Hits every few seconds

Strange POST requests

[mhwatson]

Hi,

I'm new here, so please bear with me. I have one site whose logs show requests every few seconds as follows:

"POST /index.php HTTP/1.1" 200 31063 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

Always the same user agent, and seemingly from random IP addresses. Any clues what it might be? I've rebuilt the site a couple of times at the request of my host, but the hits keep coming.

I've tried blocking the user agent in .htaccess, unfortunately blocking my own browser... And why the POST request?

Any advice on kicking these requests into the long grass?

Thanks for listening,

Martin.

[gergoe]

You would need to find out what they are posting to your index.php, and one possible solution for that is to enable logging in index.php, that there's a posted content, save it into a file, with the browser agent and the referrer included. An another way would be ton run a packet monitor and keep it running until such a request comes up, and examine the data.

It could be because of numerous reasons, someone is doing brute-force attack on a login system (if there's any), or you get hits from an another website, or the competitor tries to break down your webserver (joking), and there can be many other explanations, without examining the post data you will not be able to figure it out.

[mhwatson]

Hi,

Thanks for your reply. After a bit of trial and error I'm managing to send a 403 to these requests, and the server has quietened down significantly.

I have a copy of the site on a local server which got hit the same way, so I'll get that online and redirect to it for a while. Would Wireshark or similar give me the info I'm after, or do I need something more specific?

Final question for now - is it better to send 403 or 404? Is there a 'best practice' for this?

Thanks again,

Martin.

[lammert]

403 Access Denied is the proper response, because this is what you are doing, denying access to those bots.

[mhwatson]

Thanks for that - 403 it is!

Martin.

[gergoe]

Wireshark, or anything similar will do it indeed. If you happen to know the originating ip address, then make it filtered on that, so you don't get all requests, only the relevant ones.