1

I checked my site's logs and I found 20 thousand requests on the same day all to an obscure page of my site. The IP address of the requests belong to Opera Mini.

Can someone explain this?

I would be less surprised if the requests were spread out through the site, because then it could be regular Opera Mini traffic by users. But why 20 thousand requests to a completely uninteresting page on my site?

And there is no sign of this in Analytics, so it's not regular traffic, because JavaScript is not run, so I don't see the traffic spike in Analytics.

  • 1
    Can you give an example from you log file?? I have seen Opera Mini in my abuse database. I could look up the history I have using the IP address in the log file. But I am sure it is a compromised system trying to hack other sites- it generally is. (Script Kiddie stuff) I could see if there is something obvious (type of attack) and provide some code to help block using .htaccess and possibly others. – closetnoc Oct 27 '15 at 23:36
  • You say that analytics haven't recorded anything. Are you use private or public analytics platform? In case of a public platform, have you checked the referral section, to see if this is a SEO spam? – PatrickT80 Oct 27 '15 at 23:41
  • @closetnoc the IP address is 82.145.208.160 – Tom Oct 28 '15 at 5:17
  • @Patrick Trabocchi it's google analytics and as I said I see no traffic jump there, so I assume it did not log the requests, but I may be wrong. What should I check in the referral section? – Tom Oct 28 '15 at 5:18
  • 1
    Can it be an attack against opera mini, sending lots of requests with Mini's IP adress to innocent sites, so these sites flood Opera Mini's servers with their replies to these requests? – Tom Oct 28 '15 at 18:45
2

I have hundreds of sub-domains of opera-mini.net. Too many to count! I did a quick review of about 20 of them and I see two things:

1] Rogue Spider: A spider or bot that disobeys or ignores the robots.txt file.

2] Stealth Spider: A spider or bot that tries to fly under the site owners radar when analyzing their log file.

It is likely that this is a scraper bot that you will want to block.

I have provided some block code to try and help. I am familiar with Apache. If I have made any mistakes, please let me know. You can block by host name, IP address or IP address block. In this case, I suggest blocking by IP address block.

IP: 82.145.208.160
Host: z27-11.opera-mini.net
ASN: AS39832 - Opera Software ASA

IP Address Range:

82.145.208.0 - 82.145.223.255

NetMask:

Block: 82.145.208.0/20
Base Address: 82.145.208.0
Broadcast Address: 82.145.223.255
Net Mask: 255.255.240.0
Host Mask: 0.0.15.255
Bits: 20
Size: 4096
2nd Element: 82.145.208.2

Block by Host

Using Apache .htaccess.

RewriteCond %{HTTP_HOST} ^z27-11\.opera-mini\.net$ [NC]
RewriteRule .* - [F,L]

Using Microsoft IIS Web Server

<rule name="abort domain name z27-11.opera-mini.net" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_HOST}" pattern="^z27-11\.opera-mini\.net$" />
  </conditions>
 <action type="AbortRequest" />
</rule>

Block by IP Address

Apache .htaccess File

RewriteCond %{REMOTE_ADDR} ^82\.145\.208\.160$ [NC]
RewriteRule .* - [F,L]

Cisco Firewall

access-list deny-82-145-208-160-32 deny ip 82.145.208.160 any
permit ip any any

Nginx

Edit nginx.conf and insert include blockips.conf; if it does not exist. Edit blockips.conf and add the following:
deny 82.145.208.160;

Microsoft IIS Web Server

<rule name="abort ip address 82.145.208.160/32" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^82\.145\.208\.160$" />
  </conditions>
 <action type="AbortRequest" />
</rule>

Windows netsh ADVFirewall Firewall

netsh advfirewall firewall add rule name="block-ip-82-145-208-160-32" dir=in interface=any action=block remoteip=82.145.208.160/32

Block by IP Address Block

Apache .htaccess File

RewriteCond %{REMOTE_ADDR} ^82\.145\.(2*[0-2]+[8901234567]+)\.([0-2]+[0-5]+[0-5]+)$ [NC]
RewriteRule .* - [F,L]

Cisco Firewall

access-list deny-82-145-208-0-20 deny ip 82.145.208.0 0.0.15.255 any
permit ip any any

Nginx

Edit nginx.conf and insert include blockips.conf; if it does not exist. Edit blockips.conf and add the following:
deny 82.145.208.0/20;

How to block by IP address block using Linux IPTables Firewall.

Note: Use with caution.
/sbin/iptables -A INPUT -s 82.145.208.0/20 -j DROP

Microsoft IIS Web Server

<rule name="abort ip address block 82.145.208.0/20" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^82\.145\.223\..*$" />
  </conditions>
 <action type="AbortRequest" />
</rule>

Windows netsh ADVFirewall Firewall

netsh advfirewall firewall add rule name="block-ip-block-82-145-208-0-20" dir=in interface=any action=block remoteip=82.145.208.0/20
| improve this answer | |
  • OK, but I have a mobile site too. I can't just block every Opera Mini request. But how can it request files from Opera Mini's IP address? This does not make sense, because then it does not get any reply for its requests, because the replies go to Opera Mini. Or can it be an attack against opera mini, sending lots of requests with Mini's IP adress to innocent sites, so these sites flood Opera Mini's servers with their replies of these requests? – Tom Oct 28 '15 at 18:44
  • I gave block code for just the one IP address you can replicate/modify to be surgical. The requests are not coming from users of the Opera software that I am aware of. It is coming from compromised systems from within the company. This is like a web host doing the same thing. You are not blocking users, you are blocking machines. Again, I have many hundreds of serious abusive access from this domain. These are not innocent/accidental accesses. That is why I knew who they were off the top of my head. They are well known for being abusive. Your choice. The code is yours if you want it. – closetnoc Oct 28 '15 at 18:55
  • 1
    Ok, and how about my interpretation, that these request do not come for Opera Mini, but someone who wants to hurt Opera sends the requests faking Opera Mini's IPs. This way the replies from our servers go to Opera Mini and hammer their servers. So the aim of these requests is attacking Opera's servers with the replies, isn't it? – Tom Oct 28 '15 at 19:15
  • It is not easy to do this. Spoofing an IP address is not such a simple process but can be done. However, I have a very long history with this IP address block. If they are trying to hurt Opera, then they have been at it a very long time. Keep in mind that I have been tracking this stuff for 8+ years. The profile I see in my database is not innocent and has been long lasting. It can be a rogue employee working on a website and using the company network to do their dirty work. I have seen that happen when a company does not look after their network. – closetnoc Oct 28 '15 at 19:19
  • Did you try reporting it to Opera, so they can look into it? – Tom Oct 28 '15 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.