Odd log requests

So about 6 months ago, I made a page on my local server that pulls up a
list of movies I had in a directory and displayed them as links (I was
working on a way to make the WiiU in my living room play movies)…

Fast forward… About a month ago, I started noticing a remote IP trying to
access (and succeeding) the local server and pulling it up. Thing is, my
WiiU is packed away since I moved and I can confirm that isn’t it.

It’s happening every minute and there is no port forwarding through port 80
to my machine.

When I pull up the logs, I get this.

User Agent: Microsoft-WebDAV-MiniRedir/6.1.7601
Lucee (Neo https://www.facebook.com/neo.cfm) Os FINAL 4.5.1.000 (CFML
Version 10,0,0,0)
Time Stamp Feb 17, 2016 6:58 AM
Time Zone America/Los_Angeles
Locale English (us)
Remote IP [Redacted]

This is my local computer, but I’m not running anything that checks it
every minute. Does anyone have any suggestions on how I can figure out what
is accessing this link? There are no scheduled tasks that are running (or
even entered) that would do this.

The user agent is a good place to start…

Is that folder shared over your network, by any chance?

– DennyOn Wednesday, February 17, 2016 at 10:06:54 AM UTC-5, Phillip Vector wrote:

So about 6 months ago, I made a page on my local server that pulls up a
list of movies I had in a directory and displayed them as links (I was
working on a way to make the WiiU in my living room play movies)…

Fast forward… About a month ago, I started noticing a remote IP trying to
access (and succeeding) the local server and pulling it up. Thing is, my
WiiU is packed away since I moved and I can confirm that isn’t it.

It’s happening every minute and there is no port forwarding through port
80 to my machine.

When I pull up the logs, I get this.

User Agent: Microsoft-WebDAV-MiniRedir/6.1.7601
Lucee (Neo https://www.facebook.com/neo.cfm) Os FINAL 4.5.1.000 (CFML
Version 10,0,0,0)
Time Stamp Feb 17, 2016 6:58 AM
Time Zone America/Los_Angeles
Locale English (us)
Remote IP [Redacted]

This is my local computer, but I’m not running anything that checks it
every minute. Does anyone have any suggestions on how I can figure out what
is accessing this link? There are no scheduled tasks that are running (or
even entered) that would do this.

Also…

How to disable WebDav in IIS7:
http://www.exactsoftware.com/docs/DocView.aspx?DocumentID={c288fa96-2eea-414f-843f-29a2a1531405}

HTH!

– Denny

It was shared. Now it isn’t and the connections continue.

I’m not using IIS, so I don’t think it’s WebDAV is doing it. I tried ending
Chrome, but that didn’t help.On Thu, Feb 18, 2016 at 11:10 AM, Denard Springle <@Denard_Springle wrote:

The user agent is a good place to start…

exploit - Is this a security issue at the Remote Host or the Local Host? - Information Security Stack Exchange

WebDAV - Wikipedia

Is that folder shared over your network, by any chance?

– Denny

On Wednesday, February 17, 2016 at 10:06:54 AM UTC-5, Phillip Vector wrote:

So about 6 months ago, I made a page on my local server that pulls up a
list of movies I had in a directory and displayed them as links (I was
working on a way to make the WiiU in my living room play movies)…

Fast forward… About a month ago, I started noticing a remote IP trying
to access (and succeeding) the local server and pulling it up. Thing is, my
WiiU is packed away since I moved and I can confirm that isn’t it.

It’s happening every minute and there is no port forwarding through port
80 to my machine.

When I pull up the logs, I get this.

User Agent: Microsoft-WebDAV-MiniRedir/6.1.7601
Lucee (Neo https://www.facebook.com/neo.cfm) Os FINAL 4.5.1.000 (CFML
Version 10,0,0,0)
Time Stamp Feb 17, 2016 6:58 AM
Time Zone America/Los_Angeles
Locale English (us)
Remote IP [Redacted]

This is my local computer, but I’m not running anything that checks it
every minute. Does anyone have any suggestions on how I can figure out what
is accessing this link? There are no scheduled tasks that are running (or
even entered) that would do this.


Love Lucee? Become a supporter and be part of the Lucee project today! -
http://lucee.org/supporters/become-a-supporter.html


You received this message because you are subscribed to the Google Groups
“Lucee” group.
To unsubscribe from this group and stop receiving emails from it, send an
email to lucee+unsubscribe@googlegroups.com.
To post to this group, send email to lucee@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/lucee/6653b69f-7413-4b24-8f4d-042861cc1bf9%40googlegroups.com
https://groups.google.com/d/msgid/lucee/6653b69f-7413-4b24-8f4d-042861cc1bf9%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.