Search code examples
botnet

Exceptionally many hits from certain IP addresses


My site gets exceptionally many hits from a certain range of ip address. Mostly it is just the main page.

This is last week (the number reps the amount of hits)

81.251.164.132  1689    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.165.14   999 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.166.201  263 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.167.46   65  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.168.251  59  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.170.36   908 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.172.253  365 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.173.9    88  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.174.243  688 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.189.194  19  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.189.204  1165    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.190.31   21  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.190.71   1655    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.37.185   680 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.37.211   707 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.39.198   18  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.39.36    16  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.39.51    18  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.41.201   1580    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.42.160   100 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.42.3 593 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.45.166   52  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.57.21    88  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.57.30    1275    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
81.251.63.20    1169    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

What can it be?


Solution

  • This appears to be a bot, you can see the first IP listed on the Spamhaus PBL here:

    http://www.spamhaus.org/query/ip/81.251.164.132