[Dshield] automated probe?

Rick Leir rdshield at leirtech.com
Mon May 12 10:22:09 GMT 2008


The same someone is probing my apache every few days.  I can understand 
a badguy probing once, but it seems to be automated.  What is happening 
here?

 From my logwatch:

A total of 1 sites probed the server
     69.155.29.160
  Requests with error response codes
     404 Not Found
        /_vti_bin/_vti_aut/fp30reg.dll: 1 Time(s)
     414 Request-URI Too Large
        /\x90\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\ ... x90\x90\x90\x90: 
1 Time(s)

ARIN whois:
PPPoX Pool - Bras2 stlsmo 062104-1903.615166 
SBC06915502800023040926182104 (NET-69-155-28-0-1)
                                   69.155.28.0 - 69.155.29.255



More information about the list mailing list