MyPHP attacks

php attack

[cyberdyne]

I have a few attempts to access my PHP databases and would like some advice on how to go about blocking them. I appreciate they are not using a lot of bandwidth and that all attempts have been so far unsuccessful but I am concerned they may strike it lucky sometime soon.

Any advice appreciated.
Thank you in advance

The following is from my logs:

[18/May/2011:20:25:47 +0100] "GET //scripts/setup.php HTTP/1.1" 404 1226
[18/May/2011:20:25:47 +0100] "GET //admin/scripts/setup.php HTTP/1.1" 404 1232
[18/May/2011:20:25:47 +0100] "GET //admin/pma/scripts/setup.php HTTP/1.1" 404 1236
[18/May/2011:20:25:47 +0100] "GET //admin/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:47 +0100] "GET //db/scripts/setup.php HTTP/1.1" 404 1229
[18/May/2011:20:25:47 +0100] "GET //dbadmin/scripts/setup.php HTTP/1.1" 404 1234
[18/May/2011:20:25:48 +0100] "GET //myadmin/scripts/setup.php HTTP/1.1" 404 1234
[18/May/2011:20:25:48 +0100] "GET //mysql/scripts/setup.php HTTP/1.1" 404 1232
[18/May/2011:20:25:48 +0100] "GET //mysqladmin/scripts/setup.php HTTP/1.1" 404 1237
[18/May/2011:20:25:48 +0100] "GET //typo3/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:48 +0100] "GET //phpadmin/scripts/setup.php HTTP/1.1" 404 1235
[18/May/2011:20:25:49 +0100] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1237
[18/May/2011:20:25:49 +0100] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 404 1237
[18/May/2011:20:25:49 +0100] "GET //phpmyadmin1/scripts/setup.php HTTP/1.1" 404 1238
[18/May/2011:20:25:49 +0100] "GET //phpmyadmin2/scripts/setup.php HTTP/1.1" 404 1238
[18/May/2011:20:25:49 +0100] "GET //pma/scripts/setup.php HTTP/1.1" 404 1230
[18/May/2011:20:25:49 +0100] "GET //web/phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1241
[18/May/2011:20:25:49 +0100] "GET //xampp/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:50 +0100] "GET //web/scripts/setup.php HTTP/1.1" 404 1230
[18/May/2011:20:25:50 +0100] "GET //php-my-admin/scripts/setup.php HTTP/1.1" 404 1239
[18/May/2011:20:25:50 +0100] "GET //websql/scripts/setup.php HTTP/1.1" 404 1233
[18/May/2011:20:25:50 +0100] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 404 1237
[18/May/2011:20:25:50 +0100] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1237
[18/May/2011:20:25:50 +0100] "GET //phpMyAdmin-2/scripts/setup.php HTTP/1.1" 404 1239
[18/May/2011:20:25:50 +0100] "GET //php-my-admin/scripts/setup.php HTTP/1.1" 404 1239
[18/May/2011:20:25:50 +0100] "GET //phpMyAdmin-2.2.3/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:50 +0100] "GET //phpMyAdmin-2.2.6/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:51 +0100] "GET //phpMyAdmin-2.5.1/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:51 +0100] "GET //phpMyAdmin-2.5.4/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:51 +0100] "GET //phpMyAdmin-2.5.5-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:51 +0100] "GET //phpMyAdmin-2.5.5-rc2/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:51 +0100] "GET //phpMyAdmin-2.5.5/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:51 +0100] "GET //phpMyAdmin-2.5.5-pl1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:51 +0100] "GET //phpMyAdmin-2.5.6-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:51 +0100] "GET //phpMyAdmin-2.5.6-rc2/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:52 +0100] "GET //phpMyAdmin-2.5.6/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:52 +0100] "GET //phpMyAdmin-2.5.7/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:52 +0100] "GET //phpMyAdmin-2.5.7-pl1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:52 +0100] "GET //phpMyAdmin-2.6.0-alpha/scripts/setup.php HTTP/1.1" 404 1249
[18/May/2011:20:25:52 +0100] "GET //phpMyAdmin-2.6.0-alpha2/scripts/setup.php HTTP/1.1" 404 1250
[18/May/2011:20:25:52 +0100] "GET //phpMyAdmin-2.6.0-beta1/scripts/setup.php HTTP/1.1" 404 1249
[18/May/2011:20:25:52 +0100] "GET //phpMyAdmin-2.6.0-beta2/scripts/setup.php HTTP/1.1" 404 1249
[18/May/2011:20:25:52 +0100] "GET //phpMyAdmin-2.6.0-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:53 +0100] "GET //phpMyAdmin-2.6.0-rc2/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:53 +0100] "GET //phpMyAdmin-2.6.0-rc3/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:53 +0100] "GET //phpMyAdmin-2.6.0/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:53 +0100] "GET //phpMyAdmin-2.6.0-pl1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:53 +0100] "GET //phpMyAdmin-2.6.0-pl2/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:53 +0100] "GET //phpMyAdmin-2.6.0-pl3/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:53 +0100] "GET //phpMyAdmin-2.6.1-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:53 +0100] "GET //phpMyAdmin-2.6.1-rc2/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:53 +0100] "GET //phpMyAdmin-2.6.1/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:54 +0100] "GET //phpMyAdmin-2.6.1-pl1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:54 +0100] "GET //phpMyAdmin-2.6.1-pl2/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:54 +0100] "GET //phpMyAdmin-2.6.1-pl3/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:54 +0100] "GET //phpMyAdmin-2.6.2-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:54 +0100] "GET //phpMyAdmin-2.6.2-beta1/scripts/setup.php HTTP/1.1" 404 1249
[18/May/2011:20:25:54 +0100] "GET //phpMyAdmin-2.6.2-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:54 +0100] "GET //phpMyAdmin-2.6.2/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:54 +0100] "GET //phpMyAdmin-2.6.2-pl1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:55 +0100] "GET //phpMyAdmin-2.6.3/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:55 +0100] "GET //phpMyAdmin-2.6.3-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:55 +0100] "GET //phpMyAdmin-2.6.3/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:55 +0100] "GET //phpMyAdmin-2.6.3-pl1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:55 +0100] "GET //phpMyAdmin-2.6.4-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:55 +0100] "GET //phpMyAdmin-2.6.4-pl1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:55 +0100] "GET //phpMyAdmin-2.6.4-pl2/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:55 +0100] "GET //phpMyAdmin-2.6.4-pl3/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:56 +0100] "GET //phpMyAdmin-2.6.4-pl4/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:56 +0100] "GET //phpMyAdmin-2.6.4/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:56 +0100] "GET //phpMyAdmin-2.7.0-beta1/scripts/setup.php HTTP/1.1" 404 1249
[18/May/2011:20:25:56 +0100] "GET //phpMyAdmin-2.7.0-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:56 +0100] "GET //phpMyAdmin-2.7.0-pl1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:56 +0100] "GET //phpMyAdmin-2.7.0-pl2/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:56 +0100] "GET //phpMyAdmin-2.7.0/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:56 +0100] "GET //phpMyAdmin-2.8.0-beta1/scripts/setup.php HTTP/1.1" 404 1249
[18/May/2011:20:25:57 +0100] "GET //phpMyAdmin-2.8.0-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:57 +0100] "GET //phpMyAdmin-2.8.0-rc2/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:57 +0100] "GET //phpMyAdmin-2.8.0/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:57 +0100] "GET //phpMyAdmin-2.8.0.1/scripts/setup.php HTTP/1.1" 404 1245
[18/May/2011:20:25:57 +0100] "GET //phpMyAdmin-2.8.0.2/scripts/setup.php HTTP/1.1" 404 1245
[18/May/2011:20:25:57 +0100] "GET //phpMyAdmin-2.8.0.3/scripts/setup.php HTTP/1.1" 404 1245
[18/May/2011:20:25:57 +0100] "GET //phpMyAdmin-2.8.0.4/scripts/setup.php HTTP/1.1" 404 1245
[18/May/2011:20:25:58 +0100] "GET //phpMyAdmin-2.8.1-rc1/scripts/setup.php HTTP/1.1" 404 1247
[18/May/2011:20:25:58 +0100] "GET //phpMyAdmin-2.8.1/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:58 +0100] "GET //phpMyAdmin-2.8.2/scripts/setup.php HTTP/1.1" 404 1243
[18/May/2011:20:25:58 +0100] "GET //sqlmanager/scripts/setup.php HTTP/1.1" 404 1237
[18/May/2011:20:25:58 +0100] "GET //mysqlmanager/scripts/setup.php HTTP/1.1" 404 1239
[18/May/2011:20:25:58 +0100] "GET //p/m/a/scripts/setup.php HTTP/1.1" 404 1232
[18/May/2011:20:25:58 +0100] "GET //PMA2005/scripts/setup.php HTTP/1.1" 404 1234
[18/May/2011:20:25:59 +0100] "GET //pma2005/scripts/setup.php HTTP/1.1" 404 1234
[18/May/2011:20:25:59 +0100] "GET //phpmanager/scripts/setup.php HTTP/1.1" 404 1237
[18/May/2011:20:25:59 +0100] "GET //php-myadmin/scripts/setup.php HTTP/1.1" 404 1238
[18/May/2011:20:25:59 +0100] "GET //phpmy-admin/scripts/setup.php HTTP/1.1" 404 1238
[18/May/2011:20:25:59 +0100] "GET //webadmin/scripts/setup.php HTTP/1.1" 404 1235
[18/May/2011:20:25:59 +0100] "GET //sqlweb/scripts/setup.php HTTP/1.1" 404 1233
[18/May/2011:20:25:59 +0100] "GET //websql/scripts/setup.php HTTP/1.1" 404 1233
[18/May/2011:20:25:59 +0100] "GET //webdb/scripts/setup.php HTTP/1.1" 404 1232
[18/May/2011:20:25:59 +0100] "GET //mysqladmin/scripts/setup.php HTTP/1.1" 404 1237
[18/May/2011:20:26:00 +0100] "GET //mysql-admin/scripts/setup.php HTTP/1.1" 404 1238

[wilderness]

I've found these types of probes to be quite infrequent. Many come from server farms.

My practice is simply to deny by IP, after their visit.

You could combine a a lengthy URI based upon the multiple terms, however and considering the infrequency of these probes, the aforementioned seems a terrible waste of CPU for every server request.

[cyberdyne]

Thank you, that's a fair point. I have had 7 such visits in three months and have indeed been blocking the IP after the visit, but they've almost all been proxies from innocent web sites and those which weren't, reporting them returned no results.

[wilderness]

innocent web sites

That's an oxymoron ;)

As webmasters, we don't want visits from other websites (hogging or server CPU and.or bandwidth), rather we desire visitors from privatized IP ranges.

Is there any correlation between the User Agents of these "seven visits" in the past months?
If not?
And the IP ranges are general user (privatized) rather than servers?

Than deny access on multiple conditions of both visitor backbone range and a portion of the UA.

[brotherhood of LAN]

Quote from [webmasterworld.com...] (2nd post)

apache treats multiple slashes as single slashes.

You can 301 redirect double-slashed URLs to the correct URL using mod_rewrite in .htaccess:

RewriteCond %{REQUEST_URI} ^(.*)//+(.*)$
RewriteRule / http://www.example.com/%1/%2 [R=301,L]

or using RedirectMatch:

RedirectMatch 301 ^(.*)//+(.*)$ http://www.example.com/$1/$2

Either of these snippets will replace two or more contiguous slashes with a single slash.

Jim

Since 'normal' requests don't have double slashes you could perhaps change the rule above into a 403 Forbidden to catch all the requests you posted.

I would hazard a guess that the hackers are using double quotes to avoid other such htaccess rules.

[edited by: brotherhood_of_LAN at 4:55 pm (utc) on May 19, 2011]

[wilderness]

(2nd post)

FWIW, the Webmaster World forums previously allows direct links to portions of previous threads.
My bookmarks to these old threads were in particular portions and NOT the entire thread.

I've no idea why what functioned in the past, will not function in recent months, nor am I willing to spend time seeking a solution.

[SteveWh]

After you run almost any setup.php or config.php or install.php script, you're supposed to delete it from the server so attacks like this can't come along and run it. The requests you posted are trying to find websites where that critical removal step was neglected.

Since all those requests are getting 404 responses, they are doing no harm, especially because you don't have any setup.php scripts still lying around on your server, right? If you've properly deleted all setup scripts, the hackers cannot make a lucky strike.

Nonetheless, this .htaccess code will ban those requests:

RewriteCond %{REQUEST_URI} setup\.php [NC]
RewriteRule .* - [F]

At 1240 bytes each, the bandwidth consumption is trivial, but if you want to reduce it even more, you could add a line to the above:

ErrorDocument 403 " "
RewriteCond %{REQUEST_URI} setup\.php [NC]
RewriteRule .* - [F]

It defines your Forbidden response to be a page consisting of just one plain text space character. Log will show it as 1 byte served.

If you ever need to run a setup.php script yourself, comment out the .htaccess code, do your work, and then re-enable it.

I suggest not even bothering trying to ban by IP address. It will be frustrating and useless when you start receiving attacks from hundreds or thousands of IP addresses from all over the world.

Ban the behavior, not the person (or robot) that is exhibiting it.

[g1smd]

This is another reason for going "extensionless" with your URLs and denying access to any request that ends in .php or any other common extension that indicates a script, and denying access to any URL request that contains parameters.

The "deny" rules are then followed by the standard rules to redirect index.htm and index.html to remove the filename, non-www to www and so on.

Finally, and crucially, there's a set of restrictive rewrites that accept only very specific URL request formats and rewrite only those to the PHP script.

All other requests result in a 404 error if a physical file (image, css or .html static page) isn't found on the server.

The reason that named anchors no longer work in the forum is that they are not sent by the browser and the forum now passes link requests through a redirect script. Since the redirect script doesn't receive the named anchor data it cannot append it to the end of the URL data it sends back to the browser.

