Look what I found on my logs today

[mihai11]

There are 21 IP addresses from which they attacked by box. Take a look below:

66.249.72.201 = 1
205.134.161.114 = 11
83.16.76.50 = 1
81.177.16.71 = 1
66.35.110.180 = 1
208.99.195.54 = 18
82.199.192.2 = 1
75.126.134.16 = 1
64.131.86.2 = 1
67.99.202.5 = 1
86.121.14.71 = 2
24.83.72.98 = 1
81.3.4.103 = 2
70.87.229.2 = 1
89.120.209.12 = 4
86.35.254.29 = 2
86.124.17.151 = 1
89.42.84.165 = 1
85.54.158.71 = 5
202.88.176.109 = 27
213.203.208.154 = 5


What I mean by the above is this:

[IP address] = [no. of 404 errors]

To be more clear: how many requests they have done from a given IP address.

I only counted requests that were looking for some known vulnerabilities - like the one in "ImpExData.php".

If you will closely analyze the data, you can see that from most IPs there is only 1 request !?!?! Why ? They were anticipating a ban ?

Originally Posted by cheat-master30

I don't think blocking them with .htaccess is that difficult. Try something like:

deny from [their ip here]

in that .htaccess file.

Secondly, yes, it is a hacking attempt, but obviously not much of a good one, and a bit strange that they never tried breaking into the install directory. Try blocking access from those directories in future (install directory and directory where you installed impex).

I don't have ImpEx on my board. I did not use it because my board started with VBulletin.

You are right about this: they were not looking for the "install" folder.