Re: New zombie fleet looking at webserver root pages??? Started Feb 10, ALL with browser string "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"

From: Cichlidiot (fishlover_at_nospam.net)
Date: 02/21/04 

Date: Sat, 21 Feb 2004 02:51:49 +0000 (UTC)

In comp.security.misc Craig <anonymous@illegalhostname.com> wrote:

> Good-day,

> I know this isn't exactly a firewall question, but you guys seem much more on top of these types of things than the "general security" crowd who are all dealing with spyware and mail-worms.

> I've never seen anything like this before.

> Starting back on Feb 10th 2004 I've found an increasing number of solitary http get requests to the root page of my webserver. They come from broadband lines spread all over the place, and *ALL* the requests have the same browser identifier, with no referrer. Almost none of the IP's have ever made more than one request.

Well, can't comment on what could be causing it, but doesn't seem to be
just you. Check out the port 80 graph on DShield.org:

http://www.dshield.org/port_report.php?port=80

Perhaps it would be best to post this on several lists to see if others
know what is going on. I'll do a little web digging meanwhile and see if
anything turns up.

Relevant Pages

  • Re: New zombie fleet looking at webserver root pages??? Started Feb 10, ALL with browser string &q
    ... In comp.security.misc Craig wrote: ... Well, can't comment on what could be causing it, but doesn't seem to be ... Check out the port 80 graph on DShield.org: ...
    (comp.security.firewalls)
  • Re: Squid Proxy
    ... so i was just wondering if its possible that someone else could be trying to crash against my port 3128? ... I'v been noticeing in my snort logs a lot of Squid Proxy ... >> dont think that hes causing them (unless hes capable of spoofing what NIC ...
    (Security-Basics)
  • Re: VBA Printing
    ... IE store data, printer name, port used... ... this is where I will use the for/next loop ... > Craig,> ... Each time I encounter a new printer I install the ...
    (microsoft.public.excel.programming)
  • Novice - help with pattern matching needed
    ... I am using a very basic Perl script to parse a file and extract just ... the elements I need but one aspect is causing me trouble and I am sure ... the left and the "UV Port" on the right. ...
    (comp.lang.perl.misc)
  • Re: Source: Artest looks to be bound for L.A.
    ... >>>Glad that you found the article, it was causing quite ... My God, someone is recommending blocking a port that existed since the ...
    (alt.sports.basketball.nba.la-lakers)