Pattern matching odd HTTP request

Tue Sep 18 20:13:27 UTC 2001

On Tuesday, September 18, 2001, at 02:36 PM, Jake Khuon wrote:
>
> Anyone seeing a lot of these in their webserver logs?
>
> 208.202.180.4 - - [18/Sep/2001:11:19:31 -0700] "-" 408 -

This machine is in my /8

-----
207.202.84.209 - - [18/Sep/2001:15:16:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:18:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:19:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:21:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:22:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:24:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:25:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:27:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:28:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:30:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:31:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:33:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:34:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:36:18 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:37:48 -0400] "-" 408 -
207.202.84.209 - - [18/Sep/2001:15:39:19 -0400] "-" 408 -
-----

Every minute and a half, on the money, weird.

-----
 >telnet 207.202.84.209 80
Trying 207.202.84.209...
Connected to 207.202.84.209.
Escape character is '^]'.
HEAD / HTTP/1.0

HTTP/1.1 200 OK
Server: Microsoft-IIS/4.0
Date: Tue, 18 Sep 2001 20:05:15 GMT
Content-Type: text/html
Set-Cookie: ASPSESSIONIDQQGQGGBK=HCBJIPMDEMHKDLBPMKMDDOMN; path=/
Cache-control: private

Connection closed by foreign host.
 >
------

What else....