20
votes
6answers
3k views

Malicious Links that Respond to Browsers but not curl or wget

There are some emails with links to people's cracked websites with a malware download Like this kind of email: fake DHL pack station email ... the links often take the form of: http:// ...
2
votes
4answers
408 views

How to identify the Java program that is maliciously accessing my web site from many client addresses?

For many years, my personal web site receives numerous pairs of hits that look like this, every day: 202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04" ...
3
votes
1answer
186 views

“WICKED” entries in the default nginx vhost's logs

I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs: 109.x.x.121 - - ...
4
votes
4answers
365 views

Malware that uses http as a covert channel

I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour. Is there any database of malware, ...
11
votes
6answers
1k views

weird visitors to my website

For the last three months I have thousands of real visitors to a single page on my website. Those visits are recorded in Google Analytics and count as page views in adsense reports, but they are fake: ...