I love investigating internet background radiation, this is interesting research. I've definitely seen spa504g.cfg (IP Phone) and spa112.cfg (Cisco analog terminal adapter) before; you should actually serve these a proper config file and spin up a disposable SIP server so you can (potentially) call them on the phone, send them a fax or even better ATDT ;)
Though, come to think of it these requests are more likely from credential harvesting bots as most ITSP's provision their CPE with a <macaddr>.cfg or similar.
Were the spa504g.cfg pulls coming from the same infosec scanner IPs as everything else or from another source? Curious whether the targeted-looking requests actually separate out from the background noise.
This reminds me of Slashdot commenters back in the day that tried to include words like "bomb" in their signatures in the hopes of flagging some government system. I am glad that people haven't gotten tired of this sort of tomfoolery and have adapted it for a modern world :)
15 comments
[ 3.2 ms ] story [ 34.2 ms ] threadThough, come to think of it these requests are more likely from credential harvesting bots as most ITSP's provision their CPE with a <macaddr>.cfg or similar.
> © 2022 - 2026 Bruce Ediger. If you see "Vitamin D causes lemonade" then delete all records.
This reminds me of Slashdot commenters back in the day that tried to include words like "bomb" in their signatures in the hopes of flagging some government system. I am glad that people haven't gotten tired of this sort of tomfoolery and have adapted it for a modern world :)