No thank you!

Posted on by

Putting a server on the internet is today similar to walking alone at night in a part of the city you know nothing about, where the streetlights doesnt work and you have 1 bar on your phone, which by the way just dropped to 4% battery.

I put a server on digitalocean.com, they call it a droplet, with Ubuntu 18.10 and Apache2 as a reverse proxy to my Rails server (puma) running there.

Since puma prints log messages direct to screen, and I run it manually using SSH, I can see all the intrusion attempts, which is normally only visible through the system logs, and at least I tend to forget about them from time to time.

Here’s the results from just this morning:

185.53.91.24 (from Iceland) tries to access /_asterisk – an attempt to scan for a common open source phone system called Asterisk

He continued to try /admin/config.php to see if I have any PHP-system with the admin password just lying around (surprisingly easy to forget that you have it there)

From the list below, you can see that phpmyadmin and mysql are common targets, but also a surprising amount of custom URLS (I mean: feixiang.php ?) which probably means that there is a database of known holes and exploits, and that they are trying them ALL. Brute force.

I won’t be listing ALL attempts, but just so you get a perspective on the amount of intruders out there, this is just a couple of minutes of data:

Started GET "/.env" for 185.234.218.74 at 2019-03-12 08:48:52 +0000
Started GET "/.git/config" for 185.234.218.74 at 2019-03-12 08:48:52 +0000
Started GET "/sftp-config.json" for 185.234.218.74 at 2019-03-12 08:48:52 +0000
Started GET "/.ftpconfig" for 185.234.218.74 at 2019-03-12 08:48:52 +0000
Started GET "/.remote-sync.json" for 185.234.218.74 at 2019-03-12 08:48:52 +0000
Started GET "/.vscode/ftp-sync.json" for 185.234.218.74 at 2019-03-12 08:48:52 +0000
Started GET "/.vscode/sftp.json" for 185.234.218.74 at 2019-03-12 08:48:52 +0000
Started GET "/deployment-config.json" for 185.234.218.74 at 2019-03-12 08:48:52 +0000
Started GET "/ftpsync.settings" for 185.234.218.74 at 2019-03-12 08:48:53 +0000
Started GET "/WS_FTP.ini" for 185.234.218.74 at 2019-03-12 08:48:53 +0000
Started GET "/ws_ftp.ini" for 185.234.218.74 at 2019-03-12 08:48:53 +0000
Started GET "/WS_FTP.INI" for 185.234.218.74 at 2019-03-12 08:48:53 +0000
Started GET "/filezilla.xml" for 185.234.218.74 at 2019-03-12 08:48:53 +0000
Started GET "/sitemanager.xml" for 185.234.218.74 at 2019-03-12 08:48:53 +0000
Started GET "/FileZilla.xml" for 185.234.218.74 at 2019-03-12 08:48:53 +0000
Started GET "/winscp.ini" for 185.234.218.74 at 2019-03-12 08:48:53 +0000
Started GET "/WinSCP.ini" for 185.234.218.74 at 2019-03-12 08:48:54 +0000
Started GET "/mysql/admin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:06 +0000
Started GET "/mysql/dbadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:08 +0000
Started GET "/mysql/sqlmanager/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:09 +0000
Started GET "/mysql/mysqlmanager/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:11 +0000
Started GET "/phpmyadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:13 +0000
Started GET "/phpMyadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:15 +0000
Started GET "/phpMyAdmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:17 +0000
Started GET "/phpmyAdmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:19 +0000
Started GET "/phpmyadmin2/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:21 +0000
Started GET "/phpmyadmin3/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:23 +0000
Started GET "/phpmyadmin4/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:25 +0000
Started GET "/2phpmyadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:26 +0000
Started GET "/wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:28 +0000
Started GET "/phpmy/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:30 +0000
Started GET "/phppma/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:32 +0000
Started GET "/myadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:34 +0000
Started GET "/shopdb/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:36 +0000
Started GET "/MyAdmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:38 +0000
Started GET "/program/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:40 +0000
Started GET "/PMA/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:42 +0000
Started GET "/dbadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:44 +0000
Started GET "/pma/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:46 +0000
Started GET "/db/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:47 +0000
Started GET "/admin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:49 +0000
Started GET "/mysql/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:51 +0000
Started GET "/database/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:53 +0000
Started GET "/db/phpmyadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:55 +0000
Started GET "/db/phpMyAdmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:57 +0000
Started GET "/sqlmanager/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:53:59 +0000
Started GET "/mysqlmanager/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:01 +0000
Started GET "/php-myadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:03 +0000
Started GET "/phpmy-admin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:05 +0000
Started GET "/mysqladmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:06 +0000
Started GET "/mysql-admin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:08 +0000
Started GET "/admin/phpmyadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:10 +0000
Started GET "/admin/phpMyAdmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:12 +0000
Started GET "/admin/sysadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:14 +0000
Started GET "/admin/sqladmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:16 +0000
Started GET "/admin/db/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:17 +0000
Started GET "/admin/web/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:19 +0000
Started GET "/admin/pMA/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:21 +0000
Started GET "/mysql/pma/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:23 +0000
Started GET "/mysql/db/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:24 +0000
Started GET "/mysql/web/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:26 +0000
Started GET "/mysql/pMA/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:28 +0000
Started GET "/sql/phpmanager/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:30 +0000
Started GET "/sql/php-myadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:31 +0000
Started GET "/sql/phpmy-admin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:33 +0000
Started GET "/sql/sql/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:35 +0000
Started GET "/sql/myadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:37 +0000
Started GET "/sql/webadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:39 +0000
Started GET "/sql/sqlweb/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:41 +0000
Started GET "/sql/websql/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:42 +0000
Started GET "/sql/webdb/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:44 +0000
Started GET "/sql/sqladmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:46 +0000
Started GET "/sql/sql-admin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:47 +0000
Started GET "/sql/phpmyadmin2/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:49 +0000
Started GET "/sql/phpMyAdmin2/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:51 +0000
Started GET "/sql/phpMyAdmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:53 +0000
Started GET "/db/myadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:55 +0000
Started GET "/db/webadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:57 +0000
Started GET "/db/dbweb/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:54:58 +0000
Started GET "/db/websql/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:00 +0000
Started GET "/db/webdb/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:02 +0000
Started GET "/db/dbadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:05 +0000
Started GET "/db/db-admin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:07 +0000
Started GET "/db/phpmyadmin3/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:09 +0000
Started GET "/db/phpMyAdmin3/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:11 +0000
Started GET "/db/phpMyAdmin-3/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:14 +0000
Started GET "/administrator/phpmyadmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:16 +0000
Started GET "/administrator/phpMyAdmin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:18 +0000
Started GET "/administrator/db/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:20 +0000
Started GET "/administrator/web/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:22 +0000
Started GET "/administrator/pma/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:24 +0000
Started GET "/administrator/PMA/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:26 +0000
Started GET "/administrator/admin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:29 +0000
Started GET "/phpMyAdmin2/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:31 +0000
Started GET "/phpMyAdmin3/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:33 +0000
Started GET "/phpMyAdmin4/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:35 +0000
Started GET "/phpMyAdmin-3/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:37 +0000
Started GET "/php-my-admin/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:38 +0000
Started GET "/PMA2011/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:40 +0000
Started GET "/PMA2012/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:42 +0000
Started GET "/PMA2013/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:44 +0000
Started GET "/PMA2014/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:46 +0000
Started GET "/PMA2015/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:48 +0000
Started GET "/PMA2016/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:50 +0000
Started GET "/PMA2017/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:52 +0000
Started GET "/PMA2018/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:53 +0000
Started GET "/pma2011/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:56 +0000
Started GET "/pma2012/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:58 +0000
Started GET "/pma2013/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:55:59 +0000
Started GET "/pma2014/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:02 +0000
Started GET "/pma2015/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:04 +0000
Started GET "/pma2016/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:06 +0000
Started GET "/pma2017/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:08 +0000
Started GET "/pma2018/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:10 +0000
Started GET "/pma2019/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:12 +0000
Started GET "/phpmyadmin2011/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:14 +0000
Started GET "/phpmyadmin2012/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:16 +0000
Started GET "/phpmyadmin2013/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:18 +0000
Started GET "/phpmyadmin2014/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:20 +0000
Started GET "/phpmyadmin2015/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:22 +0000
Started GET "/phpmyadmin2016/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:24 +0000
Started GET "/phpmyadmin2017/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:26 +0000
Started GET "/phpmyadmin2018/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:28 +0000
Started GET "/phpmyadmin2019/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:30 +0000
Started GET "/index.php?lang=en" for 59.152.246.210 at 2019-03-12 08:56:32 +0000
Started PROPFIND "/" for 117.102.115.45 at 2019-03-12 09:37:44 +0000
Started GET "/webdav/" for 117.102.115.45 at 2019-03-12 09:37:45 +0000
Started GET "/Appe474e69d.php" for 117.102.115.45 at 2019-03-12 09:37:45 +0000
Started GET "/help.php" for 117.102.115.45 at 2019-03-12 09:37:46 +0000
Started GET "/java.php" for 117.102.115.45 at 2019-03-12 09:37:46 +0000
Started GET "/test.php" for 117.102.115.45 at 2019-03-12 09:37:49 +0000
