So we had a bit of a "botnet" of sorts ... someone set up a few clients to endlessly refresh the online users list for whatever reason.
*122547 TempTina> 2012-11-13 12:25:38 - IP address 184.154.96.144 is being weird. (UA: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727))
*122547 TempTina> 2012-11-13 12:25:38 - IP address 108.166.164.250 is being weird. (UA: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0)
*122552 TempTina> 2012-11-13 12:25:42 - IP address 199.217.116.207 is being weird. (UA: Mozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre)
*122552 TempTina> 2012-11-13 12:25:42 - IP address 199.217.116.207 is being weird. (UA: Mozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre)
*122553 TempTina> 2012-11-13 12:25:44 - IP address 108.166.164.250 is being weird. (UA: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 3.5.30729))
*122559 TempTina> 2012-11-13 12:25:50 - IP address 108.166.164.250 is being weird. (UA: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 3.5.30729))
*122600 TempTina> 2012-11-13 12:25:51 - IP address 184.154.96.144 is being weird. (UA: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 3.5.30729))
*122603 TempTina> 2012-11-13 12:25:53 - IP address 199.217.116.207 is being weird. (UA: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1)
*122610 TempTina> 2012-11-13 12:26:01 - IP address 199.217.116.207 is being weird. (UA: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1)
*122613 TempTina> 2012-11-13 12:26:04 - IP address 108.166.164.250 is being weird. (UA: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727))
*122620 TempTina> 2012-11-13 12:26:10 - IP address 199.217.116.207 is being weird. (UA: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 3.5.30729))
*122622 TempTina> 2012-11-13 12:26:13 - IP address 199.217.116.207 is being weird. (UA: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02)
I don't get it. There's a lot of better pages you could hit if you were aiming to ddos or slow things down or whatever... I guess someone was just really obsessed with the online users list.
So... yep. If you ever wondered why there were a bunch of guests refreshing the online user list...
(I will say, however, that the timing is a bit weird. This has been going on for weeks and started after an incident a while ago, but that could really just be coincidence. If it isn't, though, it's just sad. Which would be kind of fitting of the person, in retrospect.)____________________