2003-08-28 11:21:14 +02:00
|
|
|
Scan Apache log files for CodeRed, Nimda, FormMail, proxy scanners and
|
|
|
|
|
other malicious probes. For each one found, track down the contact email
|
|
|
|
|
from WHOIS data and send a notice. Built-in rate controls prevent flooding
|
|
|
|
|
an admin even when his machines are scanning at high rates. Runs as a
|
|
|
|
|
non-privileged cron job to not interfere with the HTTP daemon's operation.
|
|
|
|
|
|
2005-11-25 07:02:46 +01:00
|
|
|
WWW: http://www.cs.cmu.edu/~dpelleg/hunch.html
|
2003-10-14 14:31:30 +02:00
|
|
|
|
2003-08-28 11:21:14 +02:00
|
|
|
-- Dan Pelleg
|
|
|
|
|
|
|
|
|
|
daniel+hunch@pelleg.org
|
