Hi,

[Robert Brockway]

On Tue, 20 Apr 2004, Peter Pieczora wrote:

> Hi all,
>
> Is there some sort of funny activity going on these days?

Always :)

> 216.209.195.164 - - [20/Apr/2004:21:21:39 -0400]
> "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1
> \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1
> \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1
> \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1
> HTTP/1.0" 414 349 "-" "-"

Looks like an attempt at a buffer overflow to me.  As long as your server
does not have a security hole this is trying to exploit you'll be fine.

Rob

-- 
Robert Brockway B.Sc. email: robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy at public.gmane.org, rbrockway-cFo9iiqjkw8eIZ0/mPfg9Q at public.gmane.org
Linux counter project ID #16440 (http://counter.li.org)
"The earth is but one country and mankind its citizens" -Baha'u'llah
--
The Toronto Linux Users Group.      Meetings: http://tlug.ss.org
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml