Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4

[Mon Oct 10 22:35:18 2011] [error] [client 91.212.226.95] (36)File name too long: access to /forums/index.php++++++++++++++++++++++++++++++++Result:+%e8%f1%ef%ee%eb%fc%e7%ee%e2%e0%ed+%ed%e8%ea%ed%e5%e9%ec+%22immultusa%22%3b+%e7%e0%f0%e5%e3%e8%f1%f2%f0%e8%f0%ee%e2%e0%eb%e8%f1%fc+(%e2%ea%eb%fe%f7%e5%ed+%f0%e5%e6%e8%ec+%f2%ee%eb%fc%ea%ee+%f0%e5%e3%e8%f1%f2%f0%e0%f6%e8%e8)%3b failed, referer: http://xxxxxx.org/forums/index.php%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2BResult:%2B%25e8%25f1%25ef%25ee%25eb%25fc%25e7%25ee%25e2%25e0%25ed%2B%25ed%25e8%25ea%25ed%25e5%25e9%25ec%2B%2522immultusa%2522%253b%2B%25e7%25e0%25f0%25e5%25e3%25e8%25f1%25f2%25f0%25e8%25f0%25ee%25e2%25e0%25eb%25e8%25f1%25fc%2B%28%25e2%25ea%25eb%25fe%25f7%25e5%25ed%2B%25f0%25e5%25e6%25e8%25ec%2B%25f2%25ee%25eb%25fc%25ea%25ee%2B%25f0%25e5%25e3%25e8%25f1%25f2%25f0%25e0%25f6%25e8%25e8%29%253b
share|improve this question
add comment

1 Answer

up vote 11 down vote accepted

Probably someone trying to create an account on your forum and proceed to spam it.

I read about it here: http://www.projecthoneypot.org/ip_95.168.162.43

When you URL decode the string two times and google the string you find a lot of spam on different forums.

URL Decoded one time:

èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî ðåãèñòðàöèè); 
failed, referer: http://xxxxxx.org/forums
/index.php++++++++++++++++++++++++++++++++Result:+%e8%f1%ef%ee%eb%fc%e7%ee%e2%e0%ed+%ed
%e8%ea%ed%e5%e9%ec+%22immultusa%22%3b+%e7%e0%f0%e5%e3%e8%f1%f2%f0%e8%f0%ee%e2%e0%eb%e8
%f1%fc+(%e2%ea%eb%fe%f7%e5%ed+%f0%e5%e6%e8%ec+%f2%ee%eb%fc%ea%ee+%f0%e5%e3%e8%f1%f2
%f0%e0%f6%e8%e8)%3b

URL Decoded twice:

èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî ðåãèñòðàöèè); 
failed, referer: http://xxxxxx.org/forums/index.php                                
Result: èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî 
ðåãèñòðàöèè);
share|improve this answer
3  
Also, the garbled-looking text appears to be in the CP1251 encoding, and says использован никнейм "immultusa"; зарегистрировались (включен режим только регистрации). Alas, I don't really speak Russian, but it seems to be saying something about the nickname "immultusa" being already registered. –  Ilmari Karonen Oct 15 '11 at 16:50
    
Ah thanks, I was wondering about the garbled text... how did you know it was in that encoding? –  Steven Oct 16 '11 at 9:43
1  
It looked like URL encoding based on experience of seeing url encoded text before. Then I just dumped it into Burp Suite decoder and chose URL decode and it gave me more sensible data. Thanks to @Ilmari Karonen for discovering the character encoding –  Chris Andrè Dale Oct 16 '11 at 10:02
2  
@Steven: It looked like some 8-bit encoding for non-Latin text. I actually first thought it might be KOI8, but that didn't yield anything meaningful, so I wrote a quick Perl one-liner to print it using all the encodings supported by Encode::Byte and eyeballed the results to see which one made sense. –  Ilmari Karonen Oct 16 '11 at 15:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.