Geeklog Forums

I am clueless when it comes to spam so that you know where i'm coming from.

I've just installed the Dirk's Bad Behaviour plugin. Just had a look at the log and was immediately confused. It has listed there over 50 entries all associated with a recognized IP, which is used by one of my regular users. I also noticed that 2 user agents are associated with that IP: one is the regular browser thingy and the other one is "Microsoft URL Control - 6.00.8862", which Bad Behaviour, as far as i understand, doesn't like.

So my question is, is my user being blocked? According to GUS, it seems so (after Bad Behaviour is installed). But then having a closer look at GUS, I find that my user has been showing some strange activity, eg, viewing the same page 40 times in a row (prior to bad behaviour). Maybe I'm just paranoid now. Confused, for sure!

Under normal circumstances[1], all the entries are those of blocked requests. The reason given in the details should give you an idea what it didn't like. And if it only says "I know you and I don't like you, dirty spammer", then it's a repeat offender. In that case, use the "Search" option next to the IP address to find the first entry which will have the reason why it was blocked in the first place.

I don't know why Bad Behavior blocks the Microsoft URL Control (if in doubt, ask Michael), but we block this thing in the .htaccess here on geeklog.net, as it showed up in the logfiles with dubious requests too often.

If you're sure that it's a legit user, then my guess would be that he has a trojan or something like that on his machine.

bye, Dirk

[1] There's an option for extendend logging deep down in Michael's sources that would log all requests, but it's off by default and can only be enabled in the source.