4 ms·
> It makes me wonder what sort of numbers the really famous sites are seeing Not exactly a famous site, but I thought a larger sample size might be interesting
by ckuehl 12y ago
> It makes me wonder what sort of numbers the really famous sites are seeing
Not exactly a famous site, but I thought a larger sample size might be interesting...
We [1] provides shared hosting for about 500 WordPress installations, of widely varying sizes. The sites are mostly static "blogs" for student groups or individual students, with about half on a single domain (www.ocf.berkeley.edu/~something) and others on different subdomains of berkeley.edu.
In the past week, the webserver handled 3,527,157 requests (about 814 MB of uncompressed access logs). 111,409 of those were WordPress login attempts [2].
I was going to compare the list of top IPs with the list in the article, but was surprised to find that there were no shared IPs between the lists. For context, we had 435 unique IPs, 9 with > 1000 requests, and 32 with > 100 requests.
The top ten requestors in the past week are from (cities from whois data):
56742 Kiev, Ukraine
19302 Novosibirsk, Russia
7645 Sofia, Bulgaria
7641 Moscow, Russia
7190 Kiev, Ukraine
6748 Kharkov, Ukraine
2160 Roubaix, France
1041 Kharkov, Ukraine
967 Kuala Lumpur, Malaysia
894 Putian, China
[1] https://www.ocf.berkeley.edu/ https://www.ocf.berkeley.edu/
[2] POST requests to wp-login.php. I don't have accurate numbers on how many failed, but to say that less than 250 were legitimate user logins is probably accurate.
- tribaal 12y agoA small point here: Roubaix is the town where OVH has its datacenter and exchange point, so this is most probably people renting VMs or VPS in there (like Amazon).
- porker 12y agoAh, so that's why Roubaix, France always shows up on my list of hacking sources! Thanks for the explanation.
- michaelcampbell 12y agoHow can Kiev be #1 and #5? Similarly Kharkov.
- ckuehl 12y agoSorry, I should have clarified. That list is the top 10 IPs by number of requests, not the top 10 cities. I just replaced the actual IPs with the cities in their whois (since I'm not sure I want to post the IPs publicly).
- michaelcampbell 12y agoAH, of course; thanks.
- psykovsky 12y ago2 diferent IP's from the same city? I get what you mean, but it's easy to understand also.
- kaivi 12y ago.edu domains are still popular targets in Western Europe, and access to webservers in .gov and .edu TLDs is the most priced there. The cause for this is the belief that Google gives more weight to content and backlinks from these TLDs.