Odd WWWJDIC traffic

[Jim Breen]

I have some scripts on the edrdg.org server which monitor the web logs and report on the variety and quantity of the various requests. Occasionally I detect someone generating a lot of requests and I can usually block or deflect them.

About 4 days ago a script reported that WWWJDIC was getting about 40,000 API requests a day to display kanji information. This is far more than usual. Since the kanjidic file only has about 14,000 kanji it seemed something strange was going on. On looking at it in detail I see:

- the requests are all using unicode lookups

- they all seem to be coming from Macintosh systems

- unlike previous cases they are coming from a huge number of different IP addresses.  So far about 6,000 different addresses are reported in the logs with around 30 requests from each

- none of the IP addresses I examined have a domain name associated with them.

It's all quite bizarre. Whoever it is has some rather sophisticated resources, but what they are doing is not achieving anything. The server isn't being loaded much by it. I've really never seen anything quite like it. I wish they'd stop.

If there's any further developments I'll follow up this email.

Cheers

Jim 

[Jim Breen]

[Sorry to be sending this twice but I need to get it archived properly.]

[Jim Breen]

Well, whoever it was has stopped. They peaked at 56,000 requests on the 2nd-last day and made 20,000 on the last. They'd reached the last of the Unicode codepoints at that stage. The accesses were still spread over thousands of IP addresses.

I'll probably never know who they were or why they were doing it.

Jim