4 replies to this topic

[Aeolus]

These codes are in my server's access log,what's it mean and what's he doing?

Checking the link /forum/index.php?app=core is the login page of my forum.

Thanks.  

Quote

114.44.136.97 - - [26/Jan/2010:15:32:11 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:32:20 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:32:29 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:32:38 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:32:47 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:32:56 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:33:08 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:33:17 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:33:26 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:33:35 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:33:44 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:33:53 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:34:02 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:34:11 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:34:20 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:34:29 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:34:38 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:34:47 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:34:56 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:35:05 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:35:14 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:35:23 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:35:32 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:35:41 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:35:50 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:35:59 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:36:08 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:36:17 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:36:26 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:36:35 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"

[KeithK]

http code 200 is just a success code meaning your server did it's job. It looks like he's setting on your index and is having his browser refresh every 9 seconds.

[Aeolus]

Thanks for reply.
The link >> http://ipb.tw/forum/index.php?app=core is the login page of my forum.
So i think that some was trying to login my forum by the unknow name and password,and he did it by some scripts.
Although my server did that,but why so many times and so smoothly in every 9 seconds , did he forgot the password ?
Did he try some scripts to my forum ?

Quote

114.44.136.97 - - [26/Jan/2010:15:32:11 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:32:20 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:32:29 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:32:38 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
114.44.136.97 - - [26/Jan/2010:15:32:47 +0800] "HEAD /forum/index.php?app=core HTTP/1.1" 200 - "http://ipb.tw/" "

[KeithK]

its defiantly a script. You should have some logs showing what is being sent unless its failing and not sending anything.
If it were me, I'd just ban the ip at my firewall and be done with it.

[Aeolus]

Thanks, and i baned it also.