3

I have written a server in C# for windows and it works fine. A week back I setup a dynamic domain name with No-Ip.com and now my server serves pages at the address nabeel.ddns.net. I was viewing my server log and i found two strange requests:

16:41:52 21-04-2015 94.66.163.214 :::: x�|�aAL� �Wͼ����������\�&K��2��Q@�

and:

11:36:21 21-04-2015 146.185.239.100, File: h t t p://24x7-allrequestsallowed.com/

(I changed the log format in between from [time] [date] [ip address] [request path] to [time] [date] [ip address] [whole request])

A whois lookup on both IP Addresses revealed that both were in the net range assigned to RIPE Network Coordination Centre (RIPE). What should i do about this, does this qualify as a DOS attack? Should I email RIPE about this?

Please Help

2
  • @JennyD My logs had binary data....
    – nom
    Apr 21, 2015 at 12:22
  • 1
    The answer is still the same.
    – Jenny D
    Apr 21, 2015 at 12:23

2 Answers 2

8

If you have just two of such lines in your log then it hardly qualifies as a DOS attack, it would have to be much more massive than this. Reporting this will cause a few chuckles but nothing more.

Note that 94.66.163.214 is assigned to a greek ISP, and 146.185.239.100 is assigned to an ISP in United Arab Emirates. RIPE distributes address space through Europe and the Middle East.

Get used to all sorts of garbage being pushed through your port 80. Just make sure that all known exploits are fixed, e.g. the last one was apparently an attempt to check whether your system would work as an open proxy. As you've written your own server, make sure it's capable of handling any data thrown at it.

3
  • My server can only serve web pages, it can't serve as a proxy. Is there any thing to worry about? And can you give me some list for the known exploits?
    – nom
    Apr 21, 2015 at 12:21
  • I'm sure that googling for "web server exploits" or similar will give plenty of reading material. Just make sure that your server can't be tricked into doign things you don't want; e.g. do you filter out ../ sequences which could be used to access files outside your document root? Or http://yourhost/c:/whatever ?
    – wurtel
    Apr 21, 2015 at 12:28
  • Yes I tried to go to nabeel.ddns.net/C:/ but its a 404... Anyway thanks for the help!
    – nom
    Apr 21, 2015 at 12:31
8

For the equation:

If you build it, they will come.

Where it = an internet facing service, they = so-called "hackers", come = attempt to "hack" your service.

This is simply a fact of life living on the internet. "Hackers" will look for easy targets and attempt to exploit them. There are billions of devices on the internet, so "hackers" need to find a way to narrow down their targets. You're easy because you have a dynamic DNS service, it's easy to get a list of all of the domains hosted by such a service, and the people who use dynamic DNS are usually trying to expose an interesting service.

Complaining to RIPE is likely to not get you anywhere. Even if you were under a massive Denial of Service attack, a regional numbering authority isn't going to do much for you.

Not the answer you're looking for? Browse other questions tagged .