Singing Potatoes
Previous — Main Page — Up to Archive — Next
Tuesday, 10 September 2002
New worm?

In the past 26 minutes, my site has been hit from three different IP addresses (one in Japan, two in America), all looking for the same four directories on the server (/php/, /shops/include/, /include/ and /cart/).

Is this the start of a new worm? There's nothing about it on CERT that I can find. However, I've never seen these four URLs searched for before, so to get three identical series of requests in less than half an hour, from three different sources, certainly suggests that something might be up. Surely if it were just one script kiddie, he wouldn't be so stupid as to check the same site three times, as if the directories might magically appear between invocations.

Well, here's hoping the Internet hasn't slowed to a crawl by later today. Especially as I don't plan to be watching the maudlin tributes that will be filling up every channel on TV; I've already had enough hand-wringing from the media in the past couple of weeks, so I'll need to get my entertainment from somewhere.

Posted by godfrey (link)
Previous — Main Page — Up to Archive — Next