After posting the latest MDB version, this linux developer (which I
monitor from San Diego periodically) attempted a break in of godaddy's
servers with an XSS embedded script attack. This notice is posted to
warn others of this address. I am certain Linus and Co. can check
kernel.org and track down this address if they are a user of LKML.
The following is provided from server logs at godaddy.
2013-03-26 16:36:16 GET
/?page=maillist&name=press 108.64.212.227 108-64-212-227.lightspeed.sndgca.sbcglobal.net
2013-03-26 16:36:21 GET
/?page=account&action=messages 108.64.212.227 108-64-212-227.lightspeed.sndgca.sbcglobal.net
2013-03-26 16:36:29 GET
/?page=maillist&name=discussion 108.64.212.227 108-64-212-227.lightspeed.sndgca.sbcglobal.net
2013-03-26 16:36:48 GET
/?page=maillist&name=%3Cscript%3Ealert('woot');%3C/script%3E 108.64.212.227 108-64-212-227.lightspeed.sndgca.sbcglobal.net
2013-03-26 16:37:01 GET /?page=admin 108.64.212.227
geolocation shows the address is a duckblind from. He is a linux user
on Ubuntu. See:
User-Agent : Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2)
Gecko/2008092313 Ubuntu/9.25 (jaunty) ...
http://geo-location.com/host-76-219-253-168.lightspeed.sndgca.sbcglobal.net/
Here is a description of this type of attack.
http://www.acunetix.com/websitesecurity/cross-site-scripting/
This IP address has been reported to godaddy IAW their site policies
on breakin attempts to their hosted servers. So I know you are
trolling this list hacker (LKML) and I want to let you know your IP
address in San Diego won't be around much longer. Have a nice day.
Jeff Merkey
These scumbags are so predictable. After the LKML mailing went
planetwide, this idiot and his buddies came right back in from another
duckblind and accessed the site -- sorry guys, I punched right through
your duckblind. Here is this dirtbags actual IP address. I've seen
this address to -- another Merkey mission poster.
2013-03-27 04:53:07 GET / 5.14.29.243 5-14-29-243.residential.rdsnet.ro
2013-03-27 04:53:43 GET
/?page=maillist 5.14.29.243 5-14-29-243.residential.rdsnet.ro
2013-03-27 04:53:53 GET / 5.14.29.243 5-14-29-243.residential.rdsnet.ro
Wonder who on LKML uses this address. Dude, you are nailed.
Jeff
On 3/27/13, Jeffrey Merkey <[email protected]> wrote:
> After posting the latest MDB version, this linux developer (which I
> monitor from San Diego periodically) attempted a break in of godaddy's
> servers with an XSS embedded script attack. This notice is posted to
> warn others of this address. I am certain Linus and Co. can check
> kernel.org and track down this address if they are a user of LKML.
> The following is provided from server logs at godaddy.
>
> 2013-03-26 16:36:16 GET
> /?page=maillist&name=press 108.64.212.227 108-64-212-227.lightspeed.sndgca.sbcglobal.net
> 2013-03-26 16:36:21 GET
> /?page=account&action=messages 108.64.212.227 108-64-212-227.lightspeed.sndgca.sbcglobal.net
> 2013-03-26 16:36:29 GET
> /?page=maillist&name=discussion 108.64.212.227 108-64-212-227.lightspeed.sndgca.sbcglobal.net
> 2013-03-26 16:36:48 GET
> /?page=maillist&name=%3Cscript%3Ealert('woot');%3C/script%3E 108.64.212.227 108-64-212-227.lightspeed.sndgca.sbcglobal.net
> 2013-03-26 16:37:01 GET /?page=admin 108.64.212.227
>
> geolocation shows the address is a duckblind from. He is a linux user
> on Ubuntu. See:
> User-Agent : Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2)
> Gecko/2008092313 Ubuntu/9.25 (jaunty) ...
>
> http://geo-location.com/host-76-219-253-168.lightspeed.sndgca.sbcglobal.net/
>
> Here is a description of this type of attack.
>
> http://www.acunetix.com/websitesecurity/cross-site-scripting/
>
> This IP address has been reported to godaddy IAW their site policies
> on breakin attempts to their hosted servers. So I know you are
> trolling this list hacker (LKML) and I want to let you know your IP
> address in San Diego won't be around much longer. Have a nice day.
>
> Jeff Merkey
>