Link to home
Start Free TrialLog in
Avatar of speednow
speednow

asked on

Urgent: Posible Dictionary Attack Every 3 Sec, Logging not caching IP

Im trying to track some 404 errors that are popping up every 3 seconds on my cold fusion "webserver.log" file.

Someone or something is trying to pull this non-existant files. Example of this log file:
---------------------------------------------------
"Error","TID=952","10/05/07","12:35:55","HTTP/1.0 404 Object Not Found. The template specified, D:\www\domain.com\Suzuki_Dealership.cfm, does not exist on the specified server."
"Error","TID=652","10/05/07","12:37:55","HTTP/1.0 404 Object Not Found. The template specified, D:\www\domain.com\Austin_Mini.cfm, does not exist on the specified server."
"Error","TID=612","10/05/07","12:40:03","HTTP/1.0 404 Object Not Found. The template specified, D:\www\domain.com\Burlington_Car_Dealers.cfm, does not exist on the specified server."

------------------------------------------------------
Like mentioned before, multiple lines every 3 sec, for different files.

Problem is also that i am logging also to NT and i can't seem to log this errors in particular on the iis logs, but if i try to access a non existing cfm from the outside world, it will be logged. Strange.

I'm trying to pin point the source.

Cold Fusion is also not logging the ip or hostname. Can this also me accomplished?
ASKER CERTIFIED SOLUTION
Avatar of nathana21
nathana21
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Avatar of SidFishes
SidFishes
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of speednow
speednow

ASKER

The files haven't existed at anytime.  How can i check on those cfhttp's.

Im still unable to log.
Still unknown what is causing this.