Freaking me out...........

ratssass · Jan 8, 2013

.......to the point i've removed 6 yrs worth of work from my site.
I've noticed a huge increase in traffic on my site over the last month.I mean like well over a 1000% increase.Looking into it,I've found a malicious url with the following ISP info.....
[TABLE="align: left"]
[TR]
[TH]IP Address:[/TH]
[TD="class: tracking"]66.249.74.13[IP To Location-IP To Country]
[/TD]
[/TR]
[TR]
[TH]Hostname:[/TH]
[TD]crawl-66-249-74-13.googlebot.com[Domain To Location -Domain Country-Domain To IP]
[/TD]
[/TR]
[TR]
[TH]IP Blacklist Check:[/TH]
[TD="class: tracking"]Not Blacklisted [Blacklist Check]
[/TD]
[/TR]
[TR]
[TH="class: track, colspan: 2"]IP Lookup Location For IP Address: 66.249.74.13[/TH]
[/TR]
[TR]
[TH]Continent:[/TH]
[TD="class: tracking"]North America (NA)[/TD]
[/TR]
[TR]
[TH]Country:[/TH]
[TD] United States

(US)[/TD]
[/TR]
[TR]
[TH]Capital:[/TH]
[TD="class: tracking"]Washington[/TD]
[/TR]
[TR]
[TH]State:[/TH]
[TD="class: tracking"]California[/TD]
[/TR]
[TR]
[TH]City:[/TH]
[TD]Mountain View[/TD]
[/TR]
[TR]
[TH]Postal:[/TH]
[TD="class: tracking"]94043[/TD]
[/TR]
[TR]
[TH]Area:[/TH]
[TD]650[/TD]
[/TR]
[TR]
[TH]ISP:[/TH]
[TD="class: tracking"] Google[/TD]
[/TR]
[TR]
[TH]Organization:[/TH]
[TD]Google[/TD]
[/TR]
[TR]
[TH]Time zone:[/TH]
[TD="class: tracking"] America/Los_Angeles[/TD]
[/TR]
[TR]
[TH="class: track, colspan: 2"]Additional IP Lookup Info for IP Address: 66.249.74.13[/TH]
[/TR]
[TR]
[TH]Continent Lat/Lon:[/TH]
[TD="class: tracking"] 46.07305 / -100.546[/TD]
[/TR]
[TR]
[TH]Country Lat/Lon:[/TH]
[TD] 38 / -98[/TD]
[/TR]
[TR]
[TH]City Lat/Lon:[/TH]
[TD="class: tracking"] (37.4192) / (-122.0574)[/TD]
[/TR]
[TR]
[TH]IP Language:[/TH]
[TD] English[/TD]
[/TR]
[TR]
[TH]IP Address Speed:[/TH]
[TD="class: tracking"]Corporate Internet Speed [Check Internet Speed]
[/TD]
[/TR]
[TR]
[TH]IP Currency:[/TH]
[TD="class: myip"]United States dollar($) (USD)

[/TD]
[/TR]
[TR]
[TH]IDD Code:[/TH]
[TD="class: tracking"]+1

This ISP has shown up several (but not the 1000's) times in the last month.Why would someone from Palo Alto California have any interest in the 2-4 local tracks I shoot at back here in NY?Any ideas?Is this being routed through Google?[/TD]
[/TR]
[/TABLE]

snowbear · Jan 8, 2013

I'm guessing it's the crawler from Google. Ever notice that when you get search hits, a part of the web page text is listed? Crawlers get the info for the SEs. You can place a file in the main folder of your site that tells the crawler bots what pages they can and can't "look" at index; do a search on robots.txt.

Edit: It's Google.
66.249.74.13 - Whois information for IP 66.249.74.13 - Find IP Address

dewey · Jan 8, 2013

Looks like a normal web spider to me... what makes you say it's a malicious link? Was it in a comment or??

Bitter Jeweler · Jan 8, 2013

Well, Google IS malicious. So, yeah.

thetrue · Jan 8, 2013

Google is evil, but I use it daily....

ratssass · Jan 8, 2013

just went to look again............now its a place in china hittin' it 3x/sec.

