Koozali.org: home of the SME Server

my security concerns or i might be paranoid

Offline fixit

  • *
  • 216
  • +0/-0
    • http://www.fixitcomputers.com.au
my security concerns or i might be paranoid
« on: October 23, 2005, 11:15:02 AM »
I was looking through my log file and I came across these logs, what is robots.txt and _ti_bin, why would someone be trying to locate these in my primary ibays


http://www.dnsstuff.com/

IPWHOIS Lookup 61.9.56.222

Location: Philippines (high) [City: Manila, Manila]

I remember seeing this once before from that location


/var/log/httpd

[Sun Oct 23 13:37:26 2005] [error] [client 65.54.188.103] File does not exist: /home/e-smith/files/ibays/Primary/html/robots.txt

[Sun Oct 23 15:19:04 2005] [error] [client 61.9.56.222] request failed: URI too long (longer than 8190)
[Sun Oct 23 15:19:35 2005] [error] [client 61.9.56.222] File does not exist: /home/e-smith/files/ibays/Primary/html/_vti_bin

can anyone give me any ideas as what this about or is it nothing to worry about

Thanks, Russell
.........

Offline mudra

  • ****
  • 78
  • +0/-0
my security concerns or i might be paranoid
« Reply #1 on: October 23, 2005, 12:22:12 PM »
I think that robots.txt control how search engines can crawl your site to index it. In this file you can put where they can and can't go.

I don't know about the other file they looked for.

Hope this helps.

Mudra

Offline CharlieBrady

  • *
  • 6,918
  • +3/-0
Re: my security concerns or i might be paranoid
« Reply #2 on: October 23, 2005, 07:23:59 PM »
Quote from: "fixit"
I was looking through my log file and I came across these logs, what is robots.txt


If you'd asked google you would know.

Quote

[Sun Oct 23 15:19:04 2005] [error] [client 61.9.56.222] request failed: URI too long (longer than 8190)
[Sun Oct 23 15:19:35 2005] [error] [client 61.9.56.222] File does not exist: /home/e-smith/files/ibays/Primary/html/_vti_bin

can anyone give me any ideas as what this about


My guess is it's this:

http://www.guninski.com/iis50shtml.html

You don't run IIS, so this attempted exploit didn't affect you.