Forum Discussion
JustCooLpOOLe
Cirrocumulus
CirrocumulusWeb Server Probe (internet explorer) Attack Signature Detected
I'm seeing the following in traffic learning and I can't find any information on what the actual attack is trying to accomplish. Any ideas?
GET / HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: test2.test.com X-Forwarded-For: 199.199.199.199
1 Reply
natheShann_P, you probably know already but this is complaining because of the fake user-agent. So it is probably an automated tool with a fake user agent and it's trying to probe, or scan, public IPs/web pages, to check for and document the responses. Mostly this is for reconnaisance or information gathering / fingerprinting purposes.
Hope this helps,
N
