Thousands of hits from where?

[shagymoe]

Hi all, I just set up my server the other day and it isn't listed anywhere but I've been getting over a thousand hits a day. Is this virus attacks or what?

I installed awstats and almost all of the ips are unresolved.

Any suggestions on figuring this out?

Thanks

 

[sleipnir214]

The inability to reverse-resolve an IP address is not significant. They generally have to be set up separately from the forward DNS entries, and a lot of admins don't bother to set them up.

I'd examine the log files by hand.

What's being requested?

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[shagymoe]

Most requests are for the DocumentRoot page. The request in the log is "GET / HTTP/1.1" 200 29514 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"

The logs show that they just connect once and don't browse any other pages.

 

[shagymoe]

Here is a link where other people are experiencing the same exact thing, however, they haven't decided the cause/solution.

http://www.webmasterworld.com/forum39/1435-2-15.htm

 

[tarn]

This could be a lot of things:

1) you have an IP address that has been used before where it was being ping checked by some application to confirm that it remains avalible.

2) You may be using a ADSL router that is using a keepalive ping to your IP to keep it alive

3) If all the hits are from different IP's then someone has got the word out that your IP is a good site to visit

4) Is your ISP pinging your server as part of a monitoring process?

5) maybe your domain name is popular and you are getting visits from people that had wished to buy that domain? (lots of domain sellers offer a link to an allready registered domain)

6) Is it YOUR server running a process to confirm that your webserver is up .... My RAQ3's do!

7) ......

8) ..... need I go on.

If its affecting bandwith its a problem othewise you should maybe get some banners up there and start making some money!!

You will not be resolving IP's to FQDN "unless" you have specifically set this up in apache or are running some logresolve script. I would suggest that unless you realy need this then dont! it creates a REAL overhead on your server, best pull the logs off and resolve them (maybe with a log-merge-resolve script), or at least resolve them in a quiet "off-peak" period If you can find one.

Good Luck
Laurie.