phpMyAdmin scans--what signatures should I block?

I got hit by a phpMyAdmin scan a few days ago, and the scan started with a "GET /muieblackcat". phpMyAdmin is not installed, nor do I have a CMS installed, so I am safe as far as I can tell, but I'd like to determine what other accesses are known scans.

I have a Fail2ban setup that blocks known attack signatures. These signatures match accesses to files like "/muieblackcat" and user agents such as "ZmEu". I recently added a more generic signature that matches all accesses containing "/scripts/setup.php".

What other signatures do I need to block?

–DragonLord

2 Replies

Why?

If you don't have the target, it's just more Internet noise to ignore.

@vonskippy:

Why?

If you don't have the target, it's just more Internet noise to ignore.

I just took down PHPmyAdmin today. If you don't have what's trying to be hacked, or if you don't have a vulnerability, just ignore it as random internet noise. That happens.

Reply

Please enter an answer
Tips:

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct