Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 8 down vote favorite
2

It looks like someone is trying to hack my site. The following comes from my IIS log files:

#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-07-03 00:02:39
#Fields: date time s-sitename cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2011-07-03 18:29:05 W3SVC111 GET /V20xRmRRPT0K - 80 - 83.140.8.18 - 302 0 0 458 145 786
2011-07-03 18:29:06 W3SVC111 GET /scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 468 151 617
2011-07-03 18:29:06 W3SVC111 GET /admin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 480 157 132
2011-07-03 18:29:08 W3SVC111 GET /admin/pma/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 161 2407
2011-07-03 18:29:08 W3SVC111 GET /admin/phpmyadmin/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 168 181
2011-07-03 18:29:08 W3SVC111 GET /db/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 474 154 259
2011-07-03 18:29:09 W3SVC111 GET /dbadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 484 159 371
2011-07-03 18:29:09 W3SVC111 GET /myadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 484 159 357
2011-07-03 18:29:09 W3SVC111 GET /mysql/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 480 157 197
2011-07-03 18:29:10 W3SVC111 GET /mysqladmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 310
2011-07-03 18:29:10 W3SVC111 GET /typo3/phpmyadmin/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 168 103
2011-07-03 18:29:10 W3SVC111 GET /phpadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 486 160 56
2011-07-03 18:29:10 W3SVC111 GET /phpMyAdmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 139
2011-07-03 18:29:10 W3SVC111 GET /phpmyadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 87
2011-07-03 18:29:10 W3SVC111 GET /phpmyadmin1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 492 163 51
2011-07-03 18:29:10 W3SVC111 GET /phpmyadmin2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 492 163 98
2011-07-03 18:29:10 W3SVC111 GET /pma/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 476 155 55
2011-07-03 18:29:10 W3SVC111 GET /web/phpMyAdmin/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 166 53
2011-07-03 18:29:10 W3SVC111 GET /xampp/phpmyadmin/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 168 52
2011-07-03 18:29:10 W3SVC111 GET /web/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 476 155 53
2011-07-03 18:29:10 W3SVC111 GET /php-my-admin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 494 164 51
2011-07-03 18:29:10 W3SVC111 GET /websql/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 482 158 57
2011-07-03 18:29:10 W3SVC111 GET /phpmyadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 54
2011-07-03 18:29:10 W3SVC111 GET /phpMyAdmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 494 164 51
2011-07-03 18:29:11 W3SVC111 GET /php-my-admin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 494 164 51
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.2.3/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.2.6/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.4/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.5-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.5-rc2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.5/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 53
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.5-pl1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.6-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 51
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.6-rc2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.6/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 51
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.7/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 51
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.5.7-pl1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.6.0-alpha/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 514 174 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.6.0-alpha2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 516 175 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.6.0-beta1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 514 174 51
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.6.0-beta2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 514 174 52
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.6.0-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 51
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.6.0-rc2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 77
2011-07-03 18:29:11 W3SVC111 GET /phpMyAdmin-2.6.0-rc3/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 53
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.0/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 53
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.0-pl1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 53
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.0-pl2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.0-pl3/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 51
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.1-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.1-rc2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 51
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.1-pl1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.1-pl2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 51
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.1-pl3/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.2-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.2-beta1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 514 174 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.2-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 51
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.2-pl1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.3/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.3-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.3/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 50
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.3-pl1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 51
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.4-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 51
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.4-pl1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:12 W3SVC111 GET /phpMyAdmin-2.6.4-pl2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.6.4-pl3/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.6.4-pl4/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 51
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.6.4/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 51
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.7.0-beta1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 514 174 51
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.7.0-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.7.0-pl1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 51
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.7.0-pl2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 53
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.7.0/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 52
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.0-beta1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 514 174 57
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.0-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 53
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.0-rc2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.0/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 51
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.0.1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 506 170 52
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.0.2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 506 170 52
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.0.3/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 506 170 51
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.0.4/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 506 170 51
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.1-rc1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 510 172 52
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 52
2011-07-03 18:29:13 W3SVC111 GET /phpMyAdmin-2.8.2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 502 168 53
2011-07-03 18:29:13 W3SVC111 GET /sqlmanager/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 51
2011-07-03 18:29:13 W3SVC111 GET /mysqlmanager/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 494 164 50
2011-07-03 18:29:13 W3SVC111 GET /p/m/a/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 157 53
2011-07-03 18:29:13 W3SVC111 GET /PMA2005/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 484 159 52
2011-07-03 18:29:14 W3SVC111 GET /pma2005/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 484 159 52
2011-07-03 18:29:14 W3SVC111 GET /phpmanager/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 51
2011-07-03 18:29:14 W3SVC111 GET /php-myadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 492 163 52
2011-07-03 18:29:14 W3SVC111 GET /phpmy-admin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 492 163 51
2011-07-03 18:29:14 W3SVC111 GET /webadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 486 160 51
2011-07-03 18:29:14 W3SVC111 GET /sqlweb/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 482 158 50
2011-07-03 18:29:14 W3SVC111 GET /websql/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 482 158 51
2011-07-03 18:29:14 W3SVC111 GET /webdb/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 480 157 51
2011-07-03 18:29:14 W3SVC111 GET /mysqladmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 51
2011-07-03 18:29:14 W3SVC111 GET /mysql-admin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 492 163 51
2011-07-03 18:29:14 W3SVC111 GET /databaseadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 496 165 52
2011-07-03 18:29:14 W3SVC111 GET /admm/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 478 156 52
2011-07-03 18:29:14 W3SVC111 GET /admn/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 478 156 12

