Lots of entries in 404 log

I have a site where I'm notified of all 404 errors (which are also logged to
a database). It normally gets about 10-15 errors a day - mostly search
engines trying to index deleted pages. Yesterday, however, I got about 130
from one IP (69.31.133.180 - which resolves as nLayer
Communications/Pilotsoft Inc - though the whois entry is sparse on
details). These errors were searches for pages that have never existed, and
with an additional forward slash at the beginning. These pages include:
//links.php
//search.php
//privmsg.php
//groupcp.php
//viewonline.php
//viewtopic.php
My site *is* PHP-based, but I've either never had pages with these names or
never in these locations. The visitor attempted to open these pages
multiple times (10-15 times in many cases). Anyone any thoughts?

--
@+

And lo, srm didst speak in alt.computer.security:

> These errors were searches for pages that have never existed, and
> with an additional forward slash at the beginning. These pages include:
> //links.php
> //search.php
> //privmsg.php
> //groupcp.php
> //viewonline.php
> //viewtopic.php
> My site *is* PHP-based, but I've either never had pages with these names
> or
> never in these locations. The visitor attempted to open these pages
> multiple times (10-15 times in many cases). Anyone any thoughts?

Looks like someone tooling a spider, is all, and grepped their list of
links incorrectly. This is normal. From the list of files you gave, I
don't think this person has good intentions, but since you don't have any
of these pages at your site, you have nothing to worry about.

Grey

--
The technical axiom that nothing is impossible sinisterly implies the
pitfall corollory that nothing is ridiculous.
- http://www.greywyvern.com/ringmaker - Orca Ringmaker: Host a web ring
from your website!

srm wrote:
> I have a site where I'm notified of all 404 errors (which are also logged to
> a database). It normally gets about 10-15 errors a day - mostly search
> engines trying to index deleted pages. Yesterday, however, I got about 130
> from one IP (69.31.133.180 - which resolves as nLayer
> Communications/Pilotsoft Inc - though the whois entry is sparse on
> details). These errors were searches for pages that have never existed, and
> with an additional forward slash at the beginning. These pages include:
> //links.php
> //search.php
> //privmsg.php
> //groupcp.php
> //viewonline.php
> //viewtopic.php
> My site *is* PHP-based, but I've either never had pages with these names or
> never in these locations. The visitor attempted to open these pages
> multiple times (10-15 times in many cases). Anyone any thoughts?

That's an automated bot searching for phpBB pages to exploit - make sure
you've upgraded to 2.0.12, if you actually have that forum software
installed.

Regards,
Brent