What is that guy doing? 50,000 requests in 3 hours

Thousands "GET /404.html HTTP/1.0" in log files from the same iP

[benni_203]

Hi,

I am a little confused about what I just found in my log files. It has the same request over a period over 3 hours (I replaced the actual IP with xx.xx.x.x to protect the "innocent", it is always the same IP):

xx.xx.x.x - - [21/Jul/2005:17:25:53 -0400] "GET /404.html HTTP/1.0" 302 281 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
xx.xx.x.x - - [21/Jul/2005:17:25:54 -0400] "GET /404.html HTTP/1.0" 302 281 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"

This keeps on repeating over 50,000 lines. Sometimes it hits a site.

What is that guy trying to do? The only thing I could think of would be him trying to get in to my php sendmail script which I use for a feedback form? Or am I just paranoid?

Thanks for your opinion!
Benni

[jatar_k]

he for some reason seems to be actually requesting the 404.html page, or is it another page he is requesting and he is getting a 404?

strange, do you have error logs? any more info in there?

[benni_203]

Many Thanks for your feedback! In addition, I can provide the Apache referrer logs, here is what it says. There is basically nothing going on on this site, so it is easy to follow:

Line 266: (regular url from my website) -> /pics/europemap.jpg
Line 267-1291: - -> /404.html
Line 1292: (regular url from my website) 
Line 1292-1296: - -> /404.html
Line 1297: (regular url from my website) 
Line 1297-8237- -> /404.html

Then another regular request, another couple of thousand 404's and so on.

BTW - the same was happening today again, but from a different IP and only a couple of hundred times. So I start wondering if anything on the site maybe could throw a regular visitor into a loop until he closes his browser.

xx.xx.x.x - - [21/Jul/2005:14:32:25 -0400] "GET /usa-maps/usa-map-22.html HTTP/1.0" 200 6944 "http:// --- MY URL ---/usa-maps/usa-map-start.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
xx.xx.x.x - - [21/Jul/2005:14:32:25 -0400] "GET /pics/usa-map-22.jpg HTTP/1.0" 200 25013 "http:// --- MY URL ---/usa-maps/usa-map-22.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
xx.xx.x.x - - [21/Jul/2005:14:32:50 -0400] "GET /favicon.ico HTTP/1.0" 302 281 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
xx.xx.x.x - - [21/Jul/2005:14:32:50 -0400] "GET /404.html HTTP/1.0" 302 281 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
xx.xx.x.x - - [21/Jul/2005:14:32:50 -0400] "GET /404.html HTTP/1.0" 302 281 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"

and then the last line keeps repeating with another couple of thousand 404's

[jatar_k]

hmmm, sounds almost like it is caught in a loop

does the page 404.html exist?
is it in the root folder of your site?

why is that giving a 302? The page should give a 404. For my logs it shows the 404 code and then doesn't even show our custom 404 page in the logs.

[benni_203]

Hi,

I finally figured it out. It actually IS a loop, created by myself ;-). There is a problem when I redirect to my 404 in the wrong directory; it simply puts itself in a loop and stays there until the browser closes.

Thanks for your time looking at it.

Benni