HappyFunBot

[nmjudy]

Noticed this in my logs. Who are they and what were they looking for?

209.210.25.222 - - [02/Jan/2006:04:39:41 -0500] "GET /a[i];}} HTTP/1.1" 404 5590 "http://www.mysite.com/" "HappyFunBot/1.1 (+http://www.happyfunsearch.com/bot.html)"
209.210.25.222 - - [02/Jan/2006:04:39:41 -0500] "GET /x.oSrc; HTTP/1.1" 404 5590 "http://www.mysite.com/" "HappyFunBot/1.1 (+http://www.happyfunsearch.com/bot.html)"
209.210.25.222 - - [02/Jan/2006:04:39:41 -0500] "GET /x.src; HTTP/1.1" 404 5589 "http://www.mysite.com/" "HappyFunBot/1.1 (+http://www.happyfunsearch.com/bot.html)"
209.210.25.222 - - [02/Jan/2006:04:39:42 -0500] "GET /a[i+2];} HTTP/1.1" 404 5591 "http://www.mysite.com/" "HappyFunBot/1.1 (+http://www.happyfunsearch.com/bot.html)"

[Daniels_Web]

I noticed the same thing about a week ago and followed the link. It seems that it was a German link search site something like Yahoo's MyWeb 2.0.

[nmjudy]

Any idea what they're getting?
ie
GET /a[i];}}
GET /x.oSrc;
GET /x.src;
GET /a[i+2];}
?

[Pfui]

I found the iffy snippets in one line of JavaScript image-swap code on a ton of sites:

function MM_swapImgRestore() { //v3.0 
 var i,x,a=document.MM_sr; for(i=0;a&&i<a.length&&(x=a[i])&&x.oSrc;i++) x.src=x.oSrc; 

(Use any major search engine and look for: "x.oSrc" )

No clue why three GETs unless the bot choked on (or burped up:) the code.

[Daniels_Web]

They are only crawling the pages listed in the logs. I don't think they are hostile in any way.