Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Looking at my server logs, I see a lot of activity from various IP addresses. Something like this:

69.65.10.86 - - [22/Feb/2012:11:14:40 -0200] "GET http://amate urangelz.com/ HTTP/1.1" 200 69869
69.65.10.86 - - [22/Feb/2012:11:14:45 -0200] "GET http://amat eurangelz.com/tx/out.php?t=exgirlfriendshots.com&l=toplist HTTP/1.1" 301 -
95.211.8.143 - - [22/Feb/2012:11:16:19 -0200] "GET http://porn-ma ture.org/ HTTP/1.1" 200 112102
95.211.8.143 - - [22/Feb/2012:11:16:22 -0200] "GET http://porn- mature.org/streamrotator/out.php?l=0.6.191.10308.0&u=/?search=Verie&facename=tags HTTP/1.1" 302 -
95.211.8.143 - - [22/Feb/2012:11:16:27 -0200] "GET http://porn-m ature.org//?search=Verie&facename=tags/ HTTP/1.1" 200 37943
95.211.8.143 - - [22/Feb/2012:11:16:36 -0200] "GET http://porn- mature.org/cgi-bin/te/o.cgi?id= HTTP/1.1" 302 203
95.211.22.8 - - [22/Feb/2012:11:17:05 -0200] "GET http://www.teens naked.us/cgi-bin/in.cgi?id=628 HTTP/1.1" 302 219
95.211.22.8 - - [22/Feb/2012:11:17:06 -0200] "GET http://www.teens naked.us/index.html?628 HTTP/1.1" 200 64907
95.211.22.8 - - [22/Feb/2012:11:17:16 -0200] "GET http://www.teensna ked.us/cgi-bin/out.cgi?ses=1YH2IQasTU&id=1472&url=http%3a%2f%2fwww.teens-porno.net%2fteenpornforum%2f HTTP/1.1" 302 221
95.211.15.136 - - [22/Feb/2012:11:17:36 -0200] "GET http://gogous enett.com/ HTTP/1.1" 200 13794
95.211.15.136 - - [22/Feb/2012:11:17:44 -0200] "GET http://go gousenett.com/category/nonude/ HTTP/1.1" 200 11858
95.211.8.143 - - [22/Feb/2012:11:22:16 -0200] "GET http://www.milfc utees.com/?ref=moms-area.net HTTP/1.1" 200 47961
95.211.8.143 - - [22/Feb/2012:11:22:16 -0200] "GET http://www.milfc utees.com/dtr/count.php?gr=1 HTTP/1.1" 200 -

(I insert random spaces in URLS to evict any kind of flood..., and this is just a little part of the log...)

With a simple whois to some of these IP addresses, I discover that these IP addresses are from RIPE NCC. What it is and what are they doing with my server? That's weird.

I have an Apache Tomcat 7 server running on port 4040 and an Apache (LAMP) server running on port 80, proxying to an application running in Tomcat.

Is this normal and is what happening?

I checked the auth.log file, and it has a lot of login attemps from these IP addresses. It seems like a brute force attack.

The list of IP addresses:

120.205.8.6
144.16.112.130
163.17.108.2
175.45.42.32
199.15.113.158
210.72.192.56
222.174.35.3

Another thing: for a long time this server was running only Tomcat. These attacks started when I installed and ran XAMPP (LAMP)..

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Your whois was too simple.

RIPE NCC is a regional Internet registry (for Europe, the Middle East and parts of Central Asia, according to Wikipedia). Even though it is listed as the owner of the 95.0.0.0/8 network by ARIN and other RIRs, it only manages assignments of smaller networks to other users.

NetRange:       95.0.0.0 - 95.255.255.255
CIDR:           95.0.0.0/8
NetName:        95-RIPE
NetHandle:      NET-95-0-0-0-1
NetType:        Allocated to RIPE NCC
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at http://www.ripe.net/whois
RegDate:        2007-07-30
Updated:        2009-05-18
Ref:            http://whois.arin.net/rest/net/NET-95-0-0-0-1

ReferralServer: whois://whois.ripe.net:43

A smarter WHOIS client would have queried RIPE NCC automatically (either using a configuration file or by following the referral); others require you to give -h whois.ripe.net or similar options. And according to RIPE NCC, 95.211.8.143 belongs to LeaseWeb:

inetnum:         95.211.21.192 - 95.211.28.63
netname:         LEASEWEB
descr:           LeaseWeb
descr:           P.O. Box 93054
descr:           1090BB AMSTERDAM
descr:           Netherlands
descr:           www.leaseweb.com
remarks:         Please send email to "abuse@leaseweb.com" for complaints
remarks:         regarding portscans, DoS attacks and spam.
country:         NL
admin-c:         LSW1-RIPE
tech-c:          LSW1-RIPE
status:          ASSIGNED PA
mnt-by:          OCOM-MNT
share|improve this answer
    
but, if i have a lot of login attemps from them? –  caarlos0 Feb 22 '12 at 17:00
    
@caarlos0: From who? –  grawity Feb 22 '12 at 17:03
    
i just edit the question adding the list of IPs –  caarlos0 Feb 22 '12 at 18:15

To my understanding RIPE NCC manages all IP addresses (in Europe). So they are not to blame.

Seems to me like those address ranges are owned by LeaseWeb (a hosting provider).

So what is happening is, that some of their servers are scanning your web server for vulnerabilities or trying to inject URLs somehow into your website (in the hopes of the links ending up on the website and generating referral hits on those sites).

So why are their servers doing that? Well someone left their server unprotected and was hijacked. Now their server is being used to perform attacks on other servers (like yours).

You can mail abuse@leaseweb.com to tell them about it. They might shut down network access for those servers, but the problem will persist from new addresses.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.