I have a question that's been bugging me since the start of my feed maybe someone can help me find an answer for it. I have been getting a rash of idiots doing some very shifty things on my feed, but the one that is more annoying then anything else are what I classify as index page reloaders.
This type of activity can last anywhere from an short as an hour and as long as a whole day. Most of them I catch early enough before they clutter up my DNAS logs with a bunch of unnecessary crap and they end up getting their IP subnet firewalled from being able to connect to my server. I have logged this type of behavior coming from all over the world including from some IP's here in the States but a the main offenders are coming from Europe.
There is also a pattern to their behavior I have noticed in which they reload or reconnect to the index page just over every 3 minutes. I suspect that they are using some type of script and maybe a proxy of some type to randomize where they are coming from but for the purpose of this behavior is unknown to me. I am wondering if anyone else here is getting this type of activity on their Shoutcast server?
Here is a short snippit of my DNAS log from this afternoon.
<07/22/07@14:57:24> [http:XXX.XXX.XXX.XXX] REQ:"/index.html" (Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0))
<07/22/07@15:00:39> [http:XXX.XXX.XXX.XXX] REQ:"/index.html" (Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0))
<07/22/07@15:03:49> [http:XXX.XXX.XXX.XXX] REQ:"/index.html" (Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0))
<07/22/07@15:07:05> [http:XXX.XXX.XXX.XXX] REQ:"/index.html" (Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0))
<07/22/07@15:10:13> [http:XXX.XXX.XXX.XXX] REQ:"/index.html" (Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0))
Matt
This type of activity can last anywhere from an short as an hour and as long as a whole day. Most of them I catch early enough before they clutter up my DNAS logs with a bunch of unnecessary crap and they end up getting their IP subnet firewalled from being able to connect to my server. I have logged this type of behavior coming from all over the world including from some IP's here in the States but a the main offenders are coming from Europe.
There is also a pattern to their behavior I have noticed in which they reload or reconnect to the index page just over every 3 minutes. I suspect that they are using some type of script and maybe a proxy of some type to randomize where they are coming from but for the purpose of this behavior is unknown to me. I am wondering if anyone else here is getting this type of activity on their Shoutcast server?
Here is a short snippit of my DNAS log from this afternoon.
<07/22/07@14:57:24> [http:XXX.XXX.XXX.XXX] REQ:"/index.html" (Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0))
<07/22/07@15:00:39> [http:XXX.XXX.XXX.XXX] REQ:"/index.html" (Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0))
<07/22/07@15:03:49> [http:XXX.XXX.XXX.XXX] REQ:"/index.html" (Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0))
<07/22/07@15:07:05> [http:XXX.XXX.XXX.XXX] REQ:"/index.html" (Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0))
<07/22/07@15:10:13> [http:XXX.XXX.XXX.XXX] REQ:"/index.html" (Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0))
Matt
Last edited:
