[I originally posted on SO but it earned me a Tumbleweed badge. This looks like a better venue for the question.]

I have Apache (XAMPP 1.8.0) running on Vista Pro x64. A couple times now I have seen a pattern like the example below in access.log. Concerning is the "attack" seems to somehow shift from a public IP to a valid private IP on my network (happens to be the WAN address of one of my routers).

Two questions: How is this possible, and what happens if the "attacker" stumbles on a valid request?

I've googled this to no avail.

177.0.X.X - - [03/Jun/2012:08:19:34 -0400] "GET /phpMyAdmin-2.5.4/index.php HTTP/1.1" 403 
177.0.X.X - - [03/Jun/2012:08:19:34 -0400] "GET /phpMyAdmin-2.5.5-rc1/index.php HTTP/1.1" 403 
177.0.X.X - - [03/Jun/2012:08:19:34 -0400] "GET /phpMyAdmin-2.2.6/index.php HTTP/1.1" 403 
177.0.X.X - - [03/Jun/2012:08:19:34 -0400] "GET /phpMyAdmin-2.5.5-rc2/index.php HTTP/1.1" 403 - - [03/Jun/2012:08:19:56 -0400] "GET /phpMyAdmin-2.5.6-rc2/index.php HTTP/1.1" 403 
177.0.X.X - - [03/Jun/2012:08:19:56 -0400] "GET /phpMyAdmin-2.5.6-rc1/index.php HTTP/1.1" 403 
177.0.X.X - - [03/Jun/2012:08:19:56 -0400] "GET /phpMyAdmin-2.5.5-pl1/index.php HTTP/1.1" 403 - - [03/Jun/2012:08:19:59 -0400] "GET /phpMyAdmin-2.5.7/index.php HTTP/1.1" 403 - - [03/Jun/2012:08:20:01 -0400] "GET /phpMyAdmin-2.5.7-pl1/index.php HTTP/1.1" 403 - - [03/Jun/2012:08:20:02 -0400] "GET  HTTP/1.1" 400 1060 "-" "-"

It may have to do with how XAMP is configured with your local server and how routing is setup to send web traffic to your server.

It's actually common to see bots scanning your server for vulnerabilities and common scripts such as phpMyAdmin.

On linux I would add them to hosts.deny, in apache you can ban them with your .htaccess file.

If the attacks are internal check your router and see who has those IP's on your network.

  • Thanks for the response. I can pretty confidently say this is not an internal attack, and I routinely deny high-volume scan addresses in httpd.conf. FWIW my network architecture has two routers: Internet <-> RouterA <-> RouterB <-> many local devices. RouterA directs HTTP traffic to RouterB, which in turn directs to localhost. is the WAN address of RouterB. Maybe RouterB is just getting confused? Jun 27 '12 at 1:55
  • Why not run a test, using a proxy or your phone for that matter going through another network connect to your website with one of the same URL's as in your log generating a 404 and see what IP shows up? A good windows program to monitor packets is WireShark formerly etherreal. Limit protocols to HTTP traffic and see what it displays in real time.
    – Anagio
    Jun 27 '12 at 4:13
  • I'm not too familiar with TCP/IP protocol and HTTP but I know Nmap is capable of scanning ports with half open connections so they are harder to detect typical port scans with that. It's possible whichever scanner is doing this is sending packets just to quickly see what's there and disconnects before a full TCP connection is established and your server has no IP to log other than your local one? I don't know that sounds wrong but who knows how the connection is being created.
    – Anagio
    Jun 27 '12 at 4:17
  • Thanks for the ideas and suggestions. I will try these. I had not thought of using WireShark to log traffic. I will follow-up after my tests. Jun 28 '12 at 0:03
  • Test 1: I set up WireShark to record inbound HTTP requests and as luck (?) would have it, I trapped this exact scenario from a different IP. It is interesting to look at, but doesn't answer any questions. Half-way through the hit list the source IP changes from x.x.x.x to for no apparent reason. [continues...] Jun 28 '12 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.