Community ▶ Questions ▶ Is someone trying to run phpadmin scripts on my server

Is someone trying to run phpadmin scripts on my server

Here is what I get from my /var/log/messages my IP is 71.176.78.155

but,if you look. I see a different IP address in there. Also my server doesn't even have phpadmin installed.

5 12:39:37 Micro drupal: http://71.176.78.155|1330969177|page not found|213.79.125.20|http://71.176.78.155/phpMyAdmin-2.6.3/s … /setup.php">http://71.176.78.155/phpMyAdmin-2.6.3/scripts/setup.php||0||phpMyAdmin-2.6.3/scripts/setup.php

Question Title

Please include an alpha-numeric character in your title (0-9, A-Z, a-z)

Compose
Preview

Description

Please enter a question

Tags (Optional, comma-separated)

3 Replies

forum:Nuvini 12 years, 8 months ago

Seems like a fairly common type of attack. It gives a 404-error which is fine. I wouldn't worry too much about it:

Google

Honeypot alert

Edit: It's also known as an offensive IP:

Bizimbal

Project honeypot

Compose
Preview

Description

<r>Seems like a fairly common type of attack. It gives a 404-error which is fine. I wouldn't worry too much about it:

<url url="http://www.google.nl/#sclient=psy-ab&amp;hl=en&amp;site=&amp;source=hp&amp;q=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&amp;pbx=1&amp;oq=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&amp;aq=f&amp;aqi=&amp;aql=&amp;gs_sm=3&amp;gs_upl=319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&amp;gs_l=hp.3…319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&amp;bav=on.2,or.r_gc.r_pw.,cf.osb&amp;fp=746216cab9782646&amp;biw=1280&amp;bih=908">~~[](http://www.google.nl/#sclient=psy-ab&hl=en&site=&source=hp&q=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&pbx=1&oq=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&aq=f&aqi=&aql=&gs_sm=3&gs_upl=319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&gs_l=hp.3...319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=746216cab9782646&biw=1280&bih=908)~~[Google](http://www.google.nl/#sclient=psy-ab&hl=en&site=&source=hp&q=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&pbx=1&oq=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&aq=f&aqi=&aql=&gs_sm=3&gs_upl=319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&gs_l=hp.3...319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=746216cab9782646&biw=1280&bih=908)</url>

<url url="http://blog.spiderlabs.com/2012/01/honeypot-alert-extensive-setupphp-scanning-detected.html">~~[](http://blog.spiderlabs.com/2012/01/honeypot-alert-extensive-setupphp-scanning-detected.html)~~[Honeypot alert](http://blog.spiderlabs.com/2012/01/honeypot-alert-extensive-setupphp-scanning-detected.html)</url>

Edit: It's also known as an offensive IP:

<url url="http://www.bizimbal.com/odb/details.html?id=1044120">~~[](http://www.bizimbal.com/odb/details.html?id=1044120)~~[Bizimbal](http://www.bizimbal.com/odb/details.html?id=1044120)</url>

<url url="http://www.projecthoneypot.org/ip_213.79.125.20">~~[](http://www.projecthoneypot.org/ip_213.79.125.20)~~[Project honeypot](http://www.projecthoneypot.org/ip_213.79.125.20)</url></r>

<r>Seems like a fairly common type of attack. It gives a 404-error which is fine. I wouldn't worry too much about it:
<url url="http://www.google.nl/#sclient=psy-ab&amp;hl=en&amp;site=&amp;source=hp&amp;q=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&amp;pbx=1&amp;oq=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&amp;aq=f&amp;aqi=&amp;aql=&amp;gs_sm=3&amp;gs_upl=319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&amp;gs_l=hp.3…319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&amp;bav=on.2,or.r_gc.r_pw.,cf.osb&amp;fp=746216cab9782646&amp;biw=1280&amp;bih=908"><del><a href="http://www.google.nl/#sclient=psy-ab&hl=en&site=&source=hp&q=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&pbx=1&oq=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&aq=f&aqi=&aql=&gs_sm=3&gs_upl=319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&gs_l=hp.3…319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=746216cab9782646&biw=1280&bih=908"></a></del><a href="http://www.google.nl/#sclient=psy-ab&hl=en&site=&source=hp&q=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&pbx=1&oq=phpMyAdmin-2.6.3%2Fscripts%2Fsetup.php&aq=f&aqi=&aql=&gs_sm=3&gs_upl=319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&gs_l=hp.3…319l319l0l608l1l1l0l0l0l0l65l65l1l1l0&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=746216cab9782646&biw=1280&bih=908">Google</a></url>
<url url="http://blog.spiderlabs.com/2012/01/honeypot-alert-extensive-setupphp-scanning-detected.html"><del><a href="http://blog.spiderlabs.com/2012/01/honeypot-alert-extensive-setupphp-scanning-detected.html"></a></del><a href="http://blog.spiderlabs.com/2012/01/honeypot-alert-extensive-setupphp-scanning-detected.html">Honeypot alert</a></url>
Edit: It's also known as an offensive IP:
<url url="http://www.bizimbal.com/odb/details.html?id=1044120"><del><a href="http://www.bizimbal.com/odb/details.html?id=1044120"></a></del><a href="http://www.bizimbal.com/odb/details.html?id=1044120">Bizimbal</a></url>
<url url="http://www.projecthoneypot.org/ip_213.79.125.20"><del><a href="http://www.projecthoneypot.org/ip_213.79.125.20"></a></del><a href="http://www.projecthoneypot.org/ip_213.79.125.20">Project honeypot</a></url></r>

Please enter an answer

forum:nehalem 12 years, 8 months ago

> Is someone trying to run phpadmin scripts on my server

> my server doesn't even have phpadmin installed

So what's the problem?

Compose
Preview

Description

Please enter an answer

forum:jbenamy 12 years, 8 months ago

I believe you mean phpMyAdmin, not phpadmin.

Compose
Preview

Description

Please enter an answer

Reply

Compose
Preview

Description

Please enter an answer

Tips:

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct

Compute

Storage

Networking

Databases

Services

Developer Tools

Industries

Pricing

Community

Engage With Us

Is someone trying to run phpadmin scripts on my server

3 Replies

Reply

Tips: