[Dshield] http "get x" requests?

Johannes B. Ullrich jullrich at sans.org
Fri May 10 20:18:26 GMT 2002

> gsa.creighton.edu - [10/May/2002:13:45:52 -0500] "GET x
> HTTP/1.0" 400 2498 "" ""

usually these requests are just checking the banner your server
returns to see what server you are running.

Can be used to hit you with a targeted exploit next, or maybe
someone is just nosy. Netcraft is known to use 'GET x' for
its surveys (but the IP does not look like one of theirs).

jullrich at sans.org                    Join http://www.DShield.org
                          Distributed Intrusion Detection System

More information about the list mailing list