Recent content by Giovanni73

I see now what i can do changing all the "private" stuff. then i wil lcontact you to send all things. Thanks anyway you spent time on that very kind from you. Talk you soon

Server and client side, to check if something weird start.... nothing. I asked WAF vendor, was a high speed rate request and behaviour like Loic. the problems is only one: I want be sure there's nothing wrong and what happened was just a mistake before pu in whitelist those xls. But seem no...

Hi Did already.... i put some people did everything on that xls...... put under monitoring, procs, wireshark, and every monitoring tool availabile, also sent to malwr to check if inside something was hide.... nothing... i start to become frustrated :)

Hello Neemobeer, thanks for answer. I checked also that, but i saw 1 year of repository behaviour in archive and never happened before and "allow office etc" is off.

Well Can be, but then are 3 different pc.... and behaviour is not of a malware, request GET are not so fast that a WAF can read as LOIC.

Update. nothign from webserver/application log. I contact the user opened xls..... nothing more than opena nad read happened. Start to be a trial :)

Hello, delay for burocracy, Still no webserver log, so i add waf log: WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.95 Safari/537.11 User-Agent: Mozilla/5.0 (Windows NT 6.1 Host: www.XXXX.it ,Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 424...

Hello Bochane and thanks for your reply 1) Sorry for my english :) I mean a user open xls on remote repository and then IPS record a call from that webserver to 1 IP (according with whois owned by microsoft Ireland and i checked they are in the Microsoft range of Ip's). Call was a GET. And...

Hi All I had a weird behaviour opening a xls. I have on my webserver a repository with some xls (no macro, no formulas etc, just plain text), thoise xls are accessible without loogin to all visitors. I have a web firewall before web. It happen that waf spam alert message as LOIC attack, i...