0

I've recently (over the last 15 minutes) had quite a few hits from the same IP, it's in a country on our blacklist so they just up up on our "Access Denied" page, but I was just interested in what benefit a would be bot/attacker could gain from this.

All that seems to change is the referer, Has anyone seen similar behaviour?

62.245.46.204 - - [02/Dec/2013:15:06:10 +0000] "GET // HTTP/1.1" 302 3056 "http://rumagic.com/tw.php" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:06:10 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://rumagic.com/tw.php" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:06:53 +0000] "GET // HTTP/1.1" 302 3056 "http://avtoru.org/index.php?forums/35/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:06:54 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://avtoru.org/index.php?forums/35/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:07:37 +0000] "GET // HTTP/1.1" 302 3056 "http://rumagic.com/deir/book1/deir-book1.htm" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:07:37 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://rumagic.com/deir/book1/deir-book1.htm" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:08:20 +0000] "GET // HTTP/1.1" 302 3056 "http://rulibs.com/ru_zar/sci_history/zamarovskiy/0/j12.html" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:08:21 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://rulibs.com/ru_zar/sci_history/zamarovskiy/0/j12.html" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:09:04 +0000] "GET // HTTP/1.1" 302 3056 "http://uznaipravdu.org/viewtopic.php?f=31&t=650" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:09:04 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://uznaipravdu.org/viewtopic.php?f=31&t=650" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:09:47 +0000] "GET // HTTP/1.1" 302 3056 "http://rusfoto.net/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:09:48 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://rusfoto.net/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:10:31 +0000] "GET // HTTP/1.1" 302 3056 "http://programming-lang.com/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:10:31 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://programming-lang.com/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:11:14 +0000] "GET // HTTP/1.1" 302 3056 "http://rulibs.com/ru_zar/sf/index.html?10" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:11:14 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://rulibs.com/ru_zar/sf/index.html?10" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:11:57 +0000] "GET // HTTP/1.1" 302 3056 "http://smbb.ws/index.php?threads/26255/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:11:58 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://smbb.ws/index.php?threads/26255/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:12:41 +0000] "GET // HTTP/1.1" 302 3056 "http://www.avtoru.org/index.php?forums/3/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:12:41 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://www.avtoru.org/index.php?forums/3/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:13:27 +0000] "GET // HTTP/1.1" 302 3056 "http://smbb.ws/index.php?forums/13/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:13:27 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://smbb.ws/index.php?forums/13/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:14:10 +0000] "GET // HTTP/1.1" 302 3056 "http://avtoru.org/tw.php" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:14:11 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://avtoru.org/tw.php" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:14:54 +0000] "GET // HTTP/1.1" 302 3056 "http://rumagic.com/_flv/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:14:54 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://rumagic.com/_flv/" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:15:37 +0000] "GET // HTTP/1.1" 302 3056 "http://uznaipravdu.org/tw.php" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
62.245.46.204 - - [02/Dec/2013:15:15:37 +0000] "GET /denied.php HTTP/1.1" 200 1963 "http://uznaipravdu.org/tw.php" "Mozilla/4.0 (Compatible; Windows NT 5.1; MSIE 6.0) (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
Improve this question
5
  • No benefit...probably just a poorly-coded spider.
    – Nathan C
    Commented Dec 2, 2013 at 16:15
  • 1
    They're just varying request to see if they get anywhere. Probably looking for particular software or something. Little note though - Your denied.php file is returning as 200, but if you wanted it to make itself a little clearer, you could return a code like 403-forbidden. Some bots will get the idea a little easier. Of course, many are still persistent little brats.
    – Owen
    Commented Dec 2, 2013 at 16:42
  • Agree with Owen. If it's programmed right (and to work as a good little worker bot should), once it sees the forbidden it would leave it alone. If it's a nefarious bot, it's looking for an open file or directory to gain access to. If you've got a CMS (Drupal, Wordpress, etc.), they would also attempt to crawl common module locations to find an in to your site.
    – Anthony Miller
    Commented Dec 2, 2013 at 20:05
  • Thanks for your comments guys and good spot @owen, I'll update the headers now!
    – Jamie Taylor
    Commented Dec 3, 2013 at 8:58
  • Worth noting - there is a school of thought that status codes for errors shouldn't be too explicit - that they shouldn't explain too much - in order to avoid giving to much away, telling bots etc what was wrong. If you agree with this thinking, then you should return a 400 error, to express a client issue, but not explain it.
    – Owen
    Commented Dec 3, 2013 at 10:45

1 Answer 1

Reset to default
2

There is a chance that they are trying to DoS your server, but considering the rate they are performing a very poor job. Generally botnets have three purposes:

  • index information (crawl your websites)
  • take your website down using a layer 7 DoS attack (unlikely considering the very low rate they are accessing your website)
  • abuse ads on your website as to increase your profit

Either of these can be reason, I wouldn't worry too much, if it annoys you I would just drop the traffic at firewall level.

Improve this answer
1
  • Thanks for your answer, I've already added them to iptables and I'll keep in mind some of your comments :)
    – Jamie Taylor
    Commented Dec 3, 2013 at 8:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .