[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: periodic downloads of /debian/ls-lR.gz

Simon Paillard wrote: 
On Thu, Apr 09, 2009 at 07:24:22AM -0400, Ricardo Yanez wrote:
  
I have noted that certain sites download /debian/ls-lR.gz over and over  
again, every 3 or so minutes. The connection has no agent. Is there a  
Debian utility or tool that does this, or is this just wasteful?
    
I don't know any tool that use this file.

  
Example:
sysde.com - - [09/Apr/2009:06:37:14 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 200 5186205 "-" "-"
    
Is there only one host requesting this file in your logs ?
I have blocked these requests with a rewrite rule:

        # block requests having an empty user agent
        <IfModule mod_rewrite.c>
                RewriteEngine   on
                RewriteCond     %{HTTP_USER_AGENT} ^$ [NC]
                RewriteRule     ^/.* - [F]
        </IfModule>

I'm no apache expert, so please correct me if I'm doing something stupid.

Ricardo

<snip>
bas1-toronto61-1279437129.dsl.bell.ca - - [12/Apr/2009:09:00:02 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 403 347 "-" "-"
static-68-179-10-90.ptr.terago.net - - [12/Apr/2009:09:02:19 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 403 347 "-" "-"
bas1-toronto61-1279437129.dsl.bell.ca - - [12/Apr/2009:09:02:43 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 403 347 "-" "-"
host217-34-82-75.in-addr.btopenworld.com - - [12/Apr/2009:09:04:03 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 403 347 "-" "-"
cpe-60-230-187-2.static.vic.bigpond.net.au - - [12/Apr/2009:09:04:32 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 403 347 "-" "-"
bas1-toronto61-1279437129.dsl.bell.ca - - [12/Apr/2009:09:05:23 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 403 347 "-" "-"
bas1-toronto61-1279437129.dsl.bell.ca - - [12/Apr/2009:09:08:05 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 403 347 "-" "-"
static-68-179-10-90.ptr.terago.net - - [12/Apr/2009:09:08:26 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 403 347 "-" "-"
host217-34-82-75.in-addr.btopenworld.com - - [12/Apr/2009:09:09:51 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 403 347 "-" "-"
bas1-toronto61-1279437129.dsl.bell.ca - - [12/Apr/2009:09:10:44 -0400] "GET /debian/ls-lR.gz HTTP/1.1" 403 347 "-" "-"
</snip>
Reply to: