Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Various IP addresses call various domains looking for various paths that might lead to PHP My Admin/scripts/setup.php

One of those IP addresses is 74.63.212.48 which I just now found out I could navigate to shows a page in Chinese titled

Rinchen technology overseas VPS - PHP probe

A very effective translation can be achieved using Google Chrome. It will translate the live results as they come in. It is also available via domain name 8242.cn. However, although it is Chinese, it seems to be hosted within the US, and around the world. (assuming it is all the same thing)

Generally, it seems to list status information, PHP build, processor, ram, etc. linux version, uptime, clock, information on the features enabled for PHP, database. It also provides

MySQL database connection detection

which asks for address, port, user, pass and has a "MySQL Test" button

Function testing
Enter the function you want to test:

and also

Mail detection
Please enter your email address to test:

I find this program very annoying since it floods our logs with high amounts of traffic that I consider it an attack. Actually, we don't run PHP, so I am not much concerned, but we have blocked several of these IPs anyway, especially the ones that are overseas and hardly likely to serve legitimate users.

Does anybody know who runs these systems? Somebody must be putting considerable effort into getting a list of all instances of PHP MyAdmin setup.php. I was hoping there would be more information available from you guys. This is very annoying that the program keeps popping up on new IPs. All I know so far is it is Chinese....

share|improve this question
2  
    
Instead of making up some strange conspiricy theories, you should keep in mind that China is the country with largest population. Having that in mind it is quite surprising that most attacks and most SPAM originate in the USA. –  Hendrik Brummermann Sep 13 '11 at 5:49
    
IP addresses can be spoofed. Without coroberating evidence you don't know where the packets are coming from. –  this.josh Sep 15 '11 at 19:57
    
@this.josh, That would be quite a spoof. Not only do the incoming connections read that IP address (shown in the logs), but also the connection to that IP address brings up a page that suggests that the IP is dedicated to PHP probing. The only thing I can think of that allows that is a severely open proxy. Is that possibly the case? Or, is there some other IP spoofing trick? Or perhaps this is just an intentional install or infected machine as I suspect? Or are you suggesting the IP is correct, it is just the country that might be incorrect? –  George Bailey Sep 15 '11 at 22:49
add comment

1 Answer

up vote 1 down vote accepted

probes for phpmyadmin setup scripts are really just a fact of life at the moment if you run a web facing web server. I wouldn't assign too much significance to the locale that they come from .

As far as I'm aware it's just pretty much blind scanning looking for known vulnerable software. I get it on a regular basis on my web server even though I don't (and never have) run phpmyadmin on it.

After ensuring that you're not running it on the host(s) in question I'd recommend just filtering it out of the alerts that you're getting.

share|improve this answer
    
A tool which could be useful to automatically react to thoses probes would be mod_security for apache, see : modsecurity.org/projects and owasp.org/index.php/… –  Shadok Sep 20 '11 at 13:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.