RE: IIS Logfile

From: Andrew Shore (andrew.shore_at_holistecs.com)
Date: 10/27/04

  • Next message: Barrie Dempster: "Re: Is this normal?" 
    Date: Wed, 27 Oct 2004 13:32:59 +0100
To: <mfernandez@fdta-valles.org>, <security-basics@securityfocus.com>

    Without knowing exactly what your severs are doing its hard to say
    (unless you are a bank)

    However, you will probably find that they are simply running scripts
    against your system and when they can't get anywhere they'll give in.

    Just keep an eye on things

    O and patch everything till your fingers bleed!

    HTH

    Andy

    -----Original Message-----
    From: mfernandez@fdta-valles.org [mailto:mfernandez@fdta-valles.org]
    Sent: 26 October 2004 21:07
    To: security-basics@securityfocus.com
    Subject: Re: IIS Logfile

    Thanks to all of you for replying.

    This log file is getting weirder. Here are more strange entries:

    2004-10-26 01:04:22 202.38.216.127 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx
    80 GET
    /scripts/nsiislog.dll - 401 5 0 - - -
    2004-10-26 02:54:32 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx
    80 GET
    /M83A - 401 5 0 - - -
    2004-10-26 02:54:32 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx
    80
    PROPFIND / - 401 5 15 - TEST -
    2004-10-26 02:54:33 130.235.160.66 - W3SVC1 FILESERVER xxx.xxx.xxx.xxx
    80 GET
    /scripts/nsiislog.dll - 401 5 0 xxx.xxx.xxx.xxx - -

    I am located in the ass of the world (South America) and I don't
    understand why
    some chinesse and sweden people should be interested on my net? (those
    IPs are
    from that places)

    Like you say, the 401 code means an authorization failure, but, what is
    they
    trying to do?

    Thanks in advance...

    ----------------------------------------------------------------
    This message was sent using IMP, the Internet Messaging Program.

  • Next message: Barrie Dempster: "Re: Is this normal?"