Just saw flashing this by.

Do they provide dialup or dsl?

64.91.232.201 - - [28/Mar/2003:15:06:53 -0500] "GET /cgi-sys/guestbook.cgi?user=cpanel&template=|id| HTTP/1.0" 404 215
64.91.232.201 - - [28/Mar/2003:15:06:53 -0500] "GET /cgi-sys/guestbook.cgi?user=cpanel&template=|id| HTTP/1.0" 404 215 "-" "--"

03/28/03 21:15:16 IP block 64.91.232.201
Trying 64.91.232.201 at ARIN
Trying 64.91.232 at ARIN

OrgName: Liquid Web
OrgID: LQWB
Address: 5195 Jet Drive Suite 2
City: Lansing
StateProv: MI
PostalCode: 48911
Country: US

NetRange: 64.91.224.0 - 64.91.255.255
CIDR: 64.91.224.0/19
NetName: LIQUIDWEB
NetHandle: NET-64-91-224-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Allocation
NameServer: NS.LIQUIDWEB.COM
NameServer: NS1.LIQUIDWEB.COM
NameServer: NS2.LIQUIDWEB.COM
NameServer: NS9.LIQUIDWEB.COM
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2001-07-20
Updated: 2003-01-28

TechHandle: AL621-ARIN
TechName: Admin Liquidweb, Admin
TechPhone: +1-800-580-4985
TechEmail: webmaster@liquidweb.com

OrgTechHandle: IPADM47-ARIN
OrgTechName: IP Administrator
OrgTechPhone: +1-800-580-4985
OrgTechEmail: ipadmin@liquidweb.com

I bet they were compromised (read: CPanel) and whoever did that is now launching scans/attacks from their server. I recommend you inform them immediately of their lack of security.

Originally posted by clockwork
I bet they were compromised (read: CPanel) and whoever did that is now launching scans/attacks from their server. I recommend you inform them immediately of their lack of security.

those servers could have belonged to their customers :)

you should contact liquidweb and let them know about this. I wonder what version of Cpanel they are using now? this guestbook issue had been fixed for a long time.

That doesn't mean that the liquidweb's server was comprimised via the guestbook exploit... it means that they are trying to hack your server via the guestbook exploit. ;)

Anyway, if you're up to date with cpanel you don't have anything to worry about. It would still be nice to let liquidweb know about this though.

I don't even run CPanel on this box, no panel at all :laugh:

Welcome to the club I get stuff like this all the time.....

Are these appearing in your error_log?

Nope, in the access_log of our company website.