Skanują w poszukiwaniu adresów email

Jest sobie taki harvester adresów email: deltaSCAN, ostatnio został odpalony na moim sajcie.

80.51.36.85 - - [25/Dec/2003:19:57:14 +0100] "GET / HTTP/1.1" 200 8525 "-" "deltaSCAN"
80.51.36.85 - - [25/Dec/2003:20:01:08 +0100] "GET /ankieta.php HTTP/1.1" 200 1950 "-" "deltaSCAN"
80.51.36.85 - - [25/Dec/2003:20:31:06 +0100] "GET /index.php HTTP/1.1" 200 8525 "-" "deltaSCAN"
80.51.36.85 - - [25/Dec/2003:21:33:30 +0100] "GET /index.php?module=pages&pg_id=1 HTTP/1.1" 200 8284 "-" "deltaSCAN"
80.51.36.85 - - [25/Dec/2003:23:19:15 +0100] "GET /index.php?module=pages&pg_id=11 HTTP/1.1" 200 7164 "-" "deltaSCAN"
80.51.36.85 - - [25/Dec/2003:23:48:08 +0100] "GET /index.php?module=pages&pg_id=12 HTTP/1.1" 200 7534 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:00:41:31 +0100] "GET /index.php?module=pages&pg_id=13 HTTP/1.1" 200 8172 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:01:05:02 +0100] "GET /index.php?module=pages&pg_id=14 HTTP/1.1" 200 8470 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:01:24:44 +0100] "GET /index.php?module=pages&pg_id=15 HTTP/1.1" 200 14290 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:01:40:02 +0100] "GET /index.php?module=opinie&pg_id=15 HTTP/1.1" 200 6889 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:01:58:51 +0100] "GET /index.php?module=pages&pg_id=16 HTTP/1.1" 200 13776 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:02:14:47 +0100] "GET /index.php?module=pages&pg_id=17 HTTP/1.1" 200 8556 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:02:29:37 +0100] "GET /index.php?module=pages&pg_id=18 HTTP/1.1" 200 9619 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:02:44:06 +0100] "GET /index.php?module=pages&pg_id=19 HTTP/1.1" 200 8214 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:02:55:59 +0100] "GET /index.php?module=pages&pg_id=2 HTTP/1.1" 200 7582 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:08:03 +0100] "GET /index.php?module=pages&pg_id=20 HTTP/1.1" 200 10722 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:19:59 +0100] "GET /index.php?module=opinie&pg_id=20 HTTP/1.1" 200 6889 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:32:04 +0100] "GET /index.php?module=pages&pg_id=21 HTTP/1.1" 200 9050 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:42:09 +0100] "GET /index.php?module=pages&pg_id=22 HTTP/1.1" 200 7499 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:42 +0100] "GET /index.php?module=pages&pg_id=32 HTTP/1.1" 200 8541 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:43 +0100] "GET /index.php?module=pages&pg_id=33 HTTP/1.1" 200 12390 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:48 +0100] "GET /index.php?module=pages&pg_id=34 HTTP/1.1" 200 8627 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:49 +0100] "GET /index.php?module=pages&pg_id=4 HTTP/1.1" 200 7928 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:50 +0100] "GET /index.php?module=pages&pg_id=41 HTTP/1.1" 200 7339 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:51 +0100] "GET /index.php?module=pages&pg_id=42 HTTP/1.1" 200 8197 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:51 +0100] "GET /index.php?module=pages&pg_id=43 HTTP/1.1" 200 20681 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:53 +0100] "GET /index.php?module=pages&pg_id=5 HTTP/1.1" 200 7487 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:54 +0100] "GET /index.php?module=pages&pg_id=44 HTTP/1.1" 200 8445 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:54 +0100] "GET /index.php?module=pages&pg_id=7 HTTP/1.1" 200 7812 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:56 +0100] "GET /index.php?module=pages&pg_id=9 HTTP/1.1" 200 7673 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:56 +0100] "GET /index.php?module=pages&pg_id=8 HTTP/1.1" 200 8627 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:58 +0100] "GET /redir.php?banner_id=14 HTTP/1.1" 302 0 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:58 +0100] "GET /redir.php?banner_id=15 HTTP/1.1" 302 0 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:58 +0100] "GET /redir.php?banner_id=16 HTTP/1.1" 302 0 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:58 +0100] "GET /redir.php?banner_id=6 HTTP/1.1" 302 0 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:58 +0100] "GET /redir.php?banner_id=7 HTTP/1.1" 302 0 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:53:59 +0100] "GET /index.php?module=opinie&pg_id=8 HTTP/1.1" 200 6888 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:54:01 +0100] "GET /index.php3 HTTP/1.1" 404 208 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:54:02 +0100] "GET /index1.htm HTTP/1.1" 404 208 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:54:02 +0100] "GET /index2.htm HTTP/1.1" 404 208 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:54:02 +0100] "GET /index5.htm HTTP/1.1" 404 208 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:54:02 +0100] "GET /index8.htm HTTP/1.1" 404 208 "-" "deltaSCAN"
80.51.36.85 - - [26/Dec/2003:03:54:02 +0100] "GET /ok HTTP/1.1" 404 200 "-" "deltaSCAN"

Chciałbym zwrócić uwagę na to że:

nie pobrał robots.txt
ostatnie 5 wpisów z moich logów świadczy o złych intencjach - nie mam nigdzie odnośników do tych plików.
GET /ok jest próbą zebrania adresu webmastera strony (patrz konfig apacza)

No cóż kolejny drań do wycięcia.

Ostatnio w logach apacza można też zauważyć wywołanie GET /sumthin - podobnie jak w przypadku GET /ok ma to służyć ujawnieniu adresu email webmastera. A ja sobie założyłem taki plik...

Data utworzenia : 2003-12-27

Skomentuj ten tekst