Forum Moderators: phranque
[edited by: phranque at 4:05 pm (utc) on Nov 25, 2014]
[edit reason] exemplified domain [/edit]
I think I'm being hacked.
These IPs are from all over the globe.
Looks like they are probing my server and executing parts of the website that this server hosts.
Would someone please comment on what they see here, what could happen or my potential exposure,
and what I should do to prevent any destructive behavior.
1.2.172.71 - - [22/Nov/2014:22:55:20 -0500] "GET /bsbs/bsb/bs.php HTTP/1.1" 404 318
1.2.172.71 - - [22/Nov/2014:22:55:21 -0500] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 331
1.2.172.71 - - [22/Nov/2014:22:55:22 -0500] "GET /pma/scripts/setup.php HTTP/1.1" 404 324
1.2.172.71 - - [22/Nov/2014:22:55:23 -0500] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 328
66.135.34.113 - - [23/Nov/2014:06:48:05 -0500] "GET //cgi-bin/php.exe HTTP/1.1" 404 263
66.135.34.113 - - [23/Nov/2014:06:48:06 -0500] "GET //cgi-bin/php-cgi.exe HTTP/1.1" 404 264
66.135.34.113 - - [23/Nov/2014:06:48:06 -0500] "GET //cgi-bin/php5.exe HTTP/1.1" 404 263
66.135.34.113 - - [23/Nov/2014:06:48:07 -0500] "GET //cgi-bin/cgi.exe HTTP/1.1" 404 262
66.135.34.113 - - [23/Nov/2014:06:48:07 -0500] "GET //cgi-bin/php4.exe HTTP/1.1" 404 264
125.64.35.67 - - [23/Nov/2014:07:54:10 -0500] "GET http://6.example.cn/zc/chs/img/body.png HTTP/1.1" 404 259
218.164.97.122 - - [23/Nov/2014:00:56:40 -0500] "GET /ntnt/ntn/nt.php HTTP/1.1" 404 318
218.164.97.122 - - [23/Nov/2014:00:56:41 -0500] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 331
218.164.97.122 - - [23/Nov/2014:00:56:42 -0500] "GET /pma/scripts/setup.php HTTP/1.1" 404 324
218.164.97.122 - - [23/Nov/2014:00:56:43 -0500] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 32866.135.32.0 - 66.135.63.255
CIDR: 66.135.32.0/19
Organization: ServerBeach (SERVER-17)
deny from 66.135.32.0/19
I would work on getting them to show that
I'm on Windows 7 platform using Apache/2.0.64 (Win32,) mod_perl/2.0.3, and Perl/v5.8.3. I work with the firewall down because my application does not seem to be visible to the WWW with it up (probably my understanding). I run MSE all the time and MalwareBytes regularly.and I thought it might be a personal preference setting that could be adjusted.
SetEnvIf Request_URI "\.(jpg|css|png|js)$" dontlog
CustomLog logs/access_log common env=!dontlog
[edited by: phranque at 7:13 pm (utc) on Nov 26, 2014]
[edit reason] no specifics, please [/edit]
I don't want to deny access by IP address because requests to look at a part of my website could come from anywhere, client wise.
Allow from example.no-ip robots.txt
making extra work for the webmaster
I am using Apache 2.0.64
207.46.132.96
Whois (do a google on WHOIS) gives you this information:
Don't bother with blocking one IP to stop bots, they just come in with another IP on the same server. For example, if you do a whois lookup for "66.135.34.113" you can see that it is coming from "ServerBeach" so you know it is not a person visiting your site. Whois gives you this information:
So to block that robot and any others from that server you use:
deny from 66.135.32.0/19
Can I identify IP blocks that cracker organizations employ in any way other than looking for recurring patterns in the high order parts of IPs in my error and access logs? Is there perhaps an organizations that tracks cracker IPs or IP blocks?
FWIW, it appears to me that your lacking in the experience to determine what visitors within your access logs are beneficial and/or detrimental.
It's a learned process, and there is not a copy and paste solution.
This document refers to the 2.0 version of Apache httpd, which is no longer maintained. Upgrade, and refer to ...
Allow from all|host|env=[!]env-variable [host|env=[!]env-variable] ... Allow from qiniq.ca robots.txt
Allow from qiniq.ca
Allow from robots.txt
<Files "robots.txt">
Order Allow,Deny
Allow from all
</Files>
I would like to block PHP activity. I'm not using PHP at this time.
RewriteCond %{HTTP_REFERER} example\.com/?$
RewriteCond %{REQUEST_URI} !index\.html
RewriteCond %{REQUEST_URI} !/boilerplate/
RewriteRule ^([^/.]+/)+[^/.]+(\.html|/)$ - [F,NS]
RewriteCond %{THE_REQUEST} \.php
RewriteCond %{REQUEST_URI} !(Eskimo|fun/panda)
RewriteRule \.php - [F,NS]
