Boston Linux & Unix (BLU) Home | Calendar | Mail Lists | List Archives | Desktop SIG | Hardware Hacking SIG
Wiki | Flickr | PicasaWeb | Video | Maps & Directions | Installfests | Keysignings
Linux Cafe | Meeting Notes | Blog | Linux Links | Bling | About BLU

BLU Discuss list archive


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Anyone familiar with "2rand[0,1,1]" ?



Lately some CGI programs I'm responsible for have been called  a  lot
by  what  looks  like  link  spammers  with  various  params  set  to
"2rand[0,1,1]".  It's usually accompanied by URLs in other params, as
if  the client is trying to get my CGI programs to reference them, in
typical link spammer style.  The links usually point to pharm or porn
sites, but that's probably not relevant to the puzzle.

I did a bit of googling, and found zillions of hits  that  look  like
random  text  with  various relatives of "2rand[0,1,1]" inserted here
and there.  But I didn't find any explanation of this odd expression.
Sometimes  it's  "2rand  0  1  1",  sometimes  it  has other kinds of
punctuation, the sort of stuff that you'd expect  rendering  software
to rewrite it as if it's not understood, and it never has any obvious
relation to the text it's inserted in.

Anyone know what the origin of this expression is? I've added code to
recognize it, of course, and drop the  requests.   But  it  could  be
interesting  to  know  if it says anything that could be used to good
use in harrassing these clients.

I have sometimes wondered what fraction of web servers' time is spent
starting up such bogus calls of CGI programs.  These didn't cause any
harm, other than wasted  bandwidth  and  cpu,  but  seeing  such  odd
expressions being passed as parameters makes one curious.

Another one just showed up in the error_log as I typed this ...


--
   _'
   O
 <:#/>  John Chambers
   +   <jc-8FIgwK2HfyJMuWfdjsoA/w at public.gmane.org>
  /#\  <jc1742-Re5JQEeQqe8AvxtiuMwx3w at public.gmane.org>
  | |






BLU is a member of BostonUserGroups
BLU is a member of BostonUserGroups
We also thank MIT for the use of their facilities.

Valid HTML 4.01! Valid CSS!



Boston Linux & Unix / webmaster@blu.org