Welcome to WebmasterWorld Guest from 54.145.166.247

Forum Moderators: Ocean10000 & incrediBILL

Message Too Old, No Replies

Novel User Agent

Made by ZmEu @ WhiteHat Team - www.whitehat.ro

   
6:03 pm on Feb 2, 2012 (gmt 0)

WebmasterWorld Senior Member dstiles is a WebmasterWorld Top Contributor of All Time 5+ Year Member



This User-Agent hit my server about 500 hundred in 8 minutes in one of those php admin/manager/etc attacks - what can we break now kind of thing. Hit most of the sites on the server as far as I can tell: they usually do.

Full UA: Made by ZmEu @ WhiteHat Team - www(.)whitehat(.)ro
(parentheses added around dots to discourage the sods)

IP: 83.170.113.208 - UK2 hosting - same as mine :(

Action: completely non-white-hat.

Common enough recently but the UA is (in my experieice) unusual.
11:53 pm on Feb 2, 2012 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member



It's old, and bad. [webmasterworld.com...]

Its names range from the short -- ZmEu -- to the long version you saw, and in-between. I see it maybe three, four times a month across as many sites, literally from all over (.com, .ro, .ru, .jp, etc).

Basically it's just another exploit that aims to get its hooks into any machine anywhere and wreak havoc everywhere.
9:15 pm on Feb 3, 2012 (gmt 0)

WebmasterWorld Senior Member dstiles is a WebmasterWorld Top Contributor of All Time 5+ Year Member



Thanks. Hadn't conciously noticed it before. Perhaps it only popped up here two or three times before instead of hundreds.