Intrusion attempts recorded in my 1&1 server
In my vhost logs (athome-training.com_access_log) :
94.20.20.132 - - [23/Oct/2011:19:44:37 +0200] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 415 "-" "ZmEu"
94.20.20.132 - - [23/Oct/2011:19:44:38 +0200] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 405 "-" "ZmEu"
94.20.20.132 - - [23/Oct/2011:19:44:38 +0200] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 404 "-" "ZmEu"
94.20.20.132 - - [23/Oct/2011:19:44:38 +0200] "GET /pma/scripts/setup.php HTTP/1.1" 404 399 "-" "ZmEu"
94.20.20.132 - - [23/Oct/2011:19:44:38 +0200] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 403 "-" "ZmEu"
94.20.20.132 - - [23/Oct/2011:19:44:39 +0200] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 403 "-" "ZmEu"
Another
58.218.199.147 - - [23/Oct/2011:20:38:54 +0200] "GET http://www.silkool.com/cgi-bin/son!fuckyou.php HTTP/1.1" 404 446 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
58.218.199.147 - - [24/Oct/2011:05:43:11 +0200] "GET http://www.phpjc.cn/me/proxyheader.php HTTP/1.1" 404 441 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
58.218.199.147 - - [24/Oct/2011:07:33:08 +0200] "GET http://www.phpjc.cn/me/proxyheader.php HTTP/1.1" 404 441 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
58.218.199.147 - - [24/Oct/2011:09:21:56 +0200] "GET http://www.silkool.com/cgi-bin/son!fuckyou.php HTTP/1.1" 404 446 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
Anew
89.135.124.125 - - [24/Oct/2011:02:05:00 +0200] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 413 "http://87.106.98.32/phpmyadmin/scripts/setup.php" "Opera"
89.135.124.125 - - [24/Oct/2011:02:05:00 +0200] "POST /phpmyadmin/scripts/setup.php HTTP/1.1" 404 413 "http://87.106.98.32/phpmyadmin/scripts/setup.php" "Opera"
DFind port scanner (w00tw00t.at.ISC.SANS.DFind:)
209.208.246.58 - - [24/Oct/2011:10:25:58 +0200] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 415 "-" "-"
PhpMyAdmin attack
88.190.16.50 - - [24/Oct/2011:16:14:46 +0200] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 415 "-" "ZmEu"
88.190.16.50 - - [24/Oct/2011:16:14:46 +0200] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 405 "-" "ZmEu"
88.190.16.50 - - [24/Oct/2011:16:14:46 +0200] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 404 "-" "ZmEu"
88.190.16.50 - - [24/Oct/2011:16:14:46 +0200] "GET /pma/scripts/setup.php HTTP/1.1" 404 399 "-" "ZmEu"
88.190.16.50 - - [24/Oct/2011:16:14:46 +0200] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 403 "-" "ZmEu"
88.190.16.50 - - [24/Oct/2011:16:14:46 +0200] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 403 "-" "ZmEu"
#further...
124.65.80.22 - - [27/Oct/2011:02:46:00 +0200] "GET //phpmyadmin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 406 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
124.65.80.22 - - [27/Oct/2011:02:46:00 +0200] "GET //pma/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 402 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
124.65.80.22 - - [27/Oct/2011:02:46:01 +0200] "GET //admin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 404 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
124.65.80.22 - - [27/Oct/2011:02:46:02 +0200] "GET //dbadmin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 405 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
124.65.80.22 - - [27/Oct/2011:02:46:03 +0200] "GET //mysql/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 404 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
124.65.80.22 - - [27/Oct/2011:02:46:03 +0200] "GET //php-my-admin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 408 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
124.65.80.22 - - [27/Oct/2011:02:46:04 +0200] "GET //myadmin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 405 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
124.65.80.22 - - [27/Oct/2011:02:46:05 +0200] "GET //PHPMYADMIN/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 408 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
124.65.80.22 - - [27/Oct/2011:02:46:06 +0200] "GET //phpMyAdmin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 407 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
124.65.80.22 - - [27/Oct/2011:02:46:06 +0200] "GET //p/m/a/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 403 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
The big one:
113.106.197.134 - - [28/Oct/2011:03:24:00 +0200] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:01 +0200] "GET /scripts/setup.php HTTP/1.1" 404 397 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:02 +0200] "GET /admin/scripts/setup.php HTTP/1.1" 404 401 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:03 +0200] "GET /admin/pma/scripts/setup.php HTTP/1.1" 404 404 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:03 +0200] "GET /admin/phpmyadmin/scripts/setup.php HTTP/1.1" 404 407 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:04 +0200] "GET /db/scripts/setup.php HTTP/1.1" 404 399 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:05 +0200] "GET /dbadmin/scripts/setup.php HTTP/1.1" 404 402 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:06 +0200] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 403 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:06 +0200] "GET /mysql/scripts/setup.php HTTP/1.1" 404 401 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:07 +0200] "GET /mysqladmin/scripts/setup.php HTTP/1.1" 404 405 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:08 +0200] "GET /typo3/phpmyadmin/scripts/setup.php HTTP/1.1" 404 409 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:09 +0200] "GET /phpadmin/scripts/setup.php HTTP/1.1" 404 403 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:09 +0200] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 405 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:10 +0200] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 404 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:11 +0200] "GET /phpmyadmin1/scripts/setup.php HTTP/1.1" 404 406 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:14 +0200] "GET /pma/scripts/setup.php HTTP/1.1" 404 399 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:15 +0200] "GET /web/phpMyAdmin/scripts/setup.php HTTP/1.1" 404 408 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:16 +0200] "GET /xampp/phpmyadmin/scripts/setup.php HTTP/1.1" 404 409 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:17 +0200] "GET /web/scripts/setup.php HTTP/1.1" 404 400 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:18 +0200] "GET /php-my-admin/scripts/setup.php HTTP/1.1" 404 406 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:18 +0200] "GET /websql/scripts/setup.php HTTP/1.1" 404 401 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:19 +0200] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 404 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:20 +0200] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 405 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:20 +0200] "GET /phpMyAdmin-2/scripts/setup.php HTTP/1.1" 404 407 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:24 +0200] "GET /phpMyAdmin-2.2.3/scripts/setup.php HTTP/1.1" 404 410 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:25 +0200] "GET /phpMyAdmin-2.2.6/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:26 +0200] "GET /phpMyAdmin-2.5.1/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:26 +0200] "GET /phpMyAdmin-2.5.4/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:27 +0200] "GET /phpMyAdmin-2.5.5-rc1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:28 +0200] "GET /phpMyAdmin-2.5.5-rc2/scripts/setup.php HTTP/1.1" 404 413 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:28 +0200] "GET /phpMyAdmin-2.5.5/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:29 +0200] "GET /phpMyAdmin-2.5.5-pl1/scripts/setup.php HTTP/1.1" 404 413 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:30 +0200] "GET /phpMyAdmin-2.5.6-rc1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:31 +0200] "GET /phpMyAdmin-2.5.6-rc2/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:31 +0200] "GET /phpMyAdmin-2.5.6/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:32 +0200] "GET /phpMyAdmin-2.5.7/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:33 +0200] "GET /phpMyAdmin-2.5.7-pl1/scripts/setup.php HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:33 +0200] "GET /phpMyAdmin-2.6.0-alpha/scripts/setup.php HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:34 +0200] "GET /phpMyAdmin-2.6.0-alpha2/scripts/setup.php HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:35 +0200] "GET /phpMyAdmin-2.6.0-beta1/scripts/setup.php HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:35 +0200] "GET /phpMyAdmin-2.6.0-beta2/scripts/setup.php HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:36 +0200] "GET /phpMyAdmin-2.6.0-rc1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:37 +0200] "GET /phpMyAdmin-2.6.0-rc2/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:37 +0200] "GET /phpMyAdmin-2.6.0-rc3/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:38 +0200] "GET /phpMyAdmin-2.6.0/scripts/setup.php HTTP/1.1" 404 410 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:39 +0200] "GET /phpMyAdmin-2.6.0-pl1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:40 +0200] "GET /phpMyAdmin-2.6.0-pl2/scripts/setup.php HTTP/1.1" 404 413 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:40 +0200] "GET /phpMyAdmin-2.6.0-pl3/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:41 +0200] "GET /phpMyAdmin-2.6.1-rc1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:42 +0200] "GET /phpMyAdmin-2.6.1-rc2/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:42 +0200] "GET /phpMyAdmin-2.6.1/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:43 +0200] "GET /phpMyAdmin-2.6.1-pl1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:44 +0200] "GET /phpMyAdmin-2.6.1-pl2/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:44 +0200] "GET /phpMyAdmin-2.6.1-pl3/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:45 +0200] "GET /phpMyAdmin-2.6.2-rc1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:46 +0200] "GET /phpMyAdmin-2.6.2-beta1/scripts/setup.php HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:47 +0200] "GET /phpMyAdmin-2.6.2-rc1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:47 +0200] "GET /phpMyAdmin-2.6.2/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:48 +0200] "GET /phpMyAdmin-2.6.2-pl1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:49 +0200] "GET /phpMyAdmin-2.6.3/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:49 +0200] "GET /phpMyAdmin-2.6.3-rc1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:50 +0200] "GET /phpMyAdmin-2.6.3/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:51 +0200] "GET /phpMyAdmin-2.6.3-pl1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:51 +0200] "GET /phpMyAdmin-2.6.4-rc1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:52 +0200] "GET /phpMyAdmin-2.6.4-pl1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:53 +0200] "GET /phpMyAdmin-2.6.4-pl2/scripts/setup.php HTTP/1.1" 404 413 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:54 +0200] "GET /phpMyAdmin-2.6.4-pl3/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:56 +0200] "GET /phpMyAdmin-2.6.4-pl4/scripts/setup.php HTTP/1.1" 404 413 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:57 +0200] "GET /phpMyAdmin-2.6.4/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:58 +0200] "GET /phpMyAdmin-2.7.0-beta1/scripts/setup.php HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:24:58 +0200] "GET /phpMyAdmin-2.7.0-rc1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:04 +0200] "GET /phpMyAdmin-2.7.0-pl1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:05 +0200] "GET /phpMyAdmin-2.7.0-pl2/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:05 +0200] "GET /phpMyAdmin-2.7.0/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:06 +0200] "GET /phpMyAdmin-2.8.0-beta1/scripts/setup.php HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:07 +0200] "GET /phpMyAdmin-2.8.0-rc1/scripts/setup.php HTTP/1.1" 404 414 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:07 +0200] "GET /phpMyAdmin-2.8.0-rc2/scripts/setup.php HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:08 +0200] "GET /phpMyAdmin-2.8.0/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:09 +0200] "GET /phpMyAdmin-2.8.0.1/scripts/setup.php HTTP/1.1" 404 413 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:10 +0200] "GET /phpMyAdmin-2.8.0.2/scripts/setup.php HTTP/1.1" 404 412 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:10 +0200] "GET /phpMyAdmin-2.8.0.3/scripts/setup.php HTTP/1.1" 404 413 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:11 +0200] "GET /phpMyAdmin-2.8.0.4/scripts/setup.php HTTP/1.1" 404 413 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:12 +0200] "GET /phpMyAdmin-2.8.1-rc1/scripts/setup.php HTTP/1.1" 404 415 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:12 +0200] "GET /phpMyAdmin-2.8.1/scripts/setup.php HTTP/1.1" 404 412 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:13 +0200] "GET /phpMyAdmin-2.8.2/scripts/setup.php HTTP/1.1" 404 411 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:14 +0200] "GET /sqlmanager/scripts/setup.php HTTP/1.1" 404 405 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:14 +0200] "GET /mysqlmanager/scripts/setup.php HTTP/1.1" 404 406 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:15 +0200] "GET /p/m/a/scripts/setup.php HTTP/1.1" 404 400 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:16 +0200] "GET /PMA2005/scripts/setup.php HTTP/1.1" 404 404 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:17 +0200] "GET /pma2005/scripts/setup.php HTTP/1.1" 404 403 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:17 +0200] "GET /phpmanager/scripts/setup.php HTTP/1.1" 404 404 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:18 +0200] "GET /php-myadmin/scripts/setup.php HTTP/1.1" 404 405 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:19 +0200] "GET /phpmy-admin/scripts/setup.php HTTP/1.1" 404 405 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:19 +0200] "GET /webadmin/scripts/setup.php HTTP/1.1" 404 403 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:20 +0200] "GET /sqlweb/scripts/setup.php HTTP/1.1" 404 401 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:21 +0200] "GET /websql/scripts/setup.php HTTP/1.1" 404 401 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:21 +0200] "GET /webdb/scripts/setup.php HTTP/1.1" 404 401 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:22 +0200] "GET /mysqladmin/scripts/setup.php HTTP/1.1" 404 405 "-" "ZmEu"
113.106.197.134 - - [28/Oct/2011:03:25:23 +0200] "GET /mysql-admin/scripts/setup.php HTTP/1.1" 404 406 "-" "ZmEu"
A well known webmin exploit, in /var/webmin/miniserv.log
140.113.238.44 - - [06/Oct/2011:21:02:11 +0200] "POST /unauthenticated//..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/etc/shells HTTP/1.1" 404 32
I stop there, but it's endless ...
So, what to do ?
- Lock SSH
- Log, and rotate to avoid 2GO parsing
- Use log report tool : webalizer, awstat, logwatch, sec
- Block intrusions : TCP Wrapper, denyhosts, fail2ban, modsecurity
No pasaran!