Nimda as Slurp

[Josk]

Recently a
server was subject to a nimda attack. The interesting thing was that the attacker orginally came in with no user agent.

And then it bacame a "Mozilla/3.0 (Slurp/cat; [e-mail]; [inktomi.com...] and then it became a "Lycos_Spider_(T-Rex)".

Is this typical for a Mimda worm, or is just have an identity crisis?

[Brett_Tabke]

Nah, it was a human snooping. Nimda just request files from know holes in the iis. We still get 400-500 a day here.