How many hits?!

Ok, I've just been checking my site logs and something's seriously screwey because yesterday, instead of the normal 1,000 to 1,500 or so visits, I had over twenty five *thousand* hits on the site!!

According to the logs, most seemed to come from 80.161.96.79 and Sam Spade gives that as 0x50a1604f.kd4nxx12.adsl-dhcp.tele.dk which means nothing to me.

I don't know what happened, things have now dropped back down normal, so I don't know if someone was trying to DOS attack my site or what, but it's a little disconcerting!

Anyone got any ideas?

[MadGamer]

Originally Posted by Graham

Ok, I've just been checking my site logs and something's seriously screwey because yesterday, instead of the normal 1,000 to 1,500 or so visits, I had over twenty five *thousand* hits on the site!!

According to the logs, most seemed to come from 80.161.96.79 and Sam Spade gives that as 0x50a1604f.kd4nxx12.adsl-dhcp.tele.dk which means nothing to me.

I don't know what happened, things have now dropped back down normal, so I don't know if someone was trying to DOS attack my site or what, but it's a little disconcerting!

Anyone got any ideas?

Do you have security on your site, i.e:

Firewall
AV

[punky]

Originally Posted by Graham

Ok, I've just been checking my site logs and something's seriously screwey because yesterday, instead of the normal 1,000 to 1,500 or so visits, I had over twenty five *thousand* hits on the site!!

According to the logs, most seemed to come from 80.161.96.79 and Sam Spade gives that as 0x50a1604f.kd4nxx12.adsl-dhcp.tele.dk which means nothing to me.

I don't know what happened, things have now dropped back down normal, so I don't know if someone was trying to DOS attack my site or what, but it's a little disconcerting!

Anyone got any ideas?

Is it the same page getting hit, or different ones? If they are different pages, is every page different or does a small set get repeatly hit?

It could be someone trying to cache your site, either for his own gratification reasons, or just to be a theiving toerag and mirror your shop for himself. The latter is fairly common.

Edit: If it is either of those 2 senarios, I don't think there is a lot you can do. You can't ban programs like wget, BlackWidow and GetRight - they miimck regular browsers. Some control panels can limit bandwidth to every host, might be a solution. But as you said, he has got what he wanted and stopped.

Originally Posted by Wayne A

Do you have security on your site, i.e:

Firewall
AV

The site is hosted by names.co.uk and they have all the appropriate protections.

I've dropped them a line mentioning this just in case there's a problem or someone's trying to DOS the host, but as it's over Easter I'll probably have to wait a bit for the reply.
__________________

Originally Posted by punky

Is it the same page getting hit, or different ones? If they are different pages, is every page different or does a small set get repeatly hit?

As far as I can tell it's only hitting the main page, or, at least, not the top level of the site http://www.affordable-leather.co.uk/ but the first "entry" page ie: http://www.affordable-leather.co.uk/...bin/cp-app.cgi

Judging from the logs, it is only that page that's getting hit, none of the subsidiary pages are being accessed.

ADDENDA:

1) I've just had a look at the "exit pages" stats and there's a big spike of exits on that page too, so it isn't delving deeper into the site.

2) The stats for yesterday (26th) appear to have dropped back to the normal levels that I expect to see, so whatever happened it seems to have stopped.

Basically it's an ADSL user in Denmark. Unlikely to be a DOS attack, unless he is terminally stupid.
__________________

Probably some automated site scanning script that tripped up on your page for some reason, until he noticed and stopped it.

Originally Posted by Paul M

Basically it's an ADSL user in Denmark. Unlikely to be a DOS attack, unless he is terminally stupid.

Probably not. It seems an odd thing to do!
__________________

Probably some automated site scanning script that tripped up on your page for some reason, until he noticed and stopped it.

It may be, I don't know.

[Richard M]

Originally Posted by Paul M

Probably some automated site scanning script that tripped up on your page for some reason, until he noticed and stopped it.

Most likely, unless you follow W3C standards then you can expect this...