Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It looks like someone is trying to hack my site. The following comes from my IIS log files:

#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-07-03 00:02:39
#Fields: date time s-sitename cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2011-07-03 18:29:05 W3SVC111 GET /V20xRmRRPT0K - 80 - 83.140.8.18 - 302 0 0 458 145 786
2011-07-03 18:29:06 W3SVC111 GET /scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 468 151 617
2011-07-03 18:29:06 W3SVC111 GET /admin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 480 157 132
2011-07-03 18:29:08 W3SVC111 GET /admin/pma/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 161 2407
2011-07-03 18:29:08 W3SVC111 GET /admin/phpmyadmin/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 168 181
2011-07-03 18:29:08 W3SVC111 GET /db/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 474 154 259
2011-07-03 18:29:09 W3SVC111 GET /dbadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 484 159 371
2011-07-03 18:29:09 W3SVC111 GET /myadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 484 159 357
2011-07-03 18:29:09 W3SVC111 GET /mysql/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 480 157 197
2011-07-03 18:29:10 W3SVC111 GET /mysqladmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 310
2011-07-03 18:29:10 W3SVC111 GET /typo3/phpmyadmin/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 168 103
2011-07-03 18:29:10 W3SVC111 GET /phpadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 486 160 56
2011-07-03 18:29:10 W3SVC111 GET /phpMyAdmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 139
2011-07-03 18:29:10 W3SVC111 GET /phpmyadmin/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 490 162 87
2011-07-03 18:29:10 W3SVC111 GET /phpmyadmin1/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 492 163 51
2011-07-03 18:29:10 W3SVC111 GET /phpmyadmin2/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 492 163 98
2011-07-03 18:29:10 W3SVC111 GET /pma/scripts/setup.php - 80 - 83.140.8.18 - 302 0 0 476 155 55
2011-07-03 18:29:10 W3SVC111 GET /web/phpMyAdmin/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 166 53
2011-07-03 18:29:10 W3SVC111 GET /xampp/phpmyadmin/scripts/setup.php - 80 - 83.140.8.18 - 404 0 0 1457 168 52

What should I do with this? Should I go to the police with it? Any good advice is welcome.

share|improve this question
add comment

4 Answers

up vote 11 down vote accepted

I suggest to just ignore it, it's not worth the trouble. There are way too many infected machines out there.

If you have too much time at hand, you can do a whois query on the ip-address. Then contact the ISP, telling them that they have an infected customer. The email address to contact is usually "abuse@" domain.

In this case whois 83.140.8.18 even returns a comment saying:

In case of abuse, send mail to abuse (at) rixtelecom.se

share|improve this answer
    
Which whois are you using? Doing a whois lookup was the first thing I did, but I did not see that notice. I looked at ip-adress.com/whois/83.140.8.18 and it does not mention rixtelecom.se at all? The most I got was Server Location: Rock, Lancashire in United Kingdom, ISP: Phonera Networks AB –  Louis Somers Jul 3 '11 at 19:58
3  
I personally use the command line tool. heise.de/netze/tools/whois-abfrage for examples shows your the real output. ip-address.com obviously tries to do something smart with the whois output and fails miserably. –  Hendrik Brummermann Jul 3 '11 at 20:14
    
Thanks, I did mail the ISP, can I expect to see many of these attacks? The site has only been online for a week now. Also what do you mean with "infected machines"? Are there viruses that do this to any site the user visits or something like that? –  Louis Somers Jul 3 '11 at 22:34
4  
@louis Unfortunately, you can expect to see a huge variety of attacks, many of which are simply random attacks from the huge percentage of home user machines which have been taken over by a "botnet", against any server out there. –  nealmcb Jul 4 '11 at 16:08
add comment

I would not bother going to the police with it. This is a common scanning on your IP which happens to most public facing IP's out there.

As Hendrik Brummermann sais it can be worth reporting the IP to the ISP's abuse departement.

You can also block the IP by adding a route to /dev/null from that IP or blocking it in firewall.

share|improve this answer
add comment

Contact the user ISP as everyone said.

You can also use knowledge of this particular attack to harden your security and tune the firewall rules. Like limiting the number of request to the same page by unique IP or so on. Many example on google should help you determine the best for you.

This should address future attacks and lower the bandwidth used.

share|improve this answer
    
Thanks, I'm considering to do something with the 404 page, like if there are 10 hits from the same IP within one second, make sure the IP will only get 404's even if a page does exist. It might backfire on me if a searchengine-bot starts getting those. Maybe with some extra rules like if the url contains "admin", "setup" or "install". I'm on shared hosting so I guess (hope) the firewall stuff is ok. –  Louis Somers Jul 4 '11 at 18:20
1  
I would consider dropping packets. Don't bother for scripties... –  M'vy Jul 4 '11 at 19:26
add comment

I don't see anything illegal here. If you want to report everyone who queries a non-existing path, you'll be quite busy in the future.

His ISP will laugh at you.

share|improve this answer
2  
If you look at the logs it is clear he's trying some standard paths to see if a setup directory has been left behind after installation. If you found someone trying a whole bunch of keys at your front door... maybe that's not illegal, but then, would it make you feel comfertable? –  Louis Somers Jul 4 '11 at 14:38
4  
The computer scanning might be infected. The ISP may send their customer an notice about this and help their customer clean up. –  Chris Andrè Dale Jul 4 '11 at 16:45
    
The magenta coloured ISP in Germany (one of the largest) is known to contact customers about infected machines. –  Hendrik Brummermann Jul 5 '11 at 18:24
1  
Legality depends on the location and jurisdiction of the server, the owner of the server, the adversary, the ISP for the server, and the ISP for the adversary. Unless you are an expert in international computing law, I would be careful about making judgments on the legality of actions. –  this.josh Aug 3 '11 at 0:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.