Hallo,
Bei mir antwortet nur die NSA?
Habe den Server wieder vom Netz genommen. Es war ja nur ein Test mit einer dynamischen IP. Bei diesem Log wurde es mir zu bunt:
87.245.24.211 - - [03/Nov/2009:21:45:46 +0100] "OPTIONS / HTTP/1.1" 200 -
77.85.122.202 - - [03/Nov/2009:22:05:20 +0100] "\\x90r\xf8\xe1\xb2\x02{\x99\x98\vU\xe8TQ\xb8]\xff\xbc\x8b\xd0\x85\xe9i\xca<\x87/g" 400 226
87.245.117.118 - - [03/Nov/2009:22:32:29 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.117.118 - - [03/Nov/2009:22:32:29 +0100] "PROPFIND /asr_32853.exe HTTP/1.1" 405 239
87.245.117.118 - - [03/Nov/2009:22:32:29 +0100] "PROPFIND /asr_32853.exe HTTP/1.1" 405 239
87.245.117.118 - - [03/Nov/2009:22:33:29 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.117.118 - - [03/Nov/2009:22:33:29 +0100] "PROPFIND /T%24 HTTP/1.1" 405 228
87.245.117.118 - - [03/Nov/2009:22:33:30 +0100] "PROPFIND /T%24 HTTP/1.1" 405 228
87.245.117.118 - - [03/Nov/2009:22:34:51 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.117.118 - - [03/Nov/2009:22:34:51 +0100] "PROPFIND /WINDOWS%24 HTTP/1.1" 405 234
87.245.117.118 - - [03/Nov/2009:22:34:54 +0100] "PROPFIND /WINDOWS%24 HTTP/1.1" 405 234
87.245.85.116 - - [03/Nov/2009:22:38:15 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:38:24 +0100] "PROPFIND /asr_72772.exe HTTP/1.1" 405 239
87.245.85.116 - - [03/Nov/2009:22:39:24 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:39:24 +0100] "PROPFIND /E%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:43:09 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:43:35 +0100] "PROPFIND /E%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:45:29 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:45:37 +0100] "PROPFIND /F%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:46:57 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:47:00 +0100] "PROPFIND /H%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:47:01 +0100] "PROPFIND /H%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:49:06 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:49:20 +0100] "PROPFIND /N%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:49:24 +0100] "PROPFIND /N%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:50:42 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:50:46 +0100] "PROPFIND /O%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:51:03 +0100] "PROPFIND /O%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:52:18 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:52:18 +0100] "PROPFIND /Q%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:52:41 +0100] "PROPFIND /Q%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:54:02 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:54:06 +0100] "PROPFIND /X%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:55:12 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:55:33 +0100] "PROPFIND /D: HTTP/1.1" 403 204
87.245.85.116 - - [03/Nov/2009:22:55:38 +0100] "PROPFIND /D: HTTP/1.1" 403 204
87.245.85.116 - - [03/Nov/2009:22:56:46 +0100] "OPTIONS / HTTP/1.1" 200 -
87.245.85.116 - - [03/Nov/2009:22:56:48 +0100] "PROPFIND /D%24 HTTP/1.1" 405 228
87.245.85.116 - - [03/Nov/2009:22:56:54 +0100] "PROPFIND /D%24 HTTP/1.1" 405 228
Ist das eigentlich normal? Ein Wurm oder fieser Bot oder sowas?
Da will doch eindeutig jemand ins System eindringen oder sehe ich das falsch?
Gruß, Don P
sh:( fo:) ch:? rl:( br:] n4:~ ie:% mo:? va:{ js:) de:/ zu:] fl:( ss:| ls:&