Re: Revenge?

Is the traffic coming from the same source IP???  perhaps some firewall rules 
may be in order...

Does the 400 have anything like the hosts.deny file in Linux?  

dan


-----Original Message-----
From: Jim Franz [mailto:franz400@xxxxxxxxxxxx]
Sent: Thursday, February 27, 2003 2:42 PM
To: Web Enabling the AS400 / iSeries
Subject: [WEB400] Re: Revenge?


if you re-direct back to the sender, and the sender has no knowledge
of these (like smtp-relay) you will be seen as "attacking" their server.
Some would say this is ok, but if lawyers & law enforcement get
involved.....?
No hacker (except the truly stupi# (unaware)) ever send an attack from
their own pc.
and btw - make sure you have no known Apache vulnerabilities unpatched..
imho
jim

----- Original Message -----
From: "Metz, Zak" <Zak_Metz@xxxxxx>
To: "Web Enabling the AS400 / iSeries" <web400@xxxxxxxxxxxx>
Sent: Thursday, February 27, 2003 2:13 PM
Subject: [WEB400] Revenge?


> Every couple minutes in the Apache log...
>
> /WWW/Distortion/htdocs/scripts/root.exe
> /WWW/Distortion/htdocs/MSADC/root.exe
> /WWW/Distortion/htdocs/c/winnt/system32/cmd.exe
> /WWW/Distortion/htdocs/d/winnt/system32/cmd.exe
> /WWW/Distortion/htdocs/scripts/..
> /WWW/Distortion/htdocs/scripts/..A?../winnt/system32/cmd.exe
> /WWW/Distortion/htdocs/scripts/..A ../winnt/system32/cmd.exe
> /WWW/Distortion/htdocs/scripts/..
>
> Is there any fun to be had redirecting these hack attempts?
>
> Regards,
> Zak Metz
> NOTICE: This E-mail may contain confidential information. If you are not
> the addressee or the intended recipient please do not read this E-mail
> and please immediately delete this e-mail message and any attachments
> from your workstation or network mail system. If you are the addressee
> or the intended recipient and you save or print a copy of this E-mail,
> please place it in an appropriate file, depending on whether
> confidential information is contained in the message.
>
>
> _______________________________________________
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.
>
>


_______________________________________________
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.