On Thursday, May 1st, some peculiar log entries were observed on the TurboTas website. Despite having only 10 registered users and 20 posted articles, an individual or program has been excessively mirroring the entire site every 15 minutes for the past five days.
While the site’s traffic is relatively small, the owner has been intrigued to see what would result from this behavior. Surprisingly, there have been no inquiries or communication from people expressing interest in the site. Hence, they decided to delve deeper into the matter.
Firstly, the owner generated statistics using awstats (See Links) to get an overview of the site’s activity. Subsequently, they used half a day’s worth of data to gauge the bandwidth consumed by this mirror. It amounted to around 14 megabytes per day.
The owner believes that the activity is not a deliberate attempt to maliciously leech bandwidth, as 14 megs is insufficient for a significant attack profile. Instead, it is suspected that someone from the same network (IP address 213.130.128.227) might be responsible for this behavior, considering the other devices on the subnet, particularly an HP switch that indicates a non-IT-related user.
The IP address has been left unfiltered for further analysis as the owner finds the investigation intriguing.
Stay tuned for updates in the ongoing investigation!