- Sep 21, 2000
- 109
- 0
- 0
The following is a part of my logs:
23:51:12 61.139.42.107 - GET /winnt/system32/cmd.exe 403 30 -
23:51:17 61.139.42.107 - GET /winnt/system32/cmd.exe 403 11 -
23:51:19 61.139.42.107 - GET /scripts/..Á%pc../winnt/system32/cmd.exe 403 10 -
23:51:21 61.139.42.107 - GET /scripts/..À%9v../winnt/system32/cmd.exe 403 10 -
23:51:23 61.139.42.107 - GET /scripts/..À%qf../winnt/system32/cmd.exe 403 0 -
23:51:25 61.139.42.107 - GET /scripts/..Á%8s../winnt/system32/cmd.exe 403 0 -
23:51:27 61.139.42.107 - GET /scripts/..Á../winnt/system32/cmd.exe 403 0 -
23:51:37 61.139.42.107 - GET /winnt/system32/cmd.exe 403 10 -
23:51:39 61.139.42.107 - GET /scripts/..o../winnt/system32/cmd.exe 403 0 -
23:51:45 61.139.42.107 - GET /winnt/system32/cmd.exe 403 0 -
23:51:47 61.139.42.107 - GET /scripts/..ð??¯../winnt/system32/cmd.exe 403 0 -
23:51:49 61.139.42.107 - GET /scripts/..ø???¯../winnt/system32/cmd.exe 403 0 -
23:51:54 61.139.42.107 - GET /scripts/..ü????¯../winnt/system32/cmd.exe 403 0 -
23:51:56 61.139.42.107 - GET /winnt/system32/cmd.exe 403 10 -
I have gotten used to having /get default.ida in my logs.(It is patched so this request never works) But this is just brazen attacks. Oh, guess where the ip comes from? Neotrace followed it back to an ISP in China. I assume he/she/it was just checking a range of ip's since the thought of a person in china targeting students at ClemsonU doesn't make much since. Why do yall think?
23:51:12 61.139.42.107 - GET /winnt/system32/cmd.exe 403 30 -
23:51:17 61.139.42.107 - GET /winnt/system32/cmd.exe 403 11 -
23:51:19 61.139.42.107 - GET /scripts/..Á%pc../winnt/system32/cmd.exe 403 10 -
23:51:21 61.139.42.107 - GET /scripts/..À%9v../winnt/system32/cmd.exe 403 10 -
23:51:23 61.139.42.107 - GET /scripts/..À%qf../winnt/system32/cmd.exe 403 0 -
23:51:25 61.139.42.107 - GET /scripts/..Á%8s../winnt/system32/cmd.exe 403 0 -
23:51:27 61.139.42.107 - GET /scripts/..Á../winnt/system32/cmd.exe 403 0 -
23:51:37 61.139.42.107 - GET /winnt/system32/cmd.exe 403 10 -
23:51:39 61.139.42.107 - GET /scripts/..o../winnt/system32/cmd.exe 403 0 -
23:51:45 61.139.42.107 - GET /winnt/system32/cmd.exe 403 0 -
23:51:47 61.139.42.107 - GET /scripts/..ð??¯../winnt/system32/cmd.exe 403 0 -
23:51:49 61.139.42.107 - GET /scripts/..ø???¯../winnt/system32/cmd.exe 403 0 -
23:51:54 61.139.42.107 - GET /scripts/..ü????¯../winnt/system32/cmd.exe 403 0 -
23:51:56 61.139.42.107 - GET /winnt/system32/cmd.exe 403 10 -
I have gotten used to having /get default.ida in my logs.(It is patched so this request never works) But this is just brazen attacks. Oh, guess where the ip comes from? Neotrace followed it back to an ISP in China. I assume he/she/it was just checking a range of ip's since the thought of a person in china targeting students at ClemsonU doesn't make much since. Why do yall think?