For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JustCooLpOOLe's avatar
JustCooLpOOLe
Icon for Cirrocumulus rankCirrocumulus
Apr 10, 2017

Web Server Probe (internet explorer) Attack Signature Detected

I'm seeing the following in traffic learning and I can't find any information on what the actual attack is trying to accomplish. Any ideas?

 

GET / HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: test2.test.com X-Forwarded-For: 199.199.199.199

 

ASM Advanced WAF
BIG-IP
security

1 Reply

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Apr 10, 2017

    Shann_P, you probably know already but this is complaining because of the fake user-agent. So it is probably an automated tool with a fake user agent and it's trying to probe, or scan, public IPs/web pages, to check for and document the responses. Mostly this is for reconnaisance or information gathering / fingerprinting purposes.

     

    Hope this helps,

     

    N