Bonjour,  
 
J'ai depuis peu remis un analyser de logs (awstats) sous Apache 1.3.33
 
Et je me suis aperçu qu'il ressort un nombre impressionnant d'erreurs 404 générées par un serveur externe (Je ne sais pas comment faire pour savoir d'où ça vient)
 
Il appele des pages de ce genre : /webalizer/usage_200402.html&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd%20/tmp
/webalizer/usage_200402.html&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20killall%20-9%20perl
/webalizer/usage_200402.html&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd/tmp
/msadc/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe
/scripts/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe
/iisadmpwd/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe
/adsamples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe
 
 
Tous ces fichiers n'existent pas!  
 
Les commandes m'ont l'air sans effet sous linux, encore qu'un killall -9 ne me plait pas beaucoup.
 
Celà me rappelle le genre d'attaques CSS (Cross Site Scripting) et j'ai un peu peur pour mes visiteurs...  
Ce nombre impressionnant d'erreurs 404 générées cachent  les  "vraies erreurs 404", leur analyses me permetent de mettre en evidence un problème sur mon site à proprement parler.
 
Que puis-je mettre en place pour proteger mon serveur pour limiter les dégats, et surtout empecher de nouveaux hits parasites sur mon serveur ?
 
Je rappele ma config serveur
 
Débian Linux noyau 2.6.7-1-686
Apache/1.3.33 (Debian GNU/Linux) PHP/4.3.10-2  
Mise à jour fraiche  
 
 
Merci à tous pour vos idées..

liste des IP connernées...
 
Je ne vais pas les ignorer toutes quand même ?  
 
serv51.netdatacenter.net - - [09/Jan/2005
138.41.21.72.reverse.layeredtech.com - - [09/Jan/2005
138.41.21.72.reverse.layeredtech.com - - [09/Jan/2005
ns.axzion.com - - [09/Jan/2005
november.uniweb.no - - [09/Jan/2005
138.41.21.72.reverse.layeredtech.com - - [09/Jan/2005
chassis.hostnoc.net - - [09/Jan/2005
viper6.dnsmarker.net - - [09/Jan/2005
server.codhost.com - - [09/Jan/2005
www.aquaray.com - - [09/Jan/2005
hoboken.protagonist.nl - - [09/Jan/2005
www.qeydiyyat.com - - [09/Jan/2005
server.diverse-designs.biz - - [09/Jan/2005
hoboken.protagonist.nl - - [09/Jan/2005
saphir.cleverhosting.de - - [09/Jan/2005
dub.solidhosting.ch - - [09/Jan/2005
saphir.cleverhosting.de - - [09/Jan/2005
65.75.171.220 - - [09/Jan/2005
www.aquaray.com - - [09/Jan/2005
65.75.171.220 - - [09/Jan/2005
serv51.netdatacenter.net - - [09/Jan/2005
saturn.milescape.com - - [09/Jan/2005
138.41.21.72.reverse.layeredtech.com - - [09/Jan/2005
november.uniweb.no - - [09/Jan/2005
server0.24hostingnow.com - - [09/Jan/2005
server.diverse-designs.biz - - [09/Jan/2005
harbour.parkline.ru - - [09/Jan/2005
98.67-18-56.reverse.theplanet.com - - [09/Jan/2005
host150-106.crowley.pl - - [09/Jan/2005
serverbr6.com - - [09/Jan/2005
serv51.netdatacenter.net - - [09/Jan/2005
dub.solidhosting.ch - - [09/Jan/2005
ev1s-66-98-220-74.ev1servers.net - - [09/Jan/2005
flake.adminz.net - - [09/Jan/2005
ns1.tweedy.us - - [09/Jan/2005
217-20-113-119.internetserviceteam.com - - [09/Jan/2005
66.79.176.210 - - [09/Jan/2005
65.75.171.220 - - [09/Jan/2005
host150-106.crowley.pl - - [09/Jan/2005
69.9.181.34 - - [09/Jan/2005
hosting.iatp.org.ua - - [09/Jan/2005
217-20-113-119.internetserviceteam.com - - [09/Jan/2005
65.75.143.160 - - [09/Jan/2005
iceager.info - - [09/Jan/2005
65.75.171.220 - - [09/Jan/2005
dub.solidhosting.ch - - [09/Jan/2005
ns.axzion.com - - [09/Jan/2005
ns.axzion.com - - [09/Jan/2005
205.209.134.190 - - [09/Jan/2005
202.85.156.222 - - [09/Jan/2005
66-193-175-248.dimenoc.com - - [09/Jan/2005
65.75.171.220 - - [09/Jan/2005
65.75.171.220 - - [09/Jan/2005
www.qeydiyyat.com - - [09/Jan/2005
66-193-175-248.dimenoc.com - - [09/Jan/2005
69.72.195.170 - - [09/Jan/2005
ns.axzion.com - - [09/Jan/2005
pasadena.coolservecorp.net - - [09/Jan/2005
1n5-243.servernode.net - - [09/Jan/2005
65.75.143.160 - - [09/Jan/2005
pasadena.coolservecorp.net - - [09/Jan/2005
www.mativ.com - - [09/Jan/2005
ns1.tweedy.us - - [09/Jan/2005
p4-7018.uk2net.com - - [09/Jan/2005
ev1s-66-98-220-74.ev1servers.net - - [09/Jan/2005
202.85.156.222 - - [09/Jan/2005
www.aquaray.com - - [09/Jan/2005
ev1s-207-44-218-118.ev1servers.net - - [09/Jan/2005
138.41.21.72.reverse.layeredtech.com - - [09/Jan/2005
www.qeydiyyat.com - - [09/Jan/2005
ev1s-66-98-220-74.ev1servers.net - - [09/Jan/2005
69.9.181.34 - - [09/Jan/2005
flake.adminz.net - - [09/Jan/2005
pasadena.coolservecorp.net - - [09/Jan/2005
65.75.171.220 - - [09/Jan/2005
216.120.255.160 - - [09/Jan/2005
ns1.tweedy.us - - [09/Jan/2005
69.9.181.34 - - [09/Jan/2005
65.75.171.220 - - [09/Jan/2005
66-193-175-248.dimenoc.com - - [09/Jan/2005
216.120.255.160 - - [09/Jan/2005
www.qeydiyyat.com - - [09/Jan/2005
rainbow.impakt.pl - - [09/Jan/2005
ns1.tweedy.us - - [09/Jan/2005
host.union-server.com - - [09/Jan/2005
212.20.215.8 - - [09/Jan/2005
viper6.dnsmarker.net - - [09/Jan/2005
65.39.164.126 - - [09/Jan/2005
www.aquaray.com - - [09/Jan/2005
65.75.143.160 - - [09/Jan/2005
65.39.164.126 - - [09/Jan/2005
ns1.tweedy.us - - [09/Jan/2005
1n5-243.servernode.net - - [09/Jan/2005
flake.adminz.net - - [09/Jan/2005
69.9.181.34 - - [09/Jan/2005
217-20-113-119.internetserviceteam.com - - [09/Jan/2005
69.9.181.34 - - [09/Jan/2005
205.209.134.190 - - [09/Jan/2005
www.somecolors.com - - [09/Jan/2005
astrasbourg-251-1-64-11.w82-126.abo.wanadoo.fr - - [09/Jan/2005
69.9.181.34 - - [09/Jan/2005
www.somecolors.com - - [09/Jan/2005
ns1.tweedy.us - - [09/Jan/2005
www.aquaray.com - - [09/Jan/2005
65.75.143.160 - - [09/Jan/2005
astrasbourg-251-1-64-11.w82-126.abo.wanadoo.fr - - [09/Jan/2005
98.67-18-56.reverse.theplanet.com - - [09/Jan/2005
server.diverse-designs.biz - - [09/Jan/2005
rainbow.impakt.pl - - [09/Jan/2005
flashpoint.pl - - [09/Jan/2005
pasadena.coolservecorp.net - - [09/Jan/2005
69.9.181.34 - - [09/Jan/2005
217-20-113-119.internetserviceteam.com - - [09/Jan/2005
www.qeydiyyat.com - - [09/Jan/2005
202.85.156.222 - - [09/Jan/2005
ns.axzion.com - - [10/Jan/2005
www.somecolors.com - - [10/Jan/2005
candy.aladin.net - - [10/Jan/2005
natasha.dreamdns.net - - [10/Jan/2005
205.209.176.120 - - [10/Jan/2005
cpanel1.pronethosting.hu - - [10/Jan/2005
dns7.serverstoday.com - - [10/Jan/2005
www.mativ.com - - [10/Jan/2005
www.qeydiyyat.com - - [10/Jan/2005
ev1s-207-44-218-118.ev1servers.net - - [10/Jan/2005
65.75.143.160 - - [10/Jan/2005
hosting.iatp.org.ua - - [10/Jan/2005
205.209.176.120 - - [10/Jan/2005
ev1s-66-98-220-74.ev1servers.net - - [10/Jan/2005
216.120.255.160 - - [10/Jan/2005
205.209.176.120 - - [10/Jan/2005
202.85.156.222 - - [10/Jan/2005
202.85.156.222 - - [10/Jan/2005
host-ip58-184.crowley.pl - - [10/Jan/2005
www.somecolors.com - - [10/Jan/2005
dns7.serverstoday.com - - [10/Jan/2005
216.120.255.160 - - [10/Jan/2005
ev1s-66-98-220-74.ev1servers.net - - [10/Jan/2005
209.216.195.2 - - [10/Jan/2005
98.67-18-56.reverse.theplanet.com - - [10/Jan/2005
www.qeydiyyat.com - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
65.75.143.160 - - [10/Jan/2005
209.216.195.2 - - [10/Jan/2005
candy.aladin.net - - [10/Jan/2005
natasha.dreamdns.net - - [10/Jan/2005
www.mativ.com - - [10/Jan/2005
69.9.181.34 - - [10/Jan/2005
natasha.dreamdns.net - - [10/Jan/2005
hosting.iatp.org.ua - - [10/Jan/2005
hosting.iatp.org.ua - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
astrasbourg-251-1-64-11.w82-126.abo.wanadoo.fr - - [10/Jan/2005
saturn.milescape.com - - [10/Jan/2005
66.197.163.5 - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
202.85.156.222 - - [10/Jan/2005
202.85.156.222 - - [10/Jan/2005
hosting.iatp.org.ua - - [10/Jan/2005
hosting.iatp.org.ua - - [10/Jan/2005
candy.aladin.net - - [10/Jan/2005
217-20-113-119.internetserviceteam.com - - [10/Jan/2005
217-20-113-119.internetserviceteam.com - - [10/Jan/2005
98.67-18-56.reverse.theplanet.com - - [10/Jan/2005
202.85.156.222 - - [10/Jan/2005
210.245.233.72 - - [10/Jan/2005
ns.axzion.com - - [10/Jan/2005
216.120.255.160 - - [10/Jan/2005
server.diverse-designs.biz - - [10/Jan/2005
saturn.milescape.com - - [10/Jan/2005
flashpoint.pl - - [10/Jan/2005
69.9.181.34 - - [10/Jan/2005
98.67-18-56.reverse.theplanet.com - - [10/Jan/2005
66.79.176.210 - - [10/Jan/2005
138.41.21.72.reverse.layeredtech.com - - [10/Jan/2005
217-20-113-119.internetserviceteam.com - - [10/Jan/2005
ev1s-66-98-220-74.ev1servers.net - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
65.75.179.110 - - [10/Jan/2005
host.union-server.com - - [10/Jan/2005
host.union-server.com - - [10/Jan/2005
217-20-113-119.internetserviceteam.com - - [10/Jan/2005
natasha.dreamdns.net - - [10/Jan/2005
www.mativ.com - - [10/Jan/2005
natasha.dreamdns.net - - [10/Jan/2005
gs.server02.gs-wd.de - - [10/Jan/2005
217-20-113-119.internetserviceteam.com - - [10/Jan/2005
astrasbourg-251-1-64-11.w82-126.abo.wanadoo.fr - - [10/Jan/2005
205.209.176.120 - - [10/Jan/2005
67.43.8.218 - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
bno-net.de - - [10/Jan/2005
ev1s-66-98-220-74.ev1servers.net - - [10/Jan/2005
bno-net.de - - [10/Jan/2005
p15163234.pureserver.info - - [10/Jan/2005
bno-net.de - - [10/Jan/2005
gs.server02.gs-wd.de - - [10/Jan/2005
69.9.181.34 - - [10/Jan/2005
67.43.8.218 - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
brown.srv2.com - - [10/Jan/2005
ns1.kazix.com - - [10/Jan/2005
p15163234.pureserver.info - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
217-20-113-119.internetserviceteam.com - - [10/Jan/2005
ns1.kazix.com - - [10/Jan/2005
82.180.33.10 - - [10/Jan/2005
69.9.181.34 - - [10/Jan/2005
flashpoint.pl - - [10/Jan/2005
natasha.dreamdns.net - - [10/Jan/2005
pasadena.coolservecorp.net - - [10/Jan/2005
ev1s-69-57-130-35.ev1servers.net - - [10/Jan/2005
69.9.181.34 - - [10/Jan/2005
u15168473.onlinehome-server.com - - [10/Jan/2005
65.75.143.160 - - [10/Jan/2005
www.somecolors.com - - [10/Jan/2005
205.209.176.120 - - [10/Jan/2005
mymac.ru - - [10/Jan/2005
dt212.netikka.fi - - [10/Jan/2005
fairhaven.paisible.com - - [10/Jan/2005
pasadena.coolservecorp.net - - [10/Jan/2005
pasadena.coolservecorp.net - - [10/Jan/2005
www.somecolors.com - - [10/Jan/2005
217-20-113-119.internetserviceteam.com - - [10/Jan/2005
pasadena.coolservecorp.net - - [10/Jan/2005
sirstes.silicontable.net - - [10/Jan/2005
66.79.176.210 - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
205.209.176.120 - - [10/Jan/2005
205.209.176.120 - - [10/Jan/2005
66.79.176.210 - - [10/Jan/2005
ev1s-207-44-218-118.ev1servers.net - - [10/Jan/2005
69.9.181.34 - - [10/Jan/2005
www.mativ.com - - [10/Jan/2005
69.22.169.138 - - [10/Jan/2005
net2.ultrapresence.net - - [10/Jan/2005
217-20-113-119.internetserviceteam.com - - [10/Jan/2005
217-20-113-119.internetserviceteam.com - - [10/Jan/2005
216.90.186.147 - - [10/Jan/2005
ev1s-69-57-130-35.ev1servers.net - - [10/Jan/2005
69.9.181.34 - - [10/Jan/2005
u15168473.onlinehome-server.com - - [10/Jan/2005
saturn40.vc-server.de - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
65.98.60.138 - - [10/Jan/2005
217-20-113-119.internetserviceteam.com - - [10/Jan/2005
mail.vtelecom.ru - - [10/Jan/2005
net2.ultrapresence.net - - [10/Jan/2005
p4-7018.uk2net.com - - [10/Jan/2005
ib.tcz.pl - - [10/Jan/2005
66.197.163.5 - - [10/Jan/2005
98.67-18-56.reverse.theplanet.com - - [10/Jan/2005
66.197.163.5 - - [10/Jan/2005
cq170.internetdsl.tpnet.pl - - [10/Jan/2005
mail.cs-server30.com - - [10/Jan/2005
a883231.easyvserver.net - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
98.67-18-56.reverse.theplanet.com - - [10/Jan/2005
65.75.179.110 - - [10/Jan/2005
ev1s-69-57-130-35.ev1servers.net - - [10/Jan/2005
sirstes.silicontable.net - - [10/Jan/2005
202.85.156.222 - - [10/Jan/2005
fairhaven.paisible.com - - [10/Jan/2005
205.209.176.120 - - [10/Jan/2005
brown.srv2.com - - [10/Jan/2005
p4-7018.uk2net.com - - [10/Jan/2005
softlink.xs4all.nl - - [10/Jan/2005
ib.tcz.pl - - [10/Jan/2005
www.qeydiyyat.com - - [10/Jan/2005
mail.vtelecom.ru - - [10/Jan/2005
pasadena.coolservecorp.net - - [10/Jan/2005
www.qeydiyyat.com - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
bno-net.de - - [10/Jan/2005
202.85.156.222 - - [10/Jan/2005
ns1.kazix.com - - [10/Jan/2005
www.somecolors.com - - [10/Jan/2005
flashpoint.pl - - [10/Jan/2005
u15168473.onlinehome-server.com - - [10/Jan/2005
205.209.176.120 - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [10/Jan/2005
pasadena.coolservecorp.net - - [10/Jan/2005
mymac.ru - - [10/Jan/2005
christian.dnsdream.com - - [10/Jan/2005
mymac.ru - - [10/Jan/2005
net2.ultrapresence.net - - [10/Jan/2005
ev1s-69-57-130-35.ev1servers.net - - [10/Jan/2005
ns2.kylos.pl - - [10/Jan/2005
209.216.195.2 - - [10/Jan/2005
sirstes.silicontable.net - - [10/Jan/2005
205.209.134.190 - - [10/Jan/2005
net2.ultrapresence.net - - [10/Jan/2005
server.net-impressions.com - - [10/Jan/2005
net2.ultrapresence.net - - [10/Jan/2005
66.79.176.210 - - [10/Jan/2005
sirstes.silicontable.net - - [10/Jan/2005
u15168473.onlinehome-server.com - - [10/Jan/2005
www.somecolors.com - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
host.xnull.com - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
98.67-18-56.reverse.theplanet.com - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
draco.lunarpages.com - - [11/Jan/2005
draco.lunarpages.com - - [11/Jan/2005
ib.tcz.pl - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
ns2.kylos.pl - - [11/Jan/2005
alabama.shnw.net - - [11/Jan/2005
82.180.33.10 - - [11/Jan/2005
alabama.shnw.net - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
www.somecolors.com - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
dt212.netikka.fi - - [11/Jan/2005
66.197.163.5 - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
66.197.163.5 - - [11/Jan/2005
www.somecolors.com - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
flashpoint.pl - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
wat.webarts.com.br - - [11/Jan/2005
202.85.156.222 - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
www.somecolors.com - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
www.qeydiyyat.com - - [11/Jan/2005
server1.myinternetservices.com - - [11/Jan/2005
mail.vtelecom.ru - - [11/Jan/2005
flashpoint.pl - - [11/Jan/2005
christian.dnsdream.com - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
dt212.netikka.fi - - [11/Jan/2005
dns7.serverstoday.com - - [11/Jan/2005
dt212.netikka.fi - - [11/Jan/2005
www.somecolors.com - - [11/Jan/2005
www.somecolors.com - - [11/Jan/2005
ns2.kylos.pl - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
202.85.156.222 - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
ns2.kylos.pl - - [11/Jan/2005
202.85.156.222 - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
cpanel4.webhostfreaks.com - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
flashpoint.pl - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
cpanel4.webhostfreaks.com - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
matrix.webservercity.com - - [11/Jan/2005
65.98.60.138 - - [11/Jan/2005
flashpoint.pl - - [11/Jan/2005
dt212.netikka.fi - - [11/Jan/2005
server1.myinternetservices.com - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
softlink.xs4all.nl - - [11/Jan/2005
202.85.156.222 - - [11/Jan/2005
darkgate.equinoxe.de - - [11/Jan/2005
server1.myinternetservices.com - - [11/Jan/2005
flashpoint.pl - - [11/Jan/2005
flashpoint.pl - - [11/Jan/2005
p15163234.pureserver.info - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
web77.linux-hosting.com - - [11/Jan/2005
flashpoint.pl - - [11/Jan/2005
ib.tcz.pl - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
66.197.163.5 - - [11/Jan/2005
flashpoint.pl - - [11/Jan/2005
alabama.shnw.net - - [11/Jan/2005
www.somecolors.com - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
p15163234.pureserver.info - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
66.197.163.5 - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
brown.srv2.com - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
98.67-18-56.reverse.theplanet.com - - [11/Jan/2005
cpanel4.webhostfreaks.com - - [11/Jan/2005
matrix.webservercity.com - - [11/Jan/2005
dt212.netikka.fi - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
ib.tcz.pl - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
darkgate.equinoxe.de - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
server798.dnslive.net - - [11/Jan/2005
web77.linux-hosting.com - - [11/Jan/2005
cpanel4.webhostfreaks.com - - [11/Jan/2005
giga.global5connect.com - - [11/Jan/2005
p509161a9.dip.t-dialin.net - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
p15163234.pureserver.info - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
giga.global5connect.com - - [11/Jan/2005
server9.webplus24.de - - [11/Jan/2005
server1.myinternetservices.com - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
pasadena.coolservecorp.net - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
63.200.12.227 - - [11/Jan/2005
giga.global5connect.com - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
matrix.webservercity.com - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
dns2.cheap-solutions.com - - [11/Jan/2005
dns2.cheap-solutions.com - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
server1.myinternetservices.com - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
65.75.177.60 - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
server.codhost.com - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
server1.myinternetservices.com - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
wat.webarts.com.br - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
p15163234.pureserver.info - - [11/Jan/2005
server1.myinternetservices.com - - [11/Jan/2005
www.qeydiyyat.com - - [11/Jan/2005
alabama.shnw.net - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
65.98.60.138 - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
65.98.60.138 - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
98.67-18-56.reverse.theplanet.com - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
mail.vtelecom.ru - - [11/Jan/2005
server1.myinternetservices.com - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
christian.dnsdream.com - - [11/Jan/2005
server1.myinternetservices.com - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
98.67-18-56.reverse.theplanet.com - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
98.67-18-56.reverse.theplanet.com - - [11/Jan/2005
christian.dnsdream.com - - [11/Jan/2005
server.codhost.com - - [11/Jan/2005
98.67-18-56.reverse.theplanet.com - - [11/Jan/2005
65.75.177.60 - - [11/Jan/2005
giga.global5connect.com - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
98.67-18-56.reverse.theplanet.com - - [11/Jan/2005
giga.global5connect.com - - [11/Jan/2005
dt212.netikka.fi - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
65.75.177.60 - - [11/Jan/2005
astrasbourg-251-1-57-39.w82-126.abo.wanadoo.fr - - [11/Jan/2005
christian.dnsdream.com - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
bno-net.de - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
216.90.186.147 - - [11/Jan/2005
interknights.com - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
alabama.shnw.net - - [11/Jan/2005
65.98.60.138 - - [11/Jan/2005
ib.tcz.pl - - [11/Jan/2005
65.98.60.138 - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
cpanel4.webhostfreaks.com - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
web77.linux-hosting.com - - [11/Jan/2005
www.somecolors.com - - [11/Jan/2005
christian.dnsdream.com - - [11/Jan/2005
christian.dnsdream.com - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
www.qeydiyyat.com - - [11/Jan/2005
cpanel1.pronethosting.hu - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
cpanel4.webhostfreaks.com - - [11/Jan/2005
alabama.shnw.net - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
web77.linux-hosting.com - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
giga.global5connect.com - - [11/Jan/2005
65.75.177.60 - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
65.75.179.110 - - [11/Jan/2005
dns2.cheap-solutions.com - - [11/Jan/2005
210.245.233.72 - - [11/Jan/2005
web77.linux-hosting.com - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
63.200.12.227 - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
giga.global5connect.com - - [11/Jan/2005
ilkgraf-1-82-227-52-78.fbx.proxad.net - - [11/Jan/2005
ilkgraf-1-82-227-52-78.fbx.proxad.net - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
u15168473.onlinehome-server.com - - [11/Jan/2005
216.90.186.147 - - [11/Jan/2005
bill.bind4you.net - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
ib.tcz.pl - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
65.75.143.160 - - [11/Jan/2005
216.32.76.242 - - [11/Jan/2005
p15163234.pureserver.info - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
sirstes.silicontable.net - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
65.75.177.60 - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
softlink.xs4all.nl - - [11/Jan/2005
wat.webarts.com.br - - [11/Jan/2005
mail.vtelecom.ru - - [11/Jan/2005
giga.global5connect.com - - [11/Jan/2005
wat.webarts.com.br - - [11/Jan/2005
65.75.177.60 - - [11/Jan/2005
cpanel1.pronethosting.hu - - [11/Jan/2005
christian.dnsdream.com - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
giga.global5connect.com - - [11/Jan/2005
64.92.163.202 - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
65.98.60.138 - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
65.98.60.138 - - [11/Jan/2005
ev1s-207-218-248-100.ev1servers.net - - [11/Jan/2005
66.79.176.210 - - [11/Jan/2005
205.209.134.190 - - [11/Jan/2005
cpanel1.pronethosting.hu - - [11/Jan/2005
wat.webarts.com.br - - [11/Jan/2005
n00bz.net - - [02/Jan/2005
 
quelqu'un à une idée ?
 
ps : désolé pour le long message, et accessoirement les dates... (j'ai fait vite fait bien fait un grep | cut sur mon ficheir access
 
Je suis vraiment ennuyé par ces attaques... qui m'ont l'air de faire du mal à mes visiteurs.. (gachi de bande passante et execution de scripts sur leurs machines...)

je dirais ... http://httpd.apache.org/docs/
Je ne connais pas bien Apache, mais je pense qu'il faut utiliser les directives directory et files dans httpd.conf pour filtrer les requètes, et générer un 403 plutot qu'un 404

c'est pas bete ca, je vais creuser, et je vous tiens informé,
 
je pensais a d'autre solution :
 
renvoyer la requette a l'expediteur (sur son serveur web) avec modrewrite (en gros, demander au serveur de mon attaquant de repondre a sa propre requette) mais je doute que ca marche des masses
 
Monter une liste de blacklistage interdisant toute personne qui m'a contacté avec des requettes a la mort moile neoud de recommancer, mais le probleme, c'est   que les 9/10 des gens ont des IP dynamiques...
 
Faire le mort quand une requette comme celle la arrive (en gros, faire comme si le serveur n'existait pas)
 
Qu'en pensez vous ?
 
 
est-ce que le fait de generer un 403 ferra arreter l'expediteur de ces attaques qui representent quand meme plus de 80% du trafic (hit+reponse) actuel de mon serveur  
 
depuis 2 jours, ca ne fait qu'empirer...
 
 

Générer un 403 n'empêchera pas ce genre d'attaques. Ca permet seulement de différencier la réponse par rapport à un vrai 404. Par contre je ne suis pas vraiment sur que ça génère un 403. J'utilise IIS avec urlscan, un soft de filtrage d'url et je viens de vérifier, dans ce type de cas il génère un 404 ...
Une autre solution, ou plutot en complément, il faut modifier la sécurité des répertoires sensibles pour interdire un accès anonyme.
Mais en fait tu ne risques pas grand chose, puisque ces attaques sont spécifiques à Windows et que ces répertoires n'existent pas sour Linux

j'ai suivi ton conseil, mais à ma manière...
 
j'ai remarqué que les attaques étaient fréquentes :
 
/webalizer/usage_200402.html&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd%20/tmp
/webalizer/usage_200402.html&rush=echo%20_START_%3B%20cd%20/tmp
etc...
 
dans ces répertoires qui n'éxistent plus depuis au moins 3 mois...
 
j'ai recréé le repertoire... et mis un .htaccess dedans  

 
depuis plus rien.. => erreur 403
 
ça les a calmés.. ouf...
 
Merci à vous.