Security Incidents mailing list archives

http activity


From: Burak DAYIOGLU <dayioglu () METU EDU TR>
Date: Wed, 21 Mar 2001 10:03:09 +0200

Hello,
Surfing through logs of one web server box, I found out these four
lines, which I couldn't figure out. The first line is not a mistake,
but seems to be a purposeful inspection. I searched through the net
but couldn't be able to find out info on a phpads exploit.

The remaining three lines are awkward. First, the dates... Last two
lines have dates with reverse order (i.e. latter line should have been
logged earlier). The time settings on the box seem to be ok as well as
no signs of any intrusions.

Furthermore, with the last three lines, it looks like someone has had
been in search for an open-proxy what then what the heck is the syntax
error in it? I guess http:/ should have been http://, am I missing
something?

Can someone help me figure out these?

cheers,
Burak DAYIOGLU

X.X.X.X - - [19/Mar/2001:23:17:39 +0200] "GET
/adserver/phpads.php3?what=140x60&n=tr HTTP/1.1" 404 226
X.X.X.X - - [20/Mar/2001:01:52:03 +0200] "GET /"http:/some-domain.com",
HTTP/1.0" 404 217
X.X.X.X - - [20/Mar/2001:03:54:36 +0200] "GET /"http:/some-domain.com",
HTTP/1.0" 404 217
X.X.X.X - - [20/Mar/2001:03:43:14 +0200] "GET /"http:/some-domain.com",
HTTP/1.0" 404 217


Current thread: