Re: DOS?

On Sun, Sep 27, 2009 at 18:37, Chris Wells <clwells@nexcess.net> wrote: > > We're seeing a ton of requests that look like this from varied IPs. > > x.x.x.x - - [27/Sep/2009:18:36:04 -0400] "GET > /manual-lookup.php?pattern=test HTTP/1.1" 200 - > "http://php.net/manual-lookup.php?pattern=test" > "Mozilla/5.0 (Windows; U; > Windows NT 6.0; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR > 3.5.30729)" > > Lots of "pattern=test" lookups - enough to tax the server pretty severely. >  Not sure if anyone else is seeing this but I edited the 'manual-lookup..php' > to filter out these requests for now and things calmed down immediately. From the sounds of it, it's an automated bot or a "script kiddie." It's likely a bot spoofing the client information in the HTTP request, but used to see if there is any information that can be garnered from the test lookup. Keep in mind, in the way that the system works, if someone tries to access http://php.net/fake_function from an IP address in the UK, it will randomly choose one of the available UK mirrors and route the traffic there, which will then be interpreted by the mirror and redirected to http://uk[2,3]?.php.net/manual-lookup.php?pattern=fake_function > Not sure if any other mirrors are seeing this but just wanted to make a > mention. This is the first report I've heard, but I appreciate you bringing it up, and I'll be sure to continue to monitor the situation. I know the response sounds very generic, it's just all we can do for now: keep an eye on things. Thanks. -- </Daniel P. Brown> daniel.brown@parasane.net || danbrown@php.net http://www.parasane.net/ || http://www.pilotpig.net/