Security Incidents mailing list archives

IRC connect through apache ????

From: arhuman () HOTMAIL COM (arhuman () HOTMAIL COM)
Date: Wed, 14 Jun 2000 10:17:24 -0000


I found this in my apache logs.
Do someone know what does it mean ?
(referer obfuscated by me -> xx.xx.xx.xx
It appears to be a linux box with no domain name)

xx.xx.xx.xx - - [14/Jun/2000:08:38:38 +0200] "CONNECT 
irc.webbernet.net:6667 HTTP/1.0" 405 306
xx.xx.xx.xx - - [14/Jun/2000:08:38:38 +0200] "CONNECT 
irc.webbernet.net:6667 HTTP/1.0" 405 306 "-" "-"
xx.xx.xx.xx - - [14/Jun/2000:08:38:42 +0200] "CONNECT 
irc.webbernet.net:6667 HTTP/1.0" 405 306
xx.xx.xx.xx - - [14/Jun/2000:08:38:49 +0200] "POST 
http://ircd.webbernet.net:6667 HTTP/1.0" 405 304
xx.xx.xx.xx - - [14/Jun/2000:08:38:49 +0200] "POST 
http://ircd.webbernet.net:6667 HTTP/1.0" 405 304 "-" "-"
xx.xx.xx.xx - - [14/Jun/2000:08:38:53 +0200] "POST 
http://ircd.webbernet.net:6667 HTTP/1.0" 405 304

Thanks by advance.

Arhuman

Current thread:

update on scans of tcp 12345 AUSCERT#36349 Russell Fulton (Jun 05)
- Re: update on scans of tcp 12345 AUSCERT#36349 Shaw Terwilliger (Jun 08)
- unknown trojan (attached) Jeremy L. Gaddis (Jun 08)
  - ** New DDoS / Trojan ** nine (Jun 10)
    - Re: ** New DDoS / Trojan ** Pierre Vandevenne (Jun 12)
  - Re: unknown trojan (attached) Brandon Kittler (Jun 10)
    - Re: unknown trojan (attached) Doug Kahler (Jun 12)
    - .:: 14x :: Information :: New DDoS/Trojan ::. Erik Tayler (Jun 13)
    - Re: .:: 14x :: Information :: New DDoS/Trojan ::. Lic. Rodolfo Gonzalez Gonzalez (Jun 15)
    - IRC connect through apache ???? arhuman () HOTMAIL COM (Jun 14)
    - Re: IRC connect through apache ???? Eric Vyncke (Jun 15)
- Re: update on scans of tcp 12345 AUSCERT#36349 orestes () DORIAN 2Y NET (Jun 08)
- Re: update on scans of tcp 12345 AUSCERT#36349 Keith Owens (Jun 08)
- <Possible follow-ups>
- Re: update on scans of tcp 12345 AUSCERT#36349 Bryan Scaringe (Jun 08)
- Re: update on scans of tcp 12345 AUSCERT#36349 Luke Dudney (Jun 10)