Comments on: Script Kid made me late to class. http://ritchan.dasaku.net/computers/script-kid-made-me-late-to-class MAGI does not bother responding to pings. Thu, 18 Mar 2010 01:43:18 +0100 http://wordpress.org/?v=2.9 hourly 1 By: ritchan http://ritchan.dasaku.net/computers/script-kid-made-me-late-to-class/comment-page-1#comment-188 ritchan Fri, 14 Mar 2008 21:40:53 +0000 http://ritchan.dasaku.net/2008/02/28/script-kid-made-me-late-to-class/#comment-188 I have no clue what that means, other than that he's probably not a bot and you might be able to force your way in through SSH. I remember going 'http://that ip address' and I got a blank page. I have no clue what that means, other than that he’s probably not a bot and you might be able to force your way in through SSH. I remember going ‘http://that ip address’ and I got a blank page.

]]> By: ozman http://ritchan.dasaku.net/computers/script-kid-made-me-late-to-class/comment-page-1#comment-186 ozman Fri, 14 Mar 2008 16:17:44 +0000 http://ritchan.dasaku.net/2008/02/28/script-kid-made-me-late-to-class/#comment-186 Saw this on me too, so I scanned him... Completed RPCGrind Scan against 211.72.249.252 at 10:14, 0.37s elapsed (1 port) SCRIPT ENGINE: Initiating script scanning. Initiating SCRIPT ENGINE at 10:14 SCRIPT ENGINE DEBUG: showHTMLTitle.nse: Title got truncated! Completed SCRIPT ENGINE at 10:15, 3.03s elapsed Host 211.72.249.252 appears to be up ... good. Interesting ports on 211.72.249.252: Not shown: 1705 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99) |_ SSH Protocol Version 1: Server supports SSHv1 25/tcp filtered smtp 80/tcp open http Apache httpd 2.0.52 ((Red Hat)) |_ HTML title: Test Page for the Apache HTTP Server on Red Hat Enterprise Lin... 111/tcp open rpcbind 2 (rpc #100000) | rpcinfo: | 100000 2 111/udp rpcbind | 100024 1 32768/udp status | 100000 2 111/tcp rpcbind |_ 100024 1 32769/tcp status 443/tcp open ssl OpenSSL | SSLv2: server still supports SSLv2 | SSL2_DES_192_EDE3_CBC_WITH_MD5 | SSL2_RC2_CBC_128_CBC_WITH_MD5 | SSL2_RC4_128_WITH_MD5 | SSL2_RC4_64_WITH_MD5 | SSL2_DES_64_CBC_WITH_MD5 | SSL2_RC2_CBC_128_CBC_WITH_MD5 |_ SSL2_RC4_128_EXPORT40_WITH_MD5 554/tcp filtered rtsp 1720/tcp filtered H.323/Q.931 2000/tcp filtered callbook 5060/tcp filtered sip No OS matches for host Uptime: 1.398 days (since Thu Mar 13 00:42:35 2008) TCP Sequence Prediction: Difficulty=254 (Good luck!) IP ID Sequence Generation: All zeros Saw this on me too, so I scanned him…

Completed RPCGrind Scan against 211.72.249.252 at 10:14, 0.37s elapsed (1 port)
SCRIPT ENGINE: Initiating script scanning.
Initiating SCRIPT ENGINE at 10:14
SCRIPT ENGINE DEBUG: showHTMLTitle.nse: Title got truncated!
Completed SCRIPT ENGINE at 10:15, 3.03s elapsed
Host 211.72.249.252 appears to be up … good.
Interesting ports on 211.72.249.252:
Not shown: 1705 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)
|_ SSH Protocol Version 1: Server supports SSHv1
25/tcp filtered smtp
80/tcp open http Apache httpd 2.0.52 ((Red Hat))
|_ HTML title: Test Page for the Apache HTTP Server on Red Hat Enterprise Lin…
111/tcp open rpcbind 2 (rpc #100000)
| rpcinfo:

| 100000 2 111/udp rpcbind

| 100024 1 32768/udp status

| 100000 2 111/tcp rpcbind

|_ 100024 1 32769/tcp status
443/tcp open ssl OpenSSL
| SSLv2: server still supports SSLv2

| SSL2_DES_192_EDE3_CBC_WITH_MD5

| SSL2_RC2_CBC_128_CBC_WITH_MD5

| SSL2_RC4_128_WITH_MD5

| SSL2_RC4_64_WITH_MD5

| SSL2_DES_64_CBC_WITH_MD5

| SSL2_RC2_CBC_128_CBC_WITH_MD5

|_ SSL2_RC4_128_EXPORT40_WITH_MD5
554/tcp filtered rtsp
1720/tcp filtered H.323/Q.931
2000/tcp filtered callbook
5060/tcp filtered sip
No OS matches for host
Uptime: 1.398 days (since Thu Mar 13 00:42:35 2008)
TCP Sequence Prediction: Difficulty=254 (Good luck!)
IP ID Sequence Generation: All zeros

]]> By: seb http://ritchan.dasaku.net/computers/script-kid-made-me-late-to-class/comment-page-1#comment-182 seb Tue, 11 Mar 2008 17:42:22 +0000 http://ritchan.dasaku.net/2008/02/28/script-kid-made-me-late-to-class/#comment-182 wow. not thinking that googling the IP would actually turn anything up, I find this page. that same ip (211.72.249.252) was also attacking an FTP server for one of my customers. they tried tons of usernames over the course of a few hours. i would agree with the first comment. anyone finding this page after being attacked by that IP should block it entirely. wow. not thinking that googling the IP would actually turn anything up, I find this page. that same ip (211.72.249.252) was also attacking an FTP server for one of my customers. they tried tons of usernames over the course of a few hours. i would agree with the first comment. anyone finding this page after being attacked by that IP should block it entirely.

]]> By: ritchan http://ritchan.dasaku.net/computers/script-kid-made-me-late-to-class/comment-page-1#comment-176 ritchan Sat, 08 Mar 2008 21:21:42 +0000 http://ritchan.dasaku.net/2008/02/28/script-kid-made-me-late-to-class/#comment-176 Ah, thanks for the tip man! Ah, thanks for the tip man!

]]> By: kwstas http://ritchan.dasaku.net/computers/script-kid-made-me-late-to-class/comment-page-1#comment-174 kwstas Fri, 07 Mar 2008 00:44:37 +0000 http://ritchan.dasaku.net/2008/02/28/script-kid-made-me-late-to-class/#comment-174 actually, it is not a kid. This host (211.72.249.252) is also attacking my FTP server for 3 hours now, I googled it and found your site! It's probably a hacked, zombie box, used to scan large networks. Block his ass :-) actually, it is not a kid. This host (211.72.249.252) is also attacking my FTP server for 3 hours now, I googled it and found your site! It’s probably a hacked, zombie box, used to scan large networks. Block his ass :-)

]]>