Xarg blog Archive

I find reading server logs relaxing and entertaining. Besides the infinite number of IIS exploits that turn up in the logs there can be other signs evil about. Two entries I noticed recently are illustrative of what you can find if you pay a little bit of attention...

134.157.24.10 - - [13/Oct/2002:12:08:01 -0400] 
    "POST /cgi-bin/formmail.pl HTTP/1.0" 404 549 "http://j3ff.com" 
    "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)  
     via proxy gateway  CERN-HTTPD/3.0 libwww/2.17"

Here is someone trying to send spam via a (non-existent in my case) buggy form mail script. The interesting bit is that they have trawled the whois records to pick out the fact that I own j3ff.com as well as xarg.net (presumably because people trying to prevent spamular abuse of their buggy script typically check referrers).

This one, while not really as abusive as the first example is still still spam (although in this case it is spamming the weblog community).

207.253.71.48 - - [24/Oct/2002:00:01:50 -0400] 
    "GET /blog/ HTTP/1.1" 200 19529 "http://referrer.mastodonte.com" 
    "Mastodonte Referrer Advertising"

If you follow the referrer here you find a site that will add "your URL as a referrer in the logs of thousands of weblogs" all for a mere CAN$ 1,500. I guess it is the inevitable result of backlinking and Google's ranking algorithm - another negative externality to fight. Tragic...