What Are These Hackers Trying To Do ?

[rmeeuwsen]

I know hackers have a lot of different aims when they are trying to break into your site.

But what is the point of “flooding” my site with “visits” from the same IP address to different (word press) posts. There are two different types that I have noticed lately.


#1 From { Singapore ISP / IP Address: Huawei Cloud (114.119.158.94) & 114.119.156.146 & 114.119.152.160 & 114.119.158.28 & 114.119.152.139 } etc.

This one has been the most persistent one that has seemed to alternatively go to more than one my sites (on the same host) over the last few months.


#2 From {London United Kingdom ISP / IP Address: Uab Code200 (185.99.31.252) & 185.99.29.77} & {United Kingdom ISP / IP Address: Link Web Solutions Llp (185.166.43.92)} & { United Kingdom ISP / IP Address: Next Global Services L.p. (185.116.172.18 ) & 185.110.1.30 185.110.1.60} & {London, United Kingdom ISP / IP Address: Cogent Communications (154.51.174.152)}

This is a new one for me that has gone to a single low value poker site of mine that has visited equally low value “news” posts - 1,800 different urls in one day.


I assume they are hackers, but maybe they are doing something else! Does anyone have a clue as to what they are really doing?

I hope Iwasn't doing myself any harm by blocking them.

[LinuxGam]

Probably scraping content and posting it with links back on hacked wordpress domains with adverts at the top and bottom. They may rarely hit much in search but when they are automating it with millions of pages, I guess it pays off.

[Cash Bonus]

They're cybercriminals and they'll do anything to hack into your computer and steal your personal and sensitive information. Whatever they can get their filthy hands on. They'll target anyone and they don't give a cr#p.

hxxps://au.norton.com/internetsecurity-malware-ip-spoofing-what-is-it-and-how-does-it-work.html

[baldidiot]

Possibly badly coded scrapers, happens to loads of our sites.

We just auto ban or throttle any IP that accesses the site too fast (or too many pages etc..).

[PROFRBcom]

I don't even have a Wordpress based site and our sites get this bullshit in the spam logs.

Every now and then when a bunch of them show up for a particular URL, we redirect that 404'd URL to https://www.fbi.gov/investigate/cyber

Doesn't help, but makes us feel better about it.

If you have the technical ability, you could use a wildcard to redirect the pages to something else... I don't have such access, but if I could, being we don't have WordPress, we would redirect all URLs with WordPress in them to the aforementioned FBI URL.

[baldidiot]

I don't even have a Wordpress based site and our sites get this bullshit in the spam logs.

I don't think it's anything to do with WP, they're just crawling/scraping URLs.

We get it on WP, joomla, custom php, plain old html etc...

[universal4]

All the pretend seo places crawl/scrape sites. Some will database it so that when the next guy crawls a site they can compare site a to site b. Often some of them will make the sites availably publicly as domain.com.seowannabe.com

Also, all the href and any other link things you do also crawl/scrape your site. How can they see the links if they don't scrape the pages looking for the href's? Most of these places database the pages, for future reference.

Then there is all the search engine wannabe places that do the same thing.

Then there is all the script kiddies that use scrapers scanning sites for "their own research" or to later look for vulnerabilities.

Then there are the old school people who run the scrapers from their servers who believe links in stats is a benefit, although this is very old school since the days of awstats or other stats program being publicly available are not very common anymore.

In the case that rmeeuwsen defined, most likely just someone scraping content.

To hit 1800 urls in a day, likely means whichever kind of bot or scraper, they are just doing a full scan scrape of all available links they see in navigation or on the sitemap.

Rick
Universal4

[potentialeight]

My vote is that it's just a scraper of some sort gathering information. It happens a lot in virtually all industries and isn't really something to be all that worried about. You can block the IPs if you feel strongly about it.