[svlug] new type of spam?

Florin Andrei florin at andrei.myip.org
Wed Mar 5 00:35:07 PST 2003


Hey, is this a new type of spam, or what?

63.229.64.130 - - [02/Mar/2003:08:36:11 -0800] "GET / HTTP/1.0" 200 928
"http://www.sex-teen-pic.com/" "Mozilla/4.0 (compatible; MSIE 5.01;
Windows 98)"
cab-200-42-56-115.prima.net.ar - - [02/Mar/2003:08:36:13 -0800] "GET /
HTTP/1.1" 200 928 "http://www.sex-teen-pic.com/" "Mozilla/4.0
(compatible; MSIE 5.01; Windows 98)"
ns2.precisium.com.au - - [02/Mar/2003:08:36:19 -0800] "GET / HTTP/1.0"
200 928 "http://www.free-virgin.com/" "Mozilla/4.0 (compatible; MSIE
5.01; Windows 98)"
210.220.73.9 - - [02/Mar/2003:08:36:19 -0800] "GET / HTTP/1.0" 200 928
"http://www.free-virgin.com/" "Mozilla/4.0 (compatible; MSIE 5.01;
Windows 98)"
195.199.2.61 - - [02/Mar/2003:08:36:32 -0800] "GET / HTTP/1.0" 200 928
"http://www.nylon-lover.com/" "Mozilla/4.0 (compatible; MSIE 5.01;
Windows 98)"
200.46.109.82 - - [02/Mar/2003:08:36:32 -0800] "GET / HTTP/1.0" 200 928
"http://www.nylon-lover.com/" "Mozilla/4.0 (compatible; MSIE 5.01;
Windows 98)"
203.52.178.224 - - [02/Mar/2003:08:36:36 -0800] "GET / HTTP/1.0" 200 928
"http://www.wickedsearch.com/" "Mozilla/4.0 (compatible; MSIE 5.01;
Windows 98)"
wint.osn.de - - [02/Mar/2003:08:36:39 -0800] "GET / HTTP/1.0" 200 928
"http://www.wickedsearch.com/" "Mozilla/4.0 (compatible; MSIE 5.01;
Windows 98)"

This is a fragment of the Apache log files for a website i take care of. I'm
100% sure this website was never referred by those URLs :-))) it does not
have that kind of content. ;-)
The thing is, the hits are from different addresses, yet they came
almost at the same time. The User-Agent is also the same.

My question is: what are they trying to achieve? Beyond making me look
puzzled while i was browsing the webalizer page, i don't see much benefit
they can get out of this.

-- 
Florin Andrei

http://florin.myip.org/
-- 
Florin Andrei

http://florin.myip.org/




More information about the svlug mailing list