Comments on: Chase the IRC bot http://mcwresearch.com/archives/628 Things I think I've thought about Thu, 20 Nov 2008 10:33:32 +0000 http://wordpress.org/?v=2.5.1 By: Michael http://mcwresearch.com/archives/628#comment-5013 Michael Fri, 20 Jun 2008 15:05:57 +0000 http://mcwresearch.com/archives/628#comment-5013 Well, this particular session caught my eye: GET /js/useradmin/friendList/msgCount.js and then this one: GET /js/vote/boke_vote.js and this one: GET /pg/play/relat_album.php?relatId=20 Those, to me anyway, might also indicate legitimate use. But then I saw this one and immediately thought of the <a href="http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20080507" rel="nofollow">recent SQL injection attacks</a>. GET /v/iframe/15/2007/0927/6.js So I'm still undecided if this is malicious IRC traffic or not. Well, this particular session caught my eye:

GET /js/useradmin/friendList/msgCount.js

and then this one:

GET /js/vote/boke_vote.js

and this one:

GET /pg/play/relat_album.php?relatId=20

Those, to me anyway, might also indicate legitimate use.

But then I saw this one and immediately thought of the recent SQL injection attacks.

GET /v/iframe/15/2007/0927/6.js

So I’m still undecided if this is malicious IRC traffic or not.

]]> By: ev3 http://mcwresearch.com/archives/628#comment-5012 ev3 Fri, 20 Jun 2008 14:49:21 +0000 http://mcwresearch.com/archives/628#comment-5012 The one google search result that I got seems to corroborate with your speculation that this is related to Sina. I found some copy-pasted stuff on a Chinese chat forum that makes the IRC traffic akin news update traffic. That's a flimsy conclusion from my shallow investigation, of course. What other network traffic was going on at the time? The one google search result that I got seems to corroborate with your speculation that this is related to Sina. I found some copy-pasted stuff on a Chinese chat forum that makes the IRC traffic akin news update traffic. That’s a flimsy conclusion from my shallow investigation, of course. What other network traffic was going on at the time?

]]>