RE: error logs -- WEB400

Oops - I got this after I answered the last one...

FYI ping -a 199.227.45.130 returned the following;
C:\>ping -a 199.227.45.130

Pinging mail.rooftile.com [199.227.45.130] with 32 bytes

Reply from 199.227.45.130: bytes=32 time=160ms TTL=112
Reply from 199.227.45.130: bytes=32 time=130ms TTL=112
Reply from 199.227.45.130: bytes=32 time=130ms TTL=112
Reply from 199.227.45.130: bytes=32 time=131ms TTL=112

Ping statistics for 199.227.45.130:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 130ms, Maximum =  160ms, Average =  137ms

That's how I did it...

Andrew Borts / Webmaster
Seta Corporation
6400 East Rogers Circle
Boca Raton, FL 33499

E-mail: Andrewb@setacorporation.com
Corporate web site http://www.setacorporation.com
E-Commerce web site http://www.palmbeachjewelry.com
                              http://www.myfreeitems.com
Voice: 561-994-2660 Ext. 2211 / Fax: 561-997-0774

-----Original Message-----
From: Jim Franz [mailto:franz400@triad.rr.com]
Sent: Tuesday, December 04, 2001 6:48 AM
To: web400@midrange.com
Subject: Re: [WEB400] error logs

thanks - one of our customers...
jim
----- Original Message -----
From: "Peter Dow" <pcdow@yahoo.com>
To: <web400@midrange.com>
Sent: Monday, December 03, 2001 11:37 PM
Subject: Re: [WEB400] error logs


> Hi Jim,
>
> I just used www.network-tools.com to do a reverse DNS lookup and found
that
> 199.227.45.130 is mail.rooftile.com.  Possibly their mail server was
> infected by something?
>
> Peter Dow
> Dow Software Services, Inc.
> 909 425-0194 voice
> 909 425-0196 fax
>
>
> ----- Original Message -----
> From: "Jim Franz" <franz400@triad.rr.com>
> To: <web400@midrange.com>
> Sent: Monday, December 03, 2001 7:50 PM
> Subject: Re: [WEB400] error logs
>
>
> > Don't have any Front Page in our web pages. All is pure html 4 from
> rpg/cgi.
> > I suspect someone is regularly probing.
> > jim franz
> >
> > ----- Original Message -----
> > From: "Rich Duzenbury" <rduz@westernmidrange.com>
> > To: <web400@midrange.com>
> > Sent: Monday, December 03, 2001 10:46 PM
> > Subject: Re: [WEB400] error logs
> >
> >
> > > The _vti* directories are annoying FrontPage parlance.  Could be
that
> the
> > > file exists, and someone is trying to exec it, which should not
work
> (e.g.
> > > running win32 console code on AS/400).  Was the initial web
created by
> > > FrontPage?
> > >
> > > FP seems to create these _vti* directories underneath every
directory
in
> > > your web.  It was one of the (many) reasons we switched to
> > > DreamWeaver.  Another reason was that we couldn't get the FP
extensions
> > > installed and working on a Non-Windows box, although it was
supposed
to
> be
> > > supported.
> > >
> > > The problem is that even if you delete those directories (one by
one),
> if
> > > the web is re-published, they will all reappear again.
> > >
> > > Or,  someone found a FP hack that they keep trying, similar to the
code
> > red
> > > and Nimda hits you are familiar with.
> > >
> > > Regards,
> > > Rich
> > >
> > > At 09:23 PM 12/3/01, you wrote:
> > > >This is a multi-part message in MIME format.
> > > >--
> > > >[ Picked text/plain from multipart/alternative ]
> > > >In addition to the normal Red Worm or Nimda junk, I see this
> > > >from only this one address. What bothers me is the "input timer
> expired"
> > > >msg, like it actually tried to execute something.
> > > >The wwwaccess log has nothing for this address (thanks!).
> > > >This one address is banging on my system regularly since July. Is
it
a
> > web
> > > >crawler?
> > > >
> > > >[28/Nov/2001:10:01:23 +0000]FORBIDDEN BY
> > > >RULE   199.227.45.130              /bnc
> > > >[28/Nov/2001:10:01:24 +0000]FORBIDDEN BY
> > > >RULE   199.227.45.130              /_vti_inf.html
> > > >[28/Nov/2001:10:01:25 +0000]FORBIDDEN BY
> > > >RULE   199.227.45.130              /_vti_bin/shtml.exe/_vti_rpc
> > > >[28/Nov/2001:10:05:55 +0000]Input timer expired 199.227.45.130
> > >
> > > _______________________________________________
> > > This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> > > To post a message email: WEB400@midrange.com
> > > To subscribe, unsubscribe, or change list options,
> > > visit: http://lists.midrange.com/cgi-bin/listinfo/web400
> > > or email: WEB400-request@midrange.com
> > > Before posting, please take a moment to review the archives
> > > at http://archive.midrange.com/web400.
> > >
> > >
> >
> >
> > _______________________________________________
> > This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> > To post a message email: WEB400@midrange.com
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/cgi-bin/listinfo/web400
> > or email: WEB400-request@midrange.com
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/web400.
>
>
> _________________________________________________________
> Do You Yahoo!?
> Get your free @yahoo.com address at http://mail.yahoo.com
>
> _______________________________________________
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/web400
> or email: WEB400-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.
>
>


_______________________________________________
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/web400
or email: WEB400-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.