A Look at the Logs: Week 1

Ditching Drupal a week ago made for some other interesting changes. Of particular note is that logging of errors and other access issues are handled by Apache rather than a CMS. The old Impossibly Stupid site had essentially been isolated from all the other abuse handling I do for the various other sites I maintain. Now that it works like a “regular” web site, it means I can do a better job of examining the traffic.

Somewhat related to the logging change was a reset of the blacklisting. Again, Drupal supplied it's own .htaccess file, which was also inconveniently isolated compared to the mass of other Apache configuration files I update. So while I tried to keep a tight ship on Impossibly Stupid, I decided that part of the abandonment of Drupal meant to also abandon any blocks that had been built up at my Impossibly Stupid site over the years. That, of course, meant that a lot more bad requests would be coming in, but on the plus side they would be filtered through the global blocking process that covers all my sites.

Now, mind you, some of the errors were definitely on me. As noted previously, some assets have been moved to new locations. Some are just gone because they were Drupal specific. Some spiders might have old links that will take a while to clear out. Etcetera. I'm accepting of those errors. No, what I'm going to highlight here is the genuine abuse that is now on my radar. Briefly on my radar, because the IP blocks of these offenders are now part of my global blacklist.

Spammers

Some abusers scan the site in the hopes of leaving comment spam or otherwise look for a back door they can use to deface the site or make it part of a botnet. Preventing even the possibility of that is one of the big reasons I moved away from do-everything CMS software.

/logs/impossiblystupid.com/http/error.log:[Sun Nov 30 15:17:09 2014] [error] [client 108.171.248.42] File does not exist: /impossiblystupid.com/node/add, referer: http://www.impossiblystupid.com/node/add/article
/logs/impossiblystupid.com/http/error.log:[Sun Nov 30 15:31:35 2014] [error] [client 108.171.248.42] File does not exist: /impossiblystupid.com/node/add, referer: http://www.impossiblystupid.com/node/add/story
/logs/impossiblystupid.com/http/error.log:[Sun Nov 30 15:46:19 2014] [error] [client 108.171.248.42] File does not exist: /impossiblystupid.com/node/add, referer: http://www.impossiblystupid.com/node/add/page
/logs/impossiblystupid.com/http/error.log:[Sun Nov 30 15:51:26 2014] [error] [client 108.171.248.42] File does not exist: /impossiblystupid.com/node/add, referer: http://www.impossiblystupid.com/node/add/forum
/logs/impossiblystupid.com/http/error.log:[Sat Dec 06 14:41:06 2014] [error] [client 192.169.112.237] File does not exist: /impossiblystupid.com/wp-content

Bad Spiders

Sometimes spiders are badly written; not malicious per se, but suspiciously unprofessional enough to ban if they keep generating the same sorts of errors over and over. Case in point for the new Impossibly Stupid site is the Bitcoin URL at the bottom of the page. It wasn't a link on the old site because even Drupal as a CMS was so poorly written that it considered the bitcoin scheme to be nothing more than a relative path. No such problem on the new site, which is bad news to the owners of these IP blocks.

