Odd Scooter Behavior?

[Thomas Dowling]

Web4Libistas--

I was just looking through our NT Server logs and noticed a handful of
recent notes from our IIS web server, all along the lines of "The server was
unable to logon the Windows NT account 'blahblah' due to the following
error: Logon failure: unknown user name or bad password."  Sometimes the
user name is "admin" but sometimes it's something off the wall like "hansen"
or "brocear".

When I compare the times of the error messages to the IIS logs, I see that
these messages always come from requests for robots.txt, and far from being
some idle hacker looking for accounts we might have open, at least some of
these hits come from Scooter, the spider DEC uses for Alta Vista.  The other
IP's I'm seeing all come from the European Regional Internet Registry, so I
wonder if I'm seeing hits from a European version of Alta Vista.

Does anyone know what I'm seeing here?  Why would Alta Vista, or any other
spider polite enough to get robots.txt, be bouncing quasi-random user names
off our server?


Thomas Dowling
OhioLINK - Ohio Library and Information Network
tdowling at ohiolink.edu