[Dshield] Strange http gets

Jeff Kell jeff-kell at utc.edu
Sun Feb 12 23:38:16 GMT 2006


This ring a bell for anyone?:

> GET http://www.utc.edu/[removed]/[removed]/about.htm HTTP/1.0
> Accept: text/html, text/plain
> Accept-Encoding: text/html, text/plain
> Accept-Language: en
> User-Agent: mpbjvtaqSafowhyinwbufvmyt
> Host: www.utc.edu
>   
Note the weird User-Agent.  I've seen random strings appearing here.  I
can't guess what they're up to... if they had a Referrer: tag I'd
suspect link spamming, but there is no referrer.  I don't have access to
the server access logs at the moment to see what else came from the same
source, but thought I'd ask in advance if someone has seen this
behavior.  Are these some little crude crawlers trying to harvest email
addresses?  Or some other nefarious purpose I haven't thought of?

Jeff


More information about the list mailing list