Requesting /sumthin

A good candidate for ban-by-IP-address

[jdMorgan]

For several months I've been getting occasional single-access requests of the form "GET /sumthin HTTP/1.0". This has been very low-level - one or two a week from Europe and Asia, mostly.

Today, I got three such requests from different IPs, two from Korea and one from Taiwan, and decided to check this out a little more thoroughly. A search on Giggle turned up this post [online.securityfocus.com] on the SecurityFocus board. This request is apparently a 404-test, used to identify your server type and 404 response for later server-type-specific attack targetting.

I added that request profile to my bad-bot trap redirect list. The result is that they get a 200-OK, a very short and misleading html page returned, and a lifetime ban by IP address.

Check it out yourself and take the steps you feel appropriate.

Jim

[jeremy goodrich]

Thanks for the post, I've seen the same request in many logs of my own for a bit - but didn't do the research you did.

One to add to the old .htacces file for sure. :)