Is this a hack or exploit attempt?

[smah]

Starting yesterday, there are many of these entries in my access logs. They are all from different IP address - 1 'Get' per address. They are showing up in the log for the first VirtualHost which is only accessible by IP address, not name (this is an intentional configuration controlled by DNS configuration & Hostname). There is no agent info & apache seems to be serving the default page as it should, but not the images on the default page.

Nothing bad seems to be happening, & I have a suspicion about what this is & why it started, but I just wanted other thoughts to make sure. Below is a small excerpt from the access log (with IP's removed):

[i]requesting IP[/i] - - [05/Feb/2006:06:18:20 -0500] "GET / HTTP/1.0" 200 7762 "-" "-"
[i]requesting IP[/i] - - [05/Feb/2006:06:27:34 -0500] "GET / HTTP/1.0" 200 7762 "-" "-"
[i]requesting IP[/i] - - [05/Feb/2006:06:50:28 -0500] "GET / HTTP/1.0" 200 7762 "-" "-"
[i]requesting IP[/i] - - [05/Feb/2006:06:52:46 -0500] "GET / HTTP/1.0" 200 7762 "-" "-"
[i]requesting IP[/i] - - [05/Feb/2006:06:55:56 -0500] "GET / HTTP/1.0" 200 7762 "-" "-"
[i]requesting IP[/i] - - [05/Feb/2006:06:59:36 -0500] "GET / HTTP/1.0" 200 7762 "-" "-"
[i]requesting IP[/i] - - [05/Feb/2006:07:11:12 -0500] "GET / HTTP/1.0" 200 7762 "-" "-"
[i]requesting IP[/i] - - [05/Feb/2006:07:14:37 -0500] "GET / HTTP/1.0" 200 7762 "-" "-"
[i]requesting IP[/i] - - [05/Feb/2006:07:23:45 -0500] "GET / HTTP/1.0" 200 7762 "-" "-"
[i]requesting IP[/i] - - [05/Feb/2006:07:25:24 -0500] "GET / HTTP/1.0" 200 7762 "-" "-"

Thanks for your thoughts & info.

 

[elgrandeperro]

Webcrawlers/spiders will do this.

Here is a URL:

http://www.robotstxt.org/wc/robots.html

One can usually figure out from the reverse IP if it is true robot.

gene

 

[smah]

I have no doubt that it's a bot of some sort, but most search engine bots will identify themselves. I have hundreds of these - all from entirely different addresses that seem to be just personal computers on the internet. And this all started very suddenly & they are requesting the public IP address - not any domain name.

My suspicion is that someone installed a file sharing application or something similar that & those requests (from others around the world using that same app) are being routed to apache.

I just wanted to make sure there wasn't something else going on before I start a witch hunt.