Web Attack

[speedy]

Just spotted this: -

I'm running the standard HS web server with no guest access and the whois script. In the whois log it seems that i've been hit 183 times by the same ip address.

Could this be an attack of the latest virus? or someone hacking?, Also am I correct in thinking that a only failed entry in the login box whould be logged by the whois script?

The IP reports to be from the .ffni.com (fairnet) provider, should I report this to them as abuse?

[huggy591]

Easy, Speedy... it could be harmless web access. What are the hits trying to access? Have they gotten in and made any changes to your system? Most ISPs will not respond to innocuous "hits" unless they are causing DoS or damage - which it doesn't sound like this is doing.

183 hits isn't a lot if you have a lot of different images and pages in your site. Remember, a web page has mutliple elements and most browsers will try to make multiple connecitons to parallelize the download to make the page appear faster. If you have a heavy page and it gets auto-refreshed, 183 hits is easily reached.

And yes, it could be some sort of attack or virus trying to attack. But the HS web server is pretty secure.

[speedy]

Gordon,

the thing is, i'm not running anything other than the hs server - no custom pages at all.

if you goto my ip address, you just get a hs login box. The log file is reporting 183 failed login attemps.

I think that yes this may be the latest virus as the attemps are only about 5 sec apart and so on.

[huggy591]

Or if you're on a DHCP system such as most ISPs use for home networks, it could be someone trying to get to the IP they once had...

What's the IP source that's hitting you?

[speedy]

it's 12.162.44.xxx I'm on a 82.37.240.xx range and have been since the cable modem was installed.