[edited by: g1smd at 8:38 am (utc) on May 20, 2011]

[cyberdyne]

Many thanks for these suggestions guys, much appreciated.

[cyberdyne]

I've since realised that the UA for these 'attacks' was 'Python-urllib/2.7'

My .htaccess contains the following which clearly didn't prevent the above, so what could I change in order to prevent this in future please?

RewriteCond %{HTTP_USER_AGENT} (libwww|perl|Indy|python|urllib|java) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} libwww-perl [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^libwww-perl/[0-9] [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Indy\ Library [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^(Python.urllibŠJava/?[1-9]\.[0-9]) [NC,OR]
RewriteCond %{HTTP_user_agent} ^-?$ [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} ^(python[-.]?urllib|java/?[1-9]\.[0-9]) [NC]

Many thanks in advance.

[SteveWh]

There are some duplicate (or at least overlapping) conditions that address "urllib". Seems like one of them should have caught it, unless your code is missing the RewriteRule that must follow the list of RewriteConds:

RewriteRule .* - [F]

[cyberdyne]

Thanks, was just about to post regarding that very point.

I did in fact add the rule you suggested about but of course that will only prevent them if they look for setup.php files.

I was wondering if my RewriteRule must be present after each set of different conditions, ie:
RewriteCond %{THE_REQUEST}
RewriteCond %{HTTP_USER_AGENT}
RewriteCond %{REMOTE_ADDR}
RewriteCond %{HTTP_REFERER}

or if one RewriteRule will suffice after ALL of the conditions as long as there is an [OR] after each condition?

Many thanks

[cyberdyne]

The whole set now looks like this:

RewriteCond %{HTTP_USER_AGENT} (libwww|perl|Indy|python|urllib|java) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} libwww-perl [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^libwww-perl/[0-9] [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Indy\ Library [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^(Python.urllibŠJava/?[1-9]\.[0-9]) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^-?$ [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} ^(python[-.]?urllib|java/?[1-9]\.[0-9]) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Tcs/1" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "freefind" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "EmeraldShield" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "lwp-trivial" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Turnitin" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "trivial" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "User-Agent: Mozilla" [NC,OR]
RewriteCond %{HTTP_COOKIE}% s:(.*):\%22test1\%22\%3b [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "LWP::Simple" [NC]
RewriteRule .* - [F]

Wondering if the " " quotes are unnecessary.
Thank you.

[wilderness]

The quotes are NOT necessary, unless, there are spaces or special characters that would normally require escaping.
The quotes designate "exactly as".

In addition you may simplify many of these UA's, and them consolidate the UA's on a few lines as you did in this one.
RewriteCond %{HTTP_USER_AGENT} (libwww|perl|Indy|python|urllib|java) [NC,OR]

Additionally you have some unnecessary duplication of terms.

[cyberdyne]

Thanks Wilderness. Getting there.

RewriteCond %{HTTP_USER_AGENT} (libwww|perl|Indy|python|urllib|java) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^libwww-perl/[0-9] [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Indy\ Library [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^-?$ [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} ^(python[-.]?urllib|java/?[1-9]\.[0-9]) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (libwww|EmeraldShield|lwp-trivial|Turnitin|trivial|LWP::Simple|Tcs/1) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "User-Agent: Mozilla" [NC,OR]
RewriteCond %{HTTP_COOKIE}% s:(.*):\%22test1\%22\%3b [NC]
RewriteRule .* - [F]

[cyberdyne]

Wish I could edit my posts. apologies.

RewriteCond %{HTTP_USER_AGENT} (libwww|perl|Indy|python|urllib|java|EmeraldShield|lwp-trivial|Turnitin|trivial|LWP::Simple|Tcs/1) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^libwww-perl/[0-9] [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Indy\ Library [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^-?$ [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} ^(python[-.]?urllib|java/?[1-9]\.[0-9]) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "User-Agent: Mozilla" [NC,OR]
RewriteCond %{HTTP_COOKIE}% s:(.*):\%22test1\%22\%3b [NC]
RewriteRule .* - [F]

[wilderness]

RewriteCond %{HTTP_USER_AGENT} ^libwww-perl/[0-9] [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Indy\ Library [NC,OR]

These two lines are included and may be omitted.
Under the following condition:

perl|Indy|
-------
RewriteCond %{HTTP_USER_AGENT} ^(python[-.]?urllib|java/?[1-9]\.[0-9]) [NC,OR]

This line included and may be omitted under the following conditions:

python|urllib|java

[wilderness]

Wish I could edit my posts.

You may edit posts under the following conditions:
1) a subsequent reply has not taken place
2) condition 1) above and a specific time frame (minutes)

[cyberdyne]

You may edit posts under the following conditions:

I wasn't aware, I'll bear that in mind for future.

Many thanks again for your help.