I've recently set up a build server that compiles Java source on Github webhooks. I created a public page for downloading latest .jars with a top level domain and I'm logging requests to it. What are common intentions for the automated requests sent to my server?

[18.11.2014 02:06:23]      3ms /mysql/main.php
[18.11.2014 02:06:23]      2ms /sql/main.php
[18.11.2014 02:06:24]      2ms /PMA/main.php
[18.11.2014 02:06:24]      3ms /admin/main.php
[18.11.2014 02:06:24]      3ms /dbadmin/main.php
[18.11.2014 02:06:24]      3ms /myadmin/main.php
[18.11.2014 02:06:25]      3ms /db/main.php
[18.11.2014 02:06:28]      2ms /sqlmanager/main.php
[18.11.2014 02:06:28]      2ms /phpmyadmin2/main.php
[18.11.2014 02:06:28]      2ms /phpMyAdmin2/main.php
[18.11.2014 02:06:29]      2ms /phpMyAdmin-2/main.php
[18.11.2014 02:06:29]      2ms /php-my-admin/main.php
[18.11.2014 02:06:29]      2ms /phpMyAdmin-3.5.8-rc1/main.php
[18.11.2014 02:06:29]      2ms /phpMyAdmin-4.0.0-rc1/main.php
[18.11.2014 02:06:29]      2ms /phpMyAdmin-3.5.7-1/main.php
[18.11.2014 02:06:30]      3ms /phpMyAdmin-3.5.7/main.php
[18.11.2014 02:06:30]      2ms /phpMyAdmin-3.5.6/main.php
[18.11.2014 02:06:31]      2ms /phpMyAdmin-3.5.5/main.php
[18.11.2014 02:06:31]      2ms /phpMyAdmin-3.5.4/main.php
[18.11.2014 02:06:31]      2ms /phpMyAdmin-3.5.3/main.php
[18.11.2014 02:06:32]      3ms /phpMyAdmin-
[18.11.2014 02:06:35]      2ms /phpMyAdmin-
[18.11.2014 02:06:35]      2ms /phpMyAdmin-
[18.11.2014 02:06:35]      2ms /phpMyAdmin-
[18.11.2014 02:06:39]      2ms /phpMyAdmin-3.5.2/main.php
[18.11.2014 02:06:39]      2ms /phpMyAdmin-3.5.1/main.php

Okay, someone tries to find out if I have phpmyadmin installed by requesting commonly used phpmyadmin folder paths. But what could an attacker do if he knows where I have phpmyadmin? Would he try to login as root with a wordlist of passwords?

[18.11.2014 21:53:00]      4ms http://www.anonymousproxylist.net/azenv2.php
[18.11.2014 21:53:17]      4ms http://yazoodle.net/azenv.php
[18.11.2014 21:53:43]      4ms http://sonke31.free.fr/world.php
[18.11.2014 21:54:57]      5ms http://sonke31.free.fr/world.php
[18.11.2014 21:57:08]      4ms http://sonke31.free.fr/world.php
[18.11.2014 21:59:38]      4ms http://proxyjudge.us/
[18.11.2014 23:00:00]      4ms http://www.proxyjudge.biz/az.php
[18.11.2014 23:00:20]      4ms http://azenv.net/
[18.11.2014 23:00:44]      7ms http://www.mesregies.com/azz.php

These requests do not start with /, so they can't come from a normal browser. If I visit the links, the pages display information about my request.

[17.11.2014 07:40:50]      3ms /baba/bab/ba.php
[18.11.2014 03:33:47]      3ms /xbxb/xbx/xb.php
[18.11.2014 14:39:52]      4ms /jcjc/jcj/jc.php
[18.11.2014 21:31:04]      3ms /aiai/aia/ai.php

These requests base on the same pattern, but I have no idea why someone could search for a .php file on those paths.

  • 5
    Why on earth would you visit obvious spam websites? They are blindly looking for exploits on your server.
    – Ramhound
    Commented Nov 19, 2014 at 12:15
  • @Ramhound it may be an attempt to figure out what the process is and stop it from happening? a method of prevention I'm not certain though.
    – Nathan Taylor
    Commented Nov 19, 2014 at 14:57
  • Considering these type of crawlers DO NOT respect any configuration changes you might do that legit crawlers would respect your options are limited. One possible solution is configure the build server so it rejects anyone outside your network except Github.
    – Ramhound
    Commented Nov 19, 2014 at 14:59
  • I won't try to make them stop searching for exploits on my server. I am just interested in knowing what they are actually searching for. The spider from the second example sends URLs as requests. So what kind of insecure server could get attacked by sending URLs as request?
    – Aich
    Commented Nov 19, 2014 at 15:55

2 Answers 2


So there are already some answers given. For the second set, the one with the http://url in the request, these tries to find badly configured (not secured) proxy servers that could be wide open.

These can then be used to hide the real origin of attacks/scans directed onto an other machine. The other machine will then see the attack as if it was coming from you.

And about phpMyAdmin: many many things can be done by an attacker if he knows which software / which version you have. You can find a precise list of bugs/security problems here.

  • I am sorry. I do not agree with that. The URLs in question are the request and not the source of the request. These are often an indication of forged headers and may be a specific test to see how the server responds to invalid requests- possibly with a catch-all site like so many of us have. I see this in my research all the time. What is not clear is the objective. It may be a fault in the software in directing the request. Since it is a forged header, the request is delivered where as it would not normally. I still think it is a specific test of the site configuration.
    – closetnoc
    Commented Nov 19, 2014 at 18:16
  • A request from a user to a proxy for a target site is in the form: GET http://www.targetsite.com/ HTTP/1.1. The objective is simple: if the scanner receives the file that is on the target site, he found an open proxy that he will be happy to (ab)use. Have a look there: [w3.org, point 5.1.2](www.w3.org/Protocols/rfc2616/rfc2616-sec5.html)
    – Zimmi
    Commented Nov 19, 2014 at 18:41
  • Yes. You may be right. I also see this to see if the first site defined on a server, the last site defined on the server, or if a catch-all site responds and how. It may be that we are both right. My apologies! Sometimes we miss the obvious.
    – closetnoc
    Commented Nov 19, 2014 at 18:44

Okay. Most of these access (at least) are landscaping attempts to find potential vulnerabilities on your server. They are trying to fingerprint your server to know what web-based applications are installed. The first set and third set are clearly landscaping. The second set may be a result of forged request headers but still likely to be landscaping- not sure.

It is very likely that these are compromised systems.

Here are some specifics with .htaccess blocking code for each: NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC

IP Address Range: -

RewriteCond %{REMOTE_ADDR} ^64\.20\.(0*[3-5]*[2-7]*)\.([0-2]*[0-5]*[0-5]*)$ [NC]
RewriteRule .* - [F,L] CNCGROUP China169 Backbone (This network is well known for hacking activity.)

IP Address Range: -

RewriteCond %{REMOTE_ADDR} ^218\.(0*[5-6]*[6789012]*)\.([0-1]*[0-2]*[0-7]*)\.([0-2]*[0-5]*[0-5]*)$ [NC]
RewriteRule .* - [F,L] OVH Systems

IP Address Range: -

RewriteCond %{REMOTE_ADDR} ^198\.27\.([0-1]*[6789012]*[4-7]*)\.([0-2]*[0-5]*[0-5]*)$ [NC]
RewriteRule .* - [F,L] (I do not have an ASN assigned for this so the block code just blocks the one IP address.)

RewriteCond %{REMOTE_ADDR} ^123\.57\.15\.26$ [NC]
RewriteRule .* - [F,L] TOT Public Company Limited

IP Address Range: -

RewriteCond %{REMOTE_ADDR} ^118\.(1*7*[4-5]*)\.([0-2]*[1-5]*[9012345]*)\.([0-2]*[0-5]*[0-5]*)$ [NC]
RewriteRule .* - [F,L] Hutchison Global Communications

IP Address Range: -

RewriteCond %{REMOTE_ADDR} ^118\.(1*4*[0-3]*)\.0\.([0-2]*[0-5]*[0-5]*)$ [NC]
RewriteRule .* - [F,L]

You can also combine these like in this example:

RewriteCond %{REMOTE_ADDR} ^123\.57\.15\.26$ [NC, OR]
RewriteCond %{REMOTE_ADDR} ^118\.(1*4*[0-3]*)\.0\.([0-2]*[0-5]*[0-5]*)$ [NC]
RewriteRule .* - [F,L]

... where the OR is included on each line to include multiple conditions.

If you have more IP addresses, please edit the question and include them and I can edit the answer with more code. Also, please let me know if it was required to escape the . [dot] so that I can update this answer and my utility to include them for the future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.