Hi Michael,
On Wed, Feb 01, 2012 at 03:31:58PM -0600, Michael Corliss wrote:
Ok, ran tcpdump with the following result:
$ sudo tcpdump -vpni eth0 'src net 212.13.194.0/23 and not arp'
212.13.195.254.80 > 180.76.5.52.34209: Flags [S.], cksum 0x2eb3
212.13.195.254.80 > 180.76.5.52.34209: Flags [.], cksum 0x84f9
212.13.195.254.80 > 66.249.72.20.49028: Flags [S.], cksum 0x3588
I see the same few IPs in the destination, and I looked them up: Baidu and
Google.
Ah, perhaps they have been slow to pick up the new IPs.
I take it these are "scans"?
Maybe.. If you used the -A option to tcpdump you can see what web
stuff they are requesting as well. It may be that they are just
scanning every IP for port 80 to see if there is a web site on it.
But if that's the only traffic, am I'm only
facing a drop in
search ranking if I delete that IP?
I would be surprised if search ranking dropped, given that you've
had the same site on the new IPs for a week or more.. but I don't
know for sure!
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting