error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4

[Mon Oct 10 22:35:18 2011] [error] [client] (36)File name too long: access to /forums/index.php++++++++++++++++++++++++++++++++Result:+%e8%f1%ef%ee%eb%fc%e7%ee%e2%e0%ed+%ed%e8%ea%ed%e5%e9%ec+%22immultusa%22%3b+%e7%e0%f0%e5%e3%e8%f1%f2%f0%e8%f0%ee%e2%e0%eb%e8%f1%fc+(%e2%ea%eb%fe%f7%e5%ed+%f0%e5%e6%e8%ec+%f2%ee%eb%fc%ea%ee+%f0%e5%e3%e8%f1%f2%f0%e0%f6%e8%e8)%3b failed, referer: http://xxxxxx.org/forums/index.php%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2B%2BResult:%2B%25e8%25f1%25ef%25ee%25eb%25fc%25e7%25ee%25e2%25e0%25ed%2B%25ed%25e8%25ea%25ed%25e5%25e9%25ec%2B%2522immultusa%2522%253b%2B%25e7%25e0%25f0%25e5%25e3%25e8%25f1%25f2%25f0%25e8%25f0%25ee%25e2%25e0%25eb%25e8%25f1%25fc%2B%28%25e2%25ea%25eb%25fe%25f7%25e5%25ed%2B%25f0%25e5%25e6%25e8%25ec%2B%25f2%25ee%25eb%25fc%25ea%25ee%2B%25f0%25e5%25e3%25e8%25f1%25f2%25f0%25e0%25f6%25e8%25e8%29%253b

Probably someone trying to create an account on your forum and proceed to spam it.

I read about it here: http://www.projecthoneypot.org/ip_95.168.162.43

When you URL decode the string two times and google the string you find a lot of spam on different forums.

URL Decoded one time:

èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî ðåãèñòðàöèè); 
failed, referer: http://xxxxxx.org/forums

URL Decoded twice:

èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî ðåãèñòðàöèè); 
failed, referer: http://xxxxxx.org/forums/index.php                                
Result: èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì òîëüêî 
  • 4
    Also, the garbled-looking text appears to be in the CP1251 encoding, and says использован никнейм "immultusa"; зарегистрировались (включен режим только регистрации). Alas, I don't really speak Russian, but it seems to be saying something about the nickname "immultusa" being already registered. – Ilmari Karonen Oct 15 '11 at 16:50
  • Ah thanks, I was wondering about the garbled text... how did you know it was in that encoding? – Steven Oct 16 '11 at 9:43
  • 1
    It looked like URL encoding based on experience of seeing url encoded text before. Then I just dumped it into Burp Suite decoder and chose URL decode and it gave me more sensible data. Thanks to @Ilmari Karonen for discovering the character encoding – Chris Dale Oct 16 '11 at 10:02
  • 2
    @Steven: It looked like some 8-bit encoding for non-Latin text. I actually first thought it might be KOI8, but that didn't yield anything meaningful, so I wrote a quick Perl one-liner to print it using all the encodings supported by Encode::Byte and eyeballed the results to see which one made sense. – Ilmari Karonen Oct 16 '11 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.