[Xitami] Unsolicited HTTP GET requests in access.log

[jglong3 at att.net]

Hello,,,,,:) :) :)

THANKS for your time, help, and advise,,,,,

Running Xitami V2.5b4 on a Windows 98SE system and all is working as expected,,,mainly very few crashes over the last few months.

I have just noticed that the Xitami ACCESS.Log file is recording some unsolicited HTTP GET requests from several IPs around the world and these contain the same GET request text strings.

An example of one set of GET Requests includes the following:

80.55.242.146 - - [20/Jun/2006:03:02:32 -0600] "GET //README HTTP/1.1" 404 -1 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
80.55.242.146 - - [20/Jun/2006:03:02:34 -0600] "GET /horde//README HTTP/1.1" 404 -1 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
80.55.242.146 - - [20/Jun/2006:03:02:35 -0600] "GET /horde2//README HTTP/1.1" 404 -1 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
80.55.242.146 - - [20/Jun/2006:03:02:36 -0600] "GET /horde3//README HTTP/1.1" 404 -1 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
80.55.242.146 - - [20/Jun/2006:03:02:38 -0600] "GET /horde-3.0.9//README HTTP/1.1" 404 -1 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
80.55.242.146 - - [20/Jun/2006:03:02:39 -0600] "GET /Horde//README HTTP/1.1" 404 -1 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"

For the cases found related to the above example, when they start, it is the same set of requests but from several different IPs.

The above example appears to be from an IP in "RIPE Network Coordination Centre" and specifically from: 

inetnum:         80.55.242.144 - 80.55.242.147
netname:         PRYWTNELO
descr:           PRYWTNE LICEUM OGOLNOKSZTALCACE
descr:           SLUPSK
descr:           POLAND

Some investigation related to HTTP Get request and /HORDE text string in the GET request, 3 related items have been found:

       1. Macfee reports a problem with an HTTP GET in one of their applications
       2. Horde is reported as an OPEN source type development.
       3. Horde is reported as an Email type application.

Before I noticed the above item 1 and then considered these HTTP GET requests may be related to some Xitami crashes, I had already deleted the access log files related to the times listed in the crash.log file.

Has anyone had any experience related to unsolicted GET requests and Xitami crashes that may be related to item 1 above????

 
Again, thank you for your time, help, and advise!!!   :) :)

Jerry