Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Looking at my server logs, I see a lot of activity from various IP addresses. Something like this: - - [22/Feb/2012:11:14:40 -0200] "GET http://amate HTTP/1.1" 200 69869 - - [22/Feb/2012:11:14:45 -0200] "GET http://amat HTTP/1.1" 301 - - - [22/Feb/2012:11:16:19 -0200] "GET http://porn-ma HTTP/1.1" 200 112102 - - [22/Feb/2012:11:16:22 -0200] "GET http://porn- HTTP/1.1" 302 - - - [22/Feb/2012:11:16:27 -0200] "GET http://porn-m HTTP/1.1" 200 37943 - - [22/Feb/2012:11:16:36 -0200] "GET http://porn- HTTP/1.1" 302 203 - - [22/Feb/2012:11:17:05 -0200] "GET http://www.teens HTTP/1.1" 302 219 - - [22/Feb/2012:11:17:06 -0200] "GET http://www.teens HTTP/1.1" 200 64907 - - [22/Feb/2012:11:17:16 -0200] "GET http://www.teensna HTTP/1.1" 302 221 - - [22/Feb/2012:11:17:36 -0200] "GET http://gogous HTTP/1.1" 200 13794 - - [22/Feb/2012:11:17:44 -0200] "GET http://go HTTP/1.1" 200 11858 - - [22/Feb/2012:11:22:16 -0200] "GET http://www.milfc HTTP/1.1" 200 47961 - - [22/Feb/2012:11:22:16 -0200] "GET http://www.milfc HTTP/1.1" 200 -

(I insert random spaces in URLS to evict any kind of flood..., and this is just a little part of the log...)

With a simple whois to some of these IP addresses, I discover that these IP addresses are from RIPE NCC. What it is and what are they doing with my server? That's weird.

I have an Apache Tomcat 7 server running on port 4040 and an Apache (LAMP) server running on port 80, proxying to an application running in Tomcat.

Is this normal and is what happening?

I checked the auth.log file, and it has a lot of login attemps from these IP addresses. It seems like a brute force attack.

The list of IP addresses:

Another thing: for a long time this server was running only Tomcat. These attacks started when I installed and ran XAMPP (LAMP)..

share|improve this question
up vote 3 down vote accepted

Your whois was too simple.

RIPE NCC is a regional Internet registry (for Europe, the Middle East and parts of Central Asia, according to Wikipedia). Even though it is listed as the owner of the network by ARIN and other RIRs, it only manages assignments of smaller networks to other users.

NetRange: -
NetName:        95-RIPE
NetHandle:      NET-95-0-0-0-1
NetType:        Allocated to RIPE NCC
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at
RegDate:        2007-07-30
Updated:        2009-05-18

ReferralServer: whois://

A smarter WHOIS client would have queried RIPE NCC automatically (either using a configuration file or by following the referral); others require you to give -h or similar options. And according to RIPE NCC, belongs to LeaseWeb:

inetnum: -
netname:         LEASEWEB
descr:           LeaseWeb
descr:           P.O. Box 93054
descr:           1090BB AMSTERDAM
descr:           Netherlands
remarks:         Please send email to "" for complaints
remarks:         regarding portscans, DoS attacks and spam.
country:         NL
admin-c:         LSW1-RIPE
tech-c:          LSW1-RIPE
status:          ASSIGNED PA
mnt-by:          OCOM-MNT
share|improve this answer
but, if i have a lot of login attemps from them? – caarlos0 Feb 22 '12 at 17:00
@caarlos0: From who? – grawity Feb 22 '12 at 17:03
i just edit the question adding the list of IPs – caarlos0 Feb 22 '12 at 18:15

To my understanding RIPE NCC manages all IP addresses (in Europe). So they are not to blame.

Seems to me like those address ranges are owned by LeaseWeb (a hosting provider).

So what is happening is, that some of their servers are scanning your web server for vulnerabilities or trying to inject URLs somehow into your website (in the hopes of the links ending up on the website and generating referral hits on those sites).

So why are their servers doing that? Well someone left their server unprotected and was hijacked. Now their server is being used to perform attacks on other servers (like yours).

You can mail to tell them about it. They might shut down network access for those servers, but the problem will persist from new addresses.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .