My site seems under attack. A computer using the same ISP I'm using (according to whois IP.Add.re.ss) is asking my site too often for an "a.gif" and a "b.gif" in various node directories. I have no "a" or "b" gif files.
I'm thinking I want to "ban" this IP address, but I'm on ADSL and see this address is very similar to an IP I've used when browsing unauthenticated.
These files have been requested over the past few days. I loaded a few paths to see what was being requested/served, and see it's a long list of nodes. So instead of a 404 when asking for example.com/node/191/a.gif Drupal returns the home page (it appears, however, it's using a .tpl file inappropriate for what it's serving).
I also see in the Administer Log there is no "error"/message with serving up many nodes as a GIF file that does not exist.
This is unfortunate for a few reasons:
1. This seems very CPU intensive and I'm on an shared server.
2. If I ban this IP, it may be one I am given after I power cycle my DSL box. Then what happens? Does Drupal serve up a page telling me I'm banned or is the request just ignored?
3. I dislike waste, and this person/computer is wasting resources.
I just tried accessing a few random nodes here at the Drupal site with "a.gif" after it and got 404s. Why is my site sending out a long list of nodes instead?
Is this a former visitor whos computer has been taken over and is trying to hack my site?