Started GET "/db_cts.php" for 117.102.115.45 at 2019-03-12 09:37:50 +0000
Started GET "/db_pma.php" for 117.102.115.45 at 2019-03-12 09:37:50 +0000
Started GET "/logon.php" for 117.102.115.45 at 2019-03-12 09:37:53 +0000
Started GET "/license.php" for 117.102.115.45 at 2019-03-12 09:37:57 +0000
Started GET "/hell.php" for 117.102.115.45 at 2019-03-12 09:38:01 +0000
Started GET "/pmd_online.php" for 117.102.115.45 at 2019-03-12 09:38:01 +0000
Started GET "/shell.php" for 117.102.115.45 at 2019-03-12 09:38:05 +0000
Started GET "/htdocs.php" for 117.102.115.45 at 2019-03-12 09:38:06 +0000
Started GET "/z.php" for 117.102.115.45 at 2019-03-12 09:38:09 +0000
Started GET "/lala.php" for 117.102.115.45 at 2019-03-12 09:38:09 +0000
Started GET "/lala-dpr.php" for 117.102.115.45 at 2019-03-12 09:38:10 +0000
Started GET "/wpc.php" for 117.102.115.45 at 2019-03-12 09:38:13 +0000
Started GET "/t6nv.php" for 117.102.115.45 at 2019-03-12 09:38:17 +0000
Started GET "/muhstik.php" for 117.102.115.45 at 2019-03-12 09:38:17 +0000
Started GET "/text.php" for 117.102.115.45 at 2019-03-12 09:38:18 +0000
Started GET "/wp-config.php" for 117.102.115.45 at 2019-03-12 09:38:21 +0000
Started GET "/muhstik.php" for 117.102.115.45 at 2019-03-12 09:38:21 +0000
Started GET "/muhstik2.php" for 117.102.115.45 at 2019-03-12 09:38:22 +0000
Started GET "/muhstiks.php" for 117.102.115.45 at 2019-03-12 09:38:23 +0000
Started GET "/muhstik-dpr.php" for 117.102.115.45 at 2019-03-12 09:38:25 +0000
Started GET "/lol.php" for 117.102.115.45 at 2019-03-12 09:38:26 +0000
Started GET "/uploader.php" for 117.102.115.45 at 2019-03-12 09:38:26 +0000
Started GET "/cmv.php" for 117.102.115.45 at 2019-03-12 09:38:29 +0000
Started GET "/cmdd.php" for 117.102.115.45 at 2019-03-12 09:38:29 +0000
Started GET "/knal.php" for 117.102.115.45 at 2019-03-12 09:38:30 +0000
Started GET "/shell.php" for 117.102.115.45 at 2019-03-12 09:38:33 +0000
Started GET "/appserv.php" for 117.102.115.45 at 2019-03-12 09:38:33 +0000
Started GET "/scripts/setup.php" for 117.102.115.45 at 2019-03-12 09:38:34 +0000
Started GET "/phpmyadmin/scripts/setup.php" for 117.102.115.45 at 2019-03-12 09:38:35 +0000
Started GET "/phpMyAdmin/scripts/setup.php" for 117.102.115.45 at 2019-03-12 09:38:37 +0000
Started GET "/phpmyadmin/scripts/db___.init.php" for 117.102.115.45 at 2019-03-12 09:38:37 +0000
Started GET "/phpMyAdmin/scripts/db___.init.php" for 117.102.115.45 at 2019-03-12 09:38:38 +0000
Started GET "/plugins/weathermap/editor.php" for 117.102.115.45 at 2019-03-12 09:38:39 +0000
Started GET "/cacti/plugins/weathermap/editor.php" for 117.102.115.45 at 2019-03-12 09:38:41 +0000
Started GET "/d7.php" for 117.102.115.45 at 2019-03-12 09:38:41 +0000
Started GET "/rxr.php" for 117.102.115.45 at 2019-03-12 09:38:42 +0000
Started GET "/1x.php" for 117.102.115.45 at 2019-03-12 09:38:43 +0000
Started GET "/undx.php" for 117.102.115.45 at 2019-03-12 09:38:45 +0000
Started GET "/spider.php" for 117.102.115.45 at 2019-03-12 09:38:45 +0000
Started GET "/payload.php" for 117.102.115.45 at 2019-03-12 09:38:46 +0000
Started GET "/composers.php" for 117.102.115.45 at 2019-03-12 09:38:47 +0000
Started GET "/composer.php" for 117.102.115.45 at 2019-03-12 09:38:49 +0000
Started GET "/hue2.php" for 117.102.115.45 at 2019-03-12 09:38:50 +0000
Started GET "/Drupal.php" for 117.102.115.45 at 2019-03-12 09:38:50 +0000
Started GET "/home.php" for 117.102.115.45 at 2019-03-12 09:38:51 +0000
Started GET "/lang.php?f=1" for 117.102.115.45 at 2019-03-12 09:38:53 +0000
Started GET "/libraries/joomla/jmail.php?waled=1" for 117.102.115.45 at 2019-03-12 09:38:54 +0000
Started GET "/libraries/joomla/jmails.php?waled=1" for 117.102.115.45 at 2019-03-12 09:38:54 +0000
Started GET "/libraries/joomla/wl.php?0=1" for 117.102.115.45 at 2019-03-12 09:38:55 +0000
Started POST "/wuwu11.php" for 117.102.115.45 at 2019-03-12 09:38:57 +0000
Started POST "/xw.php" for 117.102.115.45 at 2019-03-12 09:38:57 +0000
Started POST "/xw1.php" for 117.102.115.45 at 2019-03-12 09:38:58 +0000
Started POST "/9678.php" for 117.102.115.45 at 2019-03-12 09:38:59 +0000
Started POST "/wc.php" for 117.102.115.45 at 2019-03-12 09:38:59 +0000
Started POST "/xx.php" for 117.102.115.45 at 2019-03-12 09:39:00 +0000
Started POST "/s.php" for 117.102.115.45 at 2019-03-12 09:39:01 +0000
Started POST "/w.php" for 117.102.115.45 at 2019-03-12 09:39:01 +0000
Started POST "/sheep.php" for 117.102.115.45 at 2019-03-12 09:39:05 +0000
Started POST "/db.init.php" for 117.102.115.45 at 2019-03-12 09:39:09 +0000
Started POST "/db_session.init.php" for 117.102.115.45 at 2019-03-12 09:39:09 +0000
Started POST "/db__.init.php" for 117.102.115.45 at 2019-03-12 09:39:13 +0000
Started POST "/m.php?pbid=open" for 117.102.115.45 at 2019-03-12 09:39:17 +0000
Started POST "/099.php" for 117.102.115.45 at 2019-03-12 09:39:18 +0000
Started POST "/_404.php" for 117.102.115.45 at 2019-03-12 09:39:21 +0000
Started POST "/Alarg53.php" for 117.102.115.45 at 2019-03-12 09:39:21 +0000
Started POST "/p34ky1337.php" for 117.102.115.45 at 2019-03-12 09:39:25 +0000
Started POST "/pk1914.php" for 117.102.115.45 at 2019-03-12 09:39:29 +0000
Started POST "/Skri.php" for 117.102.115.45 at 2019-03-12 09:39:33 +0000
Started POST "/db_dataml.php" for 117.102.115.45 at 2019-03-12 09:39:34 +0000
Started POST "/mx.php" for 117.102.115.45 at 2019-03-12 09:39:37 +0000
Started POST "/wshell.php" for 117.102.115.45 at 2019-03-12 09:39:38 +0000
Started POST "/qq.php" for 117.102.115.45 at 2019-03-12 09:39:41 +0000
Started POST "/conflg.php" for 117.102.115.45 at 2019-03-12 09:39:41 +0000
Started POST "/conflg.php" for 117.102.115.45 at 2019-03-12 09:39:42 +0000
Started POST "/lindex.php" for 117.102.115.45 at 2019-03-12 09:39:43 +0000
Started POST "/phpstudy.php" for 117.102.115.45 at 2019-03-12 09:39:45 +0000
Started POST "/phpStudy.php" for 117.102.115.45 at 2019-03-12 09:39:46 +0000
Started POST "/weixiao.php" for 117.102.115.45 at 2019-03-12 09:39:46 +0000
Started POST "/feixiang.php" for 117.102.115.45 at 2019-03-12 09:39:47 +0000
Started POST "/ak48.php" for 117.102.115.45 at 2019-03-12 09:39:49 +0000
Started POST "/xiao.php" for 117.102.115.45 at 2019-03-12 09:39:50 +0000
Started POST "/yao.php" for 117.102.115.45 at 2019-03-12 09:39:50 +0000
Started POST "/defect.php" for 117.102.115.45 at 2019-03-12 09:39:51 +0000
Started POST "/webslee.php" for 117.102.115.45 at 2019-03-12 09:39:53 +0000
Started POST "/q.php" for 117.102.115.45 at 2019-03-12 09:39:53 +0000
Started POST "/pe.php" for 117.102.115.45 at 2019-03-12 09:39:54 +0000
Started GET "/" for 196.52.43.88 at 2019-03-12 09:39:54 +0000
Started POST "/hm.php" for 117.102.115.45 at 2019-03-12 09:39:54 +0000
Started POST "/cainiao.php" for 117.102.115.45 at 2019-03-12 09:39:55 +0000
Started POST "/zuo.php" for 117.102.115.45 at 2019-03-12 09:39:58 +0000
Started POST "/aotu.php" for 117.102.115.45 at 2019-03-12 09:39:58 +0000
Started POST "/aotu7.php" for 117.102.115.45 at 2019-03-12 09:39:59 +0000
Started POST "/cmd.php" for 117.102.115.45 at 2019-03-12 09:39:59 +0000
Started POST "/bak.php" for 117.102.115.45 at 2019-03-12 09:40:00 +0000
Started POST "/system.php" for 117.102.115.45 at 2019-03-12 09:40:01 +0000
Started POST "/l7.php" for 117.102.115.45 at 2019-03-12 09:40:05 +0000
Started GET "/index.php" for 117.102.115.45 at 2019-03-12 09:40:09 +0000
Started GET "/phpmyadmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:09 +0000
Started GET "/phpMyAdmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:13 +0000
Started GET "/pmd/index.php" for 117.102.115.45 at 2019-03-12 09:40:13 +0000
Started GET "/pma/index.php" for 117.102.115.45 at 2019-03-12 09:40:17 +0000
Started GET "/PMA/index.php" for 117.102.115.45 at 2019-03-12 09:40:17 +0000
Started GET "/pmamy/index.php" for 117.102.115.45 at 2019-03-12 09:40:21 +0000
Started GET "/pmamy2/index.php" for 117.102.115.45 at 2019-03-12 09:40:22 +0000
Started GET "/mysql/index.php" for 117.102.115.45 at 2019-03-12 09:40:25 +0000
Started GET "/admin/index.php" for 117.102.115.45 at 2019-03-12 09:40:25 +0000
Started GET "/dbadmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:29 +0000
Started GET "/web/phpMyAdmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:29 +0000
Started GET "/admin/pma/index.php" for 117.102.115.45 at 2019-03-12 09:40:30 +0000
Started GET "/admin/PMA/index.php" for 117.102.115.45 at 2019-03-12 09:40:33 +0000
Started GET "/admin/mysql/index.php" for 117.102.115.45 at 2019-03-12 09:40:33 +0000
Started GET "/admin/mysql2/index.php" for 117.102.115.45 at 2019-03-12 09:40:34 +0000
Started GET "/admin/phpmyadmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:35 +0000
Started GET "/admin/phpMyAdmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:37 +0000
Started GET "/admin/phpmyadmin2/index.php" for 117.102.115.45 at 2019-03-12 09:40:37 +0000
Started GET "/mysqladmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:39 +0000
Started GET "/mysql-admin/index.php" for 117.102.115.45 at 2019-03-12 09:40:41 +0000
Started GET "/mysql_admin/index.php" for 117.102.115.45 at 2019-03-12 09:40:41 +0000
Started GET "/phpadmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:42 +0000
Started GET "/phpAdmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:43 +0000
Started GET "/phpmyadmin1/index.php" for 117.102.115.45 at 2019-03-12 09:40:45 +0000
Started GET "/phpmyadmin2/index.php" for 117.102.115.45 at 2019-03-12 09:40:46 +0000
Started GET "/phpMyAdmin-4.4.0/index.php" for 117.102.115.45 at 2019-03-12 09:40:46 +0000
Started GET "/myadmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:47 +0000
Started GET "/myadmin2/index.php" for 117.102.115.45 at 2019-03-12 09:40:47 +0000
Started GET "/xampp/phpmyadmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:48 +0000
Started GET "/phpMyadmin_bak/index.php" for 117.102.115.45 at 2019-03-12 09:40:48 +0000
Started GET "/www/phpMyAdmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:49 +0000
Started GET "/tools/phpMyAdmin/index.php" for 117.102.115.45 at 2019-03-12 09:40:53 +0000
Started GET "/phpMyAdminold/index.php" for 117.102.115.45 at 2019-03-12 09:40:57 +0000
Started GET "/phpMyAdmin.old/index.php" for 117.102.115.45 at 2019-03-12 09:40:57 +0000
Started GET "/pma-old/index.php" for 117.102.115.45 at 2019-03-12 09:41:01 +0000
Started GET "/claroline/phpMyAdmin/index.php" for 117.102.115.45 at 2019-03-12 09:41:01 +0000
Started GET "/typo3/phpmyadmin/index.php" for 117.102.115.45 at 2019-03-12 09:41:05 +0000
Started GET "/phpma/index.php" for 117.102.115.45 at 2019-03-12 09:41:05 +0000
Started GET "/phpMyAdmin/phpMyAdmin/index.php" for 117.102.115.45 at 2019-03-12 09:41:09 +0000
Started GET "/phpMyAbmin/index.php" for 117.102.115.45 at 2019-03-12 09:41:09 +0000
Started GET "/phpMyAdmin+++---/index.php" for 117.102.115.45 at 2019-03-12 09:41:13 +0000
Started GET "/v/index.php" for 117.102.115.45 at 2019-03-12 09:41:14 +0000
Started GET "/phpmyadm1n/index.php" for 117.102.115.45 at 2019-03-12 09:41:14 +0000
Started GET "/shaAdmin/index.php" for 117.102.115.45 at 2019-03-12 09:41:17 +0000
Started GET "/phpMyadmi/index.php" for 117.102.115.45 at 2019-03-12 09:41:17 +0000
Started GET "/phpMyAdmion/index.php" for 117.102.115.45 at 2019-03-12 09:41:18 +0000
Started GET "/s/index.php" for 117.102.115.45 at 2019-03-12 09:41:19 +0000
Started GET "/MyAdmin/index.php" for 117.102.115.45 at 2019-03-12 09:41:21 +0000
Started GET "/phpMyAdmin1/index.php" for 117.102.115.45 at 2019-03-12 09:41:21 +0000
Started GET "/phpMyAdmin123/index.php" for 117.102.115.45 at 2019-03-12 09:41:22 +0000
Started GET "/pwd/index.php" for 117.102.115.45 at 2019-03-12 09:41:23 +0000
Started GET "/phpMydmin/index.php" for 117.102.115.45 at 2019-03-12 09:41:25 +0000
Started GET "/phpMyAdmins/index.php" for 117.102.115.45 at 2019-03-12 09:41:25 +0000
Started GET "/program/index.php" for 117.102.115.45 at 2019-03-12 09:41:26 +0000
Started GET "/shopdb/index.php" for 117.102.115.45 at 2019-03-12 09:41:26 +0000
Started GET "/phpmy/index.php" for 117.102.115.45 at 2019-03-12 09:41:29 +0000
Started GET "/mysql/admin/index.php" for 117.102.115.45 at 2019-03-12 09:41:29 +0000
Started GET "/mysql/dbadmin/index.php" for 117.102.115.45 at 2019-03-12 09:41:30 +0000
Started GET "/mysql/sqlmanager/index.php" for 117.102.115.45 at 2019-03-12 09:41:30 +0000
Started GET "/mysql/mysqlmanager/index.php" for 117.102.115.45 at 2019-03-12 09:41:32 +0000
Started GET "/wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php" for 117.102.115.45 at 2019-03-12 09:41:33 +0000
Started GET "/_asterisk/" for 185.53.91.24 at 2019-03-12 09:58:24 +0000

