www.yuppieslovestocks.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:09:57:33 +0100] "GET / HTTP/1.1" 403 286 "http://www.flowershopentertainment.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:10:34:00 +0100] "GET / HTTP/1.1" 403 286 "http://www.mykeyboardisbroken.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:10:52:11 +0100] "GET / HTTP/1.1" 403 286 "http://www.masteroftheblasterhill.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:11:09:29 +0100] "GET / HTTP/1.1" 403 286 "http://www.masteroftheblasterhill.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:11:27:32 +0100] "GET / HTTP/1.1" 403 286 "http://www.flowershopentertainment.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:11:43:01 +0100] "GET / HTTP/1.1" 403 286 "http://www.newrealeaseonline.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:11:59:49 +0100] "GET / HTTP/1.1" 403 286 "http://www.business2fun.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:12:15:36 +0100] "GET / HTTP/1.1" 403 286 "http://www.booksandpages.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" zeus4-a6-colo7-spsc.jupiterhosting.com - - [27/Jul/2004:12:32:38 +0100] "GET / HTTP/1.1" 403 286 "http://www.newrealeaseonline.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)" [popex@echo site] $ I found your explanations helpful... Got lots of the same problems here, hadn’t thought about redirecting those requests… I am blocking from some machine because of their constant referer spamming like so:

<Limit GET HEAD POST>
order allow,deny
deny from 66.230.218.66
deny from 66.230.218.67
deny from 211.157.8.47
deny from cache1-pete.server.ntli.net
deny from zeus4-a6-colo7-spsc.jupiterhosting.com
allow from all
</LIMIT>

Getting at least one an hour from jupiterhosting

zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:09:25:11 +0100] “GET / HTTP/1.1″ 403 286 “http://www.vinegarlemonshots.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:09:41:40 +0100] “GET / HTTP/1.1″ 403 286 “http://www.yuppieslovestocks.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:09:57:33 +0100] “GET / HTTP/1.1″ 403 286 “http://www.flowershopentertainment.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:10:34:00 +0100] “GET / HTTP/1.1″ 403 286 “http://www.mykeyboardisbroken.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:10:52:11 +0100] “GET / HTTP/1.1″ 403 286 “http://www.masteroftheblasterhill.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:11:09:29 +0100] “GET / HTTP/1.1″ 403 286 “http://www.masteroftheblasterhill.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:11:27:32 +0100] “GET / HTTP/1.1″ 403 286 “http://www.flowershopentertainment.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:11:43:01 +0100] “GET / HTTP/1.1″ 403 286 “http://www.newrealeaseonline.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:11:59:49 +0100] “GET / HTTP/1.1″ 403 286 “http://www.business2fun.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:12:15:36 +0100] “GET / HTTP/1.1″ 403 286 “http://www.booksandpages.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
zeus4-a6-colo7-spsc.jupiterhosting.com – - [27/Jul/2004:12:32:38 +0100] “GET / HTTP/1.1″ 403 286 “http://www.newrealeaseonline.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .Mozilla)”
[popex@echo site] $

I found your explanations helpful…

]]> By: carson http://www.jimcarson.com/2004/check-your-logs/comment-page-1/#comment-887 carson Wed, 18 Feb 2004 04:05:20 +0000 http://www.jimcarson.com/2004/check-your-logs/#comment-887 Oh, forgot to add that I also see a lot of bogus referrers from "paris-hilton-video.blogspot.com":<blockquote> 196.2.79.247 - - [04/Feb/2004:09:16:44 -0800] "GET / HTTP/1.0" 200 48251 "http://paris-hilton-video.blogspot.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"</blockquote> These come from many different hosts: 193.251.169.169 199.71.136.70 200.13.168.132 200.140.145.18 200.161.203.51 200.189.78.179 200.223.178.154 203.113.34.237 207.108.218.217 209.247.51.197 210.212.250.227 211.184.45.123 213.41.91.103 213.77.82.19 216.167.144.187 216.219.13.37 217.110.209.212 217.56.92.207 219.238.38.252 64.241.177.20 64.31.1.74 66.123.222.42 80.58.34.44 80.58.4.46 I do see a couple of recurrences from these addresses: 196.2.79.247 200.67.93.220 208.17.78.98 211.108.90.8 211.152.58.76 80.146.216.163 Oh, forgot to add that I also see a lot of bogus referrers from “paris-hilton-video.blogspot.com”:
196.2.79.247 – - [04/Feb/2004:09:16:44 -0800] “GET / HTTP/1.0″ 200 48251 “http://paris-hilton-video.blogspot.com/” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)”

These come from many different hosts: 193.251.169.169 199.71.136.70 200.13.168.132 200.140.145.18 200.161.203.51 200.189.78.179 200.223.178.154 203.113.34.237 207.108.218.217 209.247.51.197 210.212.250.227 211.184.45.123 213.41.91.103 213.77.82.19 216.167.144.187 216.219.13.37 217.110.209.212 217.56.92.207 219.238.38.252 64.241.177.20 64.31.1.74 66.123.222.42 80.58.34.44 80.58.4.46

I do see a couple of recurrences from these addresses: 196.2.79.247 200.67.93.220 208.17.78.98 211.108.90.8 211.152.58.76 80.146.216.163

]]> By: tedder http://www.jimcarson.com/2004/check-your-logs/comment-page-1/#comment-886 tedder Fri, 30 Jan 2004 16:42:32 +0000 http://www.jimcarson.com/2004/check-your-logs/#comment-886 Looks familiar. I also see 403 fails, from IP addresses I block. Some bots (especially overture/yahoo's FAST bot) aren't well behaved, they'll try to troll my own site in the shortest amount of time possible. So I block their 66.77.73.97 - - [28/Jan/2004:22:44:05 -0800] "GET /valid/url/here HTTP/1.0" 403 1234 "-" "Yahoo-MMCrawler/ Looks familiar. I also see 403 fails, from IP addresses I block. Some bots (especially overture/yahoo’s FAST bot) aren’t well behaved, they’ll try to troll my own site in the shortest amount of time possible. So I block their

66.77.73.97 – - [28/Jan/2004:22:44:05 -0800] “GET /valid/url/here HTTP/1.0″ 403 1234 “-” “Yahoo-MMCrawler/

]]>