Re: CITSIRT case#200500812 FW: abuser: 192.25.206.16

"CITSIRT" writes...

> Hi Matt,
> 
> CITSIRT request you confirm the activity below is originating from
> merkel.debian.org?
> And if so, take steps to stop the offending traffic.
> 
> Please reply to CITSIRT to advise the status of this matter.

> David Peart for CITSIRT
> http://citsirt.hp.com/
> 
> -----Original Message-----
> From: Jason Harris [mailto:[email protected]]=20
> Sent: Tuesday, 3 May 2005 9:59 AM
> To: [email protected]; CITSIRT
> Cc: Jason Harris
> Subject: abuser: 192.25.206.16
> 
> 
> There is a poorly written program/script running on 192.25.206.16 that
> is querying hkp://subkeys.pgp.net:11371.  It started identifying itself
> as (User-Agent:) libwww-perl/5.64 at Mon May  2 10:15:38 2005 (PST8PDT)
> but changed and stopped sending User-Agent: while Host: started carrying
> extra garbage sometime later.

Thank you for the report. Yes, there was a user running with an automated 
script. I have killed it and it won't happen again.

-- 
Matt Taggart        Open Source & Linux Organization R&D
[email protected]   Hewlett-Packard