Text 17278, 60 rader
Skriven 2007-04-06 12:25:30 av waldo kitty (1:379/45)
Ärende: webserver attack??
==========================
From: waldo kitty <me@privacy.net>


i've been slack (again) in analyzing my web server logs... in looking at them,
since the first of the year, something jumped out at me starting on March
3rd... no clue as to what is going on... but it is something and it is
obvious...

  1. first thing is this is an obscure and low traffic url.
     at the most, maybe 50 hits in a month since 1999.
     average hits a month since 1999 is less than 20.

  2. it raked in over 7000 (!) hits in March with no other
     url getting anywhere near close. the next highest
     doesn't even hit 1000.

  3. no referers for the hits in question.

  4. they grab the html file only. not the css or graphics.

  5. they're all the same useragent.

  6. they come from all over the world without any sort of
     pattern that i can detect.

  7. they are a few seconds to a few minutes apart.

the url in question is windowslinks.html on my domain in my sig... there's
nothing there of any real import... it is just a links page with, i think, 5
links on it... two or three related to the old PALACE chat software (two of
them being to studies the PALACE author did on social interactions) and then
the other links are just plain old links... nothing special, really, about any
of them... definitely nothing to warrant the attention that is being given to
the url...

it has been suggested that maybe it is one site and that the source ips are
being spoofed... this is possible but i can't fathom why someone would do
this... maybe i've pissed off a forum spammer by blocking their bots in my
firewall? i dunno... i don't recall when i turned off guest posting with
captcha... i could probably tell by looking at the last system updates post in
the forum, though ;)

anyway, i'm wondering if anyone has seen anything like this before... the log
is being posted in xls format in binaries with the same subject... it only
contains hits for the url in question and those since the beginning of the
year... the main reason for using xls is the fixed width field so that the UAs
can be seen easier... i've done no sorting of the output at all... what you see
is what grep spit out... it is an apache log so the format may be a bit
different than what you IIS admins are used to ;)

--
       _\/
      (@@)                      Waldo Kitty, Waldo's Place USA
__ooO_( )_Ooo_____________________ telnet://bbs.wpusa.dynip.com
_|_____|_____|_____|_____|_____|_____ http://www.wpusa.dynip.com/
____|_____|_____|_____|_____|_____|_____ ftp://ftp.wpusa.dynip.com
_|_Eat_SPAM_to_email_me!_YUM!__|_____|_____ wkitty42 -at- alltel.net

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)