Security Incidents mailing list archives
Re: Workstations trying to GET /download/IEService215.chm HTTP/1.1 from 67.109.249.3
From: "Peter Bates" <Peter.Bates () lshtm ac uk>
Date: Mon, 12 Jul 2004 12:22:21 +0100
Hello all...
"Humes, David G." <David.Humes () jhuapl edu> 09/07/04 20:01:41 >>> Starting around July 8th we noticed workstations trying to access 67.109.249.3 on port 80 and do a
GET /download/IEService215.chm HTTP/1.1
Looking back through Squid logs, I see a couple of hosts doing something mightily similar today, but also going back as far as: Thu Jun 10 12:53:32 2004 12115 a.b.c.94 http://67.109.249.3/download/IEService215.chm text/plain Today I'm seeing Mon Jul 12 11:12:52 2004 12121 a.b.c.130 http://67.109.249.3/download/IEService299.chm text/plain Mon Jul 12 11:24:16 2004 12131 a.b.c.162 http://67.109.249.3/download/IEService299.chm text/plain instead... Perhaps it's time to pay those machines a visit. ---------------------------------------------------------------------------------------------------> Peter Bates, Systems Support Officer, Network Support Team. London School of Hygiene & Tropical Medicine. Telephone:0207-958 8353 / Fax: 0207- 636 9838
Current thread:
- Re: Workstations trying to GET /download/IEService215.chm HTTP/1.1 from 67.109.249.3 Peter Bates (Jul 12)