/logs/impossiblystupid.com/http/error.log:[Sun Nov 30 16:03:38 2014] [error] [client 69.12.68.215] File does not exist: /impossiblystupid.com/node/13/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/13/
/logs/impossiblystupid.com/http/error.log:[Sun Nov 30 17:47:55 2014] [error] [client 195.211.155.132] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=6
/logs/impossiblystupid.com/http/error.log:[Sun Nov 30 17:59:03 2014] [error] [client 60.194.100.51] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=4
/logs/impossiblystupid.com/http/error.log:[Sun Nov 30 19:34:24 2014] [error] [client 167.114.52.252] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=4
/logs/impossiblystupid.com/http/error.log:[Sun Nov 30 21:32:08 2014] [error] [client 220.134.138.16] File does not exist: /impossiblystupid.com/bitcoin:1jjdpreg59fjnred6vpem6v5j83fkv6wtz, referer: http://www.impossiblystupid.com/bitcoin:1jjdpreg59fjnred6vpem6v5j83fkv6wtz
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 03:32:17 2014] [error] [client 107.153.85.205] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=4
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 04:44:49 2014] [error] [client 23.232.221.112] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=4
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 08:15:59 2014] [error] [client 192.77.245.56] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=4
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 09:30:19 2014] [error] [client 117.169.1.95] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=4
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 09:57:17 2014] [error] [client 216.231.135.247] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=4
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 11:27:43 2014] [error] [client 117.211.93.94] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=4
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 18:49:09 2014] [error] [client 104.143.25.232] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=2
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 18:49:32 2014] [error] [client 192.240.208.247] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=11
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 19:57:50 2014] [error] [client 107.169.7.28] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=5
/logs/impossiblystupid.com/http/error.log:[Wed Dec 03 01:17:16 2014] [error] [client 162.244.10.189] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=7
/logs/impossiblystupid.com/http/error.log:[Wed Dec 03 05:32:12 2014] [error] [client 104.37.56.73] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=1
/logs/impossiblystupid.com/http/error.log:[Wed Dec 03 12:29:53 2014] [error] [client 155.94.220.200] File does not exist: /impossiblystupid.com/node/120/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/120/
/logs/impossiblystupid.com/http/error.log:[Wed Dec 03 16:19:22 2014] [error] [client 104.140.13.85] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=5
/logs/impossiblystupid.com/http/error.log:[Thu Dec 04 09:39:46 2014] [error] [client 140.224.92.94] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=8
/logs/impossiblystupid.com/http/error.log:[Thu Dec 04 19:12:36 2014] [error] [client 199.15.248.189] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=5
/logs/impossiblystupid.com/http/error.log:[Thu Dec 04 22:23:13 2014] [error] [client 31.7.56.38] File does not exist: /impossiblystupid.com/node/2/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/2/
/logs/impossiblystupid.com/http/error.log:[Fri Dec 05 08:40:40 2014] [error] [client 117.26.248.222] File does not exist: /impossiblystupid.com/bitcoin:1jjdpreg59fjnred6vpem6v5j83fkv6wtz, referer: http://www.impossiblystupid.com/bitcoin:1jjdpreg59fjnred6vpem6v5j83fkv6wtz
/logs/impossiblystupid.com/http/error.log:[Sat Dec 06 10:56:29 2014] [error] [client 5.196.109.20] File does not exist: /impossiblystupid.com/node/2/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/2/
/logs/impossiblystupid.com/http/error.log:[Sat Dec 06 11:52:51 2014] [error] [client 113.231.214.40] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=5
/logs/impossiblystupid.com/http/error.log:[Sat Dec 06 12:47:03 2014] [error] [client 68.64.172.217] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=4
/logs/impossiblystupid.com/http/error.log:[Sat Dec 06 14:02:03 2014] [error] [client 117.177.160.41] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=11
/logs/impossiblystupid.com/http/error.log:[Sat Dec 06 14:48:49 2014] [error] [client 37.203.208.49] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=6
/logs/impossiblystupid.com/http/error.log:[Sat Dec 06 14:56:36 2014] [error] [client 221.220.57.241] File does not exist: /impossiblystupid.com/node/bitcoin:1JJDPREg59fJnrEd6VPEM6V5J83FKv6WtZ, referer: http://www.impossiblystupid.com/node/?page=6

Bogus Referrers

Some blogging software out there actually rewards spammers if they even just claim their site links to yours. Drupal didn't (by default, anyway; maybe some extension does), and I certainly never would allow that sort of nonsense. Makes for some easy blacklisting of anyone hitting Impossibly Stupid that way.

