lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed Jun 14 21:33:56 2006 From: very at unprivate.com (php0t) Subject: Strange HTTP requests -----Original Message----- From: Shannon Johnston Sent: Wednesday, June 14, 2006 10:17 PM To: full-disclosure@...ts.grok.org.uk Subject: [Full-disclosure] Strange HTTP requests > I'm seeing a ton of HTTP requests in the following fashion: > > GET index.html - 80 - <ip address> HTTP/1.1 fuujcbjbGbagkmkGuj7kmgnebl > +qekaf - - website.com 302 0 0 532 206 218 > The random string would normally be the user-agent. I can't help but think this is a bot of some sort. > Anybody know of anything that would produce this? Are they all index.html requests? How often do you get them? From how many different IP's? It could be just a proxy or a firewall set up to change the user-agent to some random string, but whether they're surfers or bots you can tell by looking at all such lines - to me, an index.html alone doesn't tell me much, maybe others have seen this though and know what it is. php0t www.zorro.hu
Powered by blists - more mailing lists