1

Various IP addresses call various domains looking for various paths that might lead to PHP My Admin/scripts/setup.php

One of those IP addresses is 74.63.212.48 which I just now found out I could navigate to shows a page in Chinese titled

Rinchen technology overseas VPS - PHP probe

A very effective translation can be achieved using Google Chrome. It will translate the live results as they come in. It is also available via domain name 8242.cn. However, although it is Chinese, it seems to be hosted within the US, and around the world. (assuming it is all the same thing)

Generally, it seems to list status information, PHP build, processor, ram, etc. linux version, uptime, clock, information on the features enabled for PHP, database. It also provides

MySQL database connection detection

which asks for address, port, user, pass and has a "MySQL Test" button

Function testing
Enter the function you want to test:

and also

Mail detection
Please enter your email address to test:

I find this program very annoying since it floods our logs with high amounts of traffic that I consider it an attack. Actually, we don't run PHP, so I am not much concerned, but we have blocked several of these IPs anyway, especially the ones that are overseas and hardly likely to serve legitimate users.

Does anybody know who runs these systems? Somebody must be putting considerable effort into getting a list of all instances of PHP MyAdmin setup.php. I was hoping there would be more information available from you guys. This is very annoying that the program keeps popping up on new IPs. All I know so far is it is Chinese....

Improve this question
4
  • 2
    Duplicate of IIS logs show someone is trying to hack my site, what should I do?
    – Hendrik Brummermann
    Sep 13, 2011 at 5:47
  • Instead of making up some strange conspiricy theories, you should keep in mind that China is the country with largest population. Having that in mind it is quite surprising that most attacks and most SPAM originate in the USA.
    – Hendrik Brummermann
    Sep 13, 2011 at 5:49
  • IP addresses can be spoofed. Without coroberating evidence you don't know where the packets are coming from.
    – this.josh
    Sep 15, 2011 at 19:57
  • @this.josh, That would be quite a spoof. Not only do the incoming connections read that IP address (shown in the logs), but also the connection to that IP address brings up a page that suggests that the IP is dedicated to PHP probing. The only thing I can think of that allows that is a severely open proxy. Is that possibly the case? Or, is there some other IP spoofing trick? Or perhaps this is just an intentional install or infected machine as I suspect? Or are you suggesting the IP is correct, it is just the country that might be incorrect?
    – 700 Software
    Sep 15, 2011 at 22:49

1 Answer 1

Reset to default
1

probes for phpmyadmin setup scripts are really just a fact of life at the moment if you run a web facing web server. I wouldn't assign too much significance to the locale that they come from .

As far as I'm aware it's just pretty much blind scanning looking for known vulnerable software. I get it on a regular basis on my web server even though I don't (and never have) run phpmyadmin on it.

After ensuring that you're not running it on the host(s) in question I'd recommend just filtering it out of the alerts that you're getting.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .