Security Incidents mailing list archives

Re: foreign HTTP requests


From: Bjorn.Djupvik () GLOBALONE NET.INVALID (Bjorn Djupvik)
Date: Tue, 20 Jun 2000 22:38:22 +0200


I just have a little something to add to this subject:

I browsed the logs on two webservers I run, and this type of incident
were present on both. On one of the servers there were a lot of requests
for 2-3 domains, all having to do with sending SMS messages via the
internet (to mobile phones), and on the other server there were all
requests for porn sites. None of these servers runs or has ever run any
site similar to those mentioned. Many of the requests come from the same
client url, but this varies too.
On server A where I get all the SMS related requests I never see any
requests related to porn like I do on server B and the other way around.
The two servers are located on different subnets and run completely
different OS`es and web server software. The user agents used vary from
IE to Netscape etc. I didnt see any UNIX yet though but that may be
coincidental. I would like to see more postings on this subject, as this
really bothers me (not finding this out =).

Bjorn
Global One Communications

(the opinions expressed are my own etc etc etc :)

<HR NOSHADE>
<UL>
<LI>application/x-pkcs7-signature attachment: S/MIME Cryptographic Signature
</UL>


Current thread: