OT: Possible Hijacking from Globix

This WebDNA talk-list message is from

2002

It keeps the original formatting. numero = 42734
interpreted = N
texte = A page on my server is being hit at a rate of about 20 hits/hr from the same two IP addresses registered to a company in GB called Scrollock Computers. They seem to be owned by Globix (globix.com). I see that Globix does proxy services. I'm wondering if this is what is hitting my page. I haven't seen a reply from them to a message I sent inquiring, but it may be that it's too late there. The page being hit is a products details page for a few Beatles CD's we carry. I've done some statistics:1. Always the same browser UA. Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)2. Only 1 out of 100 hits includes a cookie that I set on the page (return visitor)3. All hits from two IP addresses: 213.219.017.220, 213.219.058.0194. Javascript Code seems to be stripped out of what the final viewer sees. (I assume this because I put a javascript in the page that would preload an image. I added some variables to the image request so that I could possibly see what url the person behind the proxy was visiting and what UA they were using. So far, no hits to that image.)5. Always the same [cart] string. So they are proxying a page that is useless as an actual e-commerce application.6. After three days of this, that cart file is still empty. This leads me to believe that they may also be stripping out the click to order button on the page.Globix looks pretty big from their web site. Has anyone else had an experience with them like this?Mike-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://search.smithmicro.com/ Associated Messages, from the most recent to the oldest:

OT: Possible Hijacking from Globix (Michael Davis 2002)

A page on my server is being hit at a rate of about 20 hits/hr from the same two IP addresses registered to a company in GB called Scrollock Computers. They seem to be owned by Globix (globix.com). I see that Globix does proxy services. I'm wondering if this is what is hitting my page. I haven't seen a reply from them to a message I sent inquiring, but it may be that it's too late there. The page being hit is a products details page for a few Beatles CD's we carry. I've done some statistics:1. Always the same browser UA. Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)2. Only 1 out of 100 hits includes a cookie that I set on the page (return visitor)3. All hits from two IP addresses: 213.219.017.220, 213.219.058.0194. Javascript Code seems to be stripped out of what the final viewer sees. (I assume this because I put a javascript in the page that would preload an image. I added some variables to the image request so that I could possibly see what url the person behind the proxy was visiting and what UA they were using. So far, no hits to that image.)5. Always the same [cart] string. So they are proxying a page that is useless as an actual e-commerce application.6. After three days of this, that cart file is still empty. This leads me to believe that they may also be stripping out the click to order button on the page.Globix looks pretty big from their web site. Has anyone else had an experience with them like this?Mike-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://search.smithmicro.com/ Michael Davis

DOWNLOAD WEBDNA NOW!

OT: Possible Hijacking from Globix

2002

Top Articles:

Related Readings: