Is someone trying to hack my site?

Discussions of secure PHP coding. Security in software is important, so don't be afraid to ask. And when answering: be anal. Nitpick. No security vulnerability is too small.

Moderator: General Moderators

Post Reply
crawford84
Forum Newbie
Posts: 3
Joined: Sun May 04, 2014 11:44 pm

Is someone trying to hack my site?

Post by crawford84 »

I was looking through my server logs today and noticed many attempts to connect to PHP pages with strings appended like this:

/RK=0/RS=S1EFScHuZogilFCMsrNbKJGrflQ-

So the full url is something like

http://www.mysite.com/index.php/RK=0/RS ... NbKJGrflQ-

There are a bunch of different similar looking strings. Is this some kind of hack? Or just some random bot or something?

Thanks for any help.
User avatar
requinix
Spammer :|
Posts: 6617
Joined: Wed Oct 15, 2008 2:35 am
Location: WA, USA

Re: Is someone trying to hack my site?

Post by requinix »

When you were looking in the logs, did you happen to see the IP address? User agent string?
crawford84
Forum Newbie
Posts: 3
Joined: Sun May 04, 2014 11:44 pm

Re: Is someone trying to hack my site?

Post by crawford84 »

165.231.*
38.84.*
192.3.*
69.12.*
66.85.*
50.3.*
23.239.*

Mozilla/5.0 and Mozilla/4.0
Last edited by requinix on Mon May 05, 2014 4:27 am, edited 1 time in total.
Reason: redacted to /16
User avatar
requinix
Spammer :|
Posts: 6617
Joined: Wed Oct 15, 2008 2:35 am
Location: WA, USA

Re: Is someone trying to hack my site?

Post by requinix »

No offense but I edited the IP addresses in your post. Not much to gain by knowing the full addresses so I'm opting for the normal etiquette of keeping them private.

Yes, it does seem to be a botnet probing for vulnerabilities. Lots of people on the internet reporting the same issue.
Unless the accesses are causing you problems, I'd just ignore them - they'll go away on their own. But if you're worried you can set up some blocking for that RK/RS pattern.
crawford84
Forum Newbie
Posts: 3
Joined: Sun May 04, 2014 11:44 pm

Re: Is someone trying to hack my site?

Post by crawford84 »

Thanks.
Post Reply