Please help NewTorrents
This post will be a bit unusual here at Releaselog, but my options are limited. You probably recall a post about one month back where we published some nasty pics of Britney Spears and our server was almost unaccessable in the following week. I can definitely say it wasn’t because of these pictures, but because of something completely different: someone released a new version of some software, which was connecting to our RSS feed at NewTorrents in very massive batches. I’ve solved this problem by reinstalling almost all software on the server and redirecting traffic from the RSS feed.
I’m writing about it now because, a few days ago, probably the very same person released a new version of this software, and it’s causing the same thing. I feel that the only chance we have to solve this problem is by finding this software, contacting the author and removing this software. I would be really happy if you could help us a bit too. I’ve already made an attempt at finding software like this, but my so far my attempts have not shown any success.
What are we trying to find is most likely a BitTorrent client or any other peer to peer application, which works with RSS feeds or displays the latest torrents from NewTorrents.info in some way. There are many many clients which can do this, and I believe that involving more people in our search will help us find the culprit faster. To be fair, I’m offering a $30 reward for the person who points us to the correct application (payable via PayPal or Moneybookers). So please try to help us, try some torrent clients, or anything else. Every comment is welcomed.
Few technical details: the usual amount of connections to NewTorrents is something like 200 requests a second – now with this extremely poor coded thing (or extremely popular) requests have shot up to 1000 requests per second (which is burning up our servers). All requests leads to URL www.newtorrents.info/rss.php. It is also causing extra traffic of about 60 GB a day, which results into something like 2 TB of overusage a month. And I must pay for that of course.
This traffic jump is clearly visible on the graph I attached to this post. There is no referer, and every request comes from different IP addresses, so that’s why I assume it’s some client or application. Webserver which would include our RSS would send the referer and the IP would be same with all connections. This flood started on Wednesday 27th December, so every software released in the new version on this date is highly suspicious.
Comments(55)
Ofcourse we would all try to help, But why dnt u stop the rss feeds temporarily until the problem is solved?!
2TB a month, damn.
wish i was able to help.
2 ElKiNG: Of course I’ve tried to do this. But because it is not a webserver but some application probably, and there’s this hardcoded URL, it continues to flood the server with connections even when there’s no such a file on the server (it’s similar effect like DDoS attack). So disabling RSS really doesn’t work, I’ve tried this 2 times already.
I have it martin!
on 27 december is “Azureus Ultra Accelerator 2.5.7″ gereleased.
Azureus has a RSS reader… So i thing this might be it!
I use Torrent Search Toolbar for Firefox (http://www.torrent-search-bar.com/)
It has RSS feed for newtorrents.
I have not checked whether it makes so many requests..
here is a link to the program + some info:
http://www.softpedia.com/get/Internet/File-Sharing/Azureus-Ultra-Accelerator.shtml
You could disable RSS for a while perhaps … . Or host the RSS feeds on a different machine, or atlernatively try using feedburner for your RSS feeds. Let them handle the traffic
I could think of the same thing i.e. disabling RSS feeds temporarily, anyhow couple of suggestions.. on the rss.php you can write a function to grab the IP of all incoming requests and that would get you closer to the problem. Look up PHP scripts IP grabber.
thanks Scit, fast reply, I will analyze that!
I was already playing with hosting the RSS feed on different machine, or using FeedBurner, but it didn’t help too much. and Vajid, I don’t see any point in logging IPs – they are different every time.
Martin, had u check the torrentflux script?! it has RSS
there is a big chance that is a stupid user (or more) with a misconfigured software. i had the same problem on my blog, some retard set his check time to 3 minutes.
So I’ve checked this Azureus Accelerator but although the release date fits, it doesn’t seem to be responsible for that. It’s just a simple application somehow accelerating torrent downloads, and it doesn’t work with RSS in any way.
I’ve contacted creators of Azureus though, because they release many new versions all the time and their client is very popular.
And about Torrentflux, I don’t think this could be what we search for, as it’s not so popular to generate these thousands of requests from different IPs from the whole world. But I’ll check it as well.
I did a search and came up with this:
TVTAD-2.00-w32install.exe release 12/18
[Latest - Main] itunes-rss-server.exe
Thursday, December 28, 2006, 10:04:36 PM
Latest – Main] Motorola Rss Depot r01 16 10.zip
Thursday, December 28, 2006, 10:04:36 PM
It sound like someone came up with a program to try accelerate the downloading process.
Drew
thanks Amperage – I’ve installed all these applications but none of them contains anything connected to NewTorrents by default
Hello,
hopefully this link could be of some help:
http://en.wikipedia.org/wiki/Comparison_of_BitTorrent_clients#Features_.28continued.29
Bittorrent, which merged with utorrent, released bittorrent 5 in november…worth a check maybe?
I still think it has SOMETHING to do with azureus. Maybe not the plug-in i said. But they released 3.0.0.3 a couple of days ago, and you have tons of plug-ins for it.
Anyway, i’ll keep looking for something.
btw, Martin. Did you get my mail a few days ago?
BitComet 0.81 [Dec 27, 2006] ? dunno if it has any RSS support ..
Allright i know how it is done.
Pay me $30 lolz
my email: rahuldhaval@gmail.com
check out screenshot……
http://img135.imageshack.us/img135/5608/untitledfe8.jpg
Actually, I too think that the Firefox toolbar could be the reason for this. It stopped working for NewTorrents last week, so…there ya go.
http://www.torrent-search-bar.com/
2 Rahul: hehe that’s very lame attempt – this wouldn’t make connections from 800 different IPs at one second…
and about BitComet – I’ve tried new version and talked to developers, and there’s nothing with NewTorrents either
Did you try tracking the geolocation of the IP addresses? This could lead to some interesting info. For example chinese or german users…. hence a german or chinese product….
nice idea @ geolocations …
can you do any cross reference with the ips that flood the rss and the ips currently connected to the tracker and are downloading and see if there is a client match ?
