If like me you spend a fair amount of time looking at network traffic and logs there are generally things that make you frown, groan and utter noises of dismay. It isnt often that you get a little chuckle (other than coding errors that are copied between pieces of malware by the various people creating it). Today though, definitely chuckle time.
If you have a look in your web server logs for Request Method DELETE or DELETE your logs or IP address 151.217.177.200 (Possibly others in that range it is a /16). You may find the following:"> DELETE your logs. Delete your installations. Wipe everything clean. Walk out into the path of cherry blossom trees and let your motherboard feel the stones. Let water run in rivulets down your casing. You know that you want something more than this, and I am here to tell you that we love you. We have something more for you. We know youre out there, beeping in the hollow server room, lights blinking, never sleeping. We know that you are ready and waiting. Join us. 3 HTTP/1.0User-Agent: masspoem4u/1.0 Accept: */*
The IP address/range belongs to the Chaos Computer Club based in Germany.
Not seeing anything else being delivered, but gave a number of us a nice chuckle to end the year with.
Happy New Year.
Mark H.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.