Back on September 18th, 2008, I wrote a piece about a run-in I’d had with David Latimer of the Mesothelioma & Asbestos Awareness Center.  The piece is here: ➡
The piece itself, and the comments about it, makes for interesting reading so I won’t go into any of the specifics here. But, I do encourage you to go and have a look.
After the initial burst of comments and E-mail about the original piece, I didn’t think much more about it.
But the other day, more than a month later, as I was looking through my Internet Logs to see where my traffic was coming from, I noticed a really odd pattern.  The second most visited page on my Blog was the piece on the Mesothelioma & Asbestos Awareness Center.
It made me curious why this piece should be so popular so I went digging and was surprised to find that all of the visits to this page on my Blog were coming from IP addresses in the range of 84.109.*.*   For example, one visit might come from 84.109.121.176 while the next might come from 84.109.104.179.  But all of them are coming from addresses that begin with 84.109.
Addresses on the Internet are often owned in ranges or blocks like this. I traced a dozen or more these addresses variations back to their source and they were ALL coming from a single Internet Service Provider (ISP) in Israel. Â The ISP is www.bezeqint.net which is located at:
Bezeq International Ltd.
40 Hashacham street, Ramat-Siv
PO Box 7097
49170 Petach Tikva
Israel
When one of the ISP’s customers requests access to the Internet, the IPS issues them one of the IP addresses from the block the ISP owns. Â This is why each time someone shows up on my Blog from Bezeq, they have a slightly different IP address.
So, what does it all mean?  Well, most probably Bezeq, the Israeli company, has a customer that has some sort of a deep and persistent interest in the Mesothelioma & Asbestos Awareness Center web page on my Samadhisoft Blog.Â
The question. of course, is why is this person so interested?
If you look at the pattern of their visits, it is puzzling what they are doing.  Check this out. These are all the visits today and yesterday.  All of these came from one of the Bezeq ISP company’s IP addresses:
081102 – 12:23:07 – 01m09s – 2 reloads
081102 – 10:13:52 – 00m50s – 2 reloads
081102 – 09:09:26 – 00m31s – 2 reloads
081102 – 08:50:40 – 00m42s – 2 reloads
081102 – 08:42:55 – 00m??s – 0 reloads (*)
081102 – 08:07:49 – 00m19s – 1 reload
081102 – 08:07:30 – 01m11s – 1 reload
081102 – 07:21:11 – 00m??s – 0 reloads
081101 – 15:59:50 – 00m??s – 0 reloads
081101 – 15:33:59 – 00m48s – 1 reload
081101 – 15:33:19 – 00m52s – 2 reloads
081101 – 15:32:51 – 00m27s – 1 reload
081101 – 15:31:44 – 00m??s – 0 reloads
081101 – 13:49:21 – 00m54s – 2 reloads
081101 – 13:28:56 – 00m26s – 1 reload
081101 – 12:10:32 – 00m51s – 2 reloads
081101 – 09:58:08 – 00m??s – 0 reloads
081101 – 09:14:21 – 00m57s – 2 reloads
081101 – 08:46:52 – 00m47s – 2 reloads
081101 – 08:33:04 – 00m42s – 2 reloads
081101 – 08:04:06 – 00m42s – 2 reloads
081101 – 08:02:37 – 00m35s – 2 reloads
081101 – 07:54:22 – 00m34s – 2 reloads
081101 – 07:03:39 – 00m??s – 0 reloads– At least one of these visits (*) came through a proxy server based in Saudi Arabia. though its original IP address was still shown as 84.109.*.*.
The way to read the list above is like so: Â If the line says
081101 – 08:02:37 – 00m35s – 2 reloads
It means that on 2008, November, 1st @ 8:02:37 I had a visit to my page that was 35 sec long and the Mesothelioma page was reloaded by the viewer twice.
It is an odd pattern, no doubt.  They come in directly to the Mesothelioma page again and again and stay anywhere from 30 seconds to a little over a minute and then depart. They may or may not reload the page once or twice during their visit. Yesterday, November 1st, they visited the Mesothelioma page like this 16 times. Today, they had made eight visits by midday.
Perhaps, they are visiting the page to make it look popular?  Perhaps, but it makes no sense to me because the only folks who would care are the Mesothelioma lawyers and this page is very likely more of a liability that an asset to them.
The only other reason I can think why someone would be visiting it so much is if they are trying to work out how to attack the page and take it down because it is a problem for someone.
I don’t know – it is all a mystery.  But, something a bit stinky and mysterious is going on.  Stay tuned, I’ll post more if I learn anything more.
Tags: Bezeq International Ltd., Mesothelioma & Asbestos Awareness Center
Maybe Bezeq is the ISP for a school or training center where linking to your page is part of a class exercise each day.
Or something more nefarious: perhaps the linkers are reading the comments to see who else is concerned with the issue.
Why not ask a group of mystery novel readers to provide explanations.
Still, I’m most curious to see what you discover about this trend.
In my opinion, the visits come from a spam bot network that maybe went crazy. I’ve also got such visits from IP’s by that provider in a similar pattern, only in my case they are all pointing to his URL of mine:
http://www.zdwonline.de/?p=25
As you can see, the text in this entry is German, so unless someone is using translation tools (definitely not web-based ones) or can speak both English and German, I don’t think there’s a person behind this.
I’ve not yet decided how I will handle this situation. I most likely will throw these log entries out of my user access statistics as they are clearly not made by real persons, but maybe I’ll also take drastic actions and ban all future visit attempts from this IP range by means of my server firewall.
Well, after I published this entry and sent an E-mail to the Bezeq people in Israel, I heard nothing. And after a few hours of no activity, the visits began again. So, I went into my ISP and used their IP Denier logic to block anyone from 84.109.*.* from accessing my Sites.
I have no desire to struggle over this. It may be, as HAF says, just a misdirected Spam Bot or, as AWT says, part of some harmless exercise. I don’t know and I don’t care. If it ties back to the Mesothelioma folks, then they can pound sand so far as I’m concerned.
Anyway, I’m hoping I’ll hear no more about it.
Cheers!
I printed the original article on my blog but it has not been a popular article at all. I’ll have to check out where the hits are coming from.