I suspect that this is some sort of attempted scan/attack, but I’m uncertain how to move forward towards complete understanding of this, or a solution. Any thoughts?

On multiple occasions, networked HP Laserjet printers have spit out single page prints with the following information:

GET http://www.sina.com.cn/ HTTP/1.1

Host: www.sina.com.cn

Accept: */*

Pragma: no-cache

User-Agent:

GET http://www.baidu.com HTTP/1.1

Host: www.baidu.com

Accept: */*

Pragma: no-cache

User-Agent:

GET http://www.sciencedirect.com HTTP/1.1

Host: www.sciencedirect.com

Accept: */*

Pragma: no-cache

User-Agent:

Both appear to be popular Chinese websites, and not malicious on their own. Prints have appeared on HP Color Laserjet 3700, HP Laserjet 2200, HP Laserjet P3005dn. The printers are networked, not controlled by a print server, and have management passwords turned on.

Disabling non-essential services on the printers from their web consoles has not stopped the prints. I do not manage the local network, and do not have any network/firewall logs to examine.

Research has turned up others reporting identical prints: h30434.www3.hp.com/t5/Printer-Networking-and-Wireless/HP-Network-Printer-periodically-prints-a-page-from-a-web-crawler/td-p/1032985

Thanks,

Shaun Leininger, CCNA
Information Technology Professional
Department of Anthropology
517-884-0388