0

We're manually reading HTTPD log files and taking note of service abuse.

Example:

10.0.0.1 - - [01/Jan/1970:00:01:01 -0100] "GET /fckeditor/editor/filemanager/connectors/php/upload.php?Type=Media
...
10.0.0.2 - - [01/Jan/1970:00:01:10 -0100] "GET /wp-content/plugins/apikey/apikey.php HTTP/1.1" 404 648 "-" "python-requests/2.23.0"
...
10.0.0.3 - - [01/Jan/1970:00:02:00 -0100] "GET /wutwut.at.blachas.isocode.ant-secs:) HTTP/1.1" 400 613 "-" "ZmEu"
10.0.0.3 - - [01/Jan/1970:00:02:00 -0100] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 400 587 "-" "ZmEu"
10.0.0.3 - - [01/Jan/1970:00:02:00 -0100] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 400 587 "-" "ZmEu"
10.0.0.3 - - [01/Jan/1970:00:02:00 -0100] "GET /pma/scripts/setup.php HTTP/1.1" 400 573 "-" "ZmEu"

Reviewing the log files manually is time consuming, so we ask the following:

  • Is there a public database of attack footprints*?
  • If so, is the database available via an API?
  • Is there a utility that already does this?
  • If so, is there a similar tool for system logs?

*Note: The term "footprint" is used loosely here. We're placing less emphasis on the IP address and more emphasis on the specific requests and/or sequence of requests.

Thnx

0