[TriLUG] Odd. Anyone else seeing this in their Apache logs?

[Brian Daniels]

On Mon, Jan 27, 2003 at 12:59:54PM -0500, Jeremy Portzer wrote:
> On Mon, 2003-01-27 at 11:15, Brian Daniels wrote:
> > Since Tuesday the 21st I'm seeing requests for 'dfasfdsfdsf' in my Apache 
> > error logs.
> > 
> > The requests are coming from a Sprint lv.sprint-hsd.net address and a 
> > Mindspring biz.mindspring.com address.  We're getting 1-3 a minute.
> 
> Are all the hits from just those two IPs?  You might consider
> tarhole'ing or just blocking those IPs, and just keep a watch for it
> from others.  I also noticed that Google had no direct hits for that
> string (at least until the TriLUG list gets re-indexed!), and neither
> did the securityfocus.org site.  Definitely odd.

Just those two.  The Sprint address is responsible for 4519 of the 
requests, with 13559 coming from the Mindspring one. (so far)

Nothing like a Monday mystery :-)

--Brian


-- 
Question with boldness even the existence of a god;
because if there be one he must approve of the
homage of reason more than that of blindfolded fear.

--Thomas Jefferson, Aug. 10, 1787


Brian Daniels                  bitmage at bellsouth.net
      http://www.eviloverlord.net