[SOLVED] SERVER_NAME & URL not in my name space + yahoo stuff not

Question

Hi!
A cheap php 404 scripts just informed me, that someone tried to access a site on my server that does not exist and:
the getenv ("REQUEST_URI") is
##censored#ip##/?login=#censored#&PASSWD=#censored#
(yes, I've got a plaintext login + password of unknown origin in there. Didn't test if it's real @ yahoo or something )
the getenv ("SERVER_NAME") is:
An IP that should definitely not be associated with my server, doesn't resolve to a host name
PORT STATE SERVICE VERSION
80/tcp open http?
443/tcp open ssl/https?
2 services unrecognized despite returning data.
and traces back or redirects to (not sure, its sort of confusing):
something.member.something.yahoo.com
... which gets redirected to the yahoo login page where firefox gives me a "cross site scripting attempt" warning. Is this just the stuff yahoo usually does to its customers or is there someone else at work? Couldn't figure out how exactly the redirects work or in which direction and how the IP from which I got there is involved - must be more [serverside + cookie + javascript] stuff than 3-5 mad computer scientists can eat together or something.
the IP who tried to access this page according to the message definitely is noone who has anything to do with me either...
PORT STATE SERVICE VERSION
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
1025/tcp open msrpc Microsoft Windows RPC
3389/tcp open microsoft-rdp Microsoft Terminal Service
Service Info: OS: Windows
also wrong provider+country (but none of the "especially conspicuous" ones) to be likely to be in the right place. Doesn't look like a "normal hacker" either, or does it? More like bored notebook guy who doesn't know the difference between internet & network...  or are windows computer supposed to look like this from outside?
Can someone give me hint? What could that mean? I feel sort of lost, my php, sever etc knowledge just isnt't that solid I guess... well, I know my "basics" are rather wobbly. Just: That's not something my server usually does.
How can getenv ("SERVER_NAME") give me something that's none of my domains / server ip's?
Can't figure out if I did something wrong... could this be something "upstream"? I transferred and registered some domains less than 20 hours ago which could explain for a period of "DNS strangeness" or something, but don't see how exactly that alone could result in something like that either... that'd be the wrong direction,  right...? Argh... 
Any hints are welcome - even if it's just something like: "don't panic" or "do panic, ffs!!!!!!". I'm not entirely sure if it's better to (a) just ignore that incident or (b) shut down the whole server without knowing why until I do.
Thanks!
Last edited by whoops (2011-03-10 00:27:39)

Answer 1

Exactly, that should have been my main question - thanks!
Almost can't believe, I just used the wrong variable! Everything makes so much more sense now... I must have been getting those clumsy / harmless "attacks" for years without noticing - until I messed up that 404 log script during domain transfer.
[...]information in your post which makes it difficult to understand what you're trying to explain[...]
I know. My problem was, that I couldn't really understand what exactly my problem was, so I "postet random stuff" and it worked out
Last edited by whoops (2011-03-10 00:30:46)