Quick google search turns up it is caused by MS office most lilely frontpage or someone using office to view part of the website, maybe excel files or word files?? No SQL injection more annoyance than anything else.
Adam H On Mon, 31 Jan 2005 21:15:32 -0800, Paul Smith <[EMAIL PROTECTED]> wrote: > This guy (64.242.88.50) is back again. 14,702 times and counting since > last midnight. He apparently ignors robots.txt I asked my ISP to block > him at the firewall early this morning, but he apparently did > not. (Today's log file for this URL is 27MB and counting.) > > But another character started out: > > 208.27.31.145 www.smarteryellowpages.com - [31/Jan/2005:11:35:46 -0800] > "GET /MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=5606&STRMVER=4&CAPREQ=0 > HTTP/1.1" 302 233 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; > .NET CLR 1.1.4322)" > > and then did > > 208.27.31.145 www.smarteryellowpages.com - [31/Jan/2005:11:35:47 -0800] > "GET /MSOffice/index.cfm HTTP/1.1" 302 233 "" "Mozilla/4.0 (compatible; > MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)" > > 31,758 times and counting. The first 208.27.31.145 looks like an attempt > at SQL Injection. Is it? We don't run asp here (perhaps > fortunately). The second looks something like a DOS attack. > > All this brings to my mind whether I should develop a ColdFusion > application that counts hits from IP addresses, emails me the top 5 or 10 > every hour, and offers me the opportunity to block an IP address in > application.cfm on the fly. > > Anyone ever do anything like this? > > best, paul > > >Date: Thu, 13 Jan 2005 12:51:50 -0800 > >To: [EMAIL PROTECTED] > >From: Paul Smith <[EMAIL PROTECTED]> > >Subject: Block a Spyder > > > >What do I put in robots.txt to block this guy: > > > >64.242.88.50 www.smarteryellowpages.com - [12/Jan/2005:00:00:55 -0800] > >"GET /hl/shl/index.cfm?in.8259/cd.10335593/cn.21277304/hd.2666000/al.I.htm > >HTTP/1.1" 200 7534 "" "Mozilla/4.0 compatible ZyBorg/1.0 Dead Link Checker > >([EMAIL PROTECTED]; http://www.WISEnutbot.com)" > >64.242.88.50 www.smarteryellowpages.com - [12/Jan/2005:00:00:58 -0800] > >"GET > >/HL/LL/LO/index.cfm?IN.1882/CD.10332492/CN.86320180/HD.3675000/AL.O/or.141677.htm > >HTTP/1.1" 200 6379 "" "Mozilla/4.0 compatible ZyBorg/1.0 Dead Link Checker > >([EMAIL PROTECTED]; http://www.WISEnutbot.com)" > >64.242.88.50 www.smarteryellowpages.com - [12/Jan/2005:00:00:59 -0800] > >"GET /emailfriend/index.cfm?in.5762/cd.10331370/cn.1817190.htm HTTP/1.1" > >200 7114 "" "Mozilla/4.0 compatible ZyBorg/1.0 Dead Link Checker > >([EMAIL PROTECTED]; http://www.WISEnutbot.com)" > > > >Whenever it comes around it brings my web server down (whereas Googlebot > >does not) > > > >best, paul > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Find out how CFTicket can increase your company's customer support efficiency by 100% http://www.houseoffusion.com/banners/view.cfm?bannerid=49 Message: http://www.houseoffusion.com/lists.cfm/link=i:4:192542 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
