Keeping an eye on logs is boring… but mandatory! Hopefully, sometimes it can reveal funny stuffs! It looks like people at the CCC are having some fun too while their annual conference is ongoing…
Here is what I got in my Apache logs this morning:
151.217.177.200 - - [30/Dec/2015:06:51:22 +0100] "DELETE your logs. \ Delete your installations. Wipe everything clean. Walk out into the \ path of cherry blossom trees and let your motherboard feel the stones. \ Let water run in rivulets down your casing. You know that you want something \ more than this, and I am here to tell you that we love you. We have something \ more for you. We know you're out there, beeping in the hollow server room, \ lights blinking, never sleeping. We know that you are ready and waiting. \ Join us. <3 HTTP/1.0" 400 415 "-" "masspoem4u/1.0"
This IP address belongs to the CCC (AS 13020) an it looks very active in the DShield database. A SANS ISC reader already reported the same event. I’m curious about the number of hits they made and, more interesting, how many people will detect it. This is the funniest event I ever found in my logs…
I have found this too…. But WTF is it?
Same here in Bosnia – 30/Dec/2015:06:32:25
I almost deleted my logs 🙂
I got the message in my log. Just checked tonight, googled it and found this page..
Same on a brand new site of mine that isn’t even public yet.
Same here, 30/Dec/2015:03:47:00 +0100. First glance it looks like nothing special, just an attempt to drum up attendance to their conference maybe, or someone decided to ping every IP from 0.0.0.0 to 255.255.255.255 for the fun of it.
client 151.217.177.200 DELETE your logs. Delete your installations. Wipe everything clean. Walk out into the path of cherry blossom trees and let your motherboard feel the stones. Let water run in rivulets down your casing. You know that you want something more than this, and I am here to tell you that we love you. We have something more for you. We know you’re out there, beeping in the hollow server room, lights blinking, never sleeping. We know that you are ready and waiting. Join us.
Same thing in mine: DELETE your logs. Delete your installations. Wipe everything clean. Walk out into the path of cherry blossom trees and let your motherboard feel the stones. Let water run in rivulets down your casing. You know that you want something more than this, and I am here to tell you that we love you. We have something more for you. We know you’re out there, beeping in the hollow server room, lights blinking, never sleeping. We know that you are ready and waiting. Join us.
haha, I see it too. Looking at my flows from their IP, its a busy little poet. Looking in my (small) ASN,
% racount -nr 151.217.177.200.arg
racount records total_pkts src_pkts dst_pkts total_bytes src_bytes dst_bytes
sum 25645 29434 27173 2261 2285772 1932908 352864
Hi, yeah found today too in my logs, same IP @ 02:29:23 +0100 :-)))
LOL… got this too. I was like, WTF is this??
Got the same, actually a nice idea 😀
saw it in my logs, lel
RT @xme: [/dev/random] The Truth is in Your Logs! https://t.co/9EWsJUGIoT
RT @xme: [/dev/random] The Truth is in Your Logs! https://t.co/9EWsJUGIoT
Me too.
.@xme confirmed that #masspoem is happening #32c3 https://t.co/j4pNykhYUx
RT @xme: [/dev/random] The Truth is in Your Logs! https://t.co/9EWsJUGIoT
Thank you for this post I was wondering what it was. I noticed it this morning in my logs too.
RT @xme: [/dev/random] The Truth is in Your Logs! https://t.co/9EWsJUGIoT
RT @xme: [/dev/random] The Truth is in Your Logs! https://t.co/9EWsJUGIoT