[Dshield] speedy!

John Sage jsage at finchhaven.com
Mon Mar 29 16:50:28 GMT 2004


speedy!.com with a bang (!) doesn't resolve, at least I can't make it
resolve.

speedy.com is another matter.

[jsage at sparky /storage/virii] $ lynx -source http://www.speedy.com/
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
 <HEAD>
<title>Speedy Auto Service</title>
<meta http-equiv="Refresh" content="0;URL=speedy2001/index.html">
</head>
</html>


So www.speedy.com redirects to www.speedy.com/speedy2001/index.html:


[jsage at sparky /storage/virii] $ lynx -source
  http://www.speedy.com/speedy2001/ |less

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<meta name="GENERATOR" content="Microsoft FrontPage 4.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta name="includeonmenu" content="aboutus">
<meta name="menuoption" content="Brands">
<meta name="menuorder" content="3">
<style>
<!--
speedy text  { font-family: Verdana; color: #000000 }
-->
</style>
<link rel="stylesheet" type="text/css" href="speedycss.css">
<title>Speedy Auto Service - Splash Page</title>
</head>
<body  stylesrc="/speedy2001/aboutus-comtop.htm" bgcolor="#ffffff">

/* snip */


This seems to be an auto repair business in Canada.


On Mon, Mar 29, 2004 at 06:43:08PM +0300, emad wrote:
> From: "emad" <emad at nets.jo>
> To: <list at dshield.org>
> Date: Mon, 29 Mar 2004 18:43:08 +0300
> Subject: [Dshield] speedy!
> 
> Hi All,
> 
> Could anybody please tell me what generates www.speedy!.com because
> I just faced a Dos by a customer generating thousands of requests to
> this url which brought our ADSL router and the CACHE engine to their
> knees. How can I go about fighting this back.


As for a DDoS, sounds like "a customer" is infected with ad ware of
some sort...


- John
-- 
"Mad cow? You'd be mad too, if someone was trying to eat you."




More information about the list mailing list