search log - users inputting "-1"

[Ray]

Another thought:

You might also want to check if you have any URL rewrites/redirection on your site which is going to the page with search.asp?zoom_query=-1 in the URL, or if you have created your own search form in HTML, you might have a typo in an input tag where instead of something like:

<input type="hidden" name="zoom_cat[]" value="-1">

and you may have mistakenly put zoom_query in place of the variable name.

[David]

I still think it is worth a look at the server HTTP log file. You might be able to work out what site they are coming from.

[kenny]

I don't think it is a DoS attack because it is only a few at a time.
2012-03-14, 06:22:14, 91.207.60.66, "-1", Matches = 0, AND, PerPage = 10, PageNum = 0, "Cat = All", Time = 0.011, Rec = 0
2012-03-14, 06:22:20, 91.207.60.66, "-1", Matches = 0, AND, PerPage = 10, PageNum = 0, "Cat = All", Time = 0.011, Rec = 0
2012-03-14, 06:27:46, 91.207.60.66, "-1", Matches = 0, AND, PerPage = 10, PageNum = 0, "Cat = All", Time = 0.010, Rec = 0
2012-03-14, 06:28:22, 91.207.60.66, "-1", Matches = 0, AND, PerPage = 10, PageNum = 0, "Cat = All", Time = 0.011, Rec = 0
2012-03-14, 06:33:10, 91.207.60.66, "-1", Matches = 0, AND, PerPage = 10, PageNum = 0, "Cat = All", Time = 0.015, Rec = 0

Not from the same IP address. The log only shows them searching for "-1" nothing else, so I don't think it is a bad link. If it is a bad link, then I would think they would end up searching for something else.

So what i been doing is, if I find a lot of -1 for one IP i just ban the IP in IIS.

[David]

Doesn't make any sense to me.
Could it be part of a denial of service attack? Got any tech savvy enemies? Still searching for -1 isn't the most effective way to load up a server. So if it is a DoS attack, it isn't a very sophisticated one.

Can you post a few lines from the log.
Are they all from a single IP address?
What is the delay between each request?

Could it be just a bad link on your own site that people are following (effectively a typo)? Check the server logs to look at the HTTP request and the referrer.

If it was a single IP address, and it was my site I would just ban the IP address via the .htaccess file.

[kenny]

This must be from a bot. why are they searching for "-1" ? or are they searching for something else but the log only shows "-1"

I have about 18,000 entries in my log with "-1"
thx