~symka/gnucleus/gcache.php
 

hello,

i do not know where else i could ask that question.

When i parse my web server apache log i see lots of these messages:

66.138.xx.xx- - [08/Jun/2006:12:57:14 +0300] "GET /~symka/gnucleus/gcache.php?client=BEAR&version=4.2.8.2&hostfile=1 HTTP/1.1" 200 20
66.37.xx.xx- - [08/Jun/2006:12:57:33 +0300] "GET /~symka/gnucleus/gcache.php?client=BEAR&version=4.2.7.9&hostfile=1 HTTP/1.1" 200 20
172.195.xx.xx- - [08/Jun/2006:12:57:33 +0300] "GET /~symka/gnucleus/gcache.php?client=BEAR&version=4.2.6.7&hostfile=1 HTTP/1.1" 200 20
82.160.xx.xx - - [08/Jun/2006:12:57:39 +0300] "GET /~symka/gnucleus/gcache.php?client=BEAR&version=4.2.4.8&hostfile=1 HTTP/1.1" 200 20
67.183.xx.xx- - [08/Jun/2006:12:57:50 +0300] "GET /~symka/gnucleus/gcache.php?client=BEAR&version=4.2.3.2&hostfile=1 HTTP/1.1" 200 20
70.174.xx.xx- - [08/Jun/2006:12:58:01 +0300] "GET /~symka/gnucleus/gcache.php?client=BEAR&version=4.2.6.7&hostfile=1 HTTP/1.1" 200 20
68.57.xx.xx- - [08/Jun/2006:12:58:12 +0300] "GET /~symka/gnucleus/gcache.php?client=BEAR&version=4.2.1.1&hostfile=1 HTTP/1.1" 200 20
209.89.xx.xx- - [08/Jun/2006:12:58:26 +0300] "GET /~symka/gnucleus/gcache.php?client=BEAR&version=4.2.1.1&hostfile=1 HTTP/1.1" 200 20

I think it is some sort of caching information. But that user even does not exists anymore. Can anyone help me. Maybe anyone of you can remove my host from your cache database???

IP: 84.32.84.6
indigo.remo.lt

Any answer would be a appreciate. Thank you

------------------------
This is what ngrep shows:
T 66.138.xx.xx:4196 -> 84.32.84.6:80 [AP]
GET /~symka/gnucleus/gcache.php?client=BEAR&version=4.2.8.2&hostfile=1 HTTP
/1.1..Connection: close..Host: indigo.remo.lt..User-Agent: BearShare 4.2.8.
------------------------

It's a bit odd that you still see that many requests. The user
was running a GWebCache at your site at some point but that was
2-4 years ago. I'm even more suprised that people still use such
old software as BearShare 4.x. I believe there's nothing anyone
can really do about this. Such old software shouldn't even attempt
to connect to GWebCaches. It's a blatant shame it does - albeit
the identification as BearShare COULD be faked, so one cannot
be absolutely sure about this.

Anyway, one request per 20 seconds shouldn't be a threat for
any webserver but I understand that it's very annoying. You
might want to put the worst offenders into your firewall's
blocklist.

Even if BearShare fixed the issue, there's nothing they can
do about old software.