Odd entries in Apache Logs

[tomrock]

I don't know if this is a Coppermine issue at all, but I'm getting some odd entries in my Apache logs.

Normally, when someone looks at a picture I see something like GET /displayimage.php?album=2&pos=12

However, there's one user where I see GET /login.php?referer=/login.php?referer=/login.php?referer=/displayimage.php?pos=-549

The login.php?referer will repeat more and more. The most I've seen is 11 repeats.

Is this user doing something wrong? Am I?

My concern is because this generates a huge number of hits to my server and causes a counter I use to reset itself.

Is there something I should do about this?

Thanks,
Tom

[OmegaGOD]

Is there a referring page to this URL in your Apache log file? Since it's only coming for 'one' user, I am assuming he/she is being a little malicious. If there is no referring page, then you may just want to block his IP address. (Assuming he has a static IP)

[tomrock]

I had to go to apache.org and read about the log files.

It's always GET /login.php?referer=/login.php?referer=/login.php?referer= and so on up to 11 times followed by an actual image they're looking for (such as displayimage.php?pos=-153), then 200 (which I understand means success), then a number which is larger than other hits, then the exact same thing again (same number of login.php's and the same image reference) followed by their browser.

So, to answer your question, the referer is the same as the page they're looking at.

Thanks for giving me any insight,
Tom

[kegobeer]

I would block that IP address - that smells like a malicious attack.  You can set up a htaccess file to route requests from that IP address to another URL.

Here's one I've used in the past:

Code Select Expand

Options +FollowSymlinks
RewriteEngine On
RewriteBase /

order allow,deny
deny from 200
deny from 145.24.132.250
deny from 205.218.64.8
deny from 168.234.198.7
allow from all

RewriteCond %{HTTP_USER_AGENT} Simple
RewriteRule .* http://www.urbandictionary.com/define.php?term=script+kiddie [F,L]

RewriteRule /modules(.*) http://www.urbandictionary.com/define.php?term=script+kiddie [R]

ErrorDocument 403 http://www.urbandictionary.com/define.php?term=script+kiddie

A nice reroute to the definition of a script kiddie.  You can set up a static html page on a free server, like geocities or yahoo, with instructions to contact you if they've feel they should have access to your site.

[tomrock]

Thank you. I've blocked the ip where they were.