Posted by Sanders Kaufman on 10/11/07 23:01

"Lars Eighner" <usenet@larseighner.com> wrote in message
news:slrnfgt7ou.3fo.usenet@debranded.larseighner.com...
>I have been getting this probe about every 90 minutes whenever I am
> online. Since I have dynamic IPs with my provider, this would seem
> to be a pretty determined effort. Does anyone have any idea what
> the perp may be after?
>
> 222.216.28.135 - - [11/Oct/2007:16:32:36 -0500] "GET \
> http://mail2.663.com.cn/include/prx.php?\
> p=q1w2e3r4t5y6u7i8o9p0*a-b?hash=\
> 1F6A3F59E7942388D86E0D4A005066FEC40DDA2854B9 \
> HTTP/1.0" 403 366 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"

It's a 2600(?) probe.
The 2600 is a hacker group.
663.com is one of their domains.

[Back to original message]