suspicious hits

[andychev]

I seem to have been getting some very suspicious activity on my account. Looking at the error log there seems to be someone? looking for config files to play with?

A small section of the error log is as follows:

[Thu Nov 30 22:20:32 2006] [error] [client 67.18.223.2] File does not exist: /home/special/public_html/search/includes/config.php
[Thu Nov 30 22:20:32 2006] [error] [client 67.18.223.2] File does not exist: /home/special/public_html/php/phpdig/includes/config.php
[Thu Nov 30 22:20:32 2006] [error] [client 67.18.223.2] File does not exist: /home/special/public_html/dig/includes/config.php
[Thu Nov 30 22:20:32 2006] [error] [client 67.18.223.2] File does not exist: /home/special/public_html/Dig/includes/config.php
[Thu Nov 30 22:20:32 2006] [error] [client 67.18.223.2] File does not exist: /home/special/public_html/phpDig/includes/config.php
[Thu Nov 30 22:20:32 2006] [error] [client 67.18.223.2] File does not exist: /home/special/public_html/PhpDig/includes/config.php
[Thu Nov 30 22:20:32 2006] [error] [client 67.18.223.2] File does not exist: /home/special/public_html/gallery/adminfoot.php
[Thu Nov 30 22:20:32 2006] [error] [client 67.18.223.2] File does not exist: /home/special/public_html/gall/config.php
[Thu Nov 30 22:20:32 2006] [error] [client 67.18.223.2] File does not exist: /home/special/public_html/gallery/config.php

Any thoughts?

[jmarcv]

Pretty common practice. They troll for known files, hoping that with remote includes they can uncover some database logins and start having fun! I see them oin the logs all the time, which is why Matt is always warning to keep your software up to date.