Hack attempt from within?

[jols]

I am seeing a bazillion of these log entires in - /usr/local/apache/logs/access_log

Any idea what may be going on here?


127.0.0.1 - - [03/Apr/2006:21:57:19 -0500] "GET http://www.ripper.com.ru:80//rippers/ HTTP/1.1" 404 -
127.0.0.1 - - [03/Apr/2006:21:57:19 -0500] "GET http://www.ripper.com.ru:80//rippers/ HTTP/1.1" 404 -
127.0.0.1 - - [03/Apr/2006:21:57:19 -0500] "GET http://www.ripper.com.ru:80//rippers/ HTTP/1.1" 404 -
127.0.0.1 - - [03/Apr/2006:21:57:19 -0500] "GET http://www.ripper.com.ru:80//rippers/ HTTP/1.1" 404 -
127.0.0.1 - - [03/Apr/2006:21:57:19 -0500] "GET http://www.ripper.com.ru:80//rippers/ HTTP/1.1" 404 -
127.0.0.1 - - [03/Apr/2006:21:57:19 -0500] "GET http://www.ripper.com.ru:80//rippers/ HTTP/1.1" 404 -
127.0.0.1 - - [03/Apr/2006:21:57:19 -0500] "GET http://www.ripper.com.ru:80//rippers/ HTTP/1.1" 404 -
127.0.0.1 - - [03/Apr/2006:21:57:19 -0500] "GET http://www.ripper.com.ru:80//rippers/ HTTP/1.1" 404 -

[AndyReed]

I am seeing a bazillion of these log entires in - /usr/local/apache/logs/access_log

Any idea what may be going on here?


127.0.0.1 - - [03/Apr/2006:21:57:19 -0500] "GET http://www.ripper.com.ru:80//rippers/ HTTP/1.1" 404 -

Secure your server before it is too late. Did you check other log files, and directories such as /tmp, for other possible vulnerabilities?

[jols]

Thanks, checking now.

Now we are seeing a ton of these in the apache access log

127.0.0.1 - - [03/Apr/2006:22:59:00 -0500] "GET http://xakepy.ru:80// HTTP/1.1" 200 137
127.0.0.1 - - [03/Apr/2006:22:59:00 -0500] "GET http://xakepy.ru:80// HTTP/1.1" 200 137
127.0.0.1 - - [03/Apr/2006:22:59:00 -0500] "GET http://xakepy.ru:80// HTTP/1.1" 200 137
127.0.0.1 - - [03/Apr/2006:22:59:00 -0500] "GET http://xakepy.ru:80// HTTP/1.1" 200 137

Any other advice?

[jols]

After running rkhunter, I am seeing this:

Port 2001: Scalper Rootkit [ Warning! (possible trojan port) ]

False alarm perhaps?

[jols]

Okay, yup. Looks like the Scalper note is a false alarm produced by PortSentry.