Re: Increase in MS vuln WebDav scans
Date: 1 Jun 2004 17:13:11 -0000 To: email@example.com('binary' encoding is not supported, stored as-is) In-Reply-To: <EB6D35AE1E5D3E40B4536F55B540A5D8013DDAE3@ssdexch1.websense.com>
220.127.116.11 - - [01/Jun/2004:04:59:58 -0400] "SEARCH /\x90\x02\xb1\x02\xb1\x02$
18.104.22.168 - - [01/Jun/2004:10:01:44 -0400] "SEARCH /\x90\x02\xb1\x02\xb1\x0$
Got some myself. I posted a post about this a few weeks ago and the moderator said that many worms out today like Ago/Phatbot use the WebDAV vulnerability in the worm. I just ignore them and rotate out my logs more because that particular scan takes like 34k of log space.