Suspicious guest book page accesses
Posted: Mon Mar 07, 2011 4:28 am
Script URL: http://www.hogtimemusic.com/nomad/gbook/gbook.php
Version of script: 1.7
Hosting company: readyhosting.com
URL of phpinfo.php:
URL of session_test.php:
What terms did you try when SEARCHING for a solution:
Write your message below:
A while after installing the very nifty Guest Book, I noticed that my guest book page was being listed in my website stats as a "entry" page very frequently. Normally the guest book would be accessed by a link on the main page of my website (and thus wouldn't be the "entry" page). I looked at my stats log and found the page was being accessed about once an hour with a "POST" type access, vs. the normal "GET". Don't really know what "POST" means. The site accessing the guest book is a Russian site, which has me a bit concerned.
The accesses come in pairs about an hour apart as follows:
91.201.66.76 - - [05/Mar/2011:13:31:47 -0500] "POST /nomad/gbook/gbook.php HTTP/1.1" 200 10550 "http://www.hogtimemusic.com/nomad/gbook ... php?a=sign" "Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1)"
91.201.66.76 - - [05/Mar/2011:13:31:47 -0500] "POST /nomad/gbook/gbook.php HTTP/1.1" 200 10490 "http://www.hogtimemusic.com/nomad/gbook/gbook.php" "Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1)"
The number after "200" (10550 and 10490, above) always changes, which makes me wonder if the site is searching for some sort of "hacking" access method.
Can anyone shed some light on this?
Thanks,
Worry Wart Ralph
Version of script: 1.7
Hosting company: readyhosting.com
URL of phpinfo.php:
URL of session_test.php:
What terms did you try when SEARCHING for a solution:
Write your message below:
A while after installing the very nifty Guest Book, I noticed that my guest book page was being listed in my website stats as a "entry" page very frequently. Normally the guest book would be accessed by a link on the main page of my website (and thus wouldn't be the "entry" page). I looked at my stats log and found the page was being accessed about once an hour with a "POST" type access, vs. the normal "GET". Don't really know what "POST" means. The site accessing the guest book is a Russian site, which has me a bit concerned.
The accesses come in pairs about an hour apart as follows:
91.201.66.76 - - [05/Mar/2011:13:31:47 -0500] "POST /nomad/gbook/gbook.php HTTP/1.1" 200 10550 "http://www.hogtimemusic.com/nomad/gbook ... php?a=sign" "Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1)"
91.201.66.76 - - [05/Mar/2011:13:31:47 -0500] "POST /nomad/gbook/gbook.php HTTP/1.1" 200 10490 "http://www.hogtimemusic.com/nomad/gbook/gbook.php" "Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1)"
The number after "200" (10550 and 10490, above) always changes, which makes me wonder if the site is searching for some sort of "hacking" access method.
Can anyone shed some light on this?
Thanks,
Worry Wart Ralph