Results 1 to 8 of 8
  1. #1
    Full Member
    Join Date
    January 18th, 2005
    Posts
    322
    This morning I’m checking out logs on one of my sites and see that someone has been scanning for formail.pl. This guy didn’t give up when he got a 404. He kept on scanning for other variations form2mail.pl, form2mail.cgi, etc. It total he tried over a dozen combinations.

    If that wasn’t bad enough, I start checking an anomaly on another site, and discover that I’m being hit by what appears to be a spider from the Department of Defense. The user agent shows up as Mozilla/3.01 (compatible; ) and it has been hitting the same page mercilessly. My stats program doesn’t report it, but when looking at my logs in excel, I saw that in a 12 hour period, it downloaded the single page almost 300 times. As of Thursday morning it had pulled 4669 kb from my server this month. And yes I checked the IP address and its part of a block owned by the Department of Defense Network Information Center.

    Jason
    “I get on my knees and pray, we don’t get fooled again!” – Who said that? I said that!

    [This message was edited by NewcastleB on July 04, 2003 at 12:23 AM.]

  2. #2
    Resident Genius and Staunch Capitalist Leader's Avatar
    Join Date
    January 18th, 2005
    Location
    Florida
    Posts
    12,817
    I've had people look for Formmail a lot, too. I don't think a day goes by without some idiot wishing I had it.

    As for the DoD--I'd just ban 'em...obviously they don't know how to program a spider! It sounds like it's caught in some sort of endless loop.

    ~Revenue is King

  3. #3
    Super Sh!t Stirrer SSanf's Avatar
    Join Date
    January 18th, 2005
    Posts
    9,944
    NewcastleB, have you been a BAD boy?

    Should we worry?

    The Wolf Credo: Respect the elders. Teach the young. Cooperate with the pack. Play when you can. Hunt when you must. Rest in between. Share your affections. Voice your feelings. Leave your mark.

  4. #4
    Full Member
    Join Date
    January 18th, 2005
    Posts
    322
    <BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>Originally posted by SSanf:
    NewcastleB, have you been a BAD boy?

    Should we worry?
    <HR></BLOCKQUOTE>

    Funny thing is, it’s hitting a page promoting Mondera. I guess it can’t tell the deference between “A Rock” and “I Rock”. Go figure.

    Jason
    “I get on my knees and pray, we don’t get fooled again!” – Who said that? I said that!

  5. #5
    Master of Design AlexBet's Avatar
    Join Date
    January 18th, 2005
    Location
    Toronto, Canada
    Posts
    1,364
    NewcastleB,

    I think that you should not worry because I get hundreds of similar requests everyday. Just like you, I worried the first time, but then I got used to it, and now I have WebTrends ignore those requests because they would give me a wrong impression on the "real" stats.

    So, unless you are paying your hosting by bandwidth, you shouldn't worry.

    Alex
    AlexBet Design

  6. #6
    Member
    Join Date
    January 18th, 2005
    Posts
    90
    How do you know, and where do you look to find out? Inquiring minds and idiots want to know.

    All I Ask Is A Chance To Prove That Money Can't Make Me Happy!

  7. #7
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    1,403
    If this would happen to me I would be very axious.

    carneol

  8. #8
    ABW Ambassador Andy's Avatar
    Join Date
    January 18th, 2005
    Posts
    4,178
    I get requests all the time for FormMail (and all variations of FormMail). It's probably just a spammer trying to compromise your script and send out spam from your server.

    I hate

    As long as you don't have FormMail, or if you call it by another name, you should be OK.

    As for the DOD scanning your site, there might be a phrase or something on there that looks suspicious to them. I would probably just ban them, and let a human at the DOD look at your site manually. I've seen government entities scanning my site as well, this has been going on for quite some time now.

    What really irks me are the ones called "unnamed robot - identified as 'robot'" I wonder exactly what those are up to...

    Andy

    _______________
    "If you were born to be shot, you'll never be hung." -Unknown

  9. Newsletter Signup

+ Reply to Thread

Similar Threads

  1. Another DOS attack
    By loxly in forum Midnight Cafe'
    Replies: 49
    Last Post: February 26th, 2005, 12:27 AM
  2. Squirrel Attack
    By Trust in forum Virtual Family and Off-Topic
    Replies: 26
    Last Post: February 21st, 2005, 11:03 PM
  3. Attack of the Cicadas
    By Trust in forum Virtual Family and Off-Topic
    Replies: 12
    Last Post: April 18th, 2004, 05:52 AM
  4. Cat attack!
    By mousejockey in forum Virtual Family and Off-Topic
    Replies: 27
    Last Post: January 21st, 2004, 02:54 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •