Ev1 servers scraping juggernaut
Well, I’d hate to sound too much like IncrediBill - but today I received nearly 9,000 emails to my Inbox - all vbulletin MySQL failure error messages.
Turns out someone at Ev1servers was hitting my comparative religion forum really hard and frequently maxing out the MySQL connections.
Took the site down for an hour in the morning, and repeatedly hit it through the day before I realised that it wasn’t my host being crap, but a nasty bot attack.
Anyway, it was all coming from a single IP - 67.15.218.17 - so I simply revisited a post I made previously on the Platinax Blog on How to Deal With Spam IPs.
A little addition to .htaccess:
order allow,deny
deny from 67.15.218.
allow from all
Rather than just block the single offender, I figured on playing safe and blocking the entire subnet.
I also decided to give myself a break and delete my email address from the vbulletin config file for database errors. :)
Possibly not the most intelligent move, but my Inbox is feeling very worn out today…
Previous: « Adsense Smart Pricing test
Next: Google patent threat to Presell Pages? »
Visited 509 times, 2 so far today since July 24th 2007
Since when is sounding like IncrediBILL such a bad thing?
My posts have mellowed over time…
The IP 67.15.218.17 isn’t assigned to any domain but it’s certainly pinging and active from some server.
I would suggest you spend a minute and cull their actions from your log file and send it to abuse@ev1servers.net because blocking them only stops them from hurting YOU, but getting them shutting them down helps everyone.
BTW, if you haven’t noticed, I’ve been battling a botnet attacking one of my servers daily from about 170+ IPs and I’m reporting to almost every host and getting them shut down en masse.
It’s the only way we can stop the nonsense.
FYI, I found out some hosting companies will even shut down scrapers as crawling other servers without legitimate cause is against their AUP! ;)
Oh yeah. Happy New Year Brian!
Comment by IncrediBILL — January 2, 2007 @ 6:33 am
And it’s only January the First!
Don’t these bad people ever take days off?
Happy New Year Brian!
Comment by Bulbboy — January 2, 2007 @ 6:35 am
“Since when is sounding like IncrediBILL such a bad thing?”
I forgot the smiley face after that sentence, that’s all. :)
Also contacted ev1, so will see if we can get this addressed properly.
And best of luck with dealing with the botnet, Bill - seems they’re getting more and more aggressive these days.
Happy New Year as well, Bill and Bulbboy. :)
Comment by Brian Turner — January 2, 2007 @ 9:28 am
Thanks Brian, I had some good luck today and a break in the case actually. Turns out they’re using a worm to locate and infest new sites and using Google to find those new sites.
Needless to say, I’ve alerted my contacts at Google that something needs to be done to restrict these types of site searches and/or notify the hosts where these kinds of searches originate so this nonsense can be shut down.
Comment by IncrediBILL — January 3, 2007 @ 12:46 am