Virus Attack??
This morning I noticed in my log files multiple requests for the same file (about 10x a second)
from the same IP that had been going on for hours. After tracing the IP to an ATT dial up I
assumed it was a DOS attack and blocked the IP. Then about 30 minutes later it started
happening again from a different IP, this time I traced it to a banks server. At this point
I figured that their server had been hacked and had been set to attack my site so I called
the bank and notified them of the situation. After they looked into it they told me the attack
was coming from one of their employees workstations and it was caused by a virus. Now here's
whats really strange, it turns out the employee of the bank had visited my site at about the same
time the attack started! She (the employee) thinks that when she visited my site the virus was
placed on her computer, I find this highly unlikely, there is nothing to download from my site except static html pages. The rest of the day I have been hit with these type of attacks from 6 different IP's.
My site gets about 6000 visitors a day so I think if it was something from my site these attacks
would be coming from a lot more than 8 different IP's, but it I still cannot figure it out.
My theory is that possibly these people already have a trojan horse in their computer
and somehow is set to attack sites they visit, or from clicking on a URL from an email.
Has anyone heard of anything like this or have any other ideas on what possibly could be
happening? It is just about to drive me crazy!
