full-disclosure - strange domain name in phishing email

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed Mar 15 03:43:52 2006
From: umphress at gmail.com (Chris Umphress)
Subject: strange domain name in phishing email

On 3/14/06, gboyce <gboyce@...belly.com> wrote:
> I tried this trick against my personal Apache 2 webserver, and got a 400
> bad request as well.  The apache log is showing "Client sent malformed
> Host header".
>
> It looks like Apache is getting the decimal host header, and doesn't
> understand what to do with it.  Oddly, the host mentioned in the initial
> e-mail is also Apache, but it's Apache 1.3.
>
> Is your Apache on windows server 1.x or 2.x?

I'll jump in and say that mine works works this way (If you want to
verify, it is http://1136002182/).

I am using Apache 1.3 and have several virtual hosts set up. Since
Apache returns the first virtual host if it doesn't match the names of
any of the other virtual hosts. That could be the determining factor
for why some work and others don't.

--
Chris Umphress <http://daga.dyndns.org/>