[질문-급] 아파치 웹서버 로그 access_log에 "CONNECT 203...." 가 계속 쌓이고 있습니다.
한참 관리 안하다가
access_log를 보니까 무려 2기가가 넘길래
일단 이름 바꾸고 나서 보니까 계속 증가하길래
tail -f access_log 했더니만... 으악~
~~~~~~
71.6.131.229 - - [05/Nov/2008:00:45:11 +0900] "CONNECT 61.222.240.10:25 HTTP/1.0
" 200 1576
205.209.161.29 - - [05/Nov/2008:00:45:11 +0900] "CONNECT 168.95.5.47:25 HTTP/1.0
" 200 1576
205.209.161.29 - - [05/Nov/2008:00:45:12 +0900] "CONNECT 218.102.53.66:25 HTTP/1
.0" 200 1576
205.209.161.29 - - [05/Nov/2008:00:45:12 +0900] "CONNECT 203.188.197.10:25 HTTP/
1.0" 200 1576
~~~~~~
계속 넘어가고 있습니다.
이넘들을 소팅해보니...
125.224.193.108 - - [05/Nov/2008:00:11:46 +0900] "CONNECT 168.95.6.156:25 HTTP/1.0" 200 1576
125.224.193.108 - - [05/Nov/2008:00:11:49 +0900] "CONNECT 168.95.5.34:25 HTTP/1.0" 200 1576
125.224.193.108 - - [05/Nov/2008:00:11:55 +0900] "CONNECT 61.222.205.180:25 HTTP/1.0" 200 1576
125.224.193.108 - - [05/Nov/2008:00:11:56 +0900] "CONNECT 216.18.3.188:25 HTTP/1.0" 200 1576
125.224.193.108 - - [05/Nov/2008:00:12:01 +0900] "CONNECT 61.67.160.1:25 HTTP/1.0" 200 1576
125.224.193.108 - - [05/Nov/2008:00:12:05 +0900] "CONNECT 168.95.5.42:25 HTTP/1.0" 200 1576
~~~~~~~~~~~~
205.209.161.29 - - [05/Nov/2008:00:13:51 +0900] "CONNECT 203.188.197.9:25 HTTP/1.0" 200 1576
205.209.161.29 - - [05/Nov/2008:00:13:52 +0900] "CONNECT 203.188.197.9:25 HTTP/1.0" 200 1576
205.209.161.29 - - [05/Nov/2008:00:13:53 +0900] "CONNECT 203.188.197.10:25 HTTP/1.0" 200 1576
205.209.161.29 - - [05/Nov/2008:00:13:54 +0900] "CONNECT 203.188.197.10:25 HTTP/1.0" 200 1576
205.209.161.29 - - [05/Nov/2008:00:13:54 +0900] "CONNECT 203.188.197.10:25 HTTP/1.0" 200 1576
205.209.161.29 - - [05/Nov/2008:00:13:54 +0900] "CONNECT 203.188.197.9:25 HTTP/1.0" 200 1576
205.209.161.29 - - [05/Nov/2008:00:13:54 +0900] "CONNECT 211.72.114.99:25 HTTP/1.0" 200 1576
205.209.161.29 - - [05/Nov/2008:00:13:56 +0900] "CONNECT 203.188.197.9:25 HTTP/1.0" 200 1576
205.209.161.29 - - [05/Nov/2008:00:13:57 +0900] "CONNECT 203.188.197.10:25 HTTP/1.0" 200 1576
~~~~~~~~~~~
71.6.131.229 - - [05/Nov/2008:00:14:34 +0900] "CONNECT 211.20.188.150:25 HTTP/1.0" 200 1576
71.6.131.229 - - [05/Nov/2008:00:14:38 +0900] "CONNECT 168.95.5.68:25 HTTP/1.0" 200 1576
71.6.131.229 - - [05/Nov/2008:00:14:39 +0900] "CONNECT 140.114.34.205:25 HTTP/1.0" 200 1576
71.6.131.229 - - [05/Nov/2008:00:14:43 +0900] "CONNECT 168.95.6.137:25 HTTP/1.0" 200 1576
71.6.131.229 - - [05/Nov/2008:00:14:43 +0900] "CONNECT 168.95.6.145:25 HTTP/1.0" 200 1576
71.6.131.229 - - [05/Nov/2008:00:14:43 +0900] "CONNECT 59.124.178.189:25 HTTP/1.0" 200 1576
71.6.131.229 - - [05/Nov/2008:00:14:44 +0900] "CONNECT 208.97.132.48:25 HTTP/1.0" 200 1576
71.6.131.229 - - [05/Nov/2008:00:14:47 +0900] "CONNECT 139.175.252.15:25 HTTP/1.0" 200 1576
71.6.131.229 - - [05/Nov/2008:00:14:47 +0900] "CONNECT 168.95.6.128:25 HTTP/1.0" 200 1576
71.6.131.229 - - [05/Nov/2008:00:14:49 +0900] "CONNECT 211.20.188.150:25 HTTP/1.0" 200 1576
~~~~~~~~
혹시 해킹 단한건가요???
그렇다면 해결 방법 부탁드립니다...
- 리눅스 초보 -
댓글 달기