Forum Discussion

JustCooLpOOLe's avatar
JustCooLpOOLe
Icon for Cirrocumulus rankCirrocumulus
Apr 10, 2017

Web Server Probe (internet explorer) Attack Signature Detected

I'm seeing the following in traffic learning and I can't find any information on what the actual attack is trying to accomplish. Any ideas?   GET / HTTP/1.1 User-Agent: Microsoft Internet Explore...
ASM Advanced WAF
BIG-IP
security
nathe's avatar
nathe
Icon for Cirrocumulus rankCirrocumulus
Apr 10, 2017

Shann_P, you probably know already but this is complaining because of the fake user-agent. So it is probably an automated tool with a fake user agent and it's trying to probe, or scan, public IPs/web pages, to check for and document the responses. Mostly this is for reconnaisance or information gathering / fingerprinting purposes.

 

Hope this helps,

 

N