.b2b3a

[wilderness]

Anybody have any idea what these refers are?

They begin with the subject line as a directory and are followed by a php request, and search on various words.

Their coming from multiple bots.

Possibly a result of some hijack-malware or virus?

[wilderness]

No replies on this?

Here's a recent refer, which results in a 404:

/.b2b3a/template.php?watch=bryan-danielson

[tangor]

Not run into this one... but heck, it's only Thursday!

[wilderness]

119.63.198.zzz - - [02/May/2010:17:17:32 -0600] "GET /.b2b3a/template.php?watch=watch-summerslam-2009-free-online HTTP/1.1" 404 490 "-" "Baiduspider+(+http://www.baidu.jp/spider/)"


88.131.106.zz - - [07/May/2010:22:41:10 -0600] "GET /.b2b3a/template.php?watch=kristen-dalton-miss-usa HTTP/1.0" 404 435 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) Speedy Spider (http://www.entireweb.com/about/search_tech/speedy_spider/)"


67.195.114.zzz - - [11/May/2010:09:01:48 -0600] "GET /.b2b3a/template.php?watch=marlene-dietrich HTTP/1.0" 403 454 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; [help.yahoo.com...]

[tangor]

The term is (apparently) from the Human Genome...

Haplogroup B2b3a (M108.2) has been found in 25% (1/4) of a very small sample of Lissongo from Central African Republic.

[wilderness]

Thanks Tangor.

I tried a google and the results were too many and not relevant.

I'm still inclined to believe this is some kind of hijacking or malware causing the refers.
I had accepted the two Euro requests, however the Yahoo/Slurp requests prompted my inquiry here.

[tangor]

Most of the time I see these in the same category as log spam. As long as they are eating 40x I don't mind, my logs are not visible to world+dog.