[thelist] Possible exploit

Kae Verens kverens at contactjuggling.org
Fri Nov 21 16:11:19 CST 2003


Keith Underdown wrote:
> http://www.worldnewslog.com   
> http://www.saulem.com   
> http://www.wr18.com   
> http://www.teoras.com   
> http://172.16.1.3:15871/cgi-bin/afterWorkOptions.cgi   
> http://www.malixya.com   
> http://www.jennifersblog.com   
> http://www.mikesspot.com   
> http://www.a-b-l-o-g.com
> 
> no-longer work properly for me. They mostly give me the Apache test 
> page. I could get to some of them yesterday and could see that their 
> links list contained a number of :2082 references, which is what alerted 
> me to a possible concerted action against CPANEL controlled sites. I've 
> even tried on a dial up conection to ensure that I've got a different ip 
> address and entered the URL's manually.
> 
> It's all very peculiar.

I've been wondering about that. I have a script that alerts me to every 
new referer to my sites, and those sites have been popping up a lot. 
Every time I look, though, I see no mention of the sites they're 
supposedly linking to.

Kae



More information about the thelist mailing list