How to identify the Java program that is maliciously accessing my web site from many client addresses?

Question

For many years, my personal web site receives numerous pairs of hits that look like this, every day:

202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"
202.xx.xx.xx - - [22/Apr/2013:12:02:27 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"

The only thing the requests have in common is the "GET / HTTP/1.1" query, the Java user agent, and the fact that they come in pairs. Forensic logs don't reveal any other distinguishing qualities. The Java versions vary all over the map, as do the source IP addresses. I suspect that someone very antisocial has coded a semi-popular Java app that pings my site in this way, just to annoy.

No matter what response I send (2xx, 3xx, 4xx, 5xx, responses with images, responses with a thousand nested <div>s, etc.) the behavior from the clients is identical. Some of the client IP's seem to be servers, while others are residential connections. An email campaign attempting to notify/query the holders of the more identifiable addresses did not produce any useful clues as to the identity of the application.

This abuse isn't exactly a strain on my servers, but it's annoying. How can I identify the Java program that is responsible?

Answer 1

The "user agent" is a string sent by whoever connects to your system -- the antisocial individual. Therefore, you cannot really trust it. Which means that you cannot assume that this client really uses Java. Actually, if the Java version is "all over the map", then this is a strong indication that the client is not using Java. A real Java-based standard HTTP client will return the version of the employed JDK; 1.4.1_04 is really old, and might not work anymore with a recent operating system.

So my opinion is that you can strike out the "Java" keyword in your search. These requests are probably the works of a botnet which tries to spread; the infected machines send these HTTP requests in order to get some information on random Web servers (e.g. server software version), and they disguise as "Java requests" in order to avoid some poorly-configured firewalls and filters.

This is not done to annoy you. It actually annoys everybody. All publicly available servers will receive requests such as yours; replicating botnets just use random IP addresses, and you cannot evade randomness. I get some on my own server, too.

Answer 2

You could try to sting them. Setup some type of account that you can trace access to. Then let them steal some fake information from you that grants them access. When they try to access it maybe they won't be so careful and give themselves away.

Of course it just sounds like just a typical broadcasted ping. So probably not worth all the trouble.

Answer 3

Have you tried sending 404, 503, or even 301 redirects to that IP when it sends requests? I wonder if sending a 301 redirect for a month would make it go bug Google instead? Far-fetched, but might be worth a shot.

Answer 4

I have info on this that may help people out. I recently registered three web sites with "Web of Trust" (WOT), a company that is based in Helsinki, Finland. They completely down-rated my sites stating a reason that my domain name showed up as a 'hidden registrant'. The treatment I got seems highly unethical, yet they claim it to be ethical. I cannot get them to undo the damage. Norton SafeWeb in the meantime had no problems giving my sites an OK rating.

But keeping that as a related note and coming more to the point, I started getting the Java1.4.1_04 entries in my logs shortly after registering the new sites with WOT. All of the bad actor accesses originated from European sources, Norway, Sweden, Spain, England, etc. I also looked up some IPs on ip lookup:

whatismyipaddress

and found some disturbing stuff, all of which began occurring after registering my web sites with web of trust.

whatismyipaddress reported these sites as being reported by users, hundreds of times, as "Possible Forum Spammers".

It would seem from my horrible experience, that Web of Trust cannot be trusted. You must judge for yourself, however. Their forum moderators are US based to handle english language and seem to be inflexible and ego-blown, power-trippers.

Here are links to show what they did to my sites:

http://www.mywot.com/en/scorecard/avenuesplus.com http://www.mywot.com/en/scorecard/circanova.com

I am only allowed to post 2 URLs here; there is a third site that was badly rated as well.

Here are links to Norton SafeWeb for same sites:

Sorry, this site won't let me post the other links, as I am new to security stack exhange. But you can look up my sites, AVenuesPlus, CircaNova and VeteransAssembly on SafeWeb.

At the time of this posting, SafeWeb has yet to test circanova, but it should be fine when they do.

Based on my recent experiences with WOT and the bad actor traffic my websites have received after signing up my sites with WOT, I advise extreme caution, should you consider registering for the WOT service, EXTREME CAUTION.

WOT apparently has set themselves up as the LAW when defining what is trustworthy on the net. It is so egregious how they have treated me, that I have been compelled to write Senator Barbara Boxer for help regarding this issue requiring attention related to Telecom/Broadcast legislation.

Beware.

If you are getting your Java1.4.1_04 problems after registering with WOT, confirm so at this site and other security related sites, so that others may be alerted and be able to avoid risks.

------ Additional edits added 08/14/2013

If you are a site owner and have started seeing these things in your logs, enter the ip addresses in your .htaccess file

deny from ipaddreass

You'll likely have a growing list of such deny directives.

You'll see more than just Java1.4.1_04 Also things like Java/1.6.0_30 and others.

It's easy for me to see these bad entries right now because my sites are new with low traffic.

After signing up with Web of Trust (WOT), I also see things like this ...

/wp-login.php?action=register

There is of course, no such php file in my applications, but these clowns try what they may have broken somewhere else for say, a WordPress site. My site is NOT WordPress, wp-login?

Add IPs that do this sort of thing to .htaccess as well.

Not many people who have had their sites defamed by WOT are aware that the defamation is only the visible part of the problem. The hidden part of the myWOT cyber-criminal activity is only revealed in their logs and they need to pay attention to them.

My site was defamed because of 'hidden registrant'. It is now obvious to me that the WOT criminals wanted me to show my email and address data in whois, for god knows what evil intent.

Again, BE EXTREMELY CAUTIOUS about considering registering your sites on Web of Trust.