-1

I have a magento shop system and I read this in my logs:

206.75.231.xxx - - [14/Dec/2017:19:59:11 +0100] "POST /downloader/ HTTP/1.1" 403 220 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/32.0"

200.128.35.x - - [14/Dec/2017:20:37:41 +0100] "POST /downloader/ HTTP/1.1" 403 220 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/32.0"

129.121.49.xxx - - [14/Dec/2017:21:29:02 +0100] "POST /downloader/ HTTP/1.1" 403 220 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/32.0"

And there also 3 additional times that this "visitor" (with also another IP) tried to detect a vulnerability in the installation.

Why does the "visitor" try this with always 6 different IPs sending always 9 POSTs? I think it is enough to try one time to guess that there is no possibility to access.

  • The answer can simply be: that's how the exploit kit was configured – schroeder Dec 15 '17 at 10:39
  • Mayby different location ip against geoip block? – Marcel Dec 15 '17 at 10:41
4

Welcome to botnets, where one person controls thousands or millions of computers to test to see if other computers have vulnerabilities that they can exploit to add to their network (or worse). They use a broad range of machines in case one IP gets blocked, and they rotate how much traffic one IP sends to try and avoid getting blocked. And they just keep going, even if there is no obvious vulnerability because it doesn't cost them anything to keep at it in case something changes.

And that's how that works. The same type of testing done from machines across the world. Like a crowd of people checking to see if you locked your front door. If one person tries too hard and gets denied access, there is still a large crowd left to keep going.

This will never go away, so make sure you have "locked your doors".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.