It's not necessarily even a botnet... it is fairly common for single scripts to hammer a site, regardless of how ineffective it might be (the bots are usually dumb, without state, so have no way to 'remember' that they're getting 404s or 401s from repeated hits on a URL. I have had problems before with Korean script kiddies running a dumb thing that tries to POST to a particular phpgroupware file which must have had some known exploit. This despite the fact that clearly, there was nothing like that installed anywhere. My logs ended up spiking and being filled with 404s and bad requests. I eventually took steps to block anything that tried to access any URL looking like phpgroupware.
As a webmaster, there's not a lot you can do beyond what you've already done AFAIK, though there are some honeypot services out there that can be used to trap and log such idiots, and if ISP's receive enough complaints, they will probably end up doing something at the network level. I suggest mentioning this problem to your web host, as they definitely won't take kindly to this sort of behavior. Regards, Mark --~--~---------~--~----~------------~-------~--~----~ NZ PHP Users Group: http://groups.google.com/group/nzphpug To post, send email to [email protected] To unsubscribe, send email to [EMAIL PROTECTED] -~----------~----~----~----~------~----~------~--~---
