CGIスキャンの危険性と実体 3

　先日に引き続き(1, 2)、再々度最悪のCGIスキャンがSkyArtsサイトに対して行われました。その実体を公表するべくここにWebサーバのログをあえてそのまま掲載します。

　先日乗っ取られていることを報告した某大手インターネット証券会社からは何の回答も来ていません。余程恥ずかしいのかも知れません。

　今回は個人のPCが乗っ取られているケースが多いのではないかと思われます。「smtp.mvgarchitects.com」とあるところを見るとSMTPサーバとして稼動しているサーバが乗っ取られているみたいですね。

207.14.106.1 - - [16/Jul/2004:03:09:41 +0000] "POST /cgi-bin/formmail.pl HTTP/1.0" 404 285 "http://www.skyarts.com/" "-"
195.172.38.234 - - [16/Jul/2004:03:09:46 +0000] "POST /cgi-bin/contact.cgi HTTP/1.0" 404 285 "http://www.skyarts.com/" "-"
no-reverse.bsve.net - - [16/Jul/2004:03:10:00 +0000] "POST /cgi-bin/mailform.pl HTTP/1.0" 404 285 "http://www.skyarts.com/" "-"
80.55.140.142 - - [16/Jul/2004:03:10:10 +0000] "POST /cgi-bin/FormMail.pl HTTP/1.0" 404 285 "http://www.skyarts.com/" "-"
smtp.mvgarchitects.com - - [16/Jul/2004:03:10:18 +0000] "POST /cgi-bin/fmail.pl HTTP/1.0" 404 282 "http://www.skyarts.com/" "-"
200-204-201-220.speedyterra.com.br - - [16/Jul/2004:03:10:22 +0000] "POST /cgi-bin/form.cgi HTTP/1.1" 404 294 "http://www.skyarts.com/" "-"
168.143.113.138 - - [16/Jul/2004:03:10:34 +0000] "POST /cgi-bin/contact.pl HTTP/1.1" 404 296 "-" "-"
66.35.206.150 - - [16/Jul/2004:03:10:41 +0000] "POST /cgi/formmail HTTP/1.1" 404 290 "http://www.skyarts.com/" "-"
216.190.27.90.dsl.infowest.net - - [16/Jul/2004:03:10:44 +0000] "POST /cgi-bin/mail.cgi HTTP/1.1" 404 294 "http://www.skyarts.com/" "-"
ip103-231.introweb.nl - - [16/Jul/2004:03:10:47 +0000] "POST /formmail.pl HTTP/1.0" 404 277 "http://www.skyarts.com/" "-"
206.204.190.4 - - [16/Jul/2004:03:10:50 +0000] "POST /cgi-bin/feedback.cgi HTTP/1.1" 404 298 "http://www.skyarts.com/" "-"
195.172.38.234 - - [16/Jul/2004:03:10:53 +0000] "POST /contact.cgi HTTP/1.0" 404 277 "http://www.skyarts.com/" "-"
216.157.225.36 - - [16/Jul/2004:03:10:56 +0000] "POST /form-bin/deliver HTTP/1.0" 404 282 "http://www.skyarts.com/" "-"
213-92-107-35.f5.ngi.it - - [16/Jul/2004:03:11:00 +0000] "POST /cgi-bin/cgiemail/contact.txt HTTP/1.1" 404 306 "http://www.skyarts.com/" "-"
211.250.81.252 - - [16/Jul/2004:03:11:06 +0000] "POST /cgi-bin/mailform.cgi HTTP/1.0" 404 286 "http://www.skyarts.com/" "-"
195.101.226.76 - - [16/Jul/2004:03:11:13 +0000] "POST /cgi-bin/form.pl HTTP/1.1" 404 293 "http://www.skyarts.com/" "-" host-200-4-225-233.cablenet - - [16/Jul/2004:03:11:18 +0000] "POST /cgi-bin/feedback.pl HTTP/1.0" 404 285 "http://www.skyarts.com/" "-"
164.109.154.28 - - [16/Jul/2004:03:11:21 +0000] "POST /cgi-bin/mail.pl HTTP/1.0" 404 281 "http://www.skyarts.com/" "-"
217.6.171.36 - - [16/Jul/2004:03:11:24 +0000] "POST /cgi-bin/sender.pl HTTP/1.1" 404 295 "http://www.skyarts.com/" "-"
207.68.98.5 - - [16/Jul/2004:03:11:27 +0000] "POST /cgi-bin/mailer/mailer.cgi HTTP/1.0" 404 291 "http://www.skyarts.com/" "-"

164.109.154.28 - - [17/Jul/2004:17:53:15 +0000] "POST /cgi-bin/formmail.pl HTTP/1.0" 404 285 "http://www.skyarts.com/" "-"
202-235-234-66.cosmoweb.net - - [17/Jul/2004:17:53:18 +0000] "POST /cgi-bin/contact.cgi HTTP/1.0" 404 285 "http://www.skyarts.com/" "-"
213.156.63.50 - - [17/Jul/2004:17:53:21 +0000] "POST /cgi-bin/mailform.pl HTTP/1.0" 404 285 "http://www.skyarts.com/" "-"
168.143.113.138 - - [17/Jul/2004:17:53:42 +0000] "POST /cgi-bin/FormMail.pl HTTP/1.1" 404 297 "-" "-"
168.9.85.227 - - [17/Jul/2004:17:54:44 +0000] "POST /cgi-bin/formmail.cgi HTTP/1.0" 404 286 "http://www.skyarts.com/" "-"