Hack attempt ?

Client Joined: Dec 24, 2004 Posts: 194 Location: Michigan

to me it looks like a hack attempt ...too me anytime an sql query shows an insert or update then my assumption woould be correct right unless it was me of course...and theres somewhere around 2475 lines of this all from the same IP and sentinal did not catch it either..i see they tried again today..see the date stamp in the last code box

dblog file shows multiple attempts of

Code:

April 18, 2008, 12:51 pm 2006 : MySQL server has gone away


SQL was: UPDATE nuke_counter SET count=count+1 WHERE (type='total' AND var='hits') OR (var='Other' AND type='browser') OR (var='Other' AND type='os')


 remote addr: 131.107.151.157

Code:

April 18, 2008, 12:51 pm 2006 : MySQL server has gone away


SQL was: SELECT year FROM nuke_stats_year WHERE year='2008'


 remote addr: 131.107.151.157

Code:

April 18, 2008, 12:51 pm 2006 : MySQL server has gone away


SQL was: INSERT INTO nuke_stats_year VALUES ('2008','0')


 remote addr: 131.107.151.157

Code:

April 18, 2008, 12:51 pm 2006 : MySQL server has gone away


SQL was: INSERT INTO nuke_stats_date VALUES ('2008','1','1','0')


 remote addr: 131.107.151.157

Code:

April 18, 2008, 12:51 pm 2006 : MySQL server has gone away


SQL was: INSERT INTO nuke_stats_hour VALUES ('2008','04','18','11','0')


 remote addr: 131.107.151.157

Code:

April 22, 2008, 4:13 pm 2006 : MySQL server has gone away


SQL was: UPDATE nuke_stats_hour SET hits=hits+1 WHERE (year='2008') AND (month='04') AND (date='22') AND (hour='16')


 remote addr: 131.107.151.157

Posted: Tue Apr 22, 2008 8:54 pm

AS far as I can tell, it is just updating the stats used for the Statistics module. Maybe multiple attempts by the script because "MySQL server has gone away"

Posted: Tue Apr 22, 2008 8:58 pm

hmm ok each statement does show an incremented number or sets of numbers and the ip comes back as microsoft so maybe it was a bot/crawler looking around ?

not sure why the db wouldve been unavailable tho

Posted: Wed Apr 23, 2008 9:07 am

More than likely a bot or series of bots - I have never heard of someone attempting to hack a site by adding to its stats... unless someone wanted you to think your site was visited more than it actually was...

-sting

Posted: Wed Apr 23, 2008 6:50 pm

thanks for the replies much appreciated