Results 1 to 4 of 4

Strange hacking attempt

This is a discussion on Strange hacking attempt within the Off-Topic & Chit Chat forums, part of the Focus on Members category; Just found everything running slow. A quick check on my server to see where hits were coming from and I ...

  1. #1
    Senior Member Lee G's Avatar
    Real Name
    Lee
    Join Date
    Sep 2006
    Location
    Costa Blanca
    Posts
    690
    Liked
    40 times
    Blog Entries
    4

    Strange hacking attempt

    Just found everything running slow. A quick check on my server to see where hits were coming from and I found this

    PHP Code:
    xc3/x83/xc2/x82/xc3/x82/xc2/xbc 
    The hashes were the other way round though
    The person was doing it about four times a second, so it looks like automated software they were using.

    Has anyone else had anything like this?

  2. #2
    Senior Member
    Real Name
    Ceri May
    Join Date
    Jul 2009
    Location
    United Kingdom
    Posts
    1,726
    Liked
    15 times
    Blog Entries
    1
    Quote Originally Posted by Lee G View Post
    Just found everything running slow. A quick check on my server to see where hits were coming from and I found this

    PHP Code:
    xc3/x83/xc2/x82/xc3/x82/xc2/xbc 
    The hashes were the other way round though
    The person was doing it about four times a second, so it looks like automated software they were using.

    Has anyone else had anything like this?
    I have seen this before, the closest thing I can guess is they are actually trying to find an exploit in apache system...

    In fact thinking back it reminds me of an old Jpeg of Death Exploit where a virus could be included in a well constructed Jpeg file but it only effected windows servers but that was patched back in 2004 but maybe they have found another or are just trying, if they have though it will be OS or Apache based.

  3. #3
    vBSEO Staff Brian Cummiskey's Avatar
    Real Name
    Brian Cummiskey
    Join Date
    Jul 2009
    Location
    btwn NYC and Boston
    Posts
    12,789
    Liked
    657 times
    Blog Entries
    2
    Those are actually kinda normal, usually the result of a bad request from a bot.

  4. #4
    Senior Member Lee G's Avatar
    Real Name
    Lee
    Join Date
    Sep 2006
    Location
    Costa Blanca
    Posts
    690
    Liked
    40 times
    Blog Entries
    4
    This was a private individual Brian. Checked the IP and it was a personal one. 80.26.114.34

    When I looked at the hits, they were coming in at 6 hits a second
    Cant of been the most intellectual of brain dead scum that inhabit the face of the earth. In todays case, Spain.
    They were using the word "forum" at the end of each bit of code
    It seemed to look like a natural progression. The code was increasing in length after each cycle
    Nothing as been thrown up on any google searches either

    Fire walled them for the fun of it

    Thanks for the help guys

Similar Threads

  1. indication of exploit attempt?
    By m0rgulvale in forum Troubleshooting
    Replies: 2
    Last Post: 12-20-2009, 11:13 AM
  2. First attempt to configure vbseo
    By AntonioP in forum Pre-Sales Questions
    Replies: 4
    Last Post: 07-26-2008, 03:14 PM
  3. Google hacking, did anyone experience this?
    By Arjan in forum General Discussion
    Replies: 2
    Last Post: 08-31-2007, 09:21 AM
  4. General Hacking and Debugging of vB
    By LarryEitel in forum General Discussion
    Replies: 1
    Last Post: 06-28-2006, 09:08 PM
  5. Considering a re-attempt at vbseo
    By Mike in forum General Discussion
    Replies: 12
    Last Post: 05-21-2006, 12:04 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •