os

Netcraft:    www.000host.com is running Apache/1.3.12 (Unix) (Red Hat/Linux)
   PHP/3.0.15 mod_perl/1.21 on Linux
NMAP: Remote operating system guess: Linux 2.1.122 - 2.2.16
www.000host.com: Server: Apache/1.3.12 (Unix)  (Red Hat/Linux) PHP/3.0.15 mod_perl/1.21
 
mirror taken by: null     
mirror taken on Mon Sep 25 15:30:07 MDT 2000
 
 1  gw.fe2-0.border1.phx.inficad.com (208.198.100.1)  0.431 ms  0.274 ms
 2  Serial2-1-1.GW1.PHX1.ALTER.NET (157.130.224.93)  11.734 ms  6.686 ms
 3  143.ATM3-0.XR1.LAX2.ALTER.NET (146.188.249.130)  14.192 ms  16.424 ms
 4  295.ATM2-0.TR1.LAX2.ALTER.NET (146.188.248.122)  10.417 ms  12.745 ms
 5  111.at-7-1-0.TR1.DCA8.ALTER.NET (146.188.138.145)  76.774 ms  84.368 ms
 6  0.so-5-0-0.XR1.DCA8.ALTER.NET (152.63.25.38)  78.402 ms  83.902 ms
 7  POS6-0.BR2.DCA8.ALTER.NET (152.63.35.189)  83.812 ms  92.133 ms
 8  204.6.140.117 (204.6.140.117)  90.675 ms  92.453 ms
 9  38.1.10.14 (38.1.10.14)  95.735 ms  102.972 ms
10  rc2.sse.us.psi.net (38.1.27.194)  197.273 ms  206.278 ms
11  * *
12  38.245.136.1 (38.245.136.1)  1869.15 ms  1982.21 ms
13  38.245.136.7 (38.245.136.7)  1966.43 ms *
 
Internic: Online Network Enterprises (000HOST-DOM)
Sitename: Online Network Enterprises
Potentially offensive content on defaced page.
This is part of a MASS hack.
defacer: rsh
remote os: Lr
remote os: Red Hat/Linux 2.1.122 - 2.2.16
remote server: Apache/1.3.12
Mon Sep 25 15:32:49 MDT 2000
mirror number:    7791
shared.lists.defaced@cert.org notified of defacement
nipc@fbi.gov notified of defacement
hostmaster@WEBMO.COM notified
 
[00.09.25] Lr [rsh]            <a href="2000/09/25/www.000host.com/">Online Network Enterprises</a> (<a href="http://www.000host.com/">www.000host.com</a>)