February 28, 2004

3:23 PM

I recently opened up port 80 on my home machine, and have been seeing a lot of "zbbpreq" lines in my access logs. What are these? [m.i]
posted by seanyboy to (5 comments total)

In my access logs, I get batches of lines like ...

81.136.218.177 - - [27/Feb/2004:11:33:30 +0000] "POST /zbbpreq/1077880558570000 HTTP/1.1" 404 301
81.136.218.177 - - [27/Feb/2004:11:33:51 +0000] "POST /zbbpreq/1077880579610000 HTTP/1.1" 404 301
81.136.218.177 - - [27/Feb/2004:11:34:59 +0000] "POST /zbbpreq/1077880647610000 HTTP/1.1" 404 301

Googling doesn't help (Even after getting someone to translate the Danish), and I'm worried that it may be some kind of hack. Any ideas.
posted by seanyboy at 3:23 PM on February 28, 2004

So-called "script kiddies" run scans across vast areas of the Internet probing for various holes in network-based products (like web servers, OS TCP/IP stacks, etc). This is just one of these scans looking for an exploit in a specific server-side program that runs as a CGI script. Nothing really to worry about. You'll see far stranger things if you keep watching the logs.
posted by LukeyBoy at 3:53 AM on February 29, 2004

I'm kind of curious what the hole is they're trying to exploit, though. Most of the oddball probes that show up in my server logs are pretty easy to identify as attempting to exploit one hole or another.
posted by hattifattener at 11:34 AM on February 29, 2004

especially given the lack of hits on google when searching for zbbpreq. weird.
posted by andrew cooke at 11:39 AM on February 29, 2004

I don't see any "zbbpreq" in the error logs for my web server nor my employer's any time in the last few months, so maybe it's somehow specific to seanyboy's address...
posted by hattifattener at 12:30 PM on February 29, 2004