[thelist] Weird Log Entries

Matthew Brooks m at pleonasm.com
Thu Aug 2 16:29:24 CDT 2001


Looking through my server logs tonight, I found dozens of things like this:

211.63.195.234 - - [01/Aug/2001:17:06:53 -0500] "GET
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
HTTP/1.0" 404 858 "-" "-"

[all on one line in the original, of course]

Each time it comes from a different IP; sometimes the domain names are
shown (e.g. caipsnt.hallym-c.ac.kr), so I can see that they come from all
over the world. No one is clicking on a link for this, otherwise surely the
referring URL would show up, as it does in other log entries where a link
was clicked. The long nonsense string is always exactly the same. Is it
Unicode? How does one translate this?

This happened about a month ago for two days, then stopped. Now here it is
again.

Does anyone have any idea what might be going on?

Thanks for any insight.  Matt





More information about the thelist mailing list