Poll Booth?

[Early Out]

Has anyone seen hits like this in his logs? I've been getting a lot of them lately, from all over the place, but only on one of my sites. They just generate 404s on my site, so I'm not really concerned about them. I just can't figure out what they are, and what's generating them:

(link removed, for safety's sake)

The URL in there has absolutely nothing to do with any site of mine. It's a strange little site that doesn't appear to have had any new content since early 2006. But the hits are definitely in my "latest visitors" list, and in my awstats list of 404s.

[wysiwyg]

It's an attempt to get a linkback to their site if your server logs are public and get crawled, or at the very least searched for, which raises its rank.

If you recall, a certain spambot was advertising in a similar fashion on the board yesterday. They use an arbitrary, unique word for their product, which they get you to search for on google. It increases their popularity rating when people land on their page, and the more visitors they get, the more revenue they receive from ads on their site, even if you don't buy anything from them.

[Early Out]

That would make sense if the site were an active site, with ads on it. But it's not - the site appears to be dead, with no revenue-generating stuff on it. In fact, the only outside links on the page at all are to Joomla and Bluehost, and a few links to some Yahoo Groups. Nothing else, and nothing newer than June 2006. Very puzzling.

Ultimately it doesn't matter much, of course, since my logs aren't public. I'm just curious about the motivation behind it.

[Treeluvin]

This is a very basic penetration test, normally ran against several thousands sites at a time.
If you were to be running whatever software that has that particular vulnerability, it would load the PHP page (id1.txt) and flag that URL as exploitable.
Next would come the inclusion of one of the many popular php shells that would give the attacker complete control over many aspects of your account.

Happens about a bajillion times a day to people that run outdated php code.

[Early Out]

Ah, I see! Happily, my sites are all plain-vanilla HTML with some Javascript - nothing exploitable.

I'll remove the link from my original post.

[wysiwyg]

True, it was an inclusion attempt. Spambots have similar behavior, and I didn't check the link.

[Shonky]

I've had the same hits as others, it looks to be bots looking for Advanced Poll which is the app that has the vulnerability.