Security Basics mailing list archives

RE: "GET /.hash=" in HTTPd logs?

From: Matias <matias () connmed com ar>
Date: Fri, 29 Nov 2002 16:49:57 -0300


Looks like WinMX traffic too.

LoginRoot

-----Original Message-----
From: Joris De Donder [mailto:joris () digitaldefense be]
Sent: Viernes, 29 de Noviembre de 2002 10:58 a.m.
To: SFDC Admin
Cc: security-basics () securityfocus com
Subject: Re: "GET /.hash=" in HTTPd logs?

I've noticed recently on a few different machines entries like this:
GET /.hash=8148dd8cd5c884d62cab26ccfa1aeaa045eab116
GET /.hash=6baa50082310ba631358f57c8fb7eaadf752e055
Any idea what is going on here?
Is this some 0day exploit? Something old that is going round again?


Looks like Kazaa traffic.



Joris

Current thread:

RE: Locking Cisco Router, (continued)
- RE: Locking Cisco Router Vachon, Scott (Nov 25)
  - RE: Locking Cisco Router puyeng abis (Nov 26)
- RE: Locking Cisco Router Kevin Jones (Nov 25)
  - RE: Locking Cisco Router David Lubowa (Nov 28)
- Locking Cisco Router Vachon, Scott (Nov 26)
  - Blocking personal email Tim V - DZ (Nov 28)
- RE: Locking Cisco Router d'Ambly, Jeff (Nov 27)
- RE: Locking Cisco Router Dozal, Tim (Nov 27)
  - "GET /.hash=" in HTTPd logs? SFDC Admin (Nov 29)
    - Re: "GET /.hash=" in HTTPd logs? Joris De Donder (Nov 29)
    - RE: "GET /.hash=" in HTTPd logs? Matias (Nov 29)
- RE: Locking Cisco Router Dozal, Tim (Nov 27)
- RE: Locking Cisco Router David Alejandro Hernandez Alonso (Nov 28)