There was a case a while back where some idiot students used a massive research botnet to (inadvertently, we presume) DDoS some poor soul's Australian Expat community web site. Perhaps they are at it again.
On Feb 11, 2013, at 6:53 PM, timh <zutes...@gmail.com> wrote: > I had thought of doing something like that ;-) > One suggestion I saw on this traffic source, was some sort of large > distributed monitoring system, but there where no details. > > On Tuesday, February 12, 2013 2:48:16 AM UTC+8, Jeff Schnitzer wrote: > Replace the image with goatse and watch twitter to see what happens. > > Jeff > > On Mon, Feb 11, 2013 at 3:48 AM, timh <zute...@gmail.com> wrote: > > Hi > > > > I have noticed over the last few months, that a particular image is being > > request from on of my applications > > from sites all over the world - they only request the image no other > > page/resource, they fetch it twice with in a second or so, > > there is no referrer in the header and the use agent is just "Mozilla/4.0" > > > > I have done some googling into this and some people suggest the it is some > > proxy pre-caching stuff for mobile networks but > > I don't believe this. We have virtually no international traffic to the > > site (it's focused on Australia, and more specifically Western Australia). > > > > I have recently removed the image so they get a 404, but still it > > continues. > > > > Here is some examples from the log > > > > 2013-02-11 16:30:352013-02-11 16:30:35.817 > > /fish/goldfish/%2Bimg/goldfish.jpg 404 37ms 1kb Mozilla/4.0 > > 121.185.196.30 - - [11/Feb/2013:00:30:35 -0800] "GET > > /fish/goldfish/%2Bimg/goldfish.jpg HTTP/1.1" 404 1012 - "Mozilla/4.0" > > "www.fishandlily.com.au" ms=37 cpu_ms=21 cpm_usd=0.000113 > > 2013-02-11 16:28:53.443 /fish/goldfish/%2Bimg/goldfish.jpg 404 35ms 1kb > > Mozilla/4.0 > > 118.103.255.171 - - [11/Feb/2013:00:28:53 -0800] "GET > > /fish/goldfish/%2Bimg/goldfish.jpg HTTP/1.1" 404 1012 - "Mozilla/4.0" > > "www.fishandlily.com.au" ms=36 cpu_ms=21 cpm_usd=0.000113 > > 2013-02-11 16:28:52.517 /fish/goldfish/%2Bimg/goldfish.jpg 404 127ms 1kb > > Mozilla/4.0 > > 118.103.255.171 - - [11/Feb/2013:00:28:52 -0800] "GET > > /fish/goldfish/%2Bimg/goldfish.jpg HTTP/1.1" 404 1012 - "Mozilla/4.0" > > "www.fishandlily.com.au" ms=127 cpu_ms=21 cpm_usd=0.000113 > > 2013-02-11 16:12:06.874 /fish/goldfish/%2Bimg/goldfish.jpg 404 36ms 1kb > > Mozilla/4.0 > > 115.243.195.218 - - [11/Feb/2013:00:12:06 -0800] "GET > > /fish/goldfish/%2Bimg/goldfish.jpg HTTP/1.1" 404 1012 - "Mozilla/4.0" > > "www.fishandlily.com.au" ms=37 cpu_ms=21 cpm_usd=0.000113 > > 2013-02-11 16:12:05.716 /fish/goldfish/%2Bimg/goldfish.jpg 404 35ms 1kb > > Mozilla/4.0 > > 115.243.195.218 - - [11/Feb/2013:00:12:05 -0800] "GET > > /fish/goldfish/%2Bimg/goldfish.jpg HTTP/1.1" 404 1012 - "Mozilla/4.0" > > "www.fishandlily.com.au" ms=36 cpu_ms=21 cpm_usd=0.000113 > > 2013-02-11 16:08:57.933 /fish/goldfish/%2Bimg/goldfish.jpg 404 73ms 1kb > > Mozilla/4.0 > > 85.26.184.244 - - [11/Feb/2013:00:08:57 -0800] "GET > > /fish/goldfish/%2Bimg/goldfish.jpg HTTP/1.1" 404 1012 - "Mozilla/4.0" > > "www.fishandlily.com.au" ms=74 cpu_ms=21 cpm_usd=0.000113 > > 2013-02-11 16:08:52.810 /fish/goldfish/%2Bimg/goldfish.jpg 404 67ms 1kb > > Mozilla/4.0 > > 85.26.184.244 - - [11/Feb/2013:00:08:52 -0800] "GET > > /fish/goldfish/%2Bimg/goldfish.jpg HTTP/1.1" 404 1012 - "Mozilla/4.0" > > "www.fishandlily.com.au" ms=68 cpu_ms=21 cpm_usd=0.000113 > > 2013-02-11 16:03:55.355 /fish/goldfish/%2Bimg/goldfish.jpg 404 70ms 1kb > > Mozilla/4.0 > > 2.50.163.232 - - [11/Feb/2013:00:03:55 -0800] "GET > > /fish/goldfish/%2Bimg/goldfish.jpg HTTP/1.1" 404 1012 - "Mozilla/4.0" > > "www.fishandlily.com.au" ms=71 cpu_ms=21 cpm_usd=0.000113 > > 2013-02-11 16:03:54.907 /fish/goldfish/%2Bimg/goldfish.jpg 404 174ms 1kb > > Mozilla/4.0 > > 2.50.163.232 - - [11/Feb/2013:00:03:54 -0800] "GET > > /fish/goldfish/%2Bimg/goldfish.jpg HTTP/1.1" 404 1012 - "Mozilla/4.0" > > "www.fishandlily.com.au" ms=175 cpu_ms=42 cpm_usd=0.000113 > > > > The total number of IP's is too large to for DOS blacklist. > > > > Any one got any ideas what is going on. > > > > Cheers > > > > Tim > > > > -- > > You received this message because you are subscribed to the Google Groups > > "Google App Engine" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to google-appengi...@googlegroups.com. > > To post to this group, send email to google-a...@googlegroups.com. > > Visit this group at http://groups.google.com/group/google-appengine?hl=en. > > For more options, visit https://groups.google.com/groups/opt_out. > > > > > > -- > You received this message because you are subscribed to the Google Groups > "Google App Engine" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to google-appengine+unsubscr...@googlegroups.com. > To post to this group, send email to google-appengine@googlegroups.com. > Visit this group at http://groups.google.com/group/google-appengine?hl=en. > For more options, visit https://groups.google.com/groups/opt_out. > > -- You received this message because you are subscribed to the Google Groups "Google App Engine" group. To unsubscribe from this group and stop receiving emails from it, send an email to google-appengine+unsubscr...@googlegroups.com. To post to this group, send email to google-appengine@googlegroups.com. Visit this group at http://groups.google.com/group/google-appengine?hl=en. For more options, visit https://groups.google.com/groups/opt_out.
