[Dshield] http "get x" requests?
Johannes B. Ullrich
jullrich at sans.org
Fri May 10 20:18:26 GMT 2002
> 220.127.116.11 gsa.creighton.edu - [10/May/2002:13:45:52 -0500] "GET x
> HTTP/1.0" 400 2498 "" ""
usually these requests are just checking the banner your server
returns to see what server you are running.
Can be used to hit you with a targeted exploit next, or maybe
someone is just nosy. Netcraft is known to use 'GET x' for
its surveys (but the IP does not look like one of theirs).
jullrich at sans.org Join http://www.DShield.org
Distributed Intrusion Detection System
More information about the list