Quantcast
Channel: Bountied questions - Information Security Stack Exchange
Viewing all articles
Browse latest Browse all 154

Strange HTTP request from binaryedge.ninja

$
0
0

I found the following strange HTTP request apparently emanating from binaryedge.ninja:

 min-li-ustx-12-13-65991-x-prod.binaryedge.ninja - - [05/Jan/2020:07:18:48 -0500] "GET / HTTP/1.0" 302 212 "-""-"
 min-extra-grab-108-ustx-prod.binaryedge.ninja - - [05/Jan/2020:07:18:52 -0500] "GET / HTTP/1.0" 302 212 "-""-"
 min-extra-grab-108-ustx-prod.binaryedge.ninja - - [05/Jan/2020:07:18:54 -0500] "HELP" 400 226 "-""-"
 min-extra-grab-108-ustx-prod.binaryedge.ninja - - [05/Jan/2020:07:18:54 -0500] "\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc" 400 226 "-""-"
 min-extra-grab-108-ustx-prod.binaryedge.ninja - - [05/Jan/2020:07:18:56 -0500] "\x16\x03\x01" 400 226 "-""-"
 min-extra-grab-108-ustx-prod.binaryedge.ninja - - [05/Jan/2020:07:18:58 -0500] "\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff" 400 226 "-""-"

Looking around the web, I see similar log messages on other publicly visible web logs and one suggesting some connection to Gh0st.

Anyone have any idea what this is, and by this company would appear to be attacking my server and others?


Viewing all articles
Browse latest Browse all 154

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>