Can anyone tell me why I'm getting SO many of this really odd access event? It's driving up my usage and making me crazy. I've tried blocking the IPs but they just keep changing (and I've probably blocked 30+ at this point!). *sigh*
Quote:
Recent Events
Date Type Location Client Summary
Sun 29 Jun 2014 03:02:35 PM EDT Gallery Error Link 31.204.152.210 Parent 6460 path ss-juvy.jpg.html result: chosen nickname "jeffreydor"; success; bb-code not working;
Sun 29 Jun 2014 03:02:35 PM EDT Gallery Error Link 31.204.152.210 Parent 6460 path SS-Juvy.jpg.html Result: chosen nickname "Jeffreydor"; success; BB-code not working;
Sun 29 Jun 2014 03:00:56 PM EDT Gallery Error Link 91.200.14.55 Parent 1373 path index.php
Sun 29 Jun 2014 03:00:55 PM EDT Gallery Error Link 91.200.14.55 Parent 1373 path index.php
Sun 29 Jun 2014 03:00:54 PM EDT Gallery Error Link 91.200.14.55 Parent 1373 path index.php
Sun 29 Jun 2014 02:32:13 PM EDT Gallery Error Link 91.200.14.55 Parent 1373 path index.php
Sun 29 Jun 2014 02:32:12 PM EDT Gallery Error Link 91.200.14.55 Parent 1373 path index.php
Sun 29 Jun 2014 02:32:12 PM EDT Gallery Error Link 91.200.14.55 Parent 1373 path index.php
Sun 29 Jun 2014 02:03:57 PM EDT Gallery Error Link 27.154.8.168 Parent 6346 path sharp2
Sun 29 Jun 2014 01:54:29 PM EDT Gallery Error Link 31.204.152.210 Parent 6460 path ss-juvy.jpg.html result: chosen nickname "jeffreydor"; success; bb-code not working;
Sun 29 Jun 2014 01:54:28 PM EDT Gallery Error Link 31.204.152.210 Parent 6460 path SS-Juvy.jpg.html Result: chosen nickname "Jeffreydor"; success; BB-code not working;
Sun 29 Jun 2014 01:33:10 PM EDT Gallery Error Link 120.42.99.5 Parent 1491 path mysterygiver2
Sun 29 Jun 2014 01:30:54 PM EDT Gallery Error Link 63.141.253.243 Parent 6460 path ss-juvy.jpg.html result: chosen nickname "jeffreydor"; success; bb-code not working;
Sun 29 Jun 2014 01:30:54 PM EDT Gallery Error Link 63.141.253.243 Parent 6460 path SS-Juvy.jpg.html Result: chosen nickname "Jeffreydor"; success; BB-code not working;
Sun 29 Jun 2014 01:28:43 PM EDT Gallery Error Link 193.201.224.58 Parent 6460 path ss-juvy.jpg.html result: chosen nickname "jeffreydor"; success; bb-code not working; result: forum not found
Sun 29 Jun 2014 01:28:42 PM EDT Gallery Error Link 193.201.224.58 Parent 6460 path SS-Juvy.jpg.html Result: chosen nickname "Jeffreydor"; success; BB-code not working; Result: forum not found
Sun 29 Jun 2014 01:28:14 PM EDT Gallery Error Link 120.42.99.5 Parent 162 path goodandtough5
Sun 29 Jun 2014 01:28:14 PM EDT Gallery Error Link 120.42.99.5 Parent 162 path goodandtough6
Sun 29 Jun 2014 01:25:31 PM EDT Gallery Error Link 27.154.8.168 Parent 20233 path img_9432
Sun 29 Jun 2014 01:14:31 PM EDT Gallery Error Link 27.154.44.126 Parent 162 path alphabetsoup2
Any suggestions at all as to what I can do to stop this access?
Thanks!
Posted: Sun, 2014-06-29 19:13
Posts: 1857
It's been a while since I've used G2, really, so I'm going out on a limb here (and could be entirely wrong).
(1) Some of the errors do appear to be bad links. (I think G2 had main.php; I don't remember it having index.php. I can't speak to goodandtough5, img_9432, etc, but I'm guessing the log is accurate and those links don't really exist.) If the links are supposed to exist but are generating errors anyway, that's a different issue that we need to address.
(2) If the links really don't exist, that suggests bots. That would also help explain the dramatic use increase; the errors aren't doing that by themselves, but are likely a symptom that bots are hitting your site and hitting it hard--thus, the usage increase. (The bots are coming more, and therefore generating more errors, too. And bots are notorious for fishing for bad urls and generating errors--at least in my experience.)
(3) Blocking bad bots is generally good practice, but if you do it ip by ip, you might be in for quite a ride. (How are you blocking? htaccess?) It's hard to advise on this without knowing your site, its use, SEO needs, etc, etc. If you have access to server logs and have a way to view ip visits from a longer period (e.g. the last 30 days or so), you may be able to eyeball the most abusive ips and block more effectively.
I know nothing about "BB-code not working" in G2, so maybe someone else will jump in on that.
EDIT: Also note that 30 isn't really a lot of blocks. On some sites, I literally block 1000s of IPs; on others, I block 100s--and that's using ranges, so the actual number of IPs blocked is much higher. Unfortunately, that's part of the cost of managing a web presence in 2014.