This is just weird: A few days ago I noticed that a page containing information that is not interesting and is commonly available elsewhere was becoming very popular on the site. It is now the most popular single page with 4352 hits in the last 6 days. I'm not going to post the page URL here because I don't want to upset what is going on with you all visiting the page. Suffice it to say that the page is just about stupid and almost empty. Today I started looking at my server logs to see who was linking to that page (expecting to find a referred from URL in at least some of the hits) and I was somewhat shocked to find that all the hits not only do not specify the referrer, they are also from exactly the same user agent: Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322) No variation at all. So I thought that some idiot had probably got his site ripping engine stuck on one page. But no, the accesses are coming from different IP addresses. No single IP address has ever requested the page more than once. In fact, none of them have requested ANY page on my server anytime in the last 7 days OTHER than this one. So then I thought it must be a DoS attack, but no, the volume is still quite low. In fact: There has not been more than 1 access from each IP address. And each IP address only hits that one page... One time... So think about this: Thousands of different IP addresses from all over the world (mostly outside the USA) are making one request of my server for a nothing page and then going away. These must be zombies. They are running some software that is causing them to make this request on first install or once every so many days but greater than the 7 days I've checked. Questions: - Is the author of the zombie planning to use my page to post updated instructions to his program? Piclist.com is a wiki... I've locked the page so it can not be modified just incase, but I am still alowing it to be viewed. - Is there some outfit that investigates things like this who would be interested to know what I'm seeing? - If this is a zombie program is its reference to my server going to implicate me? In other words, could someone who is tracking the zombie and looking for the author think that it is me since the program is looking here? - What would you do if you were me? --- James Newton: PICList webmaster/Admin mailto:jamesnewton@piclist.com 1-619-652-0593 phone http://www.piclist.com/member/JMN-EFP-786 PIC/PICList FAQ: http://www.piclist.com -- http://www.piclist.com PIC/SX FAQ & list archive View/change your membership options at http://mailman.mit.edu/mailman/listinfo/piclist