Starting at 3:52AM, (CST), to 5:39AM I received multiple requests for 'default.htm' on one of my IIS servers, about 45,000 requests or about seven a second. Though I do not see anything malicious about the request the sheer quantity is what has me interested. Any thoughts? Here is a sample of the logs: 03:53:43 208.190.*.* GET /Default.htm 302 03:53:43 208.190.*.* GET /Default.htm 302 03:53:43 208.190.*.* GET /Default.htm 302 03:53:43 208.190.*.* GET /Default.htm 302 03:53:43 208.190.*.* GET /Default.htm 302 03:53:43 208.190.*.* GET /Default.htm 302 03:53:43 208.190.*.* GET /Default.htm 302 03:53:43 208.190.*.* GET /Default.htm 302 03:53:44 208.190.*.* GET /Default.htm 302 03:53:44 208.190.*.* GET /Default.htm 302 03:53:44 208.190.*.* GET /Default.htm 302 03:53:44 208.190.*.* GET /Default.htm 302 Also this was part of the auto-response I got from SWBell: 'Since the current volume of email prohibits a personal reply to each report, unless additional information is required, THIS MAY BE THE ONLY RESPONSE YOU WILL RECEIVE.' Richard Hill Duncanville ISD Technology rhillat_private ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Aug 06 2001 - 14:23:50 PDT