Re: HTTP over SSH probes? [solved?]
sfritsch@ph.tum.de wrote:
me> But why would random IPs be requesting sciencedirect.com at my
me> workstation which has nothing to do with it? Even for a worm that
me> doesn't make any sense.
>
> For university wide subsciptions at sciencedirect it is sometimes
> necessary to use a special proxy server. If it is only one source IP,
> maybe someone has put a typo in his proxy configuration. If it are
> many source IPs but from only one or very few networks, maybe there
> is a typo in some proxy autoconfiguration file somewhere. Or it is a
> braindead attempt to find a misconfigured proxy that has
> sciencedirect subscription.
I guess the last possibility is the most likely, since I got the same
request (from the same source IP) on three hosts, all on the Princeton
network, within 10 minutes. (My home desktop which is also at
Princeton, but on a different subnet, didn't get such a message.)
Thanks to everyone who answered to clear up the mystery.
--
Kevin B. McCarty <kmccarty@princeton.edu> Physics Department
WWW: http://www.princeton.edu/~kmccarty/ Princeton University
GPG: public key ID 4F83C751 Princeton, NJ 08544
Reply to: