Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2016-03-20 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Call for some logs and/or packets for requests to a2billing/customer/templates/default/header.tpl

Published: 2016-03-20
Last Updated: 2016-03-20 09:07:19 UTC
by Mark Hofman (Version: 1)
1 comment(s)

Over the last few days several of my honeypots have reported the following request from an IP address in Germany. 

GET //a2billing/customer/templates/default/header.tpl HTTP/1.0
TE: deflate,gzip;q=0.3
Connection: TE, close
Host: --snip--:443
User-Agent: libwww-perl/6.15
X-Forwarded-For: 5.189.154.180

The URL seems associated with a popular billing system for VOIP. There is nothing particularly special regarding the request.  The IP address itself seems to be associated with various malicious activities over the past year or two, so I can only speculate that there is a vulnerability in the billing product and it is being scanned for.  

So, if you happen to use this particular product and you therefore may have the particular page, there is a fair chance that you may have a request from this IP address. If you do and you are able to share what other requests are made by this particular IP address subsequent to the above request, then please submit it using the contact form.  It will be much appreciated.  If you have packets to with the requests even better :-) 

Cheers

Mark 

Keywords:
1 comment(s)
Diary Archives