Journal bizarrerie dans les logs d'apache...

Posté par  .
Étiquettes : aucune
0
18
mai
2003
Depuis quelques temps, j'ai régulièrement, dans les logs de mon apache, ce type de ligne :

62.211.147.x - - [18/May/2003:12:18:20 +0200] "\xe33" 501 - "-" "-"
62.202.31.x - - [18/May/2003:12:22:07 +0200] "\xe3G" 501 - "-" "-"
217.187.243.x - - [18/May/2003:12:22:09 +0200] "\xe3B" 501 - "-" "-"
62.202.31.x - - [18/May/2003:12:22:56 +0200] "\xe3G" 501 - "-" "-"
62.202.31.x - - [18/May/2003:12:23:42 +0200] "\xe3G" 501 - "-" "-"


et ce à peu près toute les 5 minutes....

Savez vous à quoi cela corresponds ?

  • # Re: bizarrerie dans les logs d'apache...

    Posté par  . Évalué à 1.

    Encore un truc de kiddie qui cherche à exploiter la robustesse légendaire d'un IIS, non ?

    • [^] # Re: bizarrerie dans les logs d'apache...

      Posté par  . Évalué à 2.

      ça m'étonnerais, je pencherai plutôt pour un vers/virus vu la fréquence du truc et la diversité des adresses source :

      217.128.148.211 - - [18/May/2003:11:03:18 +0200] "\xe35" 501 - "-" "-"
      212.194.124.140 - - [18/May/2003:11:03:36 +0200] "\xe38" 501 - "-" "-"
      217.128.148.211 - - [18/May/2003:11:04:01 +0200] "\xe35" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:06:12 +0200] "\xe37" 501 - "-" "-"
      172.179.66.217 - - [18/May/2003:11:06:18 +0200] "\xe3H" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:06:57 +0200] "\xe37" 501 - "-" "-"
      172.179.66.217 - - [18/May/2003:11:06:59 +0200] "\xe3H" 501 - "-" "-"
      172.179.66.217 - - [18/May/2003:11:07:40 +0200] "\xe3H" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:07:42 +0200] "\xe37" 501 - "-" "-"
      217.187.243.112 - - [18/May/2003:11:07:56 +0200] "\xe3B" 501 - "-" "-"
      80.163.215.210 - - [18/May/2003:11:08:50 +0200] "\xe37" 501 - "-" "-"
      220.87.243.116 - - [18/May/2003:11:09:19 +0200] "\xe37" 501 - "-" "-"
      80.163.215.210 - - [18/May/2003:11:09:33 +0200] "\xe37" 501 - "-" "-"
      220.87.243.116 - - [18/May/2003:11:10:03 +0200] "\xe37" 501 - "-" "-"
      80.163.215.210 - - [18/May/2003:11:10:17 +0200] "\xe37" 501 - "-" "-"
      220.87.243.116 - - [18/May/2003:11:10:47 +0200] "\xe37" 501 - "-" "-"
      81.53.143.186 - - [18/May/2003:11:10:50 +0200] "\xe3B" 501 - "-" "-"
      217.82.201.103 - - [18/May/2003:11:12:50 +0200] "\xe3B" 501 - "-" "-"
      80.133.251.6 - - [18/May/2003:11:12:59 +0200] "\xe3N" 501 - "-" "-"
      195.113.180.82 - - [18/May/2003:11:13:45 +0200] "\xe3;" 501 - "-" "-"
      80.133.251.6 - - [18/May/2003:11:13:46 +0200] "\xe3N" 501 - "-" "-"
      80.133.251.6 - - [18/May/2003:11:14:31 +0200] "\xe3N" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:14:52 +0200] "\xe37" 501 - "-" "-"
      81.51.18.53 - - [18/May/2003:11:15:09 +0200] "\xe34" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:15:38 +0200] "\xe37" 501 - "-" "-"
      81.51.18.53 - - [18/May/2003:11:15:52 +0200] "\xe34" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:16:24 +0200] "\xe37" 501 - "-" "-"
      81.51.18.53 - - [18/May/2003:11:16:36 +0200] "\xe34" 501 - "-" "-"
      217.235.126.45 - - [18/May/2003:11:17:07 +0200] "\xe3<" 501 - "-" "-"
      217.235.126.45 - - [18/May/2003:11:17:54 +0200] "\xe3<" 501 - "-" "-"
      217.235.126.45 - - [18/May/2003:11:18:40 +0200] "\xe3<" 501 - "-" "-"
      80.133.190.198 - - [18/May/2003:11:19:13 +0200] "\xe3H" 501 - "-" "-"
      80.133.190.198 - - [18/May/2003:11:19:55 +0200] "\xe3H" 501 - "-" "-"
      80.133.190.198 - - [18/May/2003:11:20:46 +0200] "\xe3H" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:21:32 +0200] "\xe37" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:22:17 +0200] "\xe37" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:23:03 +0200] "\xe37" 501 - "-" "-"
      217.82.201.103 - - [18/May/2003:11:27:28 +0200] "\xe3B" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:27:40 +0200] "\xe37" 501 - "-" "-"
      218.159.48.26 - - [18/May/2003:11:28:26 +0200] "\xe37" 501 - "-" "-"

Suivre le flux des commentaires

Note : les commentaires appartiennent à celles et ceux qui les ont postés. Nous n’en sommes pas responsables.