[Dshield] speedy!

John Sage jsage at finchhaven.com
Mon Mar 29 16:50:28 GMT 2004

speedy!.com with a bang (!) doesn't resolve, at least I can't make it

speedy.com is another matter.

[jsage at sparky /storage/virii] $ lynx -source http://www.speedy.com/
<title>Speedy Auto Service</title>
<meta http-equiv="Refresh" content="0;URL=speedy2001/index.html">

So www.speedy.com redirects to www.speedy.com/speedy2001/index.html:

[jsage at sparky /storage/virii] $ lynx -source
  http://www.speedy.com/speedy2001/ |less

<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<meta name="GENERATOR" content="Microsoft FrontPage 4.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta name="includeonmenu" content="aboutus">
<meta name="menuoption" content="Brands">
<meta name="menuorder" content="3">
speedy text  { font-family: Verdana; color: #000000 }
<link rel="stylesheet" type="text/css" href="speedycss.css">
<title>Speedy Auto Service - Splash Page</title>
<body  stylesrc="/speedy2001/aboutus-comtop.htm" bgcolor="#ffffff">

/* snip */

This seems to be an auto repair business in Canada.

On Mon, Mar 29, 2004 at 06:43:08PM +0300, emad wrote:
> From: "emad" <emad at nets.jo>
> To: <list at dshield.org>
> Date: Mon, 29 Mar 2004 18:43:08 +0300
> Subject: [Dshield] speedy!
> Hi All,
> Could anybody please tell me what generates www.speedy!.com because
> I just faced a Dos by a customer generating thousands of requests to
> this url which brought our ADSL router and the CACHE engine to their
> knees. How can I go about fighting this back.

As for a DDoS, sounds like "a customer" is infected with ad ware of
some sort...

- John
"Mad cow? You'd be mad too, if someone was trying to eat you."

More information about the list mailing list