By Anonymous (not verified) on

I don't see a "Security" forum, so I'm posting here. Found the following in my access log in the wee hours of the morning, and "things that I seem strange in hours when I'm sleeping" always make we wonder.

Some.Random.IP.Address - - [30/Mar/2007:03:34:33 -0400] "GET / HTTP/1.1" 200 5585
Some.Random.IP.Address - - [30/Mar/2007:03:34:33 -0400] "GET /sites/all/modules/date/date.css HTTP/1.1" 200 1249
Some.Random.IP.Address - - [30/Mar/2007:03:34:33 -0400] "GET /modules/book/book.css HTTP/1.1" 200 576
Some.Random.IP.Address - - [30/Mar/2007:03:34:33 -0400] "GET /modules/forum/forum.css HTTP/1.1" 200 694
Some.Random.IP.Address - - [30/Mar/2007:03:34:33 -0400] "GET /modules/node/node.css HTTP/1.1" 200 717
Some.Random.IP.Address - - [30/Mar/2007:03:34:34 -0400] "GET /modules/system/defaults.css HTTP/1.1" 200 737
Some.Random.IP.Address - - [30/Mar/2007:03:34:34 -0400] "GET /modules/system/system.css HTTP/1.1" 200 6932
Some.Random.IP.Address - - [30/Mar/2007:03:34:34 -0400] "GET /modules/user/user.css HTTP/1.1" 200 858
Some.Random.IP.Address - - [30/Mar/2007:03:34:34 -0400] "GET /sites/all/modules/cck/content.css HTTP/1.1" 200 694
Some.Random.IP.Address - - [30/Mar/2007:03:34:34 -0400] "GET /sites/all/modules/cck/fieldgroup.css HTTP/1.1" 200 89
Some.Random.IP.Address - - [30/Mar/2007:03:34:34 -0400] "GET /sites/all/modules/event/event.css HTTP/1.1" 200 5041
Some.Random.IP.Address - - [30/Mar/2007:03:34:34 -0400] "GET /themes/garland/style.css HTTP/1.1" 200 19149
Some.Random.IP.Address - - [30/Mar/2007:03:34:34 -0400] "GET /themes/garland/print.css HTTP/1.1" 200 1192
Some.Random.IP.Address - - [30/Mar/2007:03:34:34 -0400] "GET /themes/garland/fix-ie.css HTTP/1.1" 200 1347
Some.Random.IP.Address - - [30/Mar/2007:03:34:35 -0400] "GET /files/color/garland-3c43caa9/style.css HTTP/1.1" 200 19042

This is the ENTIRE (recorded) session with Some.Random.IP.Address. Why would they want my (admittedly boring) CSS files? And only my CSS files? Anyone ever seen this before? Or got a clue as to what's going on?

Thanks.

⋅ Categories: Drupal 5.x

Comments

yelvington’s picture

yelvington commented

Why would they want my (admittedly boring) CSS files? And only my CSS files?

That's not what happened; the first line in the logfile excerpt is a request for your homepage, which probably referred to those CSS files.

Anonymous’s picture

Anonymous (not verified) commented

I must have gone brain dead.

Thanks for pointing out the obvious.......