Strange accesses to my webserver...

From: Erlend Simonsen (fudge@planetarion.com)
Date: 08/16/01


To: focus-linux@securityfocus.com
Subject: Strange accesses to my webserver...
From: Erlend Simonsen <fudge@planetarion.com>
Date: 16 Aug 2001 12:50:49 +0200
Message-ID: <m38zgk9t2u.fsf@cruiser.planetarion.com>


I'm getting _loads_ of these today. Lots of different IP's, lots of
variations in the duid field.

,----[ Examples ]
| "GET /?did=150&ver=1.51&duid=uttgjkxrpxipctnrgjffeuqivalft HTTP/1.1" 200 1205 "-" "-"
| "GET /?did=149&ver=1.51&duid=TRANCEBABE69 HTTP/1.1" 200 1205 "-" "-"
| "GET /?did=150&ver=1.51&duid=kxiothckjpjwznbhaxdqzckgincjv HTTP/1.0" 200 1192 "-" "-"
`----

Anyone able to tell me what generates this and what I can do to stop
it? I've had about 60,000 hits like this so far today, and it's
grinding my apache 1.3.19 to a stand still.

Any help would be appreciated, as my website is broken at the moment.

-- 
Fudge 
fudge@planetarion.com - http://www.planetarion.com