[TABLE="class: gbDataTable"]
[TR]
[TD="class: gbOdd"][/TD]
[TD="class: gbEven"]Tue 08 Jan 2013 08:57:23 PM MST[/TD]
[/TR]
[TR]
[TD="class: gbOdd"] Type [/TD]
[TD="class: gbEven"]Gallery Error[/TD]
[/TR]
[TR]
[TD="class: gbOdd"] Location [/TD]
[TD="class: gbEven"]http://lapointephotography.net/store/main.php?g2_path=2010+Racing+Season/Spencer+5-29-10/&g2_page=8&g2_GALLERYSID=01f124c568689c4299a62345b67634e0[/TD]
[/TR]
[TR]
[TD="class: gbOdd"] User Id [/TD]
[TD="class: gbEven"]5[/TD]
[/TR]
[TR]
[TD="class: gbOdd"] Client [/TD]
[TD="class: gbEven"]180.76.5.182[/TD]
[/TR]
[TR]
[TD="class: gbOdd"] Summary [/TD]
[TD="class: gbEven"]Parent 7 path 2010 Racing Season[/TD]
[/TR]
[TR]
[TD="class: gbOdd"] Referer [/TD]
[TD="class: gbEven"]null[/TD]
[/TR]
[TR]
[TD="class: gbOdd"] Details [/TD]
[TD="class: gbEven"]
Error (ERROR_MISSING_OBJECT) : Parent 7 path 2010 Racing Season in modules/core/classes/helpers/GalleryFileSystemEntityHelper_simple.class at line 98 (GalleryCoreApi::error) in modules/core/classes/GalleryCoreApi.class at line 1952 (GalleryFileSystemEntityHelper_simple::fetchChildIdByPathComponent) in modules/core/classes/helpers/GalleryFileSystemEntityHelper_simple.class at line 53 (GalleryCoreApi::fetchChildIdByPathComponent) in modules/core/classes/GalleryCoreApi.class at line 1901 (GalleryFileSystemEntityHelper_simple::fetchItemIdByPath) in modules/rewrite/classes/RewriteSimpleHelper.class at line 45 (GalleryCoreApi::fetchItemIdByPath) in ??? at line 0 (RewriteSimpleHelper::loadItemIdFromPath) in modules/rewrite/classes/RewriteUrlGenerator.class at line 103in modules/rewrite/classes/parsers/modrewrite/ModRewriteUrlGenerator.class at line 56 (RewriteUrlGenerator::_onLoad) in init.inc at line 166 (ModRewriteUrlGenerator::initNavigation) in main.php at line 197in main.php at line 104in main.php at line 88Request variables: Array( [path] => 2010 Racing Season/Spencer 5-29-10/ [page] => 8 [GALLERYSID] => 01f124c568689c4299a62345b67634e0)[/TD]
[/TR]
[/TABLE]

ratssass · Jan 8, 2013

dewey said:
Looks like a normal web spider to me... what makes you say it's a malicious link? Was it in a comment or??

In my "Recent Activities" tab in my site administration.........

ratssass · Jan 8, 2013

sheezus.................i don't know anything about this chit.In 6 yrs,Ive never even met the guy that set up/kinda maintains my site.I think his name is Chalie,and he only communicates w/3 girls we call the angels...

Chris R · Jan 8, 2013

You can block entire continents from accessing your site if you'd like... If people from China, Russia, or any other spam-bot-heavy country have no business visiting your website, block them in .htaccess. You can generate the list here: Block Visitors by Country | IP2Location.com

Once you do this, you'll notice a huge decrease in this type of traffic.

snowbear · Jan 8, 2013

I wouldn't worry a whole lot. When I was maintaining the web page for the local 9-1-1 association, I'd see the crawlers all the time. I used the text file I mentioned to try and keep them on the main index page - it seemed to work pretty well.

ratssass · Jan 8, 2013

thanks guys.........i'll have to figure this out........

ratssass · Jan 8, 2013

snowbear said:
I wouldn't worry a whole lot. When I was maintaining the web page for the local 9-1-1 association, I'd see the crawlers all the time. I used the text file I mentioned to try and keep them on the main index page - it seemed to work pretty well.

i overreacted??i've got everything backed up,so i could just load everything after i get this figured out

snowbear · Jan 8, 2013

I didn't say that, just that I wouldn't worry too much. You want to make regular backups, anyway, and you want to keep tabs on everything. Look up the robots.txt (sorry, I don't remember the syntax but IIRC it's pretty basic) and check out the link Chris R provided.

edit: Here's a list of robot crawlers: http://www.robotstxt.org/db.html