Curious Raw Logs information -- need help deciphering.
Someone hit my site about 250,000 times one day. Some of the hits were legitimate, but the rest were these:
195.92.244.174 - - [03/Feb/2002:20:08:42 -0500] "GET /404.html HTTP/1.0" 200 10071 "http://zerocattle.com/customers/images/images/http" "Mozilla/4.0+(compatible;+MSIE+5.0;+Windows+98;+DigExt)"
195.92.244.174 - - [03/Feb/2002:20:08:42 -0500] "GET /404.html HTTP/1.0" 200 10071 "http://zerocattle.com/customers/images/images/images/zc_motto_dk.gif" "Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98)"
Now, I get the occasional call for various urls with /images/images/images/ in it and I would like to know if this is some way to crack the server or what?
Please help me figure this out!
Edit: the whole raw log file for that day is here: zerocattle.com/examples/logs.zip
Edit2: I'm going to block the IP as they hit me on the 6th as well. I can't find out who this is -- ideas? Also, I'm using .htaccess to block, is there a better method?
Suzanne
doublehelix posted this at 00:25 — 19th February 2002.
They have: 117 posts
Joined: Feb 2002
I did a whois on the ip hitting you and here is the info:
Suzanne posted this at 00:33 — 19th February 2002.
She has: 5,507 posts
Joined: Feb 2000
Thanks, I have already filed a complaint with them. It's a large company that provides IPs to ISPs, so they needed a whack of information (that I was happy to provide).
Any ideas on why the calls to /images/images/images? Know of a hack that would do this?
Bloody idiot ran up my bandwidth, but I'm still under my limit, so far.
Fricking 60M log file. *rolling eyes*
Suzanne
doublehelix posted this at 01:02 — 19th February 2002.
They have: 117 posts
Joined: Feb 2002
LOL, life is grand, aint it?
I'm not sure about this. It could be a denial of service attack. I searched for images/images and the only security-type response was in Chinese (or something), so I don't know what it was about. The seemed to be having the same thing happen to them though -- a lot of hits for something with images/images in its path. Doesn't sound like an exploit because of the volume of requests.
Suzanne posted this at 01:08 — 19th February 2002.
She has: 5,507 posts
Joined: Feb 2000
it's not the first time I've gotten that odd request, but it is the first time that I've gotten it 125000 times in three days. Usually it's one or two, which is why I was wondering if it did something.
It didn't really affect my site (amusingly), but it sure did make it slow (dealing with a 60M log file, I'd assume). lol!
S
doublehelix posted this at 13:52 — 19th February 2002.
They have: 117 posts
Joined: Feb 2002
This is what I found on it regarding a piossible DoS type attack....
http://www.geocrawler.com/archives/3/192/2000/11/0/4730665/
Suzanne posted this at 19:19 — 19th February 2002.
She has: 5,507 posts
Joined: Feb 2000
Well poop on a stick, that's exactly the crap I'm getting -- how did you find that!? Thank you!
Yet another reason to love Netscape, I guess... :/
So basically, nail down the custom 404 document with all absolute urls for all links, images, et cetera and all will be well. I hope.
Very interesting, thank you!!
taff posted this at 20:12 — 19th February 2002.
They have: 956 posts
Joined: Jun 2001
Interesting! Having a custom 404 myself, I figured that I'm a sitting duck also. I was surprised to see that I have already coded it with absolute URLs which I rarely, if ever, do.
It has been quite a while since I coded the page. My only guess is that this isn't a new vulnerability and I was advised by my host to code it this way.
Of course, all memory of this was promptly purged in order to make more room for song lyrics and Simpsons trivia
.....
Suzanne posted this at 20:15 — 19th February 2002.
She has: 5,507 posts
Joined: Feb 2000
lol, amazing what you will throw out to make room for fun, isn't it!
S
Want to join the discussion? Create an account or log in if you already have one. Joining is fast, free and painless! We’ll even whisk you back here when you’ve finished.