|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Pattern matching odd HTTP request
On Tuesday, September 18, 2001, at 02:36 PM, Jake Khuon wrote: Anyone seeing a lot of these in their webserver logs? 208.202.180.4 - - [18/Sep/2001:11:19:31 -0700] "-" 408 - This machine is in my /8 ----- 207.202.84.209 - - [18/Sep/2001:15:16:48 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:18:18 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:19:48 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:21:18 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:22:48 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:24:18 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:25:48 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:27:18 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:28:48 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:30:18 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:31:48 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:33:18 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:34:48 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:36:18 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:37:48 -0400] "-" 408 - 207.202.84.209 - - [18/Sep/2001:15:39:19 -0400] "-" 408 - ----- Every minute and a half, on the money, weird. ----- >telnet 207.202.84.209 80 Trying 207.202.84.209... Connected to 207.202.84.209. Escape character is '^]'. HEAD / HTTP/1.0 HTTP/1.1 200 OK Server: Microsoft-IIS/4.0 Date: Tue, 18 Sep 2001 20:05:15 GMT Content-Type: text/html Set-Cookie: ASPSESSIONIDQQGQGGBK=HCBJIPMDEMHKDLBPMKMDDOMN; path=/ Cache-control: private Connection closed by foreign host. > ------ What else....
|