[Dshield] What is this?

Antti Tolamo usenet at linux.tola.org
Tue Jul 2 18:38:56 GMT 2002


At 08:44 2.7.2002 -0700, you wrote:
>"Scooter-3.2.EX" shows as a Spider from AltaVista.  An NSLOOKUP shows
>
>Name:    buildrack16.sv.av.com
>Address:  64.152.75.38
>
>which is an AltaVista name and IP address.

I used nslookup and traceroute, however
they only told me above and that it's DNS
_may_ have something to do with Altavista.

Why it however also tries to access _lot_ of  Apache files that
I don't have? What's the purpose? Is it result of
some search or what? And why atleast two days a row?

Do they evaluate webservers or what?

Regards,

Antti




>Tony Carothers
>Network/Systems Administrator
>tcarothers at lifestreamtech.com
>
>
>
>-----Original Message-----
>From: Antti Tolamo [mailto:Usenet at linux.tola.org]
>Sent: Tuesday, July 02, 2002 8:26 AM
>To: list at dshield.org
>Subject: [Dshield] What is this?
>
>
>I've been getting these alteast two days, from same source.
>Somebody going through my servers Apache document  webpages.
>This is only the part of files looked.
>
>Yes, I do have the Apache's own web pages as a default web page
>on root source: What's a 'Scooter' ? A robot?
>
>
>64.152.75.38 - - [02/Jul/2002:14:10:01 +0300] "GET
>/doc/apache/manual/keepalive.html HTTP/1.0" 302 205 "-" "Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:14:10:01 +0300] "GET /oops.html HTTP/1.0" 200
>43 "-" "Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:15:09:57 +0300] "GET
>/doc/apache/manual/configuring.html.en HTTP/1.0" 200 10443 "-"
>"Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:15:14:20 +0300] "GET
>/doc/apache/manual/misc/known_client_problems.html HTTP/1.0" 200 15697 "-"
>"Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:15:20:11 +0300] "GET
>/doc/apache/manual/netware.html HTTP/1.0" 200 13407 "-" "Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:15:21:40 +0300] "GET
>/doc/apache/manual/vhosts/name-based.html.ja.jis HTTP/1.0" 200 8670 "-"
>"Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:15:32:05 +0300] "GET
>/doc/apache/manual/programs/suexec.html HTTP/1.0" 200 1659 "-"
>"Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:15:42:59 +0300] "GET
>/doc/apache/manual/mod/mod_usertrack.html HTTP/1.0" 200 10573 "-"
>"Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:15:48:18 +0300] "GET
>/doc/apache/manual/index.html.en HTTP/1.0" 200 9349 "-" "Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:15:50:00 +0300] "GET
>/doc/apache/manual/process-model.html HTTP/1.0" 200 2701 "-"
>"Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:15:54:01 +0300] "GET
>/doc/apache/manual/mod/mod_mmap_static.html HTTP/1.0" 200 5696 "-"
>"Scooter-3.2.EX"
>
>64.152.75.38 - - [02/Jul/2002:16:07:50 +0300] "GET
>/doc/apache/manual/programs/httpd.html HTTP/1.0" 200 6402 "-"
>"Scooter-3.2.EX"
>[Tue Jul  2 16:24:57 2002] [error] [client 64.152.75.38] File does not
>exist:
>/usr/share/doc/apache/manual/mod/module-dict.html
>
>_______________________________________________
>Dshield mailing list
>Dshield at dshield.org
>To change your subscription options (or unsubscribe), see:
>http://www.dshield.org/mailman/listinfo/list
>
>_______________________________________________
>Dshield mailing list
>Dshield at dshield.org
>To change your subscription options (or unsubscribe), see: 
>http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list