Home page logo
/

nanog logo nanog mailing list archives

Re: Pattern matching odd HTTP request
From: Bill McGonigle <mcgonigle () medicalmedia com>
Date: Tue, 18 Sep 2001 16:13:27 -0400



On Tuesday, September 18, 2001, at 02:36 PM, Jake Khuon wrote:

Anyone seeing a lot of these in their webserver logs?

208.202.180.4 - - [18/Sep/2001:11:19:31 -0700] "-" 408 -

This machine is in my /8

-----
207.202.84.209 - - [18/Sep/2001:15:16:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:18:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:19:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:21:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:22:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:24:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:25:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:27:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:28:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:30:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:31:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:33:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:34:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:36:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:37:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:39:19 -0400] "-" 408 -
-----

Every minute and a half, on the money, weird.

-----
>telnet 207.202.84.209 80
Trying 207.202.84.209...
Connected to 207.202.84.209.
Escape character is '^]'.
HEAD / HTTP/1.0

HTTP/1.1 200 OK
Server: Microsoft-IIS/4.0
Date: Tue, 18 Sep 2001 20:05:15 GMT
Content-Type: text/html
Set-Cookie: ASPSESSIONIDQQGQGGBK=HCBJIPMDEMHKDLBPMKMDDOMN; path=/
Cache-control: private

Connection closed by foreign host.
>
------

What else....


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault