[Dshield] http "get x" requests?

Johannes B. Ullrich jullrich at sans.org
Fri May 10 20:18:26 GMT 2002


> 61.156.9.133 gsa.creighton.edu - [10/May/2002:13:45:52 -0500] "GET x
> HTTP/1.0" 400 2498 "" ""

usually these requests are just checking the banner your server
returns to see what server you are running.

Can be used to hit you with a targeted exploit next, or maybe
someone is just nosy. Netcraft is known to use 'GET x' for
its surveys (but the IP does not look like one of theirs).

-- 
-------
jullrich at sans.org                    Join http://www.DShield.org
                          Distributed Intrusion Detection System





More information about the list mailing list