Exploit?

error log has "x6d;x61;x69;" like entries on every folder

[Majinboo]

My error log shows several lines coming from same IP that looks to me like someone is searching for a "hole". It searchs every folder under public_html with these strings:

public_html/diretorio/x6d;aix6c;x74;x6f;:x77;x65;bmasx74;erx40;x62;x72;ax73;x6d;ox6e;tx72;ex61;x6c;x2e;x6e;x65;x74;
public_html/mailto:x61;gx65;x6e;x64;x61;x63;ux6c;x74;ux72;al@x62;x72;asmonx74;x72;x65;alx2e;nex74;
public_html/max69;x6c;tx6f;x3a;x62;rx61;x73;x69;x6c;x40;uqx61;x6d;x2e;x63;a
public_html/x6d;x61;x69;x6c;x74;x6f;:pox72;x74;x75;gal@x63;x68;x6d;x6f;x6e;x74;realx2e;x63;x6f;m

or then (not same IP)

public_html/&
public_html/&

Could that be somekind of exploit?

Thanks in advance

EDIT: Forgot to say that it crawled through every file on the site

[edited by: tedster at 6:08 am (utc) on Dec. 6, 2005]
[edit reason] fix side scroll [/edit]

[topsites]

Oh man I get that bs for many years now, too... In the case of public_html queries, it really doesn't bother me until the probes enter the cgi area but even then, what can you do? You can block one but another will come, just make sure the server is secure, most of these probes never lead anywhere, anyhow... Likely some search for open relays or other insecure stuff, it will go away on its own.

However, to reduce the number of these entries it may be helpful to change within your httpd.conf the warning level for logging events...

- su to root
- Do a 'whereis httpd.conf' or 'locate httpd.conf' (usually /etc/httpd/conf)
- Then cd /etc/httpd/conf (or wherever it is)
- pico httpd.conf
- Look for LogLevel ****

After LogLevel, there is a word (which is a setting), I will list now the settings in order from lowest to highest, to upgrade one level, simply change the current word to the next one, the settings are:
debug, info, notice, warn, error, crit, alert, emerg

So you're likely on notice or warn, so to upgrade if you are on warn then change to error...
My server's set to crit, I haven't seen an error log in weeks lol.

Hope is help.

[Majinboo]

Thanks for the answer topsites :)

My access level to the server is just as a user, I just host the website there.

I did some Googling though and find out that that first offending IP is often used by an almost famous vietnamese spammer (I actually don't see a point of recurrently using one same address unless the guy want to blacklist it) so, I just blocked his access on htaccess. I dont think thats a good solution neither I like to block an IP; like you said the probing can come from anywhere...

I guess its an option to contact the support dept and make them aware.