View Single Post
Old 12-02-2017, 07:28 PM  
porn-update
Confirmed User
 
porn-update's Avatar
 
Industry Role:
Join Date: Apr 2014
Posts: 380
Maybe I found the bastard who's cloning my sites.

Right now my server is at 100% CPU, 100% memory, 50 load, sites practically offline.

In access.log I see a lot of access from this IP 93.105.187.11,

Code:
93.105.187.11 - - [03/Dec/2017:02:10:52 +0000] "GET /page-12/search-mooty+mooty+boobs+dhod+figar+onley+fack+pick+full+screen+hd/random/ HTTP/1.1" 200 25269 "http://www.monsterboobshardpics.com/page-9/search-mooty+mooty+boobs+dhod+figar+onley+fack+pick+full+screen+hd/random/" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:10:52 +0000] "GET /page-2/search-gp+tranny+danika+haze+anal+porn/random/ HTTP/1.1" 200 23399 "http://www.monsterboobshardpics.com/page-3/search-gp+tranny+danika+haze+anal+porn/random/" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:10:55 +0000] "GET /page-1/search-indian+aunty+visible+nipples+in+clothes/date/ HTTP/1.1" 200 23789 "http://www.monsterboobshardpics.com/search-indian+aunty+visible+nipples+in+clothes/date/" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:10:54 +0000] "GET /page-19/search-yasmine+james+boobs+all+pic/random/ HTTP/1.1" 200 24789 "http://www.monsterboobshardpics.com/page-23/search-yasmine+james+boobs+all+pic/random/" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:10:52 +0000] "GET /page-2/search-north+indian+mix+pussy+photo+fap/popular/ HTTP/1.1" 200 23788 "http://www.monsterboobshardpics.com/search-north+indian+mix+pussy+photo+fap/popular/" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:12:30 +0000] "GET /page-15/search-extra+large+booty+stuffed+with+black+cock+gp+king/date/ HTTP/1.1" 200 24549 "http://www.monsterboobshardpics.com/page-10/search-extra+large+booty+stuffed+with+black+cock+gp+king/date/" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:12:29 +0000] "GET /page-9/search-anna+carlene+milky+nipples+porn/ HTTP/1.1" 200 23543 "http://www.monsterboobshardpics.com/page-12/search-anna+carlene+milky+nipples+porn/" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:12:29 +0000] "GET /page-11/search-a+huge+bellied+ssbbw+chuddy+3gp+video+sex/date/ HTTP/1.1" 200 24278 "http://www.monsterboobshardpics.com/page-6/search-a+huge+bellied+ssbbw+chuddy+3gp+video+sex/date/" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"

93.105.187.11 - - [03/Dec/2017:02:15:18 +0000] "GET /search.php?q=latin+angels+images+of+2014+of+hot+and+sexy+models&sort=date&page=1 HTTP/1.1" 200 25222 "http://www.bigbigbigboobs.com/search.php?q=latin+angels+images+of+2014+of+hot+and+sexy+models&sort=date" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:14:59 +0000] "GET /search.php?q=video+hd+karla+james+bath+bubbles+and+boobs&sort=date&page=8 HTTP/1.1" 200 24747 "http://www.bigbigbigboobs.com/search.php?q=video+hd+karla+james+bath+bubbles+and+boobs&sort=date" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:14:59 +0000] "GET /search.php?q=lila+bbw+pictures&sort=date&page=4 HTTP/1.1" 200 23594 "http://www.bigbigbigboobs.com/search.php?q=lila+bbw+pictures&sort=date&page=1" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:14:59 +0000] "GET /search.php?q=patti+with+kerala+girls&sort=random&page=4 HTTP/1.1" 200 25217 "http://www.bigbigbigboobs.com/search.php?q=patti+with+kerala+girls&sort=random" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:14:59 +0000] "GET /search.php?q=sexy+video+downloddate&sort=random HTTP/1.1" 200 25473 "http://www.bigbigbigboobs.com/search.php?q=sexy+video+downloddate&page=1" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:14:59 +0000] "GET /search.php?q=malu+big+boobs+in+t+shirt+pics&sort=popular&page=10 HTTP/1.1" 200 25418 "http://www.bigbigbigboobs.com/search.php?q=malu+big+boobs+in+t+shirt+pics&sort=popular" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:14:59 +0000] "GET /search.php?q=w+feat+auntybhabhi+moti+gand+hole+fuckingphotodate&sort=date&page=1 HTTP/1.1" 200 24731 "http://www.bigbigbigboobs.com/search.php?q=w+feat+auntybhabhi+moti+gand+hole+fuckingphotodate&sort=date" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:14:59 +0000] "GET /search.php?q=bigblack+mama+wet+pussy+pics&sort=popular&page=9 HTTP/1.1" 200 25187 "http://www.bigbigbigboobs.com/search.php?q=bigblack+mama+wet+pussy+pics&sort=popular" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
93.105.187.11 - - [03/Dec/2017:02:14:59 +0000] "GET /search.php?q=aucking+big+boobs+mothers+son+photos&sort=random&page=3 HTTP/1.1" 200 25325 "http://www.bigbigbigboobs.com/search.php?q=aucking+big+boobs+mothers+son+photos&sort=random" "Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0"
these sites usually make 150-200 visits a day, so it seems odd to see all these visits in access.log and all from the same IP

I tried to block it with this:

ufw deny from 93.105.187.11 to any;

But I still see access from this IP... am I doing something wrong? Why isn't it blocked?

The firewall is enabled and I have also restarted the server.
porn-update is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote