os

new fingerprint mailed to attrition_sigs@insecure.org for nmap upgrade
Netcraft:    The site www.weatherlike.com runs Apache/1.3.12 mod_affinity_mhp
   (Unix) mod_frontpage/3.0.4.3 on Solaris
NMAP: Aggressive OS guesses: Solaris 2.6 - 2.7 (88%), Baystack Instant Internet 400 SoHo Router (85%)
www.weatherlike.com: Server: Apache/1.3.12 mod_affinity_mhp (Unix) mod_frontpage/3.0.4.3
 
mirror taken by: munge    
mirror taken on Sat Dec  2 09:22:34 MST 2000
 
 1  gw.fe2-0.border1.phx.inficad.com (208.198.100.1)  0.391 ms  0.29 ms
 2  Serial2-1-1.GW1.PHX1.ALTER.NET (157.130.224.93)  2.89 ms  1.976 ms
 3  143.ATM2-0.XR2.LAX2.ALTER.NET (146.188.249.126)  10.93 ms  10.993 ms
 4  194.ATM9-0-0.BR1.LAX2.ALTER.NET (152.63.113.85)  12.389 ms  13.45 ms
 5  s1-0-1-45M.br1.BUR.gblx.net (208.50.13.1)  10.299 ms  11.557 ms
 6  fe8-0-0.cr2.BUR.gblx.net (207.218.173.51)  12.708 ms  15.204 ms
 7  pos5-1-155M.wr2.LAX1.gblx.net (207.218.173.197)  26.15 ms  37.848 ms
 8  pos1-0-622M.cr2.LAX1.gblx.net (206.132.112.102)  25.14 ms *
 9  pos1-0-0-155M.ar2.LAX1.gblx.net (206.132.112.158)  27.723 ms  27.078 ms
10  AffinityHosting.s10-1-0.ar2.LAX1.gblx.net (64.210.19.122)  28.806 ms  28.292 ms
11  207.150.192.12 (207.150.192.12)  23.693 ms  22.646 ms
 
Internic: 
Sitename: wetw
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
This is part of a MASS hack.
defacer: Anti-401
remote os: So
remote os: Solaris 2.6 - 2.7
remote server: Apache/1.3.12 mod_affinity_mhp (Unix) mod_frontpage/3.0.4.3
Sat Dec  2 09:24:59 MST 2000
mirror number:    9218
shared.lists.defaced@cert.org notified of defacement
nipc@fbi.gov notified of defacement
 
[00.12.02] So [Anti-401]            <a href="2000/12/02/www.weatherlike.com/">wetw</a> (<a href="http://www.weatherlike.com/">www.weatherlike.com</a>)