Solved

Possible Hacking

Posted on 2004-09-07
7
186 Views
Last Modified: 2013-12-04
probably not but Im new at this.

Suddenly got a lot of entries in our HTTP Access log for the following IP addresses:

221.232.74.205
221.232.74.102
221.232.77.30

Apparently they are allocated in China - would there be any reason why they are making http requests from within my (small)company.

thanks
0
Comment
Question by:planetnorton
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 44

Expert Comment

by:CrazyOne
ID: 11996149
IT depends on your company and what it does now doesn't it? Small or Large make no difference overall. You might have something thye want or they could just be practicing how to break in.
0
 
LVL 15

Expert Comment

by:mattisflones
ID: 11996215
Its not in China.. But Australia...
rgName:    Asia Pacific Network Information Centre
OrgID:      APNIC
Address:    PO Box 2131
City:       Milton
StateProv:  QLD
PostalCode: 4064
Country:    AU

ReferralServer: whois://whois.apnic.net

NetRange:   221.0.0.0 - 221.255.255.255
CIDR:       221.0.0.0/8
NetName:    APNIC7
NetHandle:  NET-221-0-0-0-1
Parent:    
NetType:    Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
0
 
LVL 9

Expert Comment

by:jdeclue
ID: 11999607
Most web servers HHTP logs will have "hits" such as these. It is extremly common, as more internet servers have become infected with various viruses, they automatically scan tcp/ip ranges. You will get these.

If you would like to examine it further, review the GET statements in the log, if you are recording these. The information logged can usually tell you if it is just the normal run of the mill traffic, or if there was an attempted exploit. If you want to post them here, for us to review, feel free.

J
0
Resolve Critical IT Incidents Fast

If your data, services or processes become compromised, your organization can suffer damage in just minutes and how fast you communicate during a major IT incident is everything. Learn how to immediately identify incidents & best practices to resolve them quickly and effectively.

 

Author Comment

by:planetnorton
ID: 12000443
Thanks for your feedback, the log report is from my VPN, a routefinder, and looking back through it there seems to be a lot of them. An example is shown below:

Web User Access Reports

Period:  2004Sep06-2004Sep07
User:  221.232.67.186
Sort:  BYTES, reverse
User Report
 
partner.search.sohu.com  
union.3721.com
 
TOTAL 37 149.758 0.10% 0.00% 100.00% 00:01:01 61.775 0.19%
AVERAGE 1 4.907.695    00:16:50 1.010.564 3.13%


0
 
LVL 9

Expert Comment

by:jdeclue
ID: 12000611
Are you running a web server? If so then you may want to turn on extended logging for a day, and review the GET statements. You would be surprised by how many attempts are made against web servers on an average day. The best thing you can do is stay on top of patches and seperate your web servers from you internal network with a DMZ.

J
0
 

Author Comment

by:planetnorton
ID: 12004702
Logs for the ip accesses.

thanks

1094589311.344   1915 221.232.67.186 TCP_MISS/200 4141 GET http://union.3721.com/cust.js? - DIRECT/202.165.102.144 text/html
1094589317.835   1712 221.232.67.186 TCP_MISS/200 6377 GET http://partner.search.sohu.com/cpc/partner.php? - DIRECT/61.135.134.99 text/html

0
 
LVL 9

Accepted Solution

by:
jdeclue earned 300 total points
ID: 12005782
It appears that the machines outside are requesting specific pages and you have a caching proxy that cannot return them, becuase they do not exist. These entries look pretty benign. I took a look at the partner.search (site), without going there, and it appears to be a search engine, so you most likely were just getting crawled.

J
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
IE Plugin Issue 4 88
Changing the domain admin password 9 104
Soundcloud.com 4 86
Removing local admin rights 4 10
Article by: btan
The intent is not to repeat what many has know about Ransomware but more to join its dots of what is it, who are the victims, why it exists, when and how we respond on infection. Lastly, sum up in a glance to share such information with more to help…
OfficeMate Freezes on login or does not load after login credentials are input.
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question