Multiple-IP hits

Following up on an odd 404 querystring I discovered the following weird behaviour.

The first line in the log showed a valid page request from 94.76.69.n. The page, pagename.asp, included a bot trap in the header.

The next log line, which triggered the 404, showed:
/pagename.asp/x/trapname.asp from IP 94.76.69.n

where x is a target trap folder and trapname a trap page in that folder linked from the original page's header, as noted. It obviously picked up both the pagename and the page's bot-trap URL and combined them. This in itself is odd and triggered an IP ban. This and all subsequent hits on the site from that IP and others returned 403.

The weird bit is that the resulting 404 occurred three times, once from the original IP, once from 123.125.156.nnn and once from 120.28.64.nn, all within about 3 seconds (all trapped by IP due to previous or newly trapped bad behaviour). The 404 querystring was exactly the same in each case.

Subsequent hits were all grouped in threes. The above IPs were involved seemingly at random together with a few others, mostly from APNIC ranges but an Amazon AWS (174.129.216.nnn) IP as well (all Amazon AWS IPs are permanently blocked here). Total IPs involved: 21

At no time was there a referer so I have no idea where the hits originated. They did not hit all pages but they did hit all of the forms. My guess is that they came in on the back of previous (undetected, which would be unusual) scans or from an SE of some kind. The original (random?) page was followed by the home page then by another (different) trap URL. (I often see scans from banned IPs that continue seemingly at random despite 403s.)

The whole session logged the same session cookie, which in my experience is unusual for bots, especially across varying IPs (I assume the IPs were part of a botnet). The session cookie helped trap accesses by the other IPs involved.

User-Agent in all cases:
Opera/9.70 (Linux i686 ; U; zh-cn) Presto/2.2.0

No headers set except HTTP_ACCEPT (but to what is not logged).
Note gap in "Linux i686 ;"

Presto seems to be an Opera engine. My linux version of Opera is 9.80 with Presto 2.2 (can't get it to update to 10.10) but it includes X11 in the UA (this doubtless changes according to linux flavour so probably no indication of trappability).

Total pages hit: 20 (approx half of site's pages; most use querystrings but none were included in the hits).

Multiple-IP hits

botnet activity?

dstiles

enigma1

dstiles

enigma1

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week