UPDATE: Single user attached for long periods

An update to let you all know what we've done ....

We looked at the session this user and our next most active user.  Turns out 
a reverse DNS came to nothing.  The two users have been on
continuously since 4.00am 14/march, and prior to that they were both on for 
5 days.  The second user's session started exactly 30 seconds after the 
first, and for all that time they've both been hitting the home page every 5 
minutes and 32 seconds round the clock.

So we've blocked the two ip addresses.  We'll see if anyone whines.

I can't see how there's anything to our advantage happening here, so even 
though I can't see anything sinister, I dont want to take the risk. Besides, 
there's bandwidth being used for no apparent purpose.

We await developments.

Cheers,
Mike Kear
AFP Web Development
Windsor, NSW,Australia
http://www.afp.zip.com.au

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

HWG hwg-techniques mailing list archives, maintained by Webmasters @ IWA