Is Mr. Robot at the Chaos Communication Congress?
So the “DELETE your logs” message hit my server last night and at first glance it does look like a HTTP DELETE request :-)
However, this is not a delete request or even a valid HTTP request. Since I’m running ModSecurity it got rejected, but most servers will just throw a “400 Bad request” response. The user agent string “masspoem4u/1.0” identifies the messenger as a bot, and it’s probably misbehaving by design.
Seeing how the IP address in question (184.108.40.206) belongs to the 32nd Chaos Communication Congress, I’m guessing this is either a PoC or an elaborate marketing campaign from The Chaos Computer Club.
Anyways, for the moment, keep calm and enjoy the poetry.
inetnum: 220.127.116.11 - 18.104.22.168 netname: DE-CCC-20151201 descr: Chaos Computer Club Veranstaltungsgesellschaft mbH
DELETE your logs. Delete your installations. Wipe everything clean. Walk out into the path of cherry blossom trees and let your motherboard feel the stones. Let water run in rivulets down your casing. You know that you want something more than this, and I am here to tell you that we love you. We have something more for you. We know you're out there, beeping in the hollow server room, lights blinking, never sleeping. We know that you are ready and waiting. Join us. <3