/logs/impossiblystupid.com/http/error.log:[Sun Nov 30 16:12:35 2014] [error] [client 91.200.12.67] File does not exist: /impossiblystupid.com/node/trackback, referer: http://www.impossiblystupid.com/node?page=5
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 06:48:18 2014] [error] [client 46.119.123.190] File does not exist: /impossiblystupid.com/taxonomy, referer: https://www.tattooreligion.ru/
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 06:48:18 2014] [error] [client 178.137.161.93] File does not exist: /impossiblystupid.com/taxonomy, referer: http://flowersun.msk.ru/
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 10:26:13 2014] [error] [client 37.139.52.23] File does not exist: /impossiblystupid.com/taxonomy, referer: http://ehose-store.com/
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 11:29:52 2014] [error] [client 109.120.157.179] File does not exist: /impossiblystupid.com/taxonomy, referer: http://doska-vsem.ru/
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 03:29:10 2014] [error] [client 91.207.8.46] File does not exist: /impossiblystupid.com/taxonomy, referer: http://master-muznachas.ru/
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 19:00:08 2014] [error] [client 195.242.218.133] File does not exist: /impossiblystupid.com/taxonomy, referer: http://amaviq.wordpress.com/
/logs/impossiblystupid.com/http/error.log:[Wed Dec 03 20:52:10 2014] [error] [client 120.43.17.87] File does not exist: /impossiblystupid.com/node/trackback, referer: http://www.impossiblystupid.com/node?page=5
/logs/impossiblystupid.com/http/error.log:[Wed Dec 03 21:22:28 2014] [error] [client 104.238.201.242] File does not exist: /impossiblystupid.com/node/122/trackback, referer: http://www.impossiblystupid.com/node/122
/logs/impossiblystupid.com/http/error.log:[Sat Dec 06 02:24:00 2014] [error] [client 178.137.128.163] File does not exist: /impossiblystupid.com/taxonomy, referer: http://nardulan.com/

Disreputable ISPs

Some terrible service providers seem to go out of their way to protect bad customers regardless of the abuse that they push out. Floods result in bans, of course, but the real loss is the IP addresses that are devalued by these jokers. Don't buy services from these providers unless you want to knowingly live in a bad network neighborhood.

wowrack.com

/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 01:14:40 2014] [error] [client 208.115.124.114] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 16:03:58 2014] [error] [client 208.115.124.114] File does not exist: /impossiblystupid.com/taxonomy
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 17:35:47 2014] [error] [client 208.115.124.114] File does not exist: /impossiblystupid.com/taxonomy
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:36 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:37 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:37 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:37 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:40 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:40 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:41 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:41 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:43 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/taxonomy
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:43 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/taxonomy
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:44 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/taxonomy
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:44 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/taxonomy
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:44 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:45 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:45 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:03:45 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:05:14 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:05:14 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:05:15 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 20:05:15 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 21:31:46 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 21:31:56 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/taxonomy
/logs/impossiblystupid.com/http/error.log:[Mon Dec 01 21:31:58 2014] [error] [client 208.115.124.106] File does not exist: /impossiblystupid.com/comment

amazonaws.com

/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 17:26:14 2014] [error] [client 54.80.112.7] File does not exist: /impossiblystupid.com/index.xml
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 17:26:14 2014] [error] [client 54.80.112.7] File does not exist: /impossiblystupid.com/index.rdf
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 17:26:14 2014] [error] [client 54.80.112.7] File does not exist: /impossiblystupid.com/atom.xml
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 17:26:15 2014] [error] [client 54.80.112.7] File does not exist: /impossiblystupid.com/feed
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 17:26:15 2014] [error] [client 54.80.112.7] File does not exist: /impossiblystupid.com/blog
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 17:26:16 2014] [error] [client 54.80.112.7] File does not exist: /impossiblystupid.com/feeds
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 17:26:16 2014] [error] [client 54.80.112.7] File does not exist: /impossiblystupid.com/rss
/logs/impossiblystupid.com/http/error.log:[Tue Dec 02 17:26:17 2014] [error] [client 54.80.112.7] File does not exist: /impossiblystupid.com/rss