searching for formmail

another candidate to ban?

[bull]

206.204.200.68 - - [09/Sep/2002:17:05:43 +0200] "POST /cgi-bin/formmail.pl HTTP/1.1" 404 516 www.---.de "http://www.google.com/search?hl=en&q=piccoli&start=440" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)" "10.67.125.159"

this machine searching in google for a common italian word, SERP: 440 [!]. This is surely not a human.

ip translates to:
OrgName: ConXioN Corporation
OrgID: CONX

any ideas?

[Dreamquick]

It might be a human using their browser - you never really know! I run an ASP based site so in my logs the dead give-aways for formmail scanning bots are;

1) consistantly no referrer with requests
or a hardcoded referrer which does not exist (normally /contact.html)
or whichever page they last requested (as you observed often starts with an SE results page)
2) no cookie handling / incorrect cookie handling (you often get given every cookie the bot ever recieved)

My personal view is that as long as they failed then its not worth the effort reporting them to abuse@[their isp] unless they caused you serious problems as this frequently achieves next to nothing - if they did succeed then take whatever matters you feel are neccessary.

- Tony