[Full-disclosure] Random HTTP-Requests
ro0ot.w00t at googlemail.com
Tue Mar 31 15:30:50 BST 2009
I've noticed that some weird requests are showing up in the error logs
of one of my apache webservers.
The requests seem to have the following in common:
* GET Request on some random alphanumeric string like "GET /hDMe9NS"
* Referer has some randomized, invalid URL like
Every domain that showed up wasn't registered - no DNS reply or whatsoever.
Here's an example out of my Log file ( I slightly modified the random
strings - just in case ;))
[Tue Mar 30 10:12:41 2009] [error] [client 124.236.*.*] File does not
exist: /var/www/foo.bar/web/hFBeX7EK, referer:
The amount of random directories isn't constant.
Any Ideas what is causing these requests? Is it a well known worm?
What could it be.. what for..?
The Server is Running Apache with PHP, the main application is made
with the symfony framework.
PS: You believe this doesn't belong into this mailing list? Sorry, I'm
not interested - keep it to yourself.
Full-Disclosure is hosted and sponsored by Secunia.