what's this: "GET /watch-info HTTP/1.0" 403

[meinereiner]

I have found this recently in my logfiles:

62.141.48.226 - - [01/Jun/2003:03:55:01 +0200] "GET /watch-info HTTP/1.0" 403 5597 "-" "-"

It's accessing a non existing (never existed!) page and always get's a 403 back, but doesn't stop - it's taking the page exactly every 5 minutes, what the hell is this thing about? I found nothing in the searchengines regarding this bot (if it is one) unfortunately, just stats of other sites also getting this "guy" on their /watch-info - it's "only" 51,840MB a month but hey, this is way to much for nothing worth!

So please if someone has an idea or nows, please help me to clarify this, thanks.

* Excuse my bad english please, thanks. *

[bonanza]

Probably just some knucklehead playing with a spider.

Look up the IP block that that IP address is in.
I bet it's some ISP somewhere in the world.

They'd earn themselves a quick IP block on my server.

[jdMorgan]

meinereiner,

Welcome to WebmasterWorld [webmasterworld.com]!

If you can't block this IP address at your firewall, consider "splitting" your 403 page. Copy your existing 403 page to another page (I call mine 403info.html) and then replace your 403 page with a very small page that says only "403-Forbidden - Click here for more information" with both a link and a 5-second meta-refresh to 403info.html.

The purpose here is to greatly reduce the size of your "main" 403 page and reduce the bandwidth this idiot is consuming.

Also remember to "allow" access to 403info.html in your access rules, so as not to cause a 403-error loop.

HTH,
Jim

[bull]

like that :?

RewriteCond %{REMOTE_ADDR} ^62\.141\.48\.226 
RewriteRule ^.*$ idiot\.htm [L]

with the size of idiot.htm -> 0

[jdMorgan]

bull,

That's not what I had in mind, but I suppose you could redirect just that one IP address...

RewriteCond %{REMOTE_ADDR} ^62\.141\.48\.226$
RewriteRule .* /idiot.htm [F]

However, even if idiot.htm were empty, the headers will still consume some bandwidth, so I prefer to make my 403 error page useful.

Jim

[Simon Coggins]

Not sure this really helps, but a file called watch-info is used on my host to track disk usage:

[f2o.org...]

So perhaps your host has a script to regularly check your disk usage, but the watch-info file isn't configured or something. On my account there isn't a watch-info file in public_html, but it does appear when I go to /watch-info via the web.

Maybe check the IP address and see if it's similar to your host's?

Simon