[Xitami] IP address PARKED on my server! Please help!

Mon, 7 Jul 2003 01:01:17 -0500

----- Original Message ----- 
From: "tom buckley" <jglennqualls@hotmail.com>
To: <xitami@lists.xitami.org>
Sent: Sunday, July 06, 2003 11:57 PM
Subject: Re: [Xitami] IP address PARKED on my server! Please help!

>
>   Hey Tom,
>
>   Thank you for trying to help me with this!  I"m not sure exactly how to
> best answer you, but I'll try and I hope that someone can please help me
> with it!  All I know is that this ip address: "morrilton.net" is ALWAYS
> showing to be on my site!  Hours and hours at a time, and if it leaves, it
> soon shows back up!  When I click on the site information links at site
> meter, it does show admin info and contact etc. but that don't help me
any,
> as I'm not sure what to do with it!  Are you saying that I shoudl contact
> that isp admin and tell them that someone from their isp is always on my
> site, and ask them if they are hacking me?  Or could it be they are linked
> to an image on my site etc?  I'm more afraid that they may have taken over
> my computer as a "host" for hacking, or that they have actually hacked me
or
> something like that!  I wish I knew more about this, but since I don't  I
> really appreciate any and all help and assistance I can get here!  Thanks
a
> lot and have a good day!  I just need to know what they're doing there all
> the time, and what to do about it!  What would you do? Thanks!
>
>   jgq
> +++++

If you go to www.morrilton.net, you'll see that it's an ISP. Which means,
one of their users is doing something you don't want.
Now go to your logs, and find our what that IP is doing. If you find many
error entries, than he's probably trying to hack into your system.
First thing I would do, is change all your system passwords, including
Xitami admin. Then report this beahviour to morrilton.net. Sending log files
will greatly help your case. Then it becomes their problem.

If this IP is in fact doing legitimate requests, look into _what_ he is
requesting. Is it something you don't want him to copy/link to? If so,
report him to his ISP.

If all else fails, install a good firewall like ZoneAlarm Pro which allows
you to block his specific address. In any case, a good firewall is a must
these days.

Tom

>
>
>
> >From: "Tom Baker" <t4baker@gardenstreet.org>
> >Reply-To: xitami@lists.xitami.org
> >To: <xitami@lists.xitami.org>
> >Subject: Re: [Xitami] IP address PARKED on my server! Please help!
> >Date: Tue, 1 Jul 2003 00:05:41 -0500
> >
> >I'd do a reverse DNS lookup on the IP. If this fails, at least find out
who
> >owns that IP block.
> >Compare that with the IP's used by Sitemeter, yourself, and any other
> >relevant IP addresses.
> >
> >Do mean that the IP has always made a request, or that the IP has a port
80
> >connection that it sustains?
> >If it's simply that is shows up in you log every day, I would guess it to
> >be
> >port scanner or trojan infected PC trying to find a way in to your
server.
> >I get about 100 malicious requests a day on port 80 alone.
> >
> >Tom
> >
> >----- Original Message -----
> >From: "tom buckley" <jglennqualls@hotmail.com>
> >To: <xitami@lists.xitami.org>
> >Sent: Monday, June 30, 2003 6:31 PM
> >Subject: [Xitami] IP address PARKED on my server! Please help!
> >
> >
> > >
> > >   Hello everyone,
> > >
> > >   I've got a problem (I think) and I'd sure like to hear from you guys
> >as
> >to
> > > what you think it is, and what to do about it!  I use one of the
online
> > > hit-counter, "Sitemeter", that lets you check how many hits you have
as
> >well
> > > as where they come from and how long they stay.  Everytime I check it
> >I"ve
> > > noticed that there is one particular ip address ALWAYS there!  At
first
> >I
> > > just thought that this person enjoyed my site, lol, and spent a lot of
> >time
> > > there, but now I'm getting a bit worried about it!  What could this
be?
> >Are
> > > they just linked to an image on my site, or are they spying or hacking
> >me
> >or
> > > what?  Also, how can I go about blocking that ip addy?  I have seen
some
> >of
> > > you talking about this in the past, and would really like to know what
> >you
> > > think this is, as well as what to do about it!  Thanks to all of you
in
> > > advance, and I hope you all are having a good day!  Happy upcoming
4th!
> > >
> > >    jgq
> > > +++++++
> > >
> > > _________________________________________________________________
> > > Help STOP SPAM with the new MSN 8 and get 2 months FREE*
> > > http://join.msn.com/?page=features/junkmail
> > >
> > >
> > > --
> > > Xitami Users Mailing List -- For Xitami support
> > > To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
> > >
> >
> >
> >
> >--
> >Xitami Users Mailing List -- For Xitami support
> >To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
>
> _________________________________________________________________
> Add photos to your messages with MSN 8. Get 2 months FREE*.
> http://join.msn.com/?page=features/featuredemail
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami