[quote="Headgehog"]Two days ago (LT) the site saw 16.12 MB of ftp traffic, and 0.12 MB yesterday. Cat do you know anything about this? Could this be some hidden bug from our Venezuelan friend?[/quote]

The large figure may have been generated while I was trying to fix things?
Didn't do any FTP yesterday so that wasn't me though.
I think though, that if these guys had full FTP access they'd've done a lot more damage than they did. They're obviously aren't 'crackers' rather than true 'hackers' or they wouldn't've done as much damage as they did mind so I think they'd've done more damage if they could so I'm inclined to think they only had limited access to the one directory, probably used some sort of Postnuke exploit.

[quote="Headgehog"]There has also been no new members added to the site in the last few days... go figure. Which implies that the new hits are from some sort of robot, i.e. search engine spider or hacker.[/quote]

I'll have to check that registrations are still working.
Seen plenty of guests (44 at the moment) but there's never more than one or two other members online when I am.
At home I can try looking at the server logs to see if there's any unusual user agents or something I suppose. Logs are so darned huge here though..

82-43-226-38.cable.ubr01.pres.blueyonder.co.uk
guaras1-019.ras.gua.cantv.net
pcp03721311pcs.pwayne01.pa.comcast.net
cpc3-ely12-5-0-cust81.cdif.cable.ntl.com
cabletel1.cableol.net
82-43-224-208.cable.ubr01.pres.blueyonder.co.uk

These are the FTP connections in order of volume thi month

ntl.com and cableol.net are me
At least one of the others should be you?
THe blueyonder ones look like Sad, which doesn't make sense as he shouldn't have been here the day that was most active?

[quote="Cat"]At least one of the others should be you?
THe blueyonder ones look like Sad, which doesn't make sense as he shouldn't have been here the day that was most active?[/quote]

The comcast.net is mine. Either that or somebody else in my area has ftp access.

I would think the pres.blueyonder are Sad's. I'm also going to guess that "pres" is Preston. Just like pawayne for me is Wayne, PA.

Is this list for one day, or for the month to date. If its just for the peak date, then that would be very curious. Otherwise is makes perfect sense that our webmaster would have had a lot of ftp access this month.

That's the months figures
iirc the blueyonder one (and yes, Pres is for Preston) did about 16MB of transfer on the 15th, but I though he'd gone by then.

We're left with guaras1-019.ras.gua.cantv.net being unknown.

Not anymore:

Location = Guanare, Venezuela
lat/lon = 9.04n, 69.45w

The FTP stats for that IP:

Files: 49
KBytes: 1982
Visits: 1

Worrying thing is.. there's only one username logged and that's the main one. If they have that, they'd have access to everything, including the cpanel (if they had the correct address)

Found them in the WWW stats as well

Pages: 26
Hits: 29
Bandwidth: 342.89 KB
Last visit: 19 Sep 2004 - 15:35

[img]http://www.sadgeezer.com/cat/bw-sadgeezer.com-19-09-2004-ftp.png[/img]

FTP traffic for the 19th in graph form - the yellow blip at 14:30 would be the Venezuelans.

Just realised something.. the major 16MB spike from Sad's IP was on the 22nd, not the 15th (I was mixing up the date and time charts).
Which doesn't really make sense as he shouldn't be here, unless someone else has access to his machine.

The Cpanel has an IP Deny function, so I've added 161.196.244.

BTW, that's definately Sad's machine and it' definately up and running at the moment:
http://82-43-226-38.cable.ubr01.pres.blueyonder.co.uk/

It's still hosting sadgeezer.net

Well, it was another close call, but were going to make it this month. Despite the 10k veiws/day and the >1.6 GB/day average, we will end the month using only 46/49 GB. Due mostly because the server forgot to count the bandwidth for almost and week, and as usual it fails to count the nightly bandwidth. :twisted: