Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4

[Mon Oct 10 22:35:18 2011] [error] [client] (36)File name too long: access to /forums/index.php++++++++++++++++++++++++++++++++Result:+%e8%f1%ef%ee%eb%fc%e7%ee%e2%e0%ed+%ed%e8%ea%ed%e5%e9%ec+%22immultusa%22%3b+%e7%e0%f0%e5%e3%e8%f1%f2%f0%e8%f0%ee%e2%e0%eb%e8%f1%fc+(%e2%ea%eb%fe%f7%e5%ed+%f0%e5%e6%e8%ec+%f2%ee%eb%fc%ea%ee+%f0%e5%e3%e8%f1%f2%f0%e0%f6%e8%e8)%3b failed, referer:
share|improve this question

1 Answer 1

up vote 11 down vote accepted

Probably someone trying to create an account on your forum and proceed to spam it.

I read about it here:

When you URL decode the string two times and google the string you find a lot of spam on different forums.

URL Decoded one time:

èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî ðåãèñòðàöèè); 
failed, referer:

URL Decoded twice:

èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî ðåãèñòðàöèè); 
failed, referer:                                
Result: èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî 
share|improve this answer
Also, the garbled-looking text appears to be in the CP1251 encoding, and says использован никнейм "immultusa"; зарегистрировались (включен режим только регистрации). Alas, I don't really speak Russian, but it seems to be saying something about the nickname "immultusa" being already registered. – Ilmari Karonen Oct 15 '11 at 16:50
Ah thanks, I was wondering about the garbled text... how did you know it was in that encoding? – Steven Oct 16 '11 at 9:43
It looked like URL encoding based on experience of seeing url encoded text before. Then I just dumped it into Burp Suite decoder and chose URL decode and it gave me more sensible data. Thanks to @Ilmari Karonen for discovering the character encoding – Chris Dale Oct 16 '11 at 10:02
@Steven: It looked like some 8-bit encoding for non-Latin text. I actually first thought it might be KOI8, but that didn't yield anything meaningful, so I wrote a quick Perl one-liner to print it using all the encodings supported by Encode::Byte and eyeballed the results to see which one made sense. – Ilmari Karonen Oct 16 '11 at 15:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.