<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
No internet website is immune from attack !<br>
<br>
Last night I configured Wireshark for a 7 hour communication
capture on one of our websites to help with a problem.<br>
<br>
Checking this morning I found a short attack from a Server Location
of Lithuania and a long attack from Korea.<br>
There was a 9 minute attack captured from Korea before Wireshark
timed out.<br>
<br>
Partial server log from Lithuania. Trying to POST to our site.<br>
<img src="cid:part1.07000100.05000509@oplin.org" alt=""><br>
<br>
Partial server log from Korea. Trying to find something to exploit.<br>
ZmEu is a bot run by a blackhat Romanian hacker group. It searches
for poorly configured software installations that would allow the
script to take control of the server. Looks for scripts in various
common directories such as "/admin/", "/scripts/" and
"/phpMyAdmin/".<br>
<pre class="moz-signature" cols="80"><img src="cid:part2.04080403.02010703@oplin.org" alt="">
--
R. W. (Bob) Neeper
Community Library
44 Burrer Dr.
Sunbury, Oh 43074
Tel: (740)-965-3901</pre>
</body>
</html>