Due to recent PHP-Nuke sites being successfully attacked as noticed here and reported here, I checked my logs today and noticed a slice of some of the following crack attempts that were not successful.

========================================
Request: 200.55.7.235 - - [Sun Feb 2 12:49:56 2003] GET /cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/FormMail.pl&message=ro
[email protected] HTTP/1.0 302 358
Handler: cgi-script
----------------------------------------
GET /cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/[email protected] HTTP/1.0
Connection: Keep-Alive
Host: correo.cfired.org.ar
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Via: 1.0 PROXY

HTTP/1.0 302 Found
Location: http://www.computercops.biz/cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/FormMail.pl&message=rockstar&recipient=good
[email protected]
Connection: close
Content-Type: text/html; charset=iso-8859-1
========================================
Request: 200.55.7.235 - - [Sun Feb 2 12:49:57 2003] GET /cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/formmail.cgi&message=
[email protected] HTTP/1.0 302 360
Handler: cgi-script
----------------------------------------
GET /cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/[email protected] HTTP/1.0
Connection: Keep-Alive
Host: correo.cfired.org.ar
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Via: 1.0 PROXY

HTTP/1.0 302 Found
Location: http://www.computercops.biz/cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/formmail.cgi&message=rockstar&recipient=go
[email protected]
Connection: close
Content-Type: text/html; charset=iso-8859-1
========================================
Request: 200.55.7.235 - - [Sun Feb 2 12:49:59 2003] GET /cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/formmail.pl&message=ro
[email protected] HTTP/1.0 302 358
Handler: cgi-script
----------------------------------------
GET /cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/[email protected] HTTP/1.0
Connection: Keep-Alive
Host: correo.cfired.org.ar
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Via: 1.0 PROXY

HTTP/1.0 302 Found
Location: http://www.computercops.biz/cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/formmail.pl&message=rockstar&recipient=good
[email protected]
Connection: close
Content-Type: text/html; charset=iso-8859-1
========================================
Request: 200.55.7.235 - - [Sun Feb 2 12:49:59 2003] GET /cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/FormMail.cgi&message=
[email protected] HTTP/1.0 302 360
Handler: cgi-script
----------------------------------------
GET /cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/[email protected] HTTP/1.0
Connection: Keep-Alive
Host: correo.cfired.org.ar
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Via: 1.0 PROXY

HTTP/1.0 302 Found
Location: http://www.computercops.biz/cgi-bin/[email protected]&subject=www.computercops.biz/cgi-bin/FormMail.cgi&message=rockstar&recipient=go
[email protected]
Connection: close
Content-Type: text/html; charset=iso-8859-1

PHPNuke.org was cracked, but not due to PHP-Nuke itself. In this article are more reports of black hatters that appear to all be from the 200. IP block.. Brasil?

Checking SamSpade (source) the IP resolves to:

correo.cfired.org.ar

Here is the complete WHOIS for that IP:

Trying whois -h whois.arin.net 200.55.7.235

OrgName: Latin American and Caribbean IP address Regional Registry
OrgID: LACNIC

NetRange: 200.0.0.0 - 200.255.255.255
CIDR: 200.0.0.0/8
NetName: LACNIC-200
NetHandle: NET-200-0-0-0-1
Parent:
NetType: Allocated to LACNIC
NameServer: ARROWROOT.ARIN.NET
NameServer: BUCHU.ARIN.NET
NameServer: CHIA.ARIN.NET
NameServer: DILL.ARIN.NET
NameServer: NS.LACNIC.ORG
NameServer: NS.DNS.BR
NameServer: NS2.DNS.BR
Comment: This IP address range is under LACNIC responsibility for further
allocations to users in LACNIC region.
Please see http://www.lacnic.net/ for further details, or check the
WHOIS server located at whois.lacnic.net
RegDate: 2002-07-27
Updated: 2002-12-12

TechHandle: LACNIC-ARIN
TechName: LACNIC Hostmaster
TechPhone: (+55) 11 5509-3525
TechEmail: [email protected]

OrgTechHandle: LACNIC-ARIN
OrgTechName: LACNIC Hostmaster
OrgTechPhone: (+55) 11 5509-3525
OrgTechEmail: [email protected]

# ARIN Whois database, last updated 2003-02-01 20:00
# Enter ? for additional hints on searching ARIN's Whois database.

Rest assured they will be contacted today linking back to this news article.

Lacnic's Contact Us page:

CONTACT US




LACNIC
Potosi 1517
Montevideo, 11500
Uruguay

Phone: (598) 2 6062822 - (598) 2 6015846
Fax - (598) 2 6015509
[email protected]

OPERATIONAL CENTER / REGISTRATION SERVICES
São Paulo, Brazil

Phone: (+55) 11 5509-3525 - From 8:30 am to 5:30 pm (GMT -4)
[email protected]

MEMBERSHIP
[email protected]

WEBMASTER
[email protected]

NETWORK ABUSE
[email protected]

If you are seeing these be sure to report it immediately. A copy of this text will also be sent to US Federal Agencies.

Links back to this article have been posted here, here, and here.

Note: No harm has been done. Be sure to also read more data here, and here to shore up your defenses.