|
Author: A.Degives Mas (20 Apr 11 5:58pm)
Yes and no; it depends on how sharply you define "attackers". To briefly explain: it looks like malicious asset requests have been fed into search engines - something quite common: I call it search engine poisoning - which allows ill-intending people to quickly retrieve listings of sites that have that particular resource / asset / characteristic.
Which then often is fed into a botnet for one attempt at an exploit or another.
If you're 100% positive you've never seen requests like these, and that indeed those requested assets are non-existing, you're arguably looking at an initial sweep, i.e. your site is broadsided with those requests, and essentially only those that give a non-404 reply are used, or better: set aside for later "use".
Those can then be fed into e.g. Google, Yahoo, or other SEs for the simple "batch search" for the particular vulnerability they're looking for.
Bottom line: if you're positive that they're fishing for garbage - i.e. your site doesn't respond other than with a 404 - you can ignore 'em. If they had a positive hit, it's likely you'll see a return of a botnet, washing over your site with requests related to these probes.
Since you're running Drupal, I recommend wrapping the Drupal script with a security wrapper; one I very much like is the GPL released ZB Block; see www.spambotsecurity.com
Good luck!
|
Welcome to Project Honey Pot | Login