Suspicious activity?

JIM_BOB7813

JIM_BOB7813

JIM_BOB7813

Soldato
Joined
4 May 2004
Posts
3,270
Just scanning my logs and I noticed this
Code: 
[16/Jan/2009:00:45:20 +0000] "GET / HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:45:23 +0000] "GET / HTTP/1.1" 200 31744 "-" "Java/1.6.0_04"
[16/Jan/2009:00:45:28 +0000] "GET /index.php HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:45:29 +0000] "GET / HTTP/1.1" 200 31744 "-" "Java/1.6.0_04"
[16/Jan/2009:00:45:33 +0000] "GET /\" + gaJsHost + \"google-analytics.com/ga.js HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:45:34 +0000] "GET // HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:45:36 +0000] "GET / HTTP/1.1" 200 24212 "-" "Java/1.6.0_04"
[16/Jan/2009:00:45:54 +0000] "GET /\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/ga.js HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:45:57 +0000] "GET // HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:00 +0000] "GET / HTTP/1.1" 200 31744 "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:05 +0000] "GET /\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/ga.js HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:09 +0000] "GET // HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:10 +0000] "GET / HTTP/1.1" 200 31744 "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:17 +0000] "GET /\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/ga.js HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:18 +0000] "GET // HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:20 +0000] "GET / HTTP/1.1" 200 31744 "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:24 +0000] "GET /\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/ga.js HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:26 +0000] "GET // HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:36 +0000] "GET / HTTP/1.1" 200 31744 "-" "Java/1.6.0_04"
[16/Jan/2009:00:46:54 +0000] "GET /\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/\" + gaJsHost + \"google-analytics.com/ga.js HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:47:02 +0000] "GET // HTTP/1.1" 301 - "-" "Java/1.6.0_04"
[16/Jan/2009:00:47:03 +0000] "GET / HTTP/1.1" 200 18686 "-" "Java/1.6.0_04"
what do you guys make of this?
 
Looks like someone playing with something like a Java bot that is constantly accessing a (yours?) website. Not sure about the javascript stuff though :s
 
You must log in or register to reply here.
Back
Top Bottom