nanog mailing list archives

Traffic being directed at random infrastructure with pornhub.com host header (?)


From: Drew Weaver <drew.weaver () thenap com>
Date: Wed, 13 Sep 2023 13:35:30 +0000

Has anyone else recently seen a spike of port 80 traffic being sent at seemingly random IP addresses that include the 
Pornhub host header?

0: 000C3170 A440000F 35F95000 08004500  ..1p$@..5yP...E<mailto:..1p$@..5yP...E>.
      16: 004D0997 4000F006 F8D59DF5 7C90CFB6  .M.. ()  p xU.u|.O6<mailto:.M.. ()  p xU.u|.O6>
      32: 9E010050 00500000 67D50000 000B5002  ...P.P..gU....P.
      48: FFFF6559 00004745 54202F20 48545450  ..eY..GET / HTTP
      64: 2F312E31 0D0A486F 73743A20 706F726E  /1.1..Host: porn
      80: 6875622E 636F6D0D 0A0D0A00           hub.com.....

Just thought it was quirky and was wondering if anyone else had seen it. This particular payload was directed at a 
Cisco router.

Offlist is fine if needed.
-Drew





Current thread: