1

I have an ASP.net website hosted using the Ultidev Web Server Pro.

Every day I get a steady stream of errors generated by my application where page requests were requested and denied. This is obviously someone/something trying to find any exploits on my website. Here is an example log:

28/08/2012 11:37:11 - File not Found:http://MyWebServer/phpmyadmin/index.php
28/08/2012 11:37:11 - File not Found:http://MyWebServer/phpMyAdmin/index.php
28/08/2012 11:37:12 - File not Found:http://MyWebServer/phpMyAdmin-2/index.php
28/08/2012 11:37:12 - File not Found:http://MyWebServer/php-my-admin/index.php
28/08/2012 11:37:13 - File not Found:http://MyWebServer/phpMyAdmin-2.2.3/index.php
28/08/2012 11:37:13 - File not Found:http://MyWebServer/phpMyAdmin-2.2.6/index.php
28/08/2012 11:37:14 - File not Found:http://MyWebServer/phpMyAdmin-2.5.1/index.php
28/08/2012 11:37:14 - File not Found:http://MyWebServer/phpMyAdmin-2.5.4/index.php
28/08/2012 11:37:15 - File not Found:http://MyWebServer/phpMyAdmin-2.5.5-rc1/index.php
28/08/2012 11:37:15 - File not Found:http://MyWebServer/phpMyAdmin-2.5.5-rc2/index.php
28/08/2012 11:37:15 - File not Found:http://MyWebServer/phpMyAdmin-2.5.5/index.php
28/08/2012 11:37:16 - File not Found:http://MyWebServer/phpMyAdmin-2.5.5-pl1/index.php
28/08/2012 11:37:16 - File not Found:http://MyWebServer/phpMyAdmin-2.5.6-rc1/index.php
28/08/2012 11:37:17 - File not Found:http://MyWebServer/phpMyAdmin-2.5.6-rc2/index.php
28/08/2012 11:37:18 - File not Found:http://MyWebServer/phpMyAdmin-2.5.6/index.php
28/08/2012 11:37:18 - File not Found:http://MyWebServer/phpMyAdmin-2.5.7/index.php
28/08/2012 11:37:19 - File not Found:http://MyWebServer/phpMyAdmin-2.5.7-pl1/index.php
28/08/2012 13:52:07 - File not Found:http://MyWebServer/admin/pma/translators.html

Is this normal? Is there anything I can do to protect myself against this?

Improve this question
1
  • This is normal, I have had this issue in the past
    – Daniel Li
    Aug 29, 2012 at 16:14

2 Answers 2

Reset to default
3

It is "normal". As you already stated, they probably are bots trying to find a way to access applications with known exploits, pinging random IPs. One thing you can do is to have third party services accessible from non-standard paths and/or password protect them if necessary and helpful. As long as the bot is hitting 404 then you're safe even if you are running those services.

Improve this answer
2
  • Is it worth blocking known bad IPs or IPs that are persistently getting 404s?
    – MrWhite
    Aug 28, 2012 at 14:07
  • 1
    You could block them, but keeping in mind that IPs are really easy to change, so you might end up blocking more IP than you want, and although unlikely, you could block some legitimate user. Unless you see some activity with a different pattern of actions every access, actively trying to hack your site (trying to inject SQL, bruteforcing passwords, etc), I wouldn't worry about blocking IPs.
    – milo5b
    Aug 28, 2012 at 14:21
1

Personally, I redirect requests to non-existent CMS login pages to a script that temp-blocks the IP's, files an abuse report with AbuseIPDB, and adds the IP to a set of blocklists that I maintain myself. I figure the chances of someone innocently trying to access a CMS or other protected login page on a site they don't own are roughly zero; so hits on non-existent pages are temp-blocked and reported after one hit.

Failed logins on actual pages are treated like any other failed logins: Blocked after X-number of attempts (the specific value of "X" depending on how dumb the users on that particular server are); and factored into triggers for distributed attacks, temp-to-perm blocking, and so forth.

Richard

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.