[lug] Odd web robot behavior

Warren Sanders sanders at montanalinux.org
Tue Oct 15 11:40:06 MDT 2002

Hash: SHA1

Forgot to add this tidbit:

  nmap -O

Starting nmap V. 2.54BETA31 ( www.insecure.org/nmap/ )
Interesting ports on  (
(The 1551 ports scanned but not shown below are in state: closed)
Port       State       Service
22/tcp     open        ssh
199/tcp    open        smux
3128/tcp   open        squid-http

Remote operating system guess: Linux Kernel 2.4.0 - 2.4.17 (X86)
Uptime 85.020 days (since Mon Jul 22 10:42:41 2002)

Nmap run completed -- 1 IP address (1 host up) scanned in 59 seconds

Warren Sanders wrote:
> I have a family photo gallery with tons of photos.  Just noticed (live) 
> strange robotic behaviors.  I'm getting requests for images that looks 
> normal but then I notice different IP addresses in the same network and 
> different OS/browsers for each IP.  My PostNuke is only reporting 1 
> guest online proving that it's just one person.  The traffic is 
> requesting one image after the other and in order... just four different 
> IP's and four different OS/Browsers:
> - - "Mozilla/5.0 (compatible; Konqueror/2.1.2; X11)"
> - - "Mozilla/4.0 (compatible; MSIE 4.0; Windows 95)"
> - - "Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)"
> - - "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
> I can stop the web server for about 5 minutes and restart... this guy 
> continues where it left off within a few seconds!
> Anyone know about this kind of behavior?
> Cheers!

Web Page:  http://lug.boulder.co.us
Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
Join us on IRC: lug.boulder.co.us port=6667 channel=#colug

- -- 
Warren Sanders

Version: GnuPG v1.2.0 (GNU/Linux)


More information about the LUG mailing list