Strange page requests

Discussion in 'Security' started by ama, Apr 4, 2011.

0
  1. #1
    Hi guys,

    In the past few days I've been getting lots of hits for (non-existent) pages beginning with ~cpscom/el144 One of them is an exe. Is this is some kind of attempt at seeing if I've got a virus on my server?


    Ama
     
    ama, Apr 4, 2011 IP
  2. zacharooni

    zacharooni Well-Known Member

    Messages:
    346
    Likes Received:
    20
    Best Answers:
    4
    Trophy Points:
    120
    #2
    This looks more like a bot scanning for mod_userdir usernames and files. Is this from a single IP?
     
    zacharooni, Apr 4, 2011 IP
  3. ama

    ama Greenhorn

    Messages:
    35
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    16
    #3
    Yeah, that's what I thought. It's from lots of different IPs, mostly .ru I just wondered if anybody else had seen this on their servers.
     
    ama, Apr 5, 2011 IP
  4. CI-Andrew

    CI-Andrew Peon

    Messages:
    48
    Likes Received:
    0
    Best Answers:
    1
    Trophy Points:
    0
    #4
    You'll see this happening now and again, I know it can be alarming but it's just script kiddies running their bots to scan for vulnerabilities.
     
    CI-Andrew, Apr 6, 2011 IP
  5. SSC

    SSC Active Member

    Messages:
    995
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    80
    #5
    Yup, kinda vulnerability scanning attempt
    might have been made by a bot or a network of them

    are you getting something like this:

     
    SSC, Apr 8, 2011 IP