When I sorted the whole month’s log, there’s a HUGE number of IPs involved … AWstats says 65 total in April vs. 1634 so far this month.
They replied later that they didn’t think it was FTP, except looking through the main log shows normal behavior until when that one FTP entry occurred. Then about an hour later is when all of those calls to /options.php started to happen.
From my AWstats, the average # of visits per day was <10 with < 2 KB of BW until the 15th. Then it surged to 100 - 533 visits with BW from 1.31 - 123.37 MB.
The majority of page accesses were in the USA (2659) and Germany (690).
My average number of visits per month is 150-200, but so far this month it has been > 2600, most of which happened since the 14th.
Is there anybody who studies this stuff that I could forward my logs and the files to?