mod security error

Appearing in error logs

[smells so good]

I'm finding warnings like this throughout my server error logs.

[Sat Sep 16 20:45:55 2006] [error] [client xx.xx.xx.xx] mod_security: Warning. Pattern match "([0-9a-zA-Z]+[-._+&])*[0-9a-zA-Z]+@([-0-9a-zA-Z]+[.])+[a-zA-Z]{2,6}" at POST_PAYLOAD [hostname "www.mydomain.com"] [uri "/page1.html"]

Can anyone help explain what I might be looking at? It appears that someone is searching my directories. I'm asking over here because this seems to be throwing a mod_security warning.

FWIW, each error is coming from a different IP address.

[jdMorgan]

All I can offer is an opinion based on observation of what you posted here, since I don't use mod_security myself.

The regular-expressions pattern matches the standard format for an e-mail address ([e-mail] or [e-mail], etc).
The warning mentions a POST to "/page1.html".

So, it looks like mod_security blocked an attempt to POST some data containing an e-mail address to /page1/html

Since I don't know your site, or what the effects of posting an e-mail address to that page might be, I can't comment further.

Jim

[edited by: jdMorgan at 4:53 pm (utc) on Sep. 18, 2006]

[smells so good]

Thanks Jim.

I read a few other forum posts about this warning (search for the warning) and the error seems to be localized to my webhost. I'm not sure it's a problem, since POSTing an email address to my pages won't get anyone anywhere. I'll file it on the back burner for a while.