1

Our website was behaving strangely.

  • Sometime it was down and nothing was accessible.
  • Sometime it started loading but pages browsing was too slow.

We checked apache logs and found the below suspicious entries:

[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/css
[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] script '/usr/share/phpMyAdmin/config.user.inc.php' not found or unable to stat
[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] script '/usr/share/phpMyAdmin/config_inf.php' not found or unable to stat
[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/4.2
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/config
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/config
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts

Our quick backup response was to block these IP-addresses

Moreover we also found the below entries in logs:

[Mon Dec 24 07:17:26 2018] [error] [client 91.121.134.18] Empty module and/or action after parsing the URL "/api/ip.php" (/).

Detail about above log entry: https://www.abuseipdb.com/check/91.121.134.18?page=2#report. We also blocked these IP-addresses

I want to know what was going on? Was it a DDOS attack or something else? For now I have blocked the suspicious IPs.

However what is the permanent solutions/tricks to limit/end these type of attacks?

Improve this question

3 Answers 3

Reset to default
1

The above logs don't seem suspicious at all. You should, in addition, check your access log for suspicious activities. You can filter suspicious activities looking at request line, Referrer, User-Agent and most-importantly time. Usually, suspicious requests come in no time difference, you would notice a sequence of requests- which have something in common. They, mostly, would be from same IP address and/or User-Agent.
Also, as a developer/user of the application, you can sometimes be sure of request line. So, you would mostly be looking for POST requests. For example, a GET request without any parameters to a known file could be ignored.

And from what you're describing, it looks like your server is low on resource. You can check your resource usage to be sure. This is a very common issue if you're using a CMS on a low spec VPS.

Improve this answer
4
  • Where is access logs located normally?
    – Iftikhar uddin
    Commented Dec 29, 2018 at 16:56
  • 1
    They're usually under /var/log/ directory. You can easily grep for /var/log/ on your config file and find it. For example, if you're using Apache, you could do like; grep -F '/var/log/' /etc/httpd/conf/httpd.conf.
    – 1lastBr3ath
    Commented Dec 29, 2018 at 17:00
  • in var/log i have apache_errors.log and in root php_errors.log. BUT i didn't found any access logs! I also got these entries from logs [Sun Dec 23 02:51:46 2018] [error] [client 31.163.129.232] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /maker/snwrite.cgi [Sun Dec 23 07:02:59 2018] [error] [client 212.83.145.238] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /
    – Iftikhar uddin
    Commented Dec 29, 2018 at 17:06
  • Can you not find your config files? It should be somewhere inside /etc/httpd/ or /etc/apache2/ or /opt/. The default configuration does have access log, afaik. The error about missing hostname, it's just that HTTP/1.1 requires host header be present. And about empty module, I'm not sure what it does but it seems to be expecting a module/action from /api/ip.php.
    – 1lastBr3ath
    Commented Dec 29, 2018 at 17:12
0

My own apache logs are stored in:

/var/log/apache2/*.log

Typically each virtual host has its own access log, such as:

  1. /var/log/apache2/vhost1_access.log
  2. /var/log/apache2/vhost2_access.log

The entries are very similar to many entries in my own log files. The IP addresses listed in your question each have been tagged by other web servers, probably automatically by programs such as fail2ban. At least one IP address was tagged as using zmeu scanner.

Most these types of log entries indicate what I would describe as the low to medium hum of the open Internet; meaning automated bots looking for low hanging fruit in all corners of the IPv4 address space.

If your particular corner of the Internet is chosen by several scanners simultaneously, your small low-traffic server may experience some heavier than normal load.

Generally, I check:

  1. The last command in order to make sure that I recognize all entries.
  2. The lastb command in order to check how many username/password combinations have been attempted for the day.
Improve this answer
0

While there are some red flags in what you've posted here, there is nothing to positively indicate a compromise.

[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/css

This suggests you are using Debian or Ubuntu with PHPMyAdmin installed from repo.

  • You didn't tell us that - if you can't describe your systems you are not in control of them
  • You should NEVER expose PMA on the internet without additional security controls

Our quick backup response was to block these IP-addresses

The first things to do here would be to check the permissions on the PMA installation and make sure your update process is working correctly.

If you want to protect your system by blocking IP addresses use a WAF.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .