Menu
  • Home
  • all articles that deal with spamming
  • poisoned workstations/servers detected
  • all articles dealing with webspamming aka scams
  • all articles dealing with hacking
  • content that deals with current status of netranges
  • Pride and ignorance are akin.
  • whitelisted hosts needed by customers
  • output generated by netsecdb engine
  • things we deliver to outside
    • what users/admins say about netsedb
  • external news regarding network security and fighting cybercrime
  • all about netsecdb stats
  • Impressum
  • Terms of Use/Disclaimer
proxy check
no proxy detected.

Startseite

Notifier for sysadmins

PostDateIcon Sa, 01/02/2010 - 16:39 | service

If you find entries in your webservers weblog like these:

srv08.edv-sklave.de - - [02/Jan/2010:15:31:53 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:54 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:54 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:55 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:55 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:52 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:55 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:58 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:58 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:58 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:32:00 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:57 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:48 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:32:00 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:58 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:32:01 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:58 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:32:00 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:57 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:32:02 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:59 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:32:02 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"
srv08.edv-sklave.de - - [02/Jan/2010:15:31:56 +0100] "GET /index.php?reason=netsecdb_is_visiting_back_hacker_source_and_notifying_its_admin_the_direct_way HTTP/1.0" 200 17428 "-" "ApacheBench/2.0.40-dev"

Every of these requests is send out with a HEADER:
'www.netsecdb.de - visits back hackers origin - see http://www.netsecdb.de/index.php?q=node/595'

Your server is either a torexit node, open proxy or in another way was misused to exploit-attack www.netsecdb.de.

  | PostTagIcon Tags: hacking

Copyright © 2008-2010 Claus Marxmeier EDV-Service
Alle Rechte vorbehalten. Insbesondere dürfen Nachdruck, Aufnahme in Online-Dienste und Internet und Vervielfältigung auf Datenträger
wie CD-ROM, DVD-ROM etc. nur nach vorheriger schriftlicher Zustimmung erfolgen.
Die Anbieter haften nicht für unverlangt eingesandte Manuskripte und Fotos.

Designed by Claus Marxmeier.