Forum Moderators: open
It looks like some worm or virus has taken over some machines out there, and these various zombies are fast-crawling (if they're on broadband) several of our sites in a sporadic fashion. The referrer has to be bogus, a sort of "worm signature." Needless to say, we have no links from the International Atomic Energy Agency.
I can't find anything on this in Google Groups, except for one small piece of suspicious activity reported last February.
Does anyone see recent activity from multiple domains leaving this sig?
The posts I just read didn't suggest the zombie angle. If this thing has been zombied, it may be in a position to DoS us and I have some coding to do.
<edit>Nevermind I found it</edit>
When they try to "visit" my site, they are using iaea.org as an {HTTP_REFERER}, not as a
{REMOTE_HOST}. The log entry shows that the request does not come from iaea.org, it was
refered by a link on iaea.org. So unless iaea.org is really linking to your site, this is likely just
a spamtool with a faked referer field to fool filters (like mine) that reject requests for certain
pages if they come in without a valid referer...
I haven't been visited by this agent in a long time, but a block on requests refered from iaea.org
is one of the very oldest entries in my "go away" list.
Jim
So unless iaea.org is really linking to your site, this is likely just a spamtool with a faked referer field to fool filters (like mine) that reject requests for certain pages if they come in without a valid referer...
The fact that the history of this thing goes back a year or so is further evidence that it's most likely a spam tool rather than some sort of zombie threat.
Dang! Got carried away and forgot to answer your main question...
Yes, I had a visit last weekend. I'll have to check my logs this evening and see if it came from
multiple remote-hosts.
Just to be clear on this thread, how do you define "zombie" - a distibuted agent for launching DOS
attacks? - I are an engineer, and like to make sure I understand how the terms are being used. :)
Thanks,
Jim
I see this a lot. It just looks like a user has clicked through froma link. Very strange.
The “BillGate” one seems to be interested in graphics the others does not really put an overload on my bandwidth, therefore I don’t take the time to block them.
www.iaea.org is still showing up on my logs on a daily basis. Since my site does not have anything to do with them, I have blocked it.
For a better Internet
hanuman
This is also why "http://www.iaea.org" crops up in several of the .htaccess posts which relate to blocking spambots and other malicious bots. I'm sure a site search would throw up several examples of these scripts.
- Tony
