[lug] Odd web robot behavior
sanders at montanalinux.org
Tue Oct 15 11:40:06 MDT 2002
-----BEGIN PGP SIGNED MESSAGE-----
Forgot to add this tidbit:
nmap -O 18.104.22.168
Starting nmap V. 2.54BETA31 ( www.insecure.org/nmap/ )
Interesting ports on (22.214.171.124):
(The 1551 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
199/tcp open smux
3128/tcp open squid-http
Remote operating system guess: Linux Kernel 2.4.0 - 2.4.17 (X86)
Uptime 85.020 days (since Mon Jul 22 10:42:41 2002)
Nmap run completed -- 1 IP address (1 host up) scanned in 59 seconds
Warren Sanders wrote:
> I have a family photo gallery with tons of photos. Just noticed (live)
> strange robotic behaviors. I'm getting requests for images that looks
> normal but then I notice different IP addresses in the same network and
> different OS/browsers for each IP. My PostNuke is only reporting 1
> guest online proving that it's just one person. The traffic is
> requesting one image after the other and in order... just four different
> IP's and four different OS/Browsers:
> 126.96.36.199 - - "Mozilla/5.0 (compatible; Konqueror/2.1.2; X11)"
> 188.8.131.52 - - "Mozilla/4.0 (compatible; MSIE 4.0; Windows 95)"
> 184.108.40.206 - - "Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)"
> 220.127.116.11 - - "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
> I can stop the web server for about 5 minutes and restart... this guy
> continues where it left off within a few seconds!
> Anyone know about this kind of behavior?
Web Page: http://lug.boulder.co.us
Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
Join us on IRC: lug.boulder.co.us port=6667 channel=#colug
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (GNU/Linux)
-----END PGP SIGNATURE-----
More information about the LUG