Hello Abuse-Team,

[dim7]

Поддержка переслала абузу.
Подскажите, че это за хрень

Hello Abuse-Team,

your Server with the IP: has attacked one of our
server/partner on the service:
"rfi-attack" on Time: Thu, 16 Dec 2010 19:10:07 +0100.
The IP was automatically blocked for more than 10 minutes. To block an
IP, it needs
3 failed Logins, one match for "invalid user" or a 5xx-Error-Code (eg.
Blacklist)!

Please check the machine behind the IP
(single-vps2.domain.name) and fix the problem.
Search for AS-Number/IPs from you, look at
http://www.blocklist.de/en/search.html?as=

You can parse this Mail with X-ARF-Tools from
http://www.x-arf.org/tools.html e.g. validatexarf-php.tar.gz.
You found more Information about X-Arf under
http://www.x-arf.org/specification.html

This mail will be resend after one day if more attacks are recognized.
In the attachment of this mail you can find the original protocols of
our systems.

To pause this message for one week, you can insert the IP and
E-Mailaddress to our Blocklist.
If more attacks of your network are recognized after the pause of
seven days, the block will
be canceled and you will get new reports.

[email protected]"
class=link>http://www.blocklist.de/en/[email protected]

We found your address in the Contact-Database abusix.org, because we
could not parse any
abuse/security-Address (no abuse-mailbox, abuse@....) in the Whois or
get a limit. Is the Address wrong,
please contact abusix.org: http://abusix.org/services/abuse-contact-db
(and the Ripe-Abuse-Finder does not found any data).
Answer us to rewrite the address (to abuse-quiet or a special address)
for all upcoming reports.


------------------------------
Martin Schiftan
This message was sent automatically, please answer us for Questions
or go to: http://www.blocklist.de/en/contact.html
------------------------------

-------- Attachment 1 [ text/plain ] --------

---
Reported-From: [email protected]
Category: abuse
Report-Type: login-attack
Service: rfi-attack
Version: 0.1
User-Agent: Fail2BanFeedBackScript blocklist.de V0.1
Date: Thu, 16 Dec 2010 19:10:07 +0100
Source-Type: ip-address
Source:
Port: 80
Report-ID: [email protected]
Schema-URL: http://www.x-arf.org/schema/abuse_lo...ack_0.1.1.json
Attachment: text/plain

[dim7]

Сообщение от Xenu

либо ты, либо кто-то еще пытался куда-то там (см. текст абузы) залить шелл, который лежит у тебя.

Меняй хост / ищи шелл (в txt файле например)

если б я пытался, тогда бы тут не спрашивал.
а с чего это про шелл разговор?

[2good4you2]

ну потому что форму логин/пароль сбрутить пытались с твоего ip

[Xenu]

Сообщение от dim7

а с чего это про шелл разговор?

rfi-attack => RFI => Remote File Include.
Таким макаром обычно всякие рулезные бяки подсаживаются на нужный хост, и как правило это шелл, если не полноценный, то хотя бы с возможностью заливки оного в последствии.

[inferno[DGT]]

Отпиши в аську

[StHost]

white and fluffy nigga )