Take the 2-minute tour ×

Looking at my server logs, I see a lot of activity from various IP addresses. Something like this: - - [22/Feb/2012:11:14:40 -0200] "GET http://amate urangelz.com/ HTTP/1.1" 200 69869 - - [22/Feb/2012:11:14:45 -0200] "GET http://amat eurangelz.com/tx/out.php?t=exgirlfriendshots.com&l=toplist HTTP/1.1" 301 - - - [22/Feb/2012:11:16:19 -0200] "GET http://porn-ma ture.org/ HTTP/1.1" 200 112102 - - [22/Feb/2012:11:16:22 -0200] "GET http://porn- mature.org/streamrotator/out.php?l= HTTP/1.1" 302 - - - [22/Feb/2012:11:16:27 -0200] "GET http://porn-m ature.org//?search=Verie&facename=tags/ HTTP/1.1" 200 37943 - - [22/Feb/2012:11:16:36 -0200] "GET http://porn- mature.org/cgi-bin/te/o.cgi?id= HTTP/1.1" 302 203 - - [22/Feb/2012:11:17:05 -0200] "GET http://www.teens naked.us/cgi-bin/in.cgi?id=628 HTTP/1.1" 302 219 - - [22/Feb/2012:11:17:06 -0200] "GET http://www.teens naked.us/index.html?628 HTTP/1.1" 200 64907 - - [22/Feb/2012:11:17:16 -0200] "GET http://www.teensna ked.us/cgi-bin/out.cgi?ses=1YH2IQasTU&id=1472&url=http%3a%2f%2fwww.teens-porno.net%2fteenpornforum%2f HTTP/1.1" 302 221 - - [22/Feb/2012:11:17:36 -0200] "GET http://gogous enett.com/ HTTP/1.1" 200 13794 - - [22/Feb/2012:11:17:44 -0200] "GET http://go gousenett.com/category/nonude/ HTTP/1.1" 200 11858 - - [22/Feb/2012:11:22:16 -0200] "GET http://www.milfc utees.com/?ref=moms-area.net HTTP/1.1" 200 47961 - - [22/Feb/2012:11:22:16 -0200] "GET http://www.milfc utees.com/dtr/count.php?gr=1 HTTP/1.1" 200 -

(I insert random spaces in URLS to evict any kind of flood..., and this is just a little part of the log...)

With a simple whois to some of these IP addresses, I discover that these IP addresses are from RIPE NCC. What it is and what are they doing with my server? That's weird.

I have an Apache Tomcat 7 server running on port 4040 and an Apache (LAMP) server running on port 80, proxying to an application running in Tomcat.

Is this normal and is what happening?

I checked the auth.log file, and it has a lot of login attemps from these IP addresses. It seems like a brute force attack.

The list of IP addresses:

Another thing: for a long time this server was running only Tomcat. These attacks started when I installed and ran XAMPP (LAMP)..

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

Your whois was too simple.

RIPE NCC is a regional Internet registry (for Europe, the Middle East and parts of Central Asia, according to Wikipedia). Even though it is listed as the owner of the network by ARIN and other RIRs, it only manages assignments of smaller networks to other users.

NetRange: -
NetName:        95-RIPE
NetHandle:      NET-95-0-0-0-1
NetType:        Allocated to RIPE NCC
Comment:        These addresses have been further assigned to users in
RegDate:        2007-07-30
Updated:        2009-05-18
Ref:            http://whois.arin.net/rest/net/NET-95-0-0-0-1

ReferralServer: whois://whois.ripe.net:43

A smarter WHOIS client would have queried RIPE NCC automatically (either using a configuration file or by following the referral); others require you to give -h whois.ripe.net or similar options. And according to RIPE NCC, belongs to LeaseWeb:

inetnum: -
netname:         LEASEWEB
descr:           LeaseWeb
descr:           P.O. Box 93054
descr:           1090BB AMSTERDAM
descr:           Netherlands
descr:           www.leaseweb.com
remarks:         regarding portscans, DoS attacks and spam.
country:         NL
admin-c:         LSW1-RIPE
tech-c:          LSW1-RIPE
status:          ASSIGNED PA
mnt-by:          OCOM-MNT
share|improve this answer
but, if i have a lot of login attemps from them? –  caarlos0 Feb 22 '12 at 17:00
@caarlos0: From who? –  grawity Feb 22 '12 at 17:03
i just edit the question adding the list of IPs –  caarlos0 Feb 22 '12 at 18:15
add comment

To my understanding RIPE NCC manages all IP addresses (in Europe). So they are not to blame.

Seems to me like those address ranges are owned by LeaseWeb (a hosting provider).

So what is happening is, that some of their servers are scanning your web server for vulnerabilities or trying to inject URLs somehow into your website (in the hopes of the links ending up on the website and generating referral hits on those sites).

So why are their servers doing that? Well someone left their server unprotected and was hijacked. Now their server is being used to perform attacks on other servers (like yours).

You can mail abuse@leaseweb.com to tell them about it. They might shut down network access for those servers, but the problem will persist from new addresses.

share|improve this answer
add comment

Your Answer


