Tweet
Is this an attempt to hack into my forum?
The two lines from my logs below are seen repeatedly in my server logs and the IP's are always from some foreign country like Russian Federation or Belgium etc. Are these attempts to auto register or something?
The image hash seems to change on each line and these lines are usually repeated 20 - 50 times within less than 1 minute.
194.8.75.161 - - [12/Dec/2008:07:36:20 -0500] "GET /image.php?type=regcheck&imagehash=74f6f0863916b7ad333dce990ae35a34 HTTP/1.0" 200 16708 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
194.8.75.161 - - [12/Dec/2008:07:36:51 -0500] "POST /register.php?do=addmember HTTP/1.0" 200 22262 "http://Myforum.com/register.php?" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
The two lines from my logs below are seen repeatedly in my server logs and the IP's are always from some foreign country like Russian Federation or Belgium etc. Are these attempts to auto register or something?
The image hash seems to change on each line and these lines are usually repeated 20 - 50 times within less than 1 minute.
194.8.75.161 - - [12/Dec/2008:07:36:20 -0500] "GET /image.php?type=regcheck&imagehash=74f6f0863916b7ad333dce990ae35a34 HTTP/1.0" 200 16708 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
194.8.75.161 - - [12/Dec/2008:07:36:51 -0500] "POST /register.php?do=addmember HTTP/1.0" 200 22262 "http://Myforum.com/register.php?" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
Comment