At [14/Nov/2002:22:24:40 -0500], I noticed a deliberate attack against my server at 64.26.169.18. I was being checked from the IP address 66.12.48.142, so I blocked it. All in a day's work.

Very, very shortly after blocking it, I saw accesses from another IP, 204.118.121.2. Obviously a human, but more than likely the same person, since they were accessing my webserver by IP rather than one of the many virtualhost names it has.

My webserver has a chat server on it, and it also has a webcam and stuff. The intruder watched me on my webcam. I wanted to know who it was, so I redirected the webcam to the picture here instead of my own picture, and I added text to my site saying "Who the hell are you?" and "Join the chatroom already, dumbass."

The intruder joined my chatroom, and we had the conversation as documented in the chatlog below.

• The chat log.
• Apache logs from him chatting through his web proxy
• Apache logs attempting compromise from before I blocked that IP
• Apache error logs
• Syslog showing the blocked packets
• /var/log/secure entry Important! His real IP in Romania!
• Whois information for the compromised and source IPs

I've sent mail to the people responsible for the attacking machines, as well as the FBI NIPC and the Ottawa Police cybercrime dudes.

• The autoreplies I got from the addresses Note that it took Verizon a few days to even autoreply!
• The mails I've gotten back from people