[Dshield] Unusual Web Request

Johannes Ullrich jullrich at euclidian.com
Fri Nov 15 20:51:01 GMT 2002

The 'user agent' field is often replaced by some privacy concious 
proxies (not realizing, that a user-agent of ';-)' will make you
easier identifiable then the standard string.

Its hard to figure out the intent. Looking for 'index.html' is
certainly harmless. But it could use this to check for default
installs of certain operating systems.

> I don't think any standard web browser uses user-agent ";-)" and it's
> very unusual to get requests for index.html. I know this is the most
> common default page, but I rarely see specific requests for it.
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
> http://www.dshield.org/mailman/listinfo/list

jullrich at euclidian.com             Collaborative Intrusion Detection
                                         join http://www.dshield.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://www.dshield.org/pipermail/list/attachments/20021115/b893e6b4/attachment.bin

More information about the list mailing list