Forum Moderators: DixonJones

Message Too Old, No Replies

What is Microsoft trying to do?

         

reddevil

5:25 pm on Jun 24, 2005 (gmt 0)

10+ Year Member



Today I have the following entries in my logs - does anyboby know what Microsoft is trying to do or what is happening?

83.71.152.14 - - [24/Jun/2005:03:50:50 -0500] "POST /_vti_bin/_vti_aut/author.exe HTTP/1.1" 401 490 "-" "MSFrontPage/6.0"

83.71.152.14 - - [24/Jun/2005:03:49:45 -0500] "POST /_vti_bin/shtml.exe/_vti_rpc HTTP/1.1" 200 240 "-" "MSFrontPage/6.0"

83.71.152.14 - - [24/Jun/2005:03:49:43 -0500] "OPTIONS / HTTP/1.1" 200 - "-" "Microsoft Data Access Internet Publishing Provider Protocol Discovery"

keyplyr

4:42 am on Jun 25, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



A user is opening (or downloading) your site using Microsoft Front Page, a website builder/editor.

reddevil

8:29 am on Jun 25, 2005 (gmt 0)

10+ Year Member



Yikes! I suppose this can only mean somebody has bad intentions for something? Possibly duplicating my site?

Can anybody suggest what I should do?

I only have the users IP address and so it wouldn't be possible to contact them directly?

blend27

2:01 pm on Jun 25, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



ban all user agents that have word "FrontPage" in it.

kgun

2:48 pm on Jun 25, 2005 (gmt 0)



Reddevil,

A related post here.

[webmasterworld.com...]

Do you know the Cyberwatcher company? Think it is Norwegain and well known.

But it may be overkill to use them.

KBleivik
Make it simple, as simple as possible, but no simpler.

reddevil

5:40 am on Jun 26, 2005 (gmt 0)

10+ Year Member



Thanks a lot, very useful......I just hope that guy doesn't come back to take more of my site.

reddevil

8:24 am on Jun 26, 2005 (gmt 0)

10+ Year Member



Now I think I'm becoming paranoid? Today there is another entry in my logs with the following Java message that I haven't seen before. Is this anything suspect?

209.200.82.100 - - [25/Jun/2005:01:40:58 -0500] "GET / HTTP/1.1" 200 11424 "-" "Java/1.4.1_04"

Dijkgraaf

10:43 pm on Jun 26, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Java/1.4.1_04 is listed at Project Honeypot as being a Email address Harverster, in fact it is at the very top of the of list of Top Spam Harvester User Agents.

larryn

3:00 pm on Jun 27, 2005 (gmt 0)

10+ Year Member



Hi Gang,

"Java" anything is also the default agent for any Java application that makes a HTTPD request. The programmer can change the agent name, but is not required to do so. Seeing Java in the agent name just means that the someone might be using a Java program to request a URL. I'd be cautious of blocking something just because its Java - while some people have written nasty things in Java, it does have a built-in web browser.

Larry

reddevil

3:13 pm on Jun 27, 2005 (gmt 0)

10+ Year Member



Thanks Larry,
That makes me a lot more relazed and I will just give these people the benefit of the doubt.
Cheers.