is this an attack?

colak · 2011-05-27 11:41:49

I have a number (6) of these (all at 10.23am but different ips, all canadian) in my logs. Is it an attack? Should I do something about it?

→ 184.107.132.218 	27 May 			Canada
→/events//xmlsrv/xmlrpc.php 	10:23 	 
→/events/ 	  	 
→//xmlsrv/xmlrpc.php 	  	 

→ 64.15.147.90 	27 May 			Canada
→/events//xmlsrv/xmlrpc.php 	10:23 	 
→/events/ 	  	 
→//xmlsrv/xmlrpc.php

Gocom · 2011-05-27 13:35:16

Meh, random misc, possibly script-kiddie, request. You should get them all the time. If you want to increase list of random banned IPs and save bandwidth block the IPs, or don’t do anything special from the usual.

I would just go to take cup of coffee, or glass of water, whichever rocks your boat, and continue normal life by keeping software up-to-date and taking frequent backups.

is this an attack?

Fishing.

Last edited by Gocom (2011-05-27 13:37:45)

colak · 2011-05-28 01:00:09

Gocom wrote:

Meh, random misc, possibly script-kiddie, request.

… Cool:) I’ll let them play then:) Thanks Jukka.

candyman · 2011-06-06 08:23:20

Today I’ve discovered this in the admin/access page:

05 giu 2011 07:31:16 xxxxxx.hu /phpmyadmin1/scripts/setup.php
05 giu 2011 07:31:16 xxxxxx.hu /phpmyadmin2/scripts/setup.php
05 giu 2011 07:31:16 xxxxxx.hu /pma/scripts/setup.php
05 giu 2011 07:31:16 xxxxxx.hu /web/phpMyAdmin/scripts/setup.php
05 giu 2011 07:31:17 xxxxxx.hu /xampp/phpmyadmin/scripts/setup.php
05 giu 2011 07:31:15 xxxxxx.hu /phpmyadmin/scripts/setup.php
05 giu 2011 07:31:15 xxxxxx.hu /phpadmin/scripts/setup.php
05 giu 2011 07:31:15 xxxxxx.hu /phpMyAdmin/scripts/setup.php
05 giu 2011 07:31:14 xxxxxx.hu /typo3/phpmyadmin/scripts/setup.php
05 giu 2011 07:31:14 xxxxxx.hu /mysqladmin/scripts/setup.php
05 giu 2011 07:31:14 xxxxxx.hu /mysql/scripts/setup.php
05 giu 2011 07:31:13 xxxxxx.hu /myadmin/scripts/setup.php

is this an attack?

In that case: how can I block this IP for the future?

Many thanks!

colak · 2011-06-06 10:08:36

Hi Alessandro

It’s a hacking attempt. As you don’t know if the IP is static or dynamic there is no reason of blocking it but should you want to block it anyway add

Order Allow,Deny
Deny from xx.xx.xx.xx
Deny from xxx.xxx.xxx.xxx
etc
Allow from all

in your htaccess file

ruud · 2011-06-06 11:38:21

Don’t block it. Just make sure your PHPMyAdmin software is up-to-date.

JimJoe · 2011-06-06 21:58:25

My domain page ‘not found’ checker shows someone out there looking for dlls, word docs, music files. I just ignore them. Although, on one site I put I have have music files. So that type of search dropped off.

gaekwad · 2011-06-12 20:23:48

ruud wrote:

Don’t block it. Just make sure your PHPMyAdmin software is up-to-date.

Also: don’t have it located in some obviously-named directory (/phpmyadmin, /pma, etc), flip the folder & file permissions to 000 when it’s not being used and rename your config file so it won’t work. Simple things, but they’re all useful measures against opportunist scumbags.

masa · 2011-06-13 14:16:15

All of the hosts I use have PHPMyAdmin installed in a more secure location where you need to log in; just ask them.
You shouldn’t need to install it in your own publicly accessible web root at all.

Textpattern CMS

Textpattern CMS support forum

#1 2011-05-27 11:41:49

is this an attack?

#2 2011-05-27 13:35:16

Re: is this an attack?

#3 2011-05-28 01:00:09

Re: is this an attack?

#4 2011-06-06 08:23:20

Re: is this an attack?

#5 2011-06-06 10:08:36

Re: is this an attack?

#6 2011-06-06 11:38:21

Re: is this an attack?

#7 2011-06-06 21:58:25

Re: is this an attack?

#8 2011-06-12 20:23:48

Re: is this an attack?

#9 2011-06-13 14:16:15

Re: is this an attack?

Board footer