weird referer

[sde]

i looked at my logs and it jumped form the normal 4-5k pages to 30+k pages today and yesterday. this would be great except for the fact that most of it is coming from 1 ip address. today's traffic seems to be mostly downloaded by '82-77-42-200.brasov.rdsnet.ro' in romania.

i have http referer logs that i looked at, and some of the traffic yesterday was referred by http://coresat.com , ( registered to someone in romania )

I've blocked referers coming from the coresat domain now, but is 82.77.42.200 the ip address of 82-77-42-200.brasov.rdsnet.ro' in romania

i would like to prevent this person from doing whatever their doing. they have used a gig of my bandwidth today.

[sde]

ok, that was the ip. directed him away in the header.

[sde]

i think they might have been trying to exploit the last set of vbulletin vulnerabilities since i wasn't all the way up to date. we are now.

[idx]

Nice. Might be worth looking at some throttling.

-r

[Valmont]

Originally Posted by sde

i think they might have been trying to exploit the last set of vbulletin vulnerabilities since i wasn't all the way up to date. we are now.

Why would anyone do that to a forum like this?