The Chinese are trying to use me to attack Taiwan. No, really.

[Commie Pinko Dirtbag]

I decided to set up a Web server on my home machine so I could get to some files from the outside. Immediately, I started getting access logs like this. This will look like gibberish to you, so I'll explain what it means.

220.136.75.213 - - <20/Jul/2009:10:08:48 -0300> "CONNECT mail3.xps.idv.tw:25 HTTP/1.0" 405 307 "-" "-"
125.230.161.165 - - <20/Jul/2009:16:25:55 -0300> "CONNECT 203.188.201.253:25 HTTP/1.1" 405 306 "-" "-"
125.230.161.165 - - <20/Jul/2009:18:49:54 -0300> "CONNECT 203.188.201.253:25 HTTP/1.1" 405 306 "-" "-"
118.168.136.253 - - <20/Jul/2009:19:14:05 -0300> "CONNECT mail.burst.idv.tw:25 HTTP/1.0" 405 308 "-" "-"
125.230.161.165 - - <20/Jul/2009:21:14:12 -0300> "CONNECT 203.188.201.253:25 HTTP/1.1" 405 316 "-" "-"
125.230.161.165 - - <20/Jul/2009:23:36:45 -0300> "CONNECT 203.188.201.253:25 HTTP/1.1" 405 316 "-" "-"
118.168.140.172 - - <21/Jul/2009:00:52:18 -0300> "CONNECT maila.burst.idv.tw:25 HTTP/1.0" 405 319 "-" "-"

The IP addresses on the left are all from China. The IP adresses (or hostnames) after the word "CONNECT" are all from Taiwan. The ":25" after the addresses mean the attackers tried to use MY machine to connect to machines in Taiwan so they could order the latter to send their spam.

I, of course, use an up-to-date, secure OS and Web server, and don't do stupid things with my configuration.

I'm thinking of gathering these IPs and building a blacklist of sorts.

[Why Syzygy]

1. kick