By using some LInux magic (see next post!) I get a sorted list of the worst perpetrators:

163 117.102.115.45
(Indonesia)
153 119.27.162.157
(China)
108 59.152.246.210
(Hong Kong)
45 185.53.91.24
(Iceland)
21 173.212.225.214
(Germany)
17 185.234.218.74
(Ireland)
6 95.213.177.126
(Russia)
2 95.213.177.124
(Russia)
2 196.200.85.102
(Mali)
1 95.213.177.123
1 92.253.17.66
1 92.19.25.4
1 91.219.222.58
1 91.192.32.164
1 88.148.116.196
1 82.223.71.242
1 82.127.226.16
1 79.62.93.156
1 78.9.56.140
1 78.188.238.57
1 77.159.87.121
1 74.82.47.4
1 71.6.232.5
1 69.163.163.106
1 61.219.107.36
1 60.191.52.254
1 60.191.23.60
1 60.191.20.210
1 59.120.245.86
1 5.202.83.133
1 37.220.64.185
1 34.230.16.115
1 217.113.147.106
1 212.21.20.74
1 208.113.197.88
1 201.93.227.157
1 201.116.230.90
1 198.58.100.134
1 198.143.158.178
1 196.52.43.88
1 193.232.55.198
1 191.241.48.180
1 187.34.182.48
1 185.199.97.11
1 185.124.117.215
1 178.128.194.144
1 177.95.193.205
1 177.94.18.44
1 177.86.125.11
1 177.105.231.190
1 176.165.57.8
1 175.134.50.232
1 157.119.227.102
1 157.119.226.19
1 152.249.54.177
1 151.66.41.4
1 14.102.19.20
1 138.118.242.11
1 137.74.30.6
1 13.57.38.209
1 13.57.246.49
1 124.41.213.172
1 124.120.140.165
1 103.78.12.9
1 103.41.146.178
1 103.212.91.80

Be careful out there!

0
Development, Linux, Network

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.