Mysterious ABE requests on my server?!
Posted: Thu Mar 10, 2011 7:43 pm
Hi all,
I'm running an apache web server which has mod_security enabled. In the security logs, I recently noticed
recurring requests which get denied (using a 400) by mod_security and which (according to the UA in the header)
appear to come from hosts running some ABE feature. Here is a sample Request:
Noticeable anomalies are:
Are these really from ABE?
If yes - assuming some ABE thingy running wild - Can I fabricate some reply which stops them quering my server?
Thanks in advance for any hints.
-Fritz
I'm running an apache web server which has mod_security enabled. In the security logs, I recently noticed
recurring requests which get denied (using a 400) by mod_security and which (according to the UA in the header)
appear to come from hosts running some ABE feature. Here is a sample Request:
Code: Select all
GET / HTTP/1.0
Host: xxx.xxx.xxx.xxx
User-Agent: Mozilla/5.0 (ABE, http://noscript.net/abe/wan)
Pragma: no-cache
Cache-Control: no-cache, max-age=259200
Connection: keep-alive- The IP in the Host header is usually identical to the request's origin e.g: NOT my server's IP.
- Requests don't contain an Accept header.
- The requests appear to increase at every full hour.
Are these really from ABE?
If yes - assuming some ABE thingy running wild - Can I fabricate some reply which stops them quering my server?
Thanks in advance for any hints.
-Fritz