Che diavolo è questa voce di registro in Apache?

Question

Che diavolo è questa voce di registro in Apache?

#1 da (11 voti)

5

error.log - Apache / 2.2.17 (Unix) mod_ssl / 2.2.17 OpenSSL / 0.9.8g mod_fastcgi / 2.4.6 mod_fcgid / 2.3.4

[Mon Oct 10 22:35:18 2011] [error] [client 91.212.226.95] (36)File name too long: access to /forums/index.php++++++++++++++++++++++++++++++++Result:+%e8%f1%ef%ee%eb%fc%e7%ee%e2%e0%ed+%ed%e8%ea%ed%e5%e9%ec+%22immultusa%22%3b+%e7%e0%f0%e5%e3%e8%f1%f2%f0%e8%f0%ee%e2%e0%eb%e8%f1%fc+(%e2%ea%eb%fe%f7%e5%ed+%f0%e5%e6%e8%ec+%f2%ee%eb%fc%ea%ee+%f0%e5%e3%e8%f1%f2%f0%e0%f6%e8%e8)%3b failed, referer: http://xxxxxx.org/forums/index.php%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2BResult:%2B%25e8%25f1%25ef%25ee%25eb%25fc%25e7%25ee%25e2%25e0%25ed%2B%25ed%25e8%25ea%25ed%25e5%25e9%25ec%2B%2522immultusa%2522%253b%2B%25e7%25e0%25f0%25e5%25e3%25e8%25f1%25f2%25f0%25e8%25f0%25ee%25e2%25e0%25eb%25e8%25f1%25fc%2B%28%25e2%25ea%25eb%25fe%25f7%25e5%25ed%2B%25f0%25e5%25e6%25e8%25ec%2B%25f2%25ee%25eb%25fc%25ea%25ee%2B%25f0%25e5%25e3%25e8%25f1%25f2%25f0%25e0%25f6%25e8%25e8%29%253b

apache forensics

posta Steven 15.10.2011 - 10:35

fonte

1 risposta

Leggi altre domande sui tag apache forensics

Codice di verifica SMS e messaggio di risposta [duplicato] Come difendermi dagli hacks noti di php

score 11 · Accepted Answer

Probabilmente qualcuno sta cercando di creare un account sul tuo forum e procedere allo spam.

Ne ho letto qui: link

Quando l'URL decodifica la stringa due volte e la stringa di google trova un sacco di spam su diversi forum.

URL decodificato una volta:

èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî ðåãèñòðàöèè); 
failed, referer: http://xxxxxx.org/forums
/index.php++++++++++++++++++++++++++++++++Result:+%e8%f1%ef%ee%eb%fc%e7%ee%e2%e0%ed+%ed
%e8%ea%ed%e5%e9%ec+%22immultusa%22%3b+%e7%e0%f0%e5%e3%e8%f1%f2%f0%e8%f0%ee%e2%e0%eb%e8
%f1%fc+(%e2%ea%eb%fe%f7%e5%ed+%f0%e5%e6%e8%ec+%f2%ee%eb%fc%ea%ee+%f0%e5%e3%e8%f1%f2
%f0%e0%f6%e8%e8)%3b

URL decodificato due volte:

èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî ðåãèñòðàöèè); 
failed, referer: http://xxxxxx.org/forums/index.php                                
Result: èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî 
ðåãèñòðàöèè);