5

error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4

[Mon Oct 10 22:35:18 2011] [error] [client 91.212.226.95] (36)File name too long: access to /forums/index.php++++++++++++++++++++++++++++++++Result:+%e8%f1%ef%ee%eb%fc%e7%ee%e2%e0%ed+%ed%e8%ea%ed%e5%e9%ec+%22immultusa%22%3b+%e7%e0%f0%e5%e3%e8%f1%f2%f0%e8%f0%ee%e2%e0%eb%e8%f1%fc+(%e2%ea%eb%fe%f7%e5%ed+%f0%e5%e6%e8%ec+%f2%ee%eb%fc%ea%ee+%f0%e5%e3%e8%f1%f2%f0%e0%f6%e8%e8)%3b failed, referer: http://xxxxxx.org/forums/index.php%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2BResult:%2B%25e8%25f1%25ef%25ee%25eb%25fc%25e7%25ee%25e2%25e0%25ed%2B%25ed%25e8%25ea%25ed%25e5%25e9%25ec%2B%2522immultusa%2522%253b%2B%25e7%25e0%25f0%25e5%25e3%25e8%25f1%25f2%25f0%25e8%25f0%25ee%25e2%25e0%25eb%25e8%25f1%25fc%2B%28%25e2%25ea%25eb%25fe%25f7%25e5%25ed%2B%25f0%25e5%25e6%25e8%25ec%2B%25f2%25ee%25eb%25fc%25ea%25ee%2B%25f0%25e5%25e3%25e8%25f1%25f2%25f0%25e0%25f6%25e8%25e8%29%253b

1 Answer 1

11

Probably someone trying to create an account on your forum and proceed to spam it.

I read about it here: http://www.projecthoneypot.org/ip_95.168.162.43

When you URL decode the string two times and google the string you find a lot of spam on different forums.

URL Decoded one time:

èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî ðåãèñòðàöèè); 
failed, referer: http://xxxxxx.org/forums
/index.php++++++++++++++++++++++++++++++++Result:+%e8%f1%ef%ee%eb%fc%e7%ee%e2%e0%ed+%ed
%e8%ea%ed%e5%e9%ec+%22immultusa%22%3b+%e7%e0%f0%e5%e3%e8%f1%f2%f0%e8%f0%ee%e2%e0%eb%e8
%f1%fc+(%e2%ea%eb%fe%f7%e5%ed+%f0%e5%e6%e8%ec+%f2%ee%eb%fc%ea%ee+%f0%e5%e3%e8%f1%f2
%f0%e0%f6%e8%e8)%3b

URL Decoded twice:

èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî ðåãèñòðàöèè); 
failed, referer: http://xxxxxx.org/forums/index.php                                
Result: èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî 
ðåãèñòðàöèè);
4
  • 4
    Also, the garbled-looking text appears to be in the CP1251 encoding, and says использован никнейм "immultusa"; зарегистрировались (включен режим только регистрации). Alas, I don't really speak Russian, but it seems to be saying something about the nickname "immultusa" being already registered. Oct 15, 2011 at 16:50
  • Ah thanks, I was wondering about the garbled text... how did you know it was in that encoding?
    – Steven
    Oct 16, 2011 at 9:43
  • 1
    It looked like URL encoding based on experience of seeing url encoded text before. Then I just dumped it into Burp Suite decoder and chose URL decode and it gave me more sensible data. Thanks to @Ilmari Karonen for discovering the character encoding
    – Chris Dale
    Oct 16, 2011 at 10:02
  • 2
    @Steven: It looked like some 8-bit encoding for non-Latin text. I actually first thought it might be KOI8, but that didn't yield anything meaningful, so I wrote a quick Perl one-liner to print it using all the encodings supported by Encode::Byte and eyeballed the results to see which one made sense. Oct 16, 2011 at 15:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .