Is this a hacking attempt?

http://drupal.org/node/23953

- Robert Douglass

-----
If this helped you, please take the time to rate the value of this post: http://rate.affero.net/robertDouglass/

www.hornroller.com, www.robshouse.net

I just helped a client the other day with exactly this problem. I have been meaning to write an article on it, but never got to that.

In their case, they were using an old Drupal, a 4.4 based CivicSpace distro.

Prior to 4.5, Drupal did not issue a proper 404, and just displayed the home page. So these spammers thought that their attempt was successful, and kept doing it again and again.

The other side effect was that all these attempts got into the cache and since it was the home page that got sent, it got cached over and over and over with each URL (partners.mygeek.com/?id=something), and the cache just kept growing indefinitely.

The site was getting few users anyway, and upgrading to a current release was not an option. So I turned the cache off and emptied the cache table, and they were far better off. This left only one issue which is excessive bandwidth usage, but they were willing to live with it.

You can also read about a similar incident here http://drupal.org/node/22313

Maybe I will get to write that article sometime.

--
Drupal development and customization: 2bits.com
Personal: Baheyeldin.com

Here is an article on how Drupal proxy/spamming attempts can cause trouble.

--
Drupal development and customization: 2bits.com
Personal: Baheyeldin.com