Is this a botnet attack?

admin/file_manager.php/login.php

[grandma genie]

Hi guys,

My server logs show this type of attempt over and over again, which has been going on for at least a month. Hackers are getting served a 403 every time. Is this a botnet attack, or is it something else? Examples of attempts shown below:

91.149.157.nn - - [29/May/2011:04:43:54 -0400] "GET /osc/admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051219 SeaMonkey/1.0b"
74.50.20.nn - - [29/May/2011:05:02:55 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/3.0 (X11; I; SunOS 5.4 sun4m)"
83.170.107.n - - [29/May/2011:05:02:58 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.9 sun4u; X11)"
217.171.213.nnn - - [29/May/2011:08:40:19 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.9 sun4u; X11)"
91.103.4.n - - [29/May/2011:10:36:13 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1"
213.137.57.n - - [29/May/2011:10:36:22 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1"
173.201.35.nnn - - [29/May/2011:20:41:09 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)"
41.211.2.nn - - [29/May/2011:20:43:38 -0400] "GET /admin/file_manager.php/login.php HTTP/1.0" 403 4243 "-" "Mozilla/2.0 (compatible; MSIE 3.01; Windows 98)"
85.114.137.nn - - [29/May/2011:20:44:32 -0400] "GET /osc/admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/4.0 (compatible; MSIE 5.23; Mac_PowerPC)"
178.33.146.nnn - - [29/May/2011:22:27:10 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/4.61 (Macintosh; I; PPC)"

82.198.81.nnn - - [28/May/2011:07:49:04 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051219 SeaMonkey/1.0b"
168.143.5.nn - - [28/May/2011:11:04:44 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12"
217.171.213.nnn - - [28/May/2011:19:33:08 -0400] "GET /osc/admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
216.14.127.nn - - [28/May/2011:20:46:06 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.1) Gecko/20060130 SeaMonkey/1.0"
173.193.55.nnn - - [28/May/2011:00:28:42 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1"
94.23.204.nnn - - [28/May/2011:00:29:28 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; nl-NL; rv:1.7.5) Gecko/20041202 Firefox/1.0"

217.171.213.nnn - - [27/May/2011:20:25:25 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

205.234.187.nn - - [26/May/2011:08:46:35 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.1) Gecko/20060130 SeaMonkey/1.0"
87.106.252.n - - [26/May/2011:10:16:29 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/3.0 (X11; I; SunOS 5.4 sun4m)"
91.221.70.nn - - [26/May/2011:10:16:56 -0400] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)"
82.195.150.nnn - - [26/May/2011:10:27:48 -0400] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 4243 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"

The IPs are from all over the place. The user agents seem to be a recycled set. I only see the SeaMonkey on these types of hack attempts. So, are these attempts actually coming in from compromised machines? Should I notify the abuse departments?

-- grandma genie

[wilderness]

gg,
It's certainly an attempt to gain access to your PHP files.

All these requests resulted in 403's and despite the annoyance of "taking it on the cheek", you shouldn't be required to take any corrective actions.

These types of requests/attempts appear frequently, most are not re-occuring.

My server logs show this type of attempt over and over again, which has been going on for at least a month.

If you've the time?
You might take these types of requests from recent months logs
Copy them into another file
Sort by IP
Then deny these provider ranges in their entirety from you entire website (s), however that seems excessive work for requests that are already getting denied.

Don

[dstiles]

There are so many IPs in that short log that it's almost certainly a botnet being used in an attempt to break into your site, as Wilderness says.

The problem with botnets is: they contain both server farms (which you should block completely) and broadband/wireless IPs, which you can only block short term, unless you do not like the country they come from - but many are US, UK and Europe so not always practical.

A few weeks ago a botnet hit ONE of my customer's sites (a scrape attempt, not a hack) and used up something like 5000 IPs in doing so. Now THAT was something to waste my time! :(

[grandma genie]

Yes, I have been blocking the servers that are hosting these IPs. I have not seen any broadband/wireless IPs, at least not yet. They all seem to be coming from server farms. Is it worth it to report to the server host about these IPs? Or is that just a waste of time? Some have been The Planet, Soft Layer, GoDaddy and a host of others.

[incrediBILL]

I'd report them but the list you have is the worst. All their servers should be blocked in the first place.

[g1smd]

Timely thread. I just noticed a whole bunch of these requests in the logs.

[wilderness]

A few weeks ago a botnet hit ONE of my customer's sites (a scrape attempt, not a hack) and used up something like 5000 IPs in doing so. Now THAT was something to waste my time!

dstiles,
You may save oodles of time by simply denying the Class A's ;)

Don

[dstiles]

I wish I could. :)

Most IP Class A ranges contain traffic from many countries.

Some of my customers require US traffic (much of which I would love to ban, google included!), some require Asian or East European traffic, I require Australian and NZ traffic (which cuts out blocking APNIC ranges), I need Canadian and even some US traffic...

Sadly, the internet is in meltdown and has been going that way for some time now. :(

[wilderness]

I require Australian and NZ traffic (which cuts out blocking APNIC ranges),

hardly.

Check your sticky.

[wilderness]

I'm sorting through the Class B's of an A, because it blocked out a local university.
Most of the B's are RIPE or APNIC, which I'll deny. I'll even deny some of the US B's.

I've not been able to ARIN-WHOIS to work for months. I get an occasional result, however overall it's simply a "no results".
ARIN use to allow subnet searches which would easily provide a listing of the Class A's, rather than making individual requests for all 255. Believe I'm up to 90 in my "wasting time space" ;)

[dstiles]

Thanks for the list, wilderness, but please remember I do not have htaccess on my web server: I block using ranges entered into a MySQL database, which works well for my IIS server.

In any case the list you gave is not of Class A groupings, which is what I was responding to. :)

I have flags for certain countries so that as well as blocking by country on some of my sites I can also block according to grouping - eg all China, Korea, India, Indonesia etc; all Russia, Ukraine, Latvia etc. To reduce personal time I add IP ranges to the database, with country and flag, only as they attempt illegal/unwanted activity. This usually works well for me, although the botnet attack I mentioned above is an exception that resulted in many new broadband ranges as well as server ranges being added to the database (the 5000 referred to new IP ranges, not to every hit I got which was probably 8000+ or higher).

I have considered importing country ranges from nirsoft but so far time and patience are against me.

You obviously feel the same about Ripe as I do about Arin - block them! :) Being in the UK I can't do that except for some sites and some countries as noted above. I would love to block all of NL and DE but I can't. :(

Arin-Whois has been a disaster for several months now, ever since they changed its format. It is impossible even to discover a range's country without a LOT of hassle. As to them returning "not enough info" when asking about an exact IP or domain... Still, at least they are kind to mail/web spammers and other criminals. :(

Check nirsoft for IP ranges; also IANA ipv4 assignments, which was updated recently (again). It's amazing how many IPs are assigned to Arin. :(

If the country is not obvious from a simple linux-based Network Tools whois then I generally check the cnet in robtex, which shows the country beneath each IP listed (assuming something in the DNS has an A or similar record).

I also use robtex cnet as a first-line as to whether the IP range is server or broadband, assuming the DNS response doesn't say so; some do (ADSL, Broadband, Dedicated Server etc) but many don't, especially those of the "bad" countries.

Other useful tools are linux umit, which checks for open ports and such-like, and the anti-spam sites spamhaus (their SBL listing) and blacklistalert. Either of those sites can indicate whether an IP range is troublesome and I have blocked several ranges based on them. If blacklistalert flags UCE-Protect as having an entry it is worth following up to see what the range's overall status is considered to be.

[wilderness]

You want Class A's?

1(09|1[0-9]|2[0-6])
(144|20[23]|21[01]
15[01]
16[34]
18[7-9]
19[3-6]
20
20[01]
2(1[237-9]|2[0-2])
(5[789]|6[0-2])
7[789]
8(0|2|4|[6-9]) (Note; 81, 83, and 85 may also be added here, however I've allowed exceptions)
9([0-5])


What I provided to you privately was something I put a lot of time into.
Exceptions to the Class A's ((144|20[23]|21[01]|61) of APNIC that are specific to a region.

The data lines have never been exposed here in the open format at Webmaster World, nor do I wish them exposed. The ranges were gathered, sorted, condensed and then converted to regex.

I've found a close-sister alternative to ARIN, however it is absent the subnet searches, which I utilized and and in some previous instances, even saved.

For more than ten years, my websites were highly-content-focused and furthermore focused upon the audience of North America (excluding Mexico). There was simply no benefit to allowing access to non-NA's, and when all the spiders, harvesters and other pests began their hogging and/or cache, I implemented restrictions.
The capability to expand the focus of those ranges brought me to SSID in 2000.

Today, I'm working with two websites that are even more locally focused than my previous websites. There's simply no benefit to visitors beyond a "stone's throw".

[wilderness]

I would love to block all of NL and DE but I can't.

I've some longtime correspondents in Sweden, Denmark, Norway, Finland and perhaps a few other countries in that region.

The EURO internet provided ranges work in a very different manner than North America.
In NA, a subscribers IP generally restricted to a small range (frequently in the same Class D), no matter how frequently the connection is established.

In EURO a user may have a different Class A or B as their connection varies. The C's and D's may also change at a faster rate.
There's simply no pattern or frequency, however considering my aforementioned lack of focus on RIPE, I haven't really concentrated.

[dstiles]

I appreciate your sending me the ranges but, as I said, I can't implement them on my server for the reasons given. :(

I am probably mis-interpreting Class A - I always understood that Class A was /8 whereas some of those in your list are smaller ranges. Am I mistaken? It's quite possible. :)

Interesting to know about the restricted IP range for NA. As you say, here in the UK most IPs change when the router connection is dropped and sometimes the IP change can be huge - I had one got locked out of our mail server for changing from 213.#*$! to 2.#*$! - I had to enable a whole new range for him on the POP3 server. I recommend my customers to keep their routers on even if they turn off their computers overnight: that usually keeps the IP alive.

Me, I have a fixed IP - have done for about ten years. Good and bad: good in that I can easily set up loopholes on external servers and enable test sites on our local demo server for customers; bad because we're easily tracked by (eg) google - inaccurately as they place us a couple of hundred miles from where we live. :)

[wilderness]

Class A's were listed in #:4321818 response.

"smaller ranges", were object-exceptions to Class A's in the sticky.

[dstiles]

Yes, I saw the Class A's there. I appreciated seeing the Ripe ones, as well. :)

I mis-read the "exceptions". :(

[pageoneresults]

I appreciate your sending me the ranges but, as I said, I can't implement them on my server for the reasons given.

Yes you can. IIS can be made to behave just like Apache.

[dstiles]

No it can't. Not on a virtual server on 2003. It costs far too much because MS do not provide htaccess-like support. That is only something they recently provided - another failure on their part (MSDOS: take all the best bits of Unix and CPM, throw them away and use what's left).

In order to provide htaccess-like support I have to pay per-site for a proproetary version. Which is why I set up my own interception which works well even though it requires a database to provide the IP ranges to block.

If I had to begin again I would choose linux servers (which is what I began hosting on) and ignore people who said, "SQL and ASP are easy to use on IIS". By the time I realised it wasn't the whole of it I already had a sizeable code library in ASP. :(

[g1smd]

From the same IPs, other requests are now appearing:

GET /What's_New/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1

GET /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1

with 'categories' in place of 'filemanager'.

[pageoneresults]

No it can't. Not on a virtual server on 2003. It costs far too much because MS do not provide htaccess-like support.

Yes it can. ISAPI_Rewrite - been using it for years on IIS. I fiddle with those .htaccess files on occasion although I leave most of it up to me Dev. Our Windows Servers behave just like Apache - for the most part.

If I had to begin again I would choose linux servers (which is what I began hosting on) and ignore people who said, "SQL and ASP are easy to use on IIS".

Me too! It all started in 1994/1995 for me and I didn't know jack about any of this. Still don't! ;)

[dstiles]

What version Windows/IIS? ISAPI_Rewrite was only available, as far as I know, on later than 2003 or, as I said, as an expensive add-on.

[pageoneresults]

ISAPI_Rewrite 3.0 is a one time purchase of $99.00 per server. It doesn't matter what version of Windows/IIS as long as it isn't ancient. There are two versions of ISAPI_Rewrite, 2.0 and 3.0. The 3.0 version uses .htaccess.

[dstiles]

Thanks for the info.

I found it on the Helicon site - is that the one?

When I first began looking, about eight or nine years ago (and with Windows 2000), I don't remember Helicon. There was a UK version I looked at and I know that one was expensive for several sites, one copy per site, as I remember - or at least per IP). Which was why I then began a home-grown ASP version which works well and without having to worry about getting a regex wrong. :)

What, I wonder, in the Helicon context, constitutes a "server"? A single computer or a single IP? I can't find the definition on their web site but it looks as if it's machine-wide.

Sadly, it's a bit late anyway now. It would mean disruption of a working server and a lot of time spent working up new blocking code with regex, with which I am only marginally conversant. That isn't going to happen until I move to a new server, and by that time I may have few enough sites to revert to Linux.

But again, thanks for the enlightenment! Much appreciated. :)