November 24, 2009
For years now I've been seeing this kind of thing:
http://www.denbeste.nu/essays/mars.shtml -> /libImage/blocksTile.gif 161.45.219.20 0pct.
http://www.denbeste.nu/essays/mars.shtml -> /libImage/warning.gif 161.45.219.20 0pct.
What are those two files, and given that I don't have any such directory and don't link to them, why is that browser trying to load them?
Posted by: Steven Den Beste in Site Stuff at
11:52 AM
| Comments (3)
| Add Comment
Post contains 52 words, total size 1 kb.
Posted by: metaphysician at November 24, 2009 01:24 PM (vM63Z)
I've suspected that it's a bot looking for some specific web server type and version because it's vulnerable. The reason it's feeding me the URL of one of my pages is so that I don't instantly bounce it.
But I don't have the slightest idea what server has those files, though frankly I'd guess it's some Microsoft thing.
I've been getting this kind of thing in my refers for years, but less often these days than before, which suggests that whatever it was, it's now obsolete. The idea is that there are fewer bots looking because most hackers know that there aren't really all that many of those kinds of servers any longer.
But all of that is just guesswork.
Posted by: Steven Den Beste at November 24, 2009 01:32 PM (+rSRq)
A quick google search yielded this:
http://bluequartz.org/trac/browser/5100R/branches/Cobalt/ui/carmel.mod/libImage/BlocksTile.gif?rev=4
It's from some software called bluequartz, which was apparently based on Cobalt's server management software. Â If I remember correctly, your webserver hardware was made by Cobalt, yes? Â Not sure of the specific connection or why you'd get refers for it, but it seemed like more than just a coincidence...
Posted by: Mark at November 24, 2009 02:05 PM (aUPJJ)
Enclose all spoilers in spoiler tags:
[spoiler]your spoiler here[/spoiler]
Spoilers which are not properly tagged will be ruthlessly deleted on sight.
Also, I hate unsolicited suggestions and advice. (Even when you think you're being funny.)
At Chizumatic, we take pride in being incomplete, incorrect, inconsistent, and unfair. We do all of them deliberately.
How to put links in your comment
Comments are disabled. Post is locked.20 queries taking 0.0098 seconds, 20 records returned.
Powered by Minx 1.1.6c-pink.