Is there any torrent client based on IRC and uses its Bots or something?! coz i dun think this is a program as its changes its ip many times!
Hello… i use Greatnews rss reader
http://www.curiostudio.com/
maybe it’s this one…
Hello… i use Greatnews rss reader
http://www.curiostudio.com/
maybe it’s this one…
and yer comments is borking with errors here..
Hello… i use Greatnews rss reader
maybe it’s this one…
and yer comments is borking with errors here..
2 Pentium: i have tried this already, they are basically from all countries, nothing specialized.
i have checked this torrentharvester, but it won’t be our problem, it doesn’t work with RSS. I think that this Torrent Toolbar for Firefox will be the one – it shows latest RSS releases and has all other matches.
Or maybee Safari on a Mac with RSS?
Or mobile phones with RSS, such as Nokia (i doubt it).
or XTorrent, on Mac, with RSS?
found another one:
Right Web Monitor (pro)
http://www.right-soft.com/webmonitorpro/
Latest update: 27 december
The program has more then 12.000 downloads since dec. 27th
Qoute from their website:
“Right Web Monitor constantly polls the specified internet resources and notifies you by adjustable alert methods when any changes occur.”
I wish i could help, but i’m not using RSS or have any knowledge of that kind of tech.
Try removing this from New Torrents Meltdown.2006.STV.DVDRip.XviD-NEPTUNE
as its probably not helping the situation. I get a message saying no leaching and also no seeds or peers showing in BitComet. Maybe thats how this person gets in. I really have no hacking experience so you may ignore me and i wont feel bad.
just write a shell script that bans every ip with more then 5 connections within 10 minutes
-> problem solved 
))))
okay MAYBE not the best solution tho
)
OK, I wrote an email to this guy hidden behind Torrent Search Toolbar and I hope he just confirms that he’s using this URL and fix it with one I prepared for him on the second server.
When will this happen, I’ll send the money to vVVv / kaile, as they were the ones who pointed me to this thing.
Thanks everyone for now!
did you check the 10 ips with the most hits? maybe if you post that list, we can check if we are in the list and we can report what we are using…
dunno, sounds convincing but Torrent Search Bar 4.5.126.0 Date Added 08-Dec-2006 …21 days delay ?
Id fake ip an big deal hehe …..
Allright Get confirmation ,then we may setup like
Test attack .I know this site has Lot of fans includes me + lot of rival enemies
Is fake ip an big deal hehe …..
Allright Get confirmation ,then we may setup like
Test attack .I know this site has Lot of fans includes me + lot of rival enemies
does it happen same time that you release torrents on to the rss because if you didnt realise any thing on the rss there woudlnt be anything to use and your rss file would be like a kilobyte.. and many cleints have readers i dont belive a single one would be able to do that much damage from one ip and the way id deal with the doss is to make it refer the rss to a diffrent page make a simple browser referal and that way it wont be hitting your server as hard
im also using the torrent search toolbar in firefox but dont use the rss. i just go to the site and click on the menus
hope you solve this fast
Hey Martin.. Wud dare b ny way to prevent it through router configuration and stuff lik dat…..
omg 30 dollars..better apply for that bmw i’ve wanted…but i guess some dudes can be motivated by that ..enjoy
shut up
Martin ,
I suspect the torrent search toolbar also because when completely on (all option’s) it generates huge ammounts of traffic and connection’s renewing almost constantly
It slow’s the system and firefox down like 50 % here
And the updates follow auto with firefox so whenever the creator’s release a new update probably thousands of ppl get the notification and update following the bashing of the rss as result …
And don’t care bout the 30 bucks really not , invest it in the bandwith check or hardware to keep Releaselog and NT alive
I don’t want those 30 dollars, glad I could help.
thanks again for all comments, I’ve received a mail from creator of this toolbar and he fixed that – now we just need to wait a bit until everyone updates his toolbar, and it should be fine then.
and kaile, that’s also very nice of you. if this person hidden under nick vVVv wants his reward, I’m fully prepared to send it to his account as I promised.
Nice solving, this quest is more difficult than doing one of those sudoku games lol. I hope things will settle themselves now. Hoeray for rlslog!
Congrats on the fix Martin
thank you kaile and vVVv.
hi
could someone be trying to sabotage New Torrents? maybe jealous of ur traffic? i for one always look to New Torrents first for all my TV program downloads. I use Torrent Spy for movies cuz their comments section of each torrent is very helpful. but New Torrents is my fav as i dont download many films and i hate seeing girl pics on other sites. NT is nice and clean and easy to navigate. keep up the good work. hope u sort it. sorry couldnt help, not much of a techi.
take care
alliyah
Conclusion? Community rulez!
I use thunderbird for the RSS feed here, this is how I can keep up to date!
Obviously fixed now, but couldn’t you have logged the user-agent going for the rss?
Even if it’s a naughty client that doesn’t send anything identifying you’d know what it _wasn’t_.
Hey!
Thanks for the “Thanks”
Thats enough.
I am a regular visitor of Releaselog. Keep the money for site’s improvement.
All the best. I love this exiting community.
hihi .. community rules
other opportunity would have been to write a rss.php that contains “if you read this plz report your user agent to some@email.com” and wait two days what people submit and thenn cross reference there ips ..
http://bittyrant.cs.washington.edu/ i believe this is a new bt client that only cares about DLing rates and etc