Server Gurus - Is someone snooping around my server? Logs

[Shaze]

What do you make of this? Someone trying to access my admin area scripts?

My log files show this:


[Sun Oct 21 01:42:45 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/cgi-bin/at
[Sun Oct 21 01:42:45 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/cgi-bin/atl
[Sun Oct 21 01:42:45 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/stt-webmaster.php
[Sun Oct 21 01:42:45 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/sloth_webmaster.php
[Sun Oct 21 01:42:45 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/cgi-bin/swiftclicks
[Sun Oct 21 01:42:45 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/cgi-bin/sclite
[Sun Oct 21 01:42:45 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/cgi-bin/tm3
[Sun Oct 21 01:42:45 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/cgi-bin/rb4
[Sun Oct 21 01:42:45 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/cgi-bin/te
[Sun Oct 21 01:42:45 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/cgi-bin/ucj
[Sun Oct 21 01:42:44 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/cgi-bin/at3
[Sun Oct 21 01:42:44 2007] [error] [client 64.20.33.150] script not found or unable to stat: /home/domain/public_html/cgi-bin/atx


I checked the IP of the client and it's in New Jersey.

[fris]

probably ya, fishing for an exploitable version, block their ip out

[Shaze]

Originally Posted by Fris

probably ya, fishing for an exploitable version, block their ip out

thanks. that's what i thought.

won't really do much if they have a dynamic IP. I'll just keep track and if they do get in and do some hacking i'll try to contact the service provider to see who had the lease on the ip at the current time.