weird URL's in syslog

Mar 25, 2006 3 Replies

Rate this thread:

Mike 20 years ago

I have been monitoring a small LAn which was blacklisted for sending out SPAM. I can see one host in there which is from time to time going to a host using very strange URL's omn port 80. They look like....

304001: 192.168.1.10 Accessed URL
194.18.118.2:/1/?A4q6ADclfzEXNg%2F8klPB05SCdAAzDo%2BjJ7Jihuk6zhQZU29waG9zIFNtYWxsIEJ1c2luZXNzIFNvbHV0aW9ucwAxLCAwLCAyLCAwAFNvcGhvcyBwbGMARW5nbGlzaCAoVW5pdGVkIEtpbmdkb20pAEM6XFdJTkRPV1NcVGVtcFxzb3RtcDEuZGlyXEFMVXBkYXRlLmV4ZQAzMS8wMS8yMDA2IDEzOjQ0OjQy Anyone know what this is?

Sorry, is anyone prepared to tell me :-)

Vote

Sebastian Gottschalk 20 years ago

unbase64(unescape($blah)) =3D =8A=BA7%=7F1=176=0F=FC=92S=C1=D3=94=82t3=A3'=B2b=86=E9:=CE=14=19Sophos Sm= all Business Solutions1, 0, 2,

0Sophos plcEnglish (United Kingdom)C:\\WINDOWS\\Temp\\sotmp1.dir\\ALUpdate.exe31/01/2006 13:44:42

Vote

DigitalVinyl 20 years ago

CHeck the IP address at

formatting link

at it points to RIPE (the european database for IPs)

formatting link

Which gives...

inetnum: 194.16.0.0 - 194.18.255.255 org: ORG-TA45-RIPE netname: SE-TELIANET-930901 descr: TeliaSonera AB country: SE org-name: TeliaSonera AB org-type: LIR address: Visitors: Marbackagatan 11, Hus L address: 123 86 address: Farsta-Stockholm address: Sweden phone: +46 8 50453230 fax-no: +46 8 6047006

So it is contacting a computer in Sweden.

And that IP doesn't respond.

My first suspicion is you've got spyware/adware/virus/trojan on that host. You could have a piece of software that is looking for an update, but the url wouldn't bbe so cryptic, no would any decent company use an IP address in their URL (unless they were technically clueless).

Vote

DigitalVinyl 20 years ago

Google is your friend.

formatting link

Vote

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required