Re: Odd (alarming) http log exerpt [followup]

2005-01-15 Thread Colin J. Raven
On Jan 14 at 10:22, Duo made this excellent suggestion: > On Fri, 14 Jan 2005, Colin J. Raven wrote: > >> I noticed something extremely odd this morning in my http access log. >> There's the usual activity, then suddenly this (about a hundred lines >> are snipped) >> >> Is there anything within.

Re: Odd (alarming) http log exerpt

2005-01-14 Thread Colin J. Raven
On Jan 14 at 10:22, Duo suggested this hysterically funny remedy: > On Fri, 14 Jan 2005, Colin J. Raven wrote: > >> I noticed something extremely odd this morning in my http access log. >> There's the usual activity, then suddenly this (about a hundred lines >> are snipped) > > Yeah, someone is tr

Re: Odd (alarming) http log exerpt

2005-01-14 Thread Colin J. Raven
On Jan 14 at 07:00, Andy Firman wrote: > On Fri, Jan 14, 2005 at 02:08:20PM +0100, Colin J. Raven wrote: >> What is this person doing? or attempting to do? I'm guessing nothing >> good. >> Is there anything within...say httpd.conf..that I could do to prevent >> this..or curtail it before it grow

Re: Odd (alarming) http log exerpt

2005-01-14 Thread Colin J. Raven
On Jan 14 at 10:17, Jacob S launched this into the bitstream: > On Fri, 14 Jan 2005 07:00:30 -0900 > Andy Firman <[EMAIL PROTECTED]> wrote: > >> On Fri, Jan 14, 2005 at 02:08:20PM +0100, Colin J. Raven wrote: >>> What is this person doing? or attempting to do? I'm guessing nothing >>> >>> good. >>

Re: Odd (alarming) http log exerpt

2005-01-14 Thread Jacob S
On Fri, 14 Jan 2005 11:36:36 -0500 Louis LeBlanc <[EMAIL PROTECTED]> wrote: > On 01/14/05 10:17 AM, Jacob S sat at the `puter and typed: > > On Fri, 14 Jan 2005 07:00:30 -0900 > > Andy Firman <[EMAIL PROTECTED]> wrote: > > > > > On Fri, Jan 14, 2005 at 02:08:20PM +0100, Colin J. Raven wrote: > >

Re: Odd (alarming) http log exerpt

2005-01-14 Thread Louis LeBlanc
On 01/14/05 10:17 AM, Jacob S sat at the `puter and typed: > On Fri, 14 Jan 2005 07:00:30 -0900 > Andy Firman <[EMAIL PROTECTED]> wrote: > > > On Fri, Jan 14, 2005 at 02:08:20PM +0100, Colin J. Raven wrote: > > > What is this person doing? or attempting to do? I'm guessing nothing > > > > > > goo

Re: Odd (alarming) http log exerpt

2005-01-14 Thread Duo
On Fri, 14 Jan 2005, Colin J. Raven wrote: I noticed something extremely odd this morning in my http access log. There's the usual activity, then suddenly this (about a hundred lines are snipped) Yeah, someone is trying a M$ DAV exploit. I get these alot, along with nimda attempts. Is there anyt

Re: Odd (alarming) http log exerpt

2005-01-14 Thread Jacob S
On Fri, 14 Jan 2005 07:00:30 -0900 Andy Firman <[EMAIL PROTECTED]> wrote: > On Fri, Jan 14, 2005 at 02:08:20PM +0100, Colin J. Raven wrote: > > What is this person doing? or attempting to do? I'm guessing nothing > > > > good. > > Is there anything within...say httpd.conf..that I could do to >

Re: Odd (alarming) http log exerpt

2005-01-14 Thread Eric Brunner-Williams in Portland Maine
Hi Colin, I started seeing these in September. For a _very_ obscure and low hit url. chars dns date/time 27680 d142-59-129-32.abhsia.telus.net 11/Sep/2004:17:13:53 32713 stjhts18c101.nbnet.nb.ca09/Nov/2004:14:37:26 27670 i

Re: Odd (alarming) http log exerpt

2005-01-14 Thread Andy Firman
On Fri, Jan 14, 2005 at 02:08:20PM +0100, Colin J. Raven wrote: > What is this person doing? or attempting to do? I'm guessing nothing > good. > Is there anything within...say httpd.conf..that I could do to prevent > this..or curtail it before it grows to such an enormous size. Looks like a We

Odd (alarming) http log exerpt

2005-01-14 Thread Colin J. Raven
I noticed something extremely odd this morning in my http access log. There's the usual activity, then suddenly this (about a hundred lines are snipped) 62.241.98.151 - - [14/Jan/2005:01:29:44 +0100] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x 02\xb1\x02\xb1\