backend.php attack? or news feed pulling?

New Member Joined: Nov 22, 2005 Posts: 22

Hi hi,

While scoping over Nuke Sentinels logs my wife came across something odd. An anonymous user was hitting our backend.php about once ever half hour maybe more often sometimes but averaging about that. This of course prompted us to understand what this was used for.

We operate a small business and have been trying to promote ourselves.

The address is registered to a user at 24.175.147.104. This appears to be registered to Road Runner. The agent is Mozilla/4.0 (compatible; Google Desktop). I'm just trying to determine if I should be concerned or not.

Our website is www.nightfallfashions.com.

Thanks in advance,

Nev

registered · Posted: Mon Feb 27, 2006 8:07 pm

Looks like a user is using the Google Desktop program to pull your RSS feed.
According to their IP, its a user on
United States - Alabama - Birmingham - Road Runner

Looks like a legit user to me

Posted: Tue Feb 28, 2006 6:24 pm

Neveryll,

since I found daily more and more Google Desktop entries in my logfiles I ´m also wondering about Mozilla/4.0 (compatible; Google Desktop). I ´m not using the desktop search but it seems it´s popular. Now Desktop Search 3.
However,I´ll check the logs for this also in the future to be sure it´ s always harmless.