os

new fingerprint mailed to attrition_sigs@insecure.org for nmap upgrade
Netcraft:    The site www.forums.nl runs Apache/1.3.12 Cobalt (Unix) mod_ssl/2.6.4
   OpenSSL/0.9.5a PHP/4.0.1pl2 mod_auth_pam/1.0a FrontPage/4.0.4.3
NMAP: Aggressive OS guesses: Linux 2.1.122 - 2.2.16 (97%), Linux 2.2.14 (95%), Linux kernel 2.2.13 (95%), Linux 2.2.12 (93%), Linux Kernel 2.1.88 (92%), Linux 2.1.91 - 2.1.103 (91%), Linux 2.3.12 (88%), Linux 2.1.76 (87%)
www.forums.nl: Server: Apache/1.3.12 Cobalt (Unix) mod_ssl/2.6.4 OpenSSL/0.9.5a PHP/4.0.1pl2 m
 
mirror taken by: munge    
mirror taken on Sat Dec  9 19:40:51 MST 2000
 
 1  gw.fe2-0.border1.phx.inficad.com (208.198.100.1)  0.406 ms  0.271 ms
 2  Serial2-1-1.GW1.PHX1.ALTER.NET (157.130.224.93)  5.346 ms  6.059 ms
 3  143.ATM3-0.XR1.LAX2.ALTER.NET (146.188.249.130)  9.995 ms  14.404 ms
 4  195.ATM3-0.TR1.LAX2.ALTER.NET (146.188.248.118)  29.291 ms  29.806 ms
 5  111.at-6-0-0.TR1.NYC8.ALTER.NET (146.188.142.170)  99.377 ms  130.072 ms
 6  * 185.ATM7-0.XR1.NYC4.ALTER.NET (152.63.21.97)  135.88 ms
 7  189.ATM7-0.GW13.NYC4.ALTER.NET (152.63.23.33)  111.777 ms  117.785 ms
 8  carrier1-oc3-gw.customer.alter.net (157.130.223.42)  138.357 ms  110.431 ms
 9  gigabitethernet2-0.nyc-bbr-02.carrier1.net (212.4.193.213)  107.936 ms  137.941 ms
10  pos6-1-0.fra-bbr-01.carrier1.net (213.239.20.254)  200.939 ms  175.635 ms
11  pos1-1-0.ams-bbr-02.carrier1.net (212.4.199.57)  200.594 ms  200.192 ms
12  fastethernet2-0.ams-icr-01.carrier1.net (212.4.192.20)  197.153 ms  176.262 ms
13  212.4.194.126 (212.4.194.126)  204.205 ms  213.493 ms
14  hfd1.s2-0-ams.widexs.net (212.204.214.1)  237.464 ms  214.016 ms
15  HOSTED-BY.widexs.nl (212.204.243.12)  236.559 ms  218.615 ms
 
Internic: [whois.domain-registry.nl]
invalid query
Sitename: www.forums.nl
Potentially offensive content on defaced page.
This is part of a MASS hack.
defacer: Earthquaker
remote os: Lb
remote os: Linux 2.1.122 - 2.2.16
remote server: Apache/1.3.12 Cobalt (Unix) mod_ssl/2.6.4 OpenSSL/0.9.5a PHP/4.0.1pl2
Sat Dec  9 19:46:12 MST 2000
mirror number:    9388
shared.lists.defaced@cert.org notified of defacement
nipc@fbi.gov notified of defacement
cert@uni-cert.nl and cert-nl@surfnet.nl notified of defacement
postmaster@argo.nl notified
heessels@euronet.nl notified
 
[00.12.09] Lb [Earthquaker]            <a href="2000/12/09/www.forums.nl/">www.forums.nl</a> (<a href="http://www.forums.nl/">www.forums.nl</a>)