Welcome to WebmasterWorld Guest from 34.228.143.13

Forum Moderators: Ocean10000

Message Too Old, No Replies

KKman2.0 With Strange Characters in Logs

     
7:24 pm on Feb 2, 2011 (gmt 0)

New User

10+ Year Member

joined:Jan 28, 2009
posts: 17
votes: 0


Would someone kindly interpret what exactly this KKman thing is and what it seems to be requesting/injecting/whatever?

212.117.177.213 - - [02/Feb/2011:10:57:21 -0700] "GET /newreply.php?do=newreply&noquote=1&p=18882++++++++++++++Result:+%F4%EE%F0%F3%EC+%ED%E5+%ED%E0%E9%E4%E5%ED+/+%ED%E5+%F3%E4%E0%EB%EE%F1%FC+%EE%EF%F0%E5%E4%E5%EB%E8%F2%FC+IP HTTP/1.0" 403 1792 "http://(MY SITE).net/newreply.php?do=newreply&noquote=1&p=18882++++++++++++++Result:+%F4%EE%F0%F3%EC+%ED%E5+%ED%E0%E9%E4%E5%ED+/+%ED%E5+%F3%E4%E0%EB%EE%F1%FC+%EE%EF%F0%E5%E4%E5%EB%E8%F2%FC+IP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"
212.117.177.213 - - [02/Feb/2011:10:57:22 -0700] "GET / HTTP/1.0" 403 1614 "http://(MY SITE).net/newreply.php?do=newreply&noquote=1&p=18882++++++++++++++Result:+%F4%EE%F0%F3%EC+%ED%E5+%ED%E0%E9%E4%E5%ED+/+%ED%E5+%F3%E4%E0%EB%EE%F1%FC+%EE%EF%F0%E5%E4%E5%EB%E8%F2%FC+IP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"
212.117.177.213 - - [02/Feb/2011:10:57:22 -0700] "GET / HTTP/1.0" 403 1614 "http://(MY SITE).net/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"
212.117.177.213 - - [02/Feb/2011:10:57:23 -0700] "GET / HTTP/1.0" 403 1614 "http://(MY SITE).net/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"


"(My Site)" was replaced by me.

Also note the 403; I had pre-banned this IP at some earlier date for some other reason.
8:24 pm on Feb 2, 2011 (gmt 0)

System Operator from US 

incredibill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Jan 25, 2005
posts:14664
votes: 99


Looks like a comment spammer to me.

Also see: [webmasterworld.com...]
8:57 pm on Feb 2, 2011 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
posts:5496
votes: 3


Sister site:

94.102.63.zz - - [22/Feb/2010:06:14:08 +0000] "GET /MyFolder/MyPage.html HTTP/1.0" 410 1228 "http: //theinvestblog.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"


My site (note requested page same as referring page:

218.6.15.zz - - [20/Feb/2010:13:10:31 +0000] "GET /DifferentFolder/DifferentPage.html HTTP/1.0" 410 1245 "http://www.example.com/DifferentFolder/DifferentPage.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"
3:14 am on Feb 3, 2011 (gmt 0)

New User

10+ Year Member

joined:Jan 28, 2009
posts: 17
votes: 0


Thanks. I was aware it was a comment spammer by checking the Project Honey Pot and Stop Forum Spam databases. I meant to ask what correlation there is between the KKman2.0 UA and that string of characters -- what that seemingly obfuscated message was meant to represent and how a forum would render it in a language.

Sorry for not being clear.

Also I did check that other thread, but posting there has been disabled due to thread age.

I tried using urldecode, rawurldecode, base64_decode, and parse_url but none of these returned a readable message.

Any ideas?
10:46 am on Feb 3, 2011 (gmt 0)

System Operator from US 

incredibill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Jan 25, 2005
posts:14664
votes: 99


perhaps it's in unicode
4:59 pm on Feb 3, 2011 (gmt 0)

New User

10+ Year Member

joined:Jan 28, 2009
posts: 17
votes: 0


Thanks. I tried these:

[code.cside.com...]
[people.w3.org...]
[macchiato.com...]

But none returned a readable message.

I guess it's not important, more a case of curiosity on my part.
 

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members