Re: Bulk Text-glossing activity.

[Jim Breen <jimbreen@*********>]

An update on this. I'm now logging all calls to text-glossing
and running an hourly report on which IP addresses call it
more than 50 times. I have also put into WWWJDIC a
warning/block capability. At present 8 IP addresses are
receiving a warning message whenever they use the function
and 7 just get a blocked message and no other output.

It's obvious that no-one is actually reading the results of
some of these attempts. IP 37.205.105.11 was blocked
yesterday, but has made 1200 accesses in the last 30
minutes.

As well as WWWJDIC-based responses, I can just tell the
IP routing tables to drop packets from a given address,
which means the caller can't even make an http connection.
I have one blocked that way, and will probably add more.

Since I started detailed logging about 30 hours ago 8
IP addresses have made over 1000 calls each. The highest
was over 8,000.

All quite bizarre.

Jim


On 24 July 2015 at 10:01, Jim Breen <jimbreen@gmail.com> wrote:
> The most recent monthly account for the server running the
> edrdg.org server showed a huge leap in bandwidth usage (and
> costs!) William Maton and I have been doing some investigation,
> including increased monitoring of requests to the WWWJDIC server.
>
> What is showing up is a mass of text-glossing requests coming from
> single IP addresses. Typically a heap of short Japanese sentences
> will be put in at about 1/second intervals, e.g.
>
> LOGGING    201.53.96.52        Thu Jul 23 23:44:56 2015
> 乃愛「え、えっ、ええっ!?」
> LOGGING    201.53.96.52        Thu Jul 23 23:44:58 2015
> ポロ～～ン。
> LOGGING    201.53.96.52        Thu Jul 23 23:44:59 2015
> 乃愛「な、ななな、なにが起こったのよぉ～～!?」
>
> They are coming from IP addresses all over the place. I have tried
> bit-bucketing selected IP addresses, but new ones just pop up.
> Looking at the ISPs involved there seems to be no pattern (that one
> above is in Brazil.)
>
> William suggested it might be a case of some Japanese forums
> embedding calls to WWWJDIC in their pages, and when someone
> reads the page a heap of requests is made.
>
> Does anyone know of sites doing that?
>
> Anyway, what I'm planning to do is monitor usage of the function
> and where there are repeated calls in a short period from the one
> IP address, initially add a warning to the output, and if the calls
> continue, block further access (at least until the contact me).
>
> Any suggestions, comment, etc. welcome.
>
> Jim
>
> --
> Jim Breen
> Adjunct Snr Research Fellow, Japanese Studies Centre, Monash University



-- 
Jim Breen
Adjunct Snr Research Fellow, Japanese Studies Centre, Monash University