[Spam] またまた新手のWeb-DoS-Spam？
01/10/2005 19:09 (投稿者：たかの)

だいぶ遅くなりましたが、新年おめっとさんです。 新年一発目からまだSpamの話かよと悲しくなってしまうのですが…。小ネタ系でモントラに収まらない話となると、こればっかりになってしまうようです。 で、本題。久々にWebのログなんぞ見ていたら、こんなん落ちてきておりました。

219.96.71.88 - - [06/Jan/2005:14:52:49 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "uniplastcompositi.com" 219.96.71.88 - - [06/Jan/2005:14:52:49 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "asdspeedshop.com" 219.96.71.88 - - [06/Jan/2005:14:52:50 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:52:50 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:52:50 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:52:50 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:52:51 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:52:51 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "asdspeedshop.com" 219.96.71.88 - - [06/Jan/2005:14:52:51 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "uniplastcompositi.com" 219.96.71.88 - - [06/Jan/2005:14:52:54 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:52:54 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "uniplastcompositi.com" 219.96.71.88 - - [06/Jan/2005:14:52:56 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "uniplastcompositi.com" 219.96.71.88 - - [06/Jan/2005:14:52:56 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:52:56 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "asdspeedshop.com" 219.96.71.88 - - [06/Jan/2005:14:52:57 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "asdspeedshop.com" 219.96.71.88 - - [06/Jan/2005:14:52:58 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:52:58 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "asdspeedshop.com" 219.96.71.88 - - [06/Jan/2005:14:52:58 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "uniplastcompositi.com" 219.96.71.88 - - [06/Jan/2005:14:52:59 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:52:59 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "asdspeedshop.com" 219.96.71.88 - - [06/Jan/2005:14:52:59 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "uniplastcompositi.com" 219.96.71.88 - - [06/Jan/2005:14:53:01 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "uniplastcompositi.com" 219.96.71.88 - - [06/Jan/2005:14:53:01 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "asdspeedshop.com" 219.96.71.88 - - [06/Jan/2005:14:53:01 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:53:02 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" 219.96.71.88 - - [06/Jan/2005:14:53:03 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "asdspeedshop.com" 219.96.71.88 - - [06/Jan/2005:14:53:03 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "uniplastcompositi.com" 219.96.71.88 - - [06/Jan/2005:14:53:04 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "uniplastcompositi.com" 219.96.71.88 - - [06/Jan/2005:14:53:04 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "asdspeedshop.com" 219.96.71.88 - - [06/Jan/2005:14:53:04 +0900] "GET /robots.txt HTTP/1.1" 404 1059 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "desertshieldfunding.com" ---- ちょっとだけ補足しておくと、このログは、通常のcommon-log-formatの末尾に、リクエストされたHostヘッダを含めたものであります。 本来所収すべきバーチャルドメインのコンテンツが、設定ミスなどでエラーを吐いているときの対策として入れているのですが、もちろん「asdspeedshop.com」とか「desertshieldfunding.com」なんてドメインは抱えていません。 てっきり新手のログSpamで、自動集計ランキングの上位に来させることを狙っているのかな？と思ったのだけど、そもそもこれらのドメインはウェブすら持っていないみたい。 219.96.71.88というアドレスは日本のマイナープロバイダのものみたいだけど、この主は一体何をしたかったんでしょうかね？ ここで聞いても教えてもらえないだろうけど、とりあえず「こんなんあったよ」っつー報告でした。

メールでコメント