What should I do with this? Should I go to the police with it? Any good advice is welcome.

share|improve this question

4 Answers

up vote 11 down vote accepted

I suggest to just ignore it, it's not worth the trouble. There are way too many infected machines out there.

If you have too much time at hand, you can do a whois query on the ip-address. Then contact the ISP, telling them that they have an infected customer. The email address to contact is usually "abuse@" domain.

In this case whois 83.140.8.18 even returns a comment saying:

In case of abuse, send mail to abuse (at) rixtelecom.se

share|improve this answer
Which whois are you using? Doing a whois lookup was the first thing I did, but I did not see that notice. I looked at ip-adress.com/whois/83.140.8.18 and it does not mention rixtelecom.se at all? The most I got was Server Location: Rock, Lancashire in United Kingdom, ISP: Phonera Networks AB – Louis Somers Jul 3 '11 at 19:58
3  
I personally use the command line tool. heise.de/netze/tools/whois-abfrage for examples shows your the real output. ip-address.com obviously tries to do something smart with the whois output and fails miserably. – Hendrik Brummermann♦ Jul 3 '11 at 20:14
Thanks, I did mail the ISP, can I expect to see many of these attacks? The site has only been online for a week now. Also what do you mean with "infected machines"? Are there viruses that do this to any site the user visits or something like that? – Louis Somers Jul 3 '11 at 22:34
3  
@louis Unfortunately, you can expect to see a huge variety of attacks, many of which are simply random attacks from the huge percentage of home user machines which have been taken over by a "botnet", against any server out there. – nealmcb Jul 4 '11 at 16:08
up vote 6 down vote

I would not bother going to the police with it. This is a common scanning on your IP which happens to most public facing IP's out there.

As Hendrik Brummermann sais it can be worth reporting the IP to the ISP's abuse departement.

You can also block the IP by adding a route to /dev/null from that IP or blocking it in firewall.

share|improve this answer
up vote 5 down vote

Contact the user ISP as everyone said.

You can also use knowledge of this particular attack to harden your security and tune the firewall rules. Like limiting the number of request to the same page by unique IP or so on. Many example on google should help you determine the best for you.

This should address future attacks and lower the bandwidth used.

share|improve this answer
Thanks, I'm considering to do something with the 404 page, like if there are 10 hits from the same IP within one second, make sure the IP will only get 404's even if a page does exist. It might backfire on me if a searchengine-bot starts getting those. Maybe with some extra rules like if the url contains "admin", "setup" or "install". I'm on shared hosting so I guess (hope) the firewall stuff is ok. – Louis Somers Jul 4 '11 at 18:20
1  
I would consider dropping packets. Don't bother for scripties... – M'vy Jul 4 '11 at 19:26
up vote 2 down vote

I don't see anything illegal here. If you want to report everyone who queries a non-existing path, you'll be quite busy in the future.

His ISP will laugh at you.

share|improve this answer
2  
If you look at the logs it is clear he's trying some standard paths to see if a setup directory has been left behind after installation. If you found someone trying a whole bunch of keys at your front door... maybe that's not illegal, but then, would it make you feel comfertable? – Louis Somers Jul 4 '11 at 14:38
4  
The computer scanning might be infected. The ISP may send their customer an notice about this and help their customer clean up. – Chris Andrè Dale Jul 4 '11 at 16:45
The magenta coloured ISP in Germany (one of the largest) is known to contact customers about infected machines. – Hendrik Brummermann♦ Jul 5 '11 at 18:24
1  
Legality depends on the location and jurisdiction of the server, the owner of the server, the adversary, the ISP for the server, and the ISP for the adversary. Unless you are an expert in international computing law, I would be careful about making judgments on the legality of actions. – this.josh Aug 3 '11 at 0:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.