鬱陶しいもの(2) [Site info. and blog ]

先日から脆弱性のある CGI プログラム探しと思われる怪しいアクセスが続いている。短時間の間に異なるホストから formmail.pl だの feedback.cgi といったありがちな URL をスキャンしてゆく。アクセス元のホストは恐らく踏み台にされた open proxy か何かだろう。ウィルスではなく、悪意のあるクラッカーだとは思うが不明だ。

Apache のログ抜粋、あえてアクセス元を伏せない。

insight.tobin.com - - [15/Jul/2004:22:09:30 +0900] "POST /cgi-bin/forms.cgi HTTP/1.1" 404 2267 "http://bird.dip.jp/" "-"
200.245.65.25 - - [15/Jul/2004:22:09:34 +0900] "POST /cgi-bin/formmail.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
insight.tobin.com - - [15/Jul/2004:22:09:40 +0900] "POST /cgi-bin/contact.cgi HTTP/1.1" 404 2267 "http://bird.dip.jp/" "-"
207.14.106.1 - - [15/Jul/2004:22:09:47 +0900] "POST /cgi-bin/mailform.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
142.131.18.2 - - [15/Jul/2004:22:09:50 +0900] "POST /cgi-bin/formmail.cgi HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
207.14.106.1 - - [15/Jul/2004:22:10:08 +0900] "POST /cgi-bin/FormMail.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
ip103-231.introweb.nl - - [15/Jul/2004:22:10:20 +0900] "POST /mail.cgi HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
141.158.65.245 - - [15/Jul/2004:22:10:24 +0900] "POST /cgi-bin/fmail.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
216.128.69.140 - - [15/Jul/2004:22:10:59 +0900] "POST /cgi-bin/form.cgi HTTP/1.1" 404 2267 "http://bird.dip.jp/" "-"
69.30.133.25 - - [15/Jul/2004:22:11:26 +0900] "POST /cgi-bin/form.cgi HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
209.251.3.194 - - [15/Jul/2004:22:11:36 +0900] "POST /cgi-bin/form.cgi HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
21.47.30.61.isp.tfn.net.tw - - [15/Jul/2004:22:11:45 +0900] "POST /cgi-bin/form.cgi HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
dino.cache.state.mn.us - - [15/Jul/2004:22:11:46 +0900] "POST /cgi-bin/form.cgi HTTP/1.1" 404 2267 "http://bird.dip.jp/" "-"
adsl-207-213-100-137.dsl.lsan03.pacbell.net - - [15/Jul/2004:22:12:05 +0900] "POST /cgi-bin/contact.pl HTTP/1.1" 404 2267 "http://bird.dip.jp/" "-"
yahoobb219012090005.bbtec.net - - [15/Jul/2004:22:12:05 +0900] "POST /cgi/formmail HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
216.132.173.180 - - [15/Jul/2004:22:12:11 +0900] "POST /cgi-bin/mail.cgi HTTP/1.1" 404 2267 "http://bird.dip.jp/" "-"
adsl-64-108-104-253.dsl.dytnoh.ameritech.net - - [15/Jul/2004:22:12:19 +0900] "POST /formmail.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
217.172.70.182 - - [15/Jul/2004:22:12:28 +0900] "POST /cgi-bin/feedback.cgi HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
host119-34.discord.birch.net - - [15/Jul/2004:22:24:42 +0900] "POST /cgi-bin/mailto2.cgi HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
141.158.65.245 - - [15/Jul/2004:22:25:05 +0900] "POST /cgi-bin/formmail.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
141.158.65.245 - - [15/Jul/2004:22:25:21 +0900] "POST /cgi-bin/contact.cgi HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
12.14.65.2 - - [15/Jul/2004:22:25:26 +0900] "POST /cgi-bin/mailform.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
lpib.gva.es - - [15/Jul/2004:22:25:33 +0900] "POST /cgi-bin/formmail.cgi HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
fu-154-125.edit.ne.jp - - [15/Jul/2004:22:25:34 +0900] "POST /cgi-bin/contact.cgi HTTP/1.1" 404 2267 "http://bird.dip.jp/" "-"
hq-asl.sylogist.com - - [15/Jul/2004:22:25:39 +0900] "POST /cgi-bin/FormMail.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
dpvc-68-162-220-233.bos.east.verizon.net - - [15/Jul/2004:22:25:47 +0900] "POST /mail.cgi HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
207.14.106.1 - - [15/Jul/2004:22:26:09 +0900] "POST /cgi-bin/fmail.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
63.201.124.50 - - [15/Jul/2004:22:26:15 +0900] "POST /cgi-bin/form.cgi HTTP/1.1" 404 2267 "http://bird.dip.jp/" "-"
195.54.87.222 - - [15/Jul/2004:22:26:41 +0900] "POST /cgi-bin/contact.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"
207.127.0.2 - - [15/Jul/2004:22:26:49 +0900] "POST /cgi-bin/contact.pl HTTP/1.0" 404 2267 "http://bird.dip.jp/" "-"

[2004.07.19]
なんだか更に意味不明なアクセスが。なんだこりゃ。

usr023.bb015-04.udb.im.wakwak.ne.jp - - [19/Jul/2004:10:15:24 +0900] "0\x817" 501 - "-" "-"
usr014.bb046-01.ude.im.wakwak.ne.jp - - [19/Jul/2004:10:17:41 +0900] "p\x9b0\x14" 501 - "-" "-"
usr024.bb051-02.udf.im.wakwak.ne.jp - - [19/Jul/2004:10:21:16 +0900] "(\xd87" 501 - "-" "-"
usr014.bb046-01.ude.im.wakwak.ne.jp - - [19/Jul/2004:10:23:05 +0900] "\x98Y2\x14" 501 - "-" "-"
usr014.bb046-01.ude.im.wakwak.ne.jp - - [19/Jul/2004:10:36:46 +0900] "\b\xb46\x14" 501 - "-" "-"
usr014.bb046-01.ude.im.wakwak.ne.jp - - [19/Jul/2004:10:39:47 +0900] "x\xc2\xb7\x1d" 501 - "-" "-"
usr023.bb015-04.udb.im.wakwak.ne.jp - - [19/Jul/2004:10:46:40 +0900] "\xa8\xbd7" 501 - "-" "-"
usr023.bb015-04.udb.im.wakwak.ne.jp - - [19/Jul/2004:13:17:54 +0900] "\xd8\xdf" 501 - "-" "-" 

これも断続的にアクセスがある。アドレスは微妙に違うものの同じプロバイダを使用しているマシン。同一ホストか？

[2004.07.27]
RSS リーダの類でチェックしてくれるのはありがたいが、頻繁に自動更新チェックをするものは robots.txt を見て欲しいし、更新が無いときはさらえて行かないなどの配慮をして欲しい。