minadreapta Posted February 6, 2008 Share Posted February 6, 2008 i have everyday some IPs blocked by my server's firewall. but lately this has gone mad: over 4-500 IPs blocked everyday... is this normal? i am quite new to dedicated servers so i don't know if this is the average... 99% of the the firewall entries look like this: =========== ModSecurity: Access denied with code 406 (phase 2). Pattern match [msg "System Command Injection."] [hostname "www.domain.tld"] [uri "//index.php?option=com_content&task=§ionid=&id=&mosConfig_absolute_path=<<URL to shell script removed>>?"] =========== anyone? 0 Quote Link to comment Share on other sites More sharing options...
JasonO Posted February 6, 2008 Share Posted February 6, 2008 Looks like a file to grab the contents of something someone shouldn't be seeing - relating to Mambo or Joomla. It's being picked up and blocking whoever's trying to do it. 0 Quote Link to comment Share on other sites More sharing options...
bear Posted February 6, 2008 Share Posted February 6, 2008 Someone's bot is trying to inject a script into your server (.txt file, which is a shell script, or more specifically, testing your server for exploitable things). Yup, it's normal...ish. 0 Quote Link to comment Share on other sites More sharing options...
railto Posted February 6, 2008 Share Posted February 6, 2008 welcome to the world of running your own servers, happens all the time, 0 Quote Link to comment Share on other sites More sharing options...
minadreapta Posted February 7, 2008 Author Share Posted February 7, 2008 ok, thanks guys. 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.