robotsdobetter
msg:354796 | 8:07 pm on Jul 24, 2004 (gmt 0) |
It's very diffacult to track them down because they are using fake IPs, but I am not a expert in this area. You also can't block them because all those IPs are fake.
|
walrus
msg:354797 | 8:52 pm on Jul 24, 2004 (gmt 0) |
uh oh,
i just added them all to my htaccess,
sure i shouldnt block em?
Thanks
Walrus
|
microcars
msg:354798 | 9:40 pm on Jul 24, 2004 (gmt 0) |
I get those too, but they are trying to access non-existant cgi-bin files. (at least in my case...) The site in question has no cgi-bin folder!
|
pendanticist
msg:354799 | 9:54 pm on Jul 24, 2004 (gmt 0) |
I'm curious. How do you know they are fake?
|
uncle_bob
msg:354800 | 10:17 pm on Jul 24, 2004 (gmt 0) |
Because they don't all ask for the same file, I've always assumed they are zombied machines. If they were fake, I would assume there would be more requests for the same file.
|
pendanticist
msg:354801 | 10:25 pm on Jul 24, 2004 (gmt 0) |
Oh. I thought you were saying that the IP numbers themselves were fake.
|
walrus
msg:354802 | 3:30 am on Jul 25, 2004 (gmt 0) |
Thanks for the replies,
they didnt all ask for the same files ,and they are non existant on my site.
Im leaving them blocked for now.Maybe i should post the whole excerpt from the log?
Walrus
|
m_shroom
msg:354803 | 4:14 pm on Jul 25, 2004 (gmt 0) |
I report all my firewall hits to [dshield.org...] they my be of some help.
|
walrus
msg:354804 | 8:54 pm on Jul 25, 2004 (gmt 0) |
DSheilds a good idea.Ive also just forwarded them to my server to see if they can find the reverse path.
Man can see why they say hacks and viruses cost the economy so much.I'm spending hours chasing spectres and log anomolies,and less time maintaining and building my site.
|
|
