server attack??

S

SupermanInNY

Verified User
Joined
Sep 28, 2004
Messages
419
do these seem like legit entries?


84.94.129.43 - - [29/Nov/2005:20:09:40 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
62.0.180.38 - - [29/Nov/2005:20:11:06 +0200] "GET /forums HTTP/1.1" 301 310 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
62.0.180.38 - - [29/Nov/2005:20:11:12 +0200] "GET /forums HTTP/1.1" 301 310 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
62.0.80.18 - - [29/Nov/2005:20:13:17 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
62.0.180.38 - - [29/Nov/2005:20:13:40 +0200] "GET /forums HTTP/1.1" 301 310 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
82.81.139.92 - - [29/Nov/2005:20:14:32 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
62.0.80.18 - - [29/Nov/2005:20:14:39 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
85.64.67.73 - - [29/Nov/2005:20:14:57 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
80.230.81.15 - - [29/Nov/2005:20:15:21 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
84.94.6.81 - - [29/Nov/2005:20:15:25 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
81.218.63.59 - - [29/Nov/2005:20:15:32 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
82.81.79.96 - - [29/Nov/2005:20:15:55 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
84.110.75.157 - - [29/Nov/2005:20:16:05 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
87.68.52.178 - - [29/Nov/2005:20:16:04 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
209.237.238.179 - - [29/Nov/2005:20:16:09 +0200] "GET /forums/member.php?amp;u=3145 HTTP/1.0" 200 - "-" "ia_archiver"
84.94.129.43 - - [29/Nov/2005:20:16:08 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
80.230.81.15 - - [29/Nov/2005:20:16:15 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
80.230.81.15 - - [29/Nov/2005:20:16:19 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
80.230.81.15 - - [29/Nov/2005:20:16:28 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
84.109.133.221 - - [29/Nov/2005:20:16:19 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; he-IL; rv:1.7.12) Gecko/20050919 Firefox/1.0.7"
81.218.63.59 - - [29/Nov/2005:20:16:22 +0200] "GET / HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
62.0.180.38 - - [29/Nov/2005:20:16:33 +0200] "GET /forums HTTP/1.1" 301 310 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
Click to expand...

-Alon
 
Looks normal.

Yes.

Basically, you have alot of random visitors, a good handful of webcrawlers, and some .NET applications.
 
OK,.

thanks.
It appears that since the load on my server has dropped dramatically, so the attacks were probably stopped (for now at least).

Thanks again,

-Alon.
 
You must log in or register to reply here.
Back
Top