these are what i found in my stats page:
couple days ago:
Host: 12.---.---.11 Url: /c/winnt/system32/cmd.exe?/c+dir

ant today:
Host: 66.95.---.--- Url: /scripts/..%252f../winnt/system32/cmd.exe?/c+dir

those 2 IPs are attempting to take control of the server or what?? They are from different location as tracing route returned. And my site is hosted on Unix server (luckily?).

thanks a lot for any comments, responds.

ML

We have the same sort of things show up in our log files, but they only show up for a single domain from the many hosted on the server.

The domain they always show up on is the one set-up only as a domain for e-mail servers to successfully look-up...otherwise they fail if the sending domain does not exist...

Because we are also Unix based, we don't worry about it...

If you're using linux, don't worry about it. It's the Code Red worm trying to penetrate your server. And, as you probably know, Code Red can't harm linux servers.

But its still annoying tho.

If you are worried about this sort of thing, you should order a Security Audit from your favorite network security firm.

They can point out for you most of the areas where you are vulnerable, and give you a bit of peace-of-mind on what crackers are tryign to do to your machines.

nevermind..