ILX swamping my blog domain with failed requests

Message Bookmarked
Bookmark Removed

Over the past few days, my long-dormant blog http://troubled-diva.com has been flooded out with failed access requests from ILX, to such an extent that I was about to get slapped with extra bandwidth charges from my service provider. These have been running 24/7. Here are some examples, for just a single second this morning.

ACCESS LOG

192.74.224.249 - - [30/Jan/2013:11:23:30 +0000] "GET /ThreadSelectedControllerServlet?boardid=41&threadid=8700 HTTP/1.0" 404 4910 "Bon Jovi; "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)"

192.74.224.249 - - [30/Jan/2013:11:23:30 +0000] "GET /ThreadSelectedControllerServlet?boardid=41&threadid=66194 HTTP/1.0" 404 4910 "In every "Classic Album" TV/Radio documentary...; "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0"

192.74.224.249 - - [30/Jan/2013:11:23:30 +0000] "GET /ThreadSelectedControllerServlet?boardid=41&threadid=12793 HTTP/1.0" 404 4910 "X; "Mozilla/5.0 (iPad; CPU OS 6_0_1 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A523 Safari/8536.25"

192.74.224.249 - - [30/Jan/2013:11:23:30 +0000] "GET /ILX/ThreadSelectedControllerServlet?boardid=41&threadid=7657 HTTP/1.0" 404 4910 "mars volta?; "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)"

192.74.224.249 - - [30/Jan/2013:11:23:30 +0000] "GET /ILX/ThreadSelectedControllerServlet?boardid=41&threadid=95184 HTTP/1.0" 404 4910 "Philosophy...Is The Talk On A Cereal Box; "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0"

192.74.224.249 - - [30/Jan/2013:11:23:30 +0000] "GET /ILX/ThreadSelectedControllerServlet?boardid=41&threadid=50859 HTTP/1.0" 404 4910 "t/s : disco mastermixers masterclass - walter gibbons vs larry levan vs francois kevorkian vs danny krivit; "Mozilla/5.0 (iPad; CPU OS 6_0_1 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A523 Safari/8536.25"

192.74.224.249 - - [30/Jan/2013:11:23:30 +0000] "GET /ThreadSelectedControllerServlet?boardid=41&threadid=7657 HTTP/1.0" 404 4910 "mars volta?; "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)"

192.74.224.249 - - [30/Jan/2013:11:23:30 +0000] "GET /ThreadSelectedControllerServlet?boardid=41&threadid=95184 HTTP/1.0" 404 4910 "Philosophy...Is The Talk On A Cereal Box; "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0"

ERROR LOG

[Wed Jan 30 11:23:30 2013] [error] [client 192.74.224.249] File does not exist: /usr/local/psa/home/vhosts/troubled-diva.com/httpdocs/ILX, referer: X

[Wed Jan 30 11:23:30 2013] [error] [client 192.74.224.249] File does not exist: /usr/local/psa/home/vhosts/troubled-diva.com/httpdocs/ThreadSelectedControllerServlet, referer: Bon Jovi

[Wed Jan 30 11:23:30 2013] [error] [client 192.74.224.249] File does not exist: /usr/local/psa/home/vhosts/troubled-diva.com/httpdocs/ThreadSelectedControllerServlet, referer: In every "Classic Album" TV/Radio documentary...

[Wed Jan 30 11:23:30 2013] [error] [client 192.74.224.249] File does not exist: /usr/local/psa/home/vhosts/troubled-diva.com/httpdocs/ThreadSelectedControllerServlet, referer: X

[Wed Jan 30 11:23:30 2013] [error] [client 192.74.224.249] File does not exist: /usr/local/psa/home/vhosts/troubled-diva.com/httpdocs/ILX, referer: mars volta?

[Wed Jan 30 11:23:30 2013] [error] [client 192.74.224.249] File does not exist: /usr/local/psa/home/vhosts/troubled-diva.com/httpdocs/ILX, referer: Philosophy...Is The Talk On A Cereal Box

[Wed Jan 30 11:23:30 2013] [error] [client 192.74.224.249] File does not exist: /usr/local/psa/home/vhosts/troubled-diva.com/httpdocs/ILX, referer: t/s : disco mastermixers masterclass - walter gibbons vs larry levan vs francois kevorkian vs danny krivit

I've solved my problem by removing my website address from my ILX user profile - it was the same address - and hey presto, no more requests.

Strongly suspect that it might be racking up bandwidth charges for other ILXors - could someone investigate?

mike t-diva, Wednesday, 30 January 2013 16:15 (twelve years ago)

Ack, the bbcode has converted some of the URLs to thread titles - but hopefully you get the general picture.

mike t-diva, Wednesday, 30 January 2013 16:16 (twelve years ago)

NB if you hover over the links, you'll see references to my blog domain.

mike t-diva, Wednesday, 30 January 2013 16:17 (twelve years ago)

Bump. Is this a known issue? Should others be advised to remove their domains from their profiles, in order to avoid bandwidth excess charges? I was getting multiple ILX referrals every second, more or less 24/7, until I removed mine.

mike t-diva, Saturday, 2 February 2013 23:36 (twelve years ago)

Eugh, sorry I missed this. These is all coming from the same IP - 192.74.224.249 - and that's a known comment spammer. http://www.projecthoneypot.org/ip_192.74.224.249 which is obviously scraping us hard.

I will block them from ILX, which should stop them following links to user sites. Additionally, I see we don't have "nofollow" on those links, which is a bad oversight. Will fix that too.

stet, Monday, 4 February 2013 23:22 (twelve years ago)

Great, thanks for investigating!

mike t-diva, Monday, 4 February 2013 23:27 (twelve years ago)

three months pass...

It's happening again, totally swamping my access log and incurring excess charges. The IP is 212.59.16.145 - could you block them please?

mike t-diva, Thursday, 16 May 2013 11:26 (twelve years ago)

blechh; will take a look tonight

stet, Thursday, 16 May 2013 14:38 (twelve years ago)

OK, done

stet, Thursday, 16 May 2013 19:55 (twelve years ago)

Fantastic, thank you very much.

mike t-diva, Friday, 17 May 2013 07:13 (twelve years ago)


You must be logged in to post. Please either login here, or if you are not registered, you may register here.