Welcome to WebmasterWorld Guest from

Forum Moderators: DixonJones & mademetop

Message Too Old, No Replies

Logs showing request for /\x90\x02\xb1\x02\xb1...

Need help to understand what it is?

2:03 pm on Mar 28, 2004 (gmt 0)

New User

10+ Year Member

joined:Feb 20, 2003
votes: 0

Over the past few days, I have been receiveing hits for the following:

66.125.23*.** - - [09/Mar/2004:03:19:55 -0600] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1...(it goes on for miles...)

HTTP Code: 353

The IP ranges vary, some are in the same block group and some are not.

Any ideas what this is looking or trying to do?

1:10 pm on May 19, 2004 (gmt 0)

Senior Member

WebmasterWorld Senior Member macguru is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Dec 30, 2000
votes: 0

>>I am running Apache on SuSe

Dont worry then, it's IIS vulnerabilities. Most of them are.

During the last 4 years, only one client of mine had his site defaced on *NIX server.
His host was running an older kernel.


4:42 am on May 28, 2004 (gmt 0)

Inactive Member
Account Expired


so i was checking my log files this evening and found this absolutely crazy long line, it started like this: "216.63.XXX.242 - - [27/May/2004:11:55:01 -0600] "SEARCH/\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\....."

i had no idea what it was so i popped it into my browser hoping it'd take me somewhere, and it took me to this forum. i didn't do a search or anything, just put it in the location bar and here i found myself. i had to get register for the site to see the post that it was in, and here i am.

i read what the rest of you had to say about it, and after trying webalizer (and having it get a weirdo error) i think i've been hit by whatever hit you guys.

my problem is that i don't really understand what's going on so i don't know if it's a problem or not.

is this just another spider?

i've got nothing on my site that anyone would wanna hack into or play around with.

any ideas or comments would be appreciated.

[edited by: webdiversity at 5:23 pm (utc) on May 28, 2004]
[edit reason] Specific URL snipped [/edit]

This 12 message thread spans 2 pages: 12