By Jaza on

I was browsing through my logs for the past day, when I saw that I'd gotten about 25 '404 not found' errors in the space of less than a minute (happened a few hours ago).

Here's a sample of some of the errors:

404 error: services/webdesign/node/10 not found.

(repeated several times)

404 error: services/webdesign/comment/reply/10 not found.

(also repeated)

404 error: services/webdesign/comment/reply/52 not found.

(also repeated)

All of them are for non-existant nodes on my site, and all of them seem to be a bad attempt at scripted guessing of what addresses on my site will resolve. As far as I can tell, my unusual aliasing system seems to have confused the bot that was crawling my site (none of the search bots have ever gotten confused by it).

I did an nslookup on the IP of the bot - which is 205.234.174.55 - and it resolved to unknown.ord.scnet.net. I went to scnet.net, and it looks like some kind of high-bandwidth provider. Clearly not a search bot or anything like that.

A lot of the 404s indicate that the bot was trying to hit my comment pages. This looks like an attempt at comment spam if you ask me. Would I be right in guessing this? If so, then is there anything I can do to report this spammer and to prevent future attacks (on all Drupal sites)? The bot wasn't successful in spamming any pages on my site, but I know that this has been a problem for many other Drupal webmasters. I already have comment captchas enabled, by the way.

Jeremy Epstein - GreenAsh

Comments

mmtahir’s picture

mmtahir commented

I recently received an email from the hosting server that The site is
using up to 100% of the available CPU with the following details

[ID]: 3648 (php.exe) [Parent: 3592] [User: WEBA10\IUSR_216.119.72.73]
[cmd]: c:\php\php.exe d:\inetpub\afghanwomensnetwork\index.php
Mem: 19904k VMem: 57684k PageFaults: 5694
[Threads: 2] [Reads: 359] [Writes: 4] [Other: 1153] [Hndls: 79]

[ID]: 7860 (php.exe) [Parent: 3592] [User: WEBA10\IUSR_216.119.72.73]
[cmd]: c:\php\php.exe d:\inetpub\afghanwomensnetwork\index.php
Mem: 19920k VMem: 57684k PageFaults: 5648
[Threads: 2] [Reads: 359] [Writes: 4] [Other: 1153] [Hndls: 77]

[ID]: 6704 (php.exe) [Parent: 3592] [User: WEBA10\IUSR_216.119.72.73]
[cmd]: c:\php\php.exe d:\inetpub\afghanwomensnetwork\index.php
Mem: 19908k VMem: 57684k PageFaults: 5748
[Threads: 2] [Reads: 359] [Writes: 2] [Other: 1154] [Hndls: 77]

[ID]: 7680 (php.exe) [Parent: 3592] [User: \]
[cmd]: c:\php\php.exe d:\inetpub\afghanwomensnetwork\index.php
Mem: 12980k VMem: 48468k PageFaults: 3489
[Threads: 2] [Reads: 139] [Writes: 0] [Other: 518] [Hndls: 78]

[ID]: 2900 (php.exe) [Parent: 3592] [User: WEBA10\IUSR_216.119.72.73]
[cmd]: c:\php\php.exe d:\inetpub\afghanwomensnetwork\index.php
Mem: 7932k VMem: 38528k PageFaults: 2127
[Threads: 1] [Reads: 9] [Writes: 0] [Other: 206] [Hndls: 57]

[ID]: 7732 (php.exe) [Parent: 3592] [User: \]
[cmd]: c:\php\php.exe d:\inetpub\afghanwomensnetwork\index.php
Mem: 388k VMem: 5160k PageFaults: 93
[Threads: 1] [Reads: 0] [Writes: 0] [Other: 2] [Hndls: 18]

[ID]: 4648 (php.exe) [Parent: 3592] [User: WEBA10\IUSR_216.119.72.73]
[cmd]: c:\php\php.exe d:\inetpub\afghanwomensnetwork\index.php
Mem: 7936k VMem: 38528k PageFaults: 2128
[Threads: 1] [Reads: 9] [Writes: 0] [Other: 207] [Hndls: 57]

[ID]: 4112 (php.exe) [Parent: 3592] [User: \]
[cmd]: c:\php\php.exe d:\inetpub\afghanwomensnetwork\index.php
Mem: 7932k VMem: 38528k PageFaults: 2127
[Threads: 1] [Reads: 9] [Writes: 0] [Other: 206] [Hndls: 57]

[ID]: 7196 (php.exe) [Parent: 3592] [User: WEBA10\IUSR_216.119.72.73]
Mem: 56k VMem: 2016k PageFaults: 10
[Threads: 1] [Reads: 0] [Writes: 0] [Other: 0] [Hndls: 14]

when I checked my log the site was bundeled with 404 not found errors and those links that did not exist on the site.

Moreover, there were a lot of comments of the same text like "nice!", "thanks", etc repeated shown but did not exist in the actual contents.

as a pre-cation i disabled the comment and some other modules but I still have the following errors filling my log every minute.

System/file/xxxxxx Not found.
comment/reply/xxx not found.

Also The IP address of the host was not located.

I would appriciate if any one guru could help in this

Malik Mohammad Tahir Saeed