Re: how to explain these logs?
From: RainbowHat (nHiATlE@blSackholeP.mAit.edMu.invalid)Date: 02/05/02
- Next message: chris: "Re: how to explain these logs?"
- Previous message: Daniel Miller: "Re: security violation behind a firewal??"
- In reply to: chris: "how to explain these logs?"
- Next in thread: chris: "Thanks !"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: RainbowHat <nHiATlE@blSackholeP.mAit.edMu.invalid> Date: Tue, 5 Feb 2002 18:24:22 +0000 (UTC)
< chris
8<
>I'm running RH72 with firewall.
>
>Also, in some place of the log file, I see these 2 lines where the
>URLs after "GET" are nothing to do with my URL/web server. How could
>this happen? Is it some one isusing my machine to access other web
>site?
>
>Can some one explain this a little bit to me, or point me to a place
>for more details? Thanks a lot!
>
>210.21.30.169 - - [04/Feb/2002:00:29:37 -0800] "GET
>http://www.sina.com.cn/ HTTP/1.1" 200 692 "-" "Mozilla/4.0
>(compatible; MSIE 4.01; Windows 95)"
Someone who oriented privacy at 210.21.30.169 searched proxy server.
And your server responded code 200. This mean your httpd server allow
proxy request. You served proxy volunteer. This is not so bad. Depend
on your volunteer policy.
>216.35.116.20 - - [04/Feb/2002:04:55:48 -0800] "GET
>/allhotel/Beijing_Hilton.htm HTTP/1.0" 404 294 "-" "Mozilla/5.0
>(Slurp/cat; slurp@inktomi.com; http://www.inktomi.com/slurp.html)"
Someone from 216.35.116.20 wanted to get /allhotel/Beijing_Hilton.htm.
I'm not sure quoted () mean. But I guess URL of search engine or
subliminal advertisement.
>63.121.98.164 - - [03/Feb/2002:05:58:58 -0800] "GET
>/scripts/root.exe?/c+dir HTTP/1.0" 404 283 "-" "-"
8<
Google "nimda". Many admins are satiated about this from last summer.
Malicious prober or attacker who use social engineering make mimic
nimda scan. And perhaps they include other probe or attack subliminally.
>216.35.116.91 - - [03/Feb/2002:11:27:19 -0800] "GET /robots.txt
>HTTP/1.0" 404 277 "-" "Mozilla/3.0 (Slurp/si; slurp@inktomi.com;
>http://www.inktomi.com/slurp.html)"
Someone or search engine from 216.35.116.91 wanted to get robots.txt
file. Sometimes bad guys use this information but usually not so bad.
Google "robots.txt". Google use this information too.
$ nslookup www.inktomi.com
$ nslookup _above_IPs_
$ whois www.inktomi.com
$ whois _above_IPs_
-- Best Regards, RainbowHat. I support FULL DISCLOSURE. ----+----1----+----2----+----3----+----4----+----5----+----6----+----7
- Next message: chris: "Re: how to explain these logs?"
- Previous message: Daniel Miller: "Re: security violation behind a firewal??"
- In reply to: chris: "how to explain these logs?"
- Next in thread: chris: "Thanks !"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
