Java 1.1.8 paired probes

From: Jackie (JackieJat_private)
Date: Thu Aug 16 2001 - 07:00:52 PDT

Next message: Ryan Russell: "Re: Appeal for Help. NOT Code Red But Is It?"

Previous message: Kevin Holmquist: "scans for root.exe"
In reply to: dewt: "Re: Unsuspected "named" behaviour"
Next in thread: NESTING, DAVID M (SBCSI): "RE: Java 1.1.8 paired probes"
Reply: NESTING, DAVID M (SBCSI): "RE: Java 1.1.8 paired probes"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Over the last 2 days ONLY, I have been seeing
63.85.124.6 - - [16/Aug/2001:09:04:21 -0400] "GET / HTTP/1.0" 200 453 "-" "Java1.1.8"
203.194.146.46 - - [16/Aug/2001:09:04:25 -0400] "GET / HTTP/1.0" 200 453 "-" "Java1.1.8"

These probes are ALWAYS paired, always from the same 2 IP addresses,
the second ALWAYS within seconds of the first.

Sorry if this has been covered here previously. Can someone give me a
thumbnail of what's going on? Also note the 200 response from our
Linux box.

Thanks.


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Ryan Russell: "Re: Appeal for Help. NOT Code Red But Is It?"
Previous message: Kevin Holmquist: "scans for root.exe"
In reply to: dewt: "Re: Unsuspected "named" behaviour"
Next in thread: NESTING, DAVID M (SBCSI): "RE: Java 1.1.8 paired probes"
Reply: NESTING, DAVID M (SBCSI): "RE: Java 1.1.8 paired probes"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Aug 16 2001 - 07:38:45 PDT