Bot confused or evil?

[qoregexp]

I am seeing in my logs that a particular bot is accessing a lot of my pages (and hitting them fast) with invalid arguments.

For instance I have a page like content.php?page=1 where page should be numeric.

This bot is accessing it with an url instead of a page number, like
content.php?page=http://www.somesite.com/dir1/dir2/

It doesn't hurt anything because I check all the arguments and if they aren't valid set them to default values. I have seen small amounts of this in the past but on one day that I'm looking at the log is just full of it. They are also pulling pages that don't take arguments and for those they don't try to set any argument. What are they up to? I can't think what the point of this is. Should I ban this IP address? I looked it up and it says it's ph02.droa.com. droa.com is a registrar, kind of a sleazy one apparently, and they also submit sites to search engines. Could they be thinking I'm a search engine? Are they looking for some vulnerability that I'm not aware of?

Any thoughts would be much appreciated.

[wige]

My guess is Evil.

Looks like an analysis program probing your site for vulnerabilities. If you run an auditing tool like Nessus on your site, you would see the same thing.

One common vulnerability is causing one page to show the source code of another page. This can be used to find database usernames and passwords, and other interesting information. Generally, the URLs used in such a scan are pulled from a list of known-vulnerable applications, such as older or unpatched CMS systems. Typically, you would just get a 404 not found error, but if your script has the same name as a vulnerable application, you may get hit with attempted exploits.

If your logging indicates this type of traffic is repeatedly being targeted at the same script, I would check the script itself, as there may be some other exploit occuring.

[qoregexp]

Thanks. Can you suggest anyplace I could go to read more about such vulnerabilities? I don't think I am very good at thinking like a hacker.