Oliver Perry and w3matter paid a visit

[Marcia]

198.139.155.10 - - [04/May/2001:05:44:11 -0400] "GET /robots.txt HTTP/1.0" 404 204 "-" "OliverPerry"
198.139.155.10 - - [04/May/2001:05:44:11 -0400] "GET / HTTP/1.0" 200 7254 "-" "OliverPerry"
64.95.2.212 - - [04/May/2001:06:29:55 -0400] "GET / HTTP/1.0" 200 7254 "-" "Mozilla/4.0 (W3MATTER; [e-mail]; [w3matter.com...]

Were *not* submitted to.

[toolman]

Yeah I got hit by Oliver Perry last month. I don't know who he is though. At least it isn't just me.

[Marcia]

I looked, and that one came by last month also, just this one out of the sites I take care of. It's a crafts site with a number of links - not an awful lot. Haven't seen this on any of my others. The difference with this site compared to the others is that it's got some links from about.com and the others don't.

w3matter looks interesting, at least for some reading material.

[littleman]

198.139.155.10
from VERIO.NET

Verio [home.verio.com] is a big time ISP that does hosting and co-location. So that really doesn't tell you much about what OliverPerry was up to.

Take a look at [198.139.155.26...] -- I bet that is our baby.
It looks to be a M$ box behind a Cisco switch.

64.95.2.212
CaribbeanBlues.com is assigned 64.95.2.208 - 64.95.2.223
The info site is at [64.95.2.216...] or W3matter.com.
They are running a Linux 2.1 box with Apache/1.3.19 (Unix) PHP/4.0. They aren't displaying a search quarry page at W3matter, but it looks like they are using a large SE database at CaribbeanBlues.com -- there is pretty good odds that it is the same technology. So if you want a preview try it out.

[Marcia]

Thank you, littleman.

[toolman]

It looks to be a M$ box behind a Cisco switch

How do you read the headers or whatever to figure that out?

[littleman]

Headers, are from my tool [cgi-fun.hypermart.net]
The switch was figured out by using Queso, a unix utility that determines the OS of a box via ping. NFFC turned me on to that one.

[toolman]

Headers I can get using Sam Spade. Is Queso in the Mandrake 7.2 dist?

[littleman]

No, you need to hunt it down. Also make sure you get the right rpm. The source distro wouldn't compile for me on Mandrake 7.2.

[toolman]

apostols is down...how about nmap little?

[littleman]

>NMAP
Haven't tried it, but I will.

Here is a working link to the mandrake 7.2 Queso rpm:
[sopac.org.fj...]
That site is slow but it has all the goodies.

[littleman]

toolman,
NMAP = My new favorite toy.

[toolman]

Cool. Did you get the GUI for it too?

I'm having that blonde thing happen again.

How do I get these rpm's to do something?

[littleman]

I'll sticky you.

[littleman]

The nmap features are awesome, but for pure OS identification quanta give you more to work with.

[Macguru]

Sorry to bring this back, It is the only thread I found about "OliverPerry" with the 'site search' reature.

That may sound quite a simple question but who is OliverPerry? What is Claymont? And what should I do with him?

198.139.155.10 - - [16/Oct/2001:02:01:29 -0400] "GET /robots.txt HTTP/1.0" 200 4845 "-" "OliverPerry" 0 <url snipped>

[volatilegx]

Netcraft [uptime.netcraft.com] has a great tool that will tell you the OS of a box.

[bufferzone]

OliverPerry is a USMC warship, if I am not mistaken, named after a USMC private first class.

semper fi (sorry couldn't resist)