Mar 27 18:11:49 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61018 -> 195.44.254.18:80 Mar 27 18:12:00 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61019 -> 207.200.86.65:80 Mar 27 18:12:00 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61019 -> 207.200.86.65:80 Mar 27 18:12:02 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:02 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:03 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61019 -> 207.200.86.65:80 Mar 27 18:12:08 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:08 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61020 -> 207.200.86.65:80 Mar 27 18:12:10 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61021 -> 205.188.245.116:80 Mar 27 18:12:10 gardiyan snort: spp_http_decode: IIS Unicode attack detected: 212.xxx.xxx.xxx:61021 -> 205.188.245.116:80 Your culprit is apparently trying to exploit the IIS Unicode bug in IIS. Unless you've got IIS running, the only thing you should be paranoid about is
On Tuesday 27 March 2001 01:06 pm, you wrote: that he knows you exist and can find other exploits. Good luck Kevin Breit