Security Incidents: Re: User-agent

[Chip McClure <vhm3 () hades dnsalias net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

More than likely, it is a modified user agent string. I've had a few
entries in my server logs:

tide74.microsoft.com - - [09/Feb/2001:10:19:01 -0800] "GET
/mp3/south-park/ HTTP/1.0" 200 1545 "http://xxxx.xxxxxxx.net/mp3/";
"Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"

Chip

- -----
Chip McClure
Sr. Unix Administrator
GigGuardian, Inc.

http://www.gigguardian.com/
- -----

On Wed, 3 Oct 2001, Johan Denoyer wrote:

> Hi,
>
> I was going through my web server logs and I saw requests from
> tide74.microsoft.com. The thing is though the user-agent is not really
> usuall since it is "BunnySlippers".
>
> Does anyone know where I could find more information on the software used, I
> have tried on search engines (google,yahoo,etc...) with no luck.
>
>
> Sincerly,
>
> Johan Denoyer
> jdenoy () dci 4mg com
> Digital Connexion
> http://digitalc.free.fr
> French Computer Security Web Site
>
>
> ----------------------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management
> and tracking system please see: http://aris.securityfocus.com
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Made with pgp4pine 1.76

iQA/AwUBO7uRCYxq/3tb9j7EEQJqCACfSzcpvpczF//NRYRFRVJbir8KdYYAnizx
G8BHza3JXeblwkaRg5+Cf6IE
=AGEx
-----END PGP SIGNATURE-----



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com