These scumbags are so predictable. After the LKML mailing went
planetwide, this idiot and his buddies came right back in from another
duckblind and accessed the site -- sorry guys, I punched right through
your duckblind. Here is this dirtbags actual IP address. I've seen
this address to -- another Merkey mission poster.
2013-03-27 04:53:07 GET / 5.14.29.243
5-14-29-243.residential.rdsnet.ro
2013-03-27 04:53:43 GET
/?page=maillist 5.14.29.243 5-14-29-243.residential.rdsnet.ro
2013-03-27 04:53:53 GET / 5.14.29.243
5-14-29-243.residential.rdsnet.ro
Wonder who on LKML uses this address. Dude, you are nailed.
Jeff
On 3/27/13, Jeffrey Merkey <jeffmer...@gmail.com> wrote:
> After posting the latest MDB version, this linux developer (which I
> monitor from San Diego periodically) attempted a break in of godaddy's
> servers with an XSS embedded script attack. This notice is posted to
> warn others of this address. I am certain Linus and Co. can check
> kernel.org and track down this address if they are a user of LKML.
> The following is provided from server logs at godaddy.
>
> 2013-03-26 16:36:16 GET
> /?page=maillist&name=press 108.64.212.227
> 108-64-212-227.lightspeed.sndgca.sbcglobal.net
> 2013-03-26 16:36:21 GET
> /?page=account&action=messages 108.64.212.227
> 108-64-212-227.lightspeed.sndgca.sbcglobal.net
> 2013-03-26 16:36:29 GET
> /?page=maillist&name=discussion 108.64.212.227
> 108-64-212-227.lightspeed.sndgca.sbcglobal.net
> 2013-03-26 16:36:48 GET
> /?page=maillist&name=%3Cscript%3Ealert('woot');%3C/script%3E 108.64.212.227
> 108-64-212-227.lightspeed.sndgca.sbcglobal.net
> 2013-03-26 16:37:01 GET /?page=admin 108.64.212.227
>
> geolocation shows the address is a duckblind from. He is a linux user
> on Ubuntu. See:
> User-Agent : Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2)
> Gecko/2008092313 Ubuntu/9.25 (jaunty) ...
>
> http://geo-location.com/host-76-219-253-168.lightspeed.sndgca.sbcglobal.net/
>
> Here is a description of this type of attack.
>
> http://www.acunetix.com/websitesecurity/cross-site-scripting/
>
> This IP address has been reported to godaddy IAW their site policies
> on breakin attempts to their hosted servers. So I know you are
> trolling this list hacker (LKML) and I want to let you know your IP
> address in San Diego won't be around much longer. Have a nice day.
>
> Jeff Merkey
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
