Anyone Wanna Help Me With These IP's? Weird hits
 

I asked on AWI, figured I wouldnt get a proper reply with out asking the GFY board too?

here....

First off let me say, im just curious, as I am checking my hit stats and referring URLs on my sites I am noticing something that has caught my eye and I am wondering if anyone can help me...

Lets just say it this way, what would you think if these 4 possibly more in numeral order were hitting your site, but coming from very strange places but hitting 4 of your sites daily and randomly...

What really puzzles me is the IPs come in from various places on the web, for example 212.138.47.12 came in from my Yahoo profile on Yahoo....

Then... 212.138.47.11 comes to me from a Google Search...."massive cock pics"

Then minutes later, 212.138.47.13 comes but from another Google search "lesbian dykes"

In the end these IPs come in from various places and hit my site throughout, can anyone help explain this? my logs only go back 50 referring URLs.... thanks in advance.

Just curious, not pointing the finger, shit i only trade with one site... im just wondering about the sequentiality of it... and its been hitting 4 of my sites...all day.

212.138.47.11
212.138.47.12
212.138.47.13
212.138.47.14

this might help

http://cello.cs.uiuc.edu/cgi-bin/slamm/ip2name

inetnum: 212.138.47.0 - 212.138.47.255
netname: ISU-5
descr: Internet Service Unit ISU
country: SA
admin-c: KR6046-RIPE
tech-c: KR6046-RIPE
status: ASSIGNED PA
mnt-by: KACST-ISU-MNT
mnt-lower: KACST-ISU-MNT
remarks: ------------------------------------------------------
remarks: Part of this IP block has been used for proxy/cache
remarks: service at the National level in Saudi Arabia. All
remarks: Saudi Arabia web traffic will come from this IP block.
remarks:
remarks: NOTE: If you experience high volume of traffic from
remarks: IP in this block it is because your site is very
remarks: popular/famous of Saudi Arabia community.
remarks: ------------------------------------------------------
changed: [email protected] 19991005
changed: [email protected] 19991212
changed: [email protected] 20010707
source: RIPE

Might be the Taliban:ak47:

Yeah I can get all the info too, heres the rest of it....

route: 212.138.0.0/16
descr: Saudi Arabia backbone and local registry address space
origin: AS8895
holes: 212.138.64.0/22
holes: 212.138.68.0/23
holes: 212.138.70.0/24
notify: [email protected]
mnt-by: ISU-NOC
changed: [email protected] 20000114
changed: [email protected] 20011112
source: RIPE

role: KACST ROLE
address: Saudi Network Information Center, ISU
address: King Abdulaziz City for Science and Technology,
address: P.O.Box 6086, Riyadh 11442, Saudi Arabia.
phone: +9661 481 3932
fax-no: +9661 481 3254
e-mail: [email protected]
trouble: [email protected]
admin-c: ZOM1-RIPE
tech-c: RA705-RIPE
tech-c: ANAS1-RIPE
nic-hdl: KR6046-RIPE
remarks: This Role object is for handling and maintaining all
remarks: IP Blocks registered by SaudiNIC(LIR) in Saudi Arabia.
mnt-by: KACST-ISU-MNT
changed: [email protected] 20010701
source: RIPE



But that doesnt tell me what the fuck it is or should I worry about it.... LOL, I dont mind the Arabs surfin my porn, just curious as to why the seperate IPs, from different area, if its the same person on different pcs or what?

Drew, this is what I get when I look them up as hostnames...

cache1-1.ruh.isu.net.sa
cache2-1.ruh.isu.net.sa
cache3-1.ruh.isu.net.sa
cache4-1.ruh.isu.net.sa


is it search engine cache?

But that wouldnt explain the Yahoo profile entrance...

Then in this case you will need to Format C:

That explains everything, doesn't it?
You have visitors from Saudi Arabia, simple as that.

So we could explain very easily where that traffic was coming from. But that raises another question: Shouldn't we save on bandwidth and block these IPs as users from an arabic country will probably never dare to have a porn site (or iBill) on their credit card bill? ;-)

- Otto -

don't block them saudi arabia = $$

just ask me, it costs me $25 to fill up my truck everyday

These are either proxy servers or active cache servers in a global
cluster like akamai technologies uses (yahoo, cnn, altavsita) etc, etc. which are used for global loadbalacing... if a user goes to yahoo his shortest/fastes path is determined by BGP router info
and a distributed DNS gives out an IP of the best location for that
user.

works a bit similar as flashing proxy. I would not worry about it.

DynaMite

yeah, they're real hits.
everyone knows there are way more computers hooked to the net in saudi arabia than there are in say............the US.

hahahahaha

I know that ip block by heart.

Thanks....:thumbsup

The CIA says the taliban are regrouping and internet traffic is drasticly increasing, this could be why:ticking

DOS attack from school network! :)