Webserver Incident Reporting and Termination(TM) Squad
NOTE: Web servers have logs and in those logs is evidence of attempted hacking. For instance, one may notice an attack that calls such a script from a remote server "r57.php??". Its these kinds of attacks we're looking to investigate. For a concrete example, see these reports.
Please do not submit phish, spam, or malware to WsIRT. Only submit attack signatures from web server logs. As this project hasn't officially been publicly launched, we are still reclassifying the tool and its verbiage.
Paul: Extended information for AS7514:
State/Province:
Country: jp
Responsible Domain: mex.ad.jp
Abuse Email: security@mex.ad.jp
Handler Note: 22 Dec, 2007 18:18:07
Paul: This domain has been compromised, it is running a known hijacking shell called c99. Please investigate your system as
this shell permits criminals to conduct spam, phish, malware and other nefarious campaigns.
Handler Note: 22 Dec, 2007 18:18:48
Paul: Generated and sent email attack alert to respective parties.
We have attempted to notify the owner of this domain as well as the ISP without success in having the shell or any
related malware removed. Please contact them. This server very urgently needs to be secured.
