เรียนพี่ๆผู้ดูแลระบบทุกท่านครับ
เช้านี้ผมตรวจ log file ตามปกติ แต่ปรากฎว่าพบ log file ที่มี request แปลกๆมาจาก ip 49.49.107.56 (ซึ่งน่าจะเป็นของ 3bb) พยามๆ get phpmyadmin (ลง appserv)
ผมจึงได้ query log เฉพาะ ip มาดู ซึ่งได้ผลดังนี้
49.49.107.56 - - [09/ก.ย./2555:16:34:01 +0700] “GET /phpmyadmin HTTP/1.1” 301 247
49.49.107.56 - - [09/ก.ย./2555:16:34:01 +0700] “GET /phpmyadmin/ HTTP/1.1” 200 7463
49.49.107.56 - - [09/ก.ย./2555:16:34:03 +0700] “GET /phpmyadmin/themes/pmahomme/jquery/jquery-ui-1.8.custom.css HTTP/1.1” 200 30846
49.49.107.56 - - [09/ก.ย./2555:16:34:03 +0700] “GET /phpmyadmin/js/cross_framing_protection.js?ts=1324454872 HTTP/1.1” 200 331
49.49.107.56 - - [09/ก.ย./2555:16:34:03 +0700] “GET /phpmyadmin/js/update-location.js?ts=1324454872 HTTP/1.1” 200 758
49.49.107.56 - - [09/ก.ย./2555:16:34:03 +0700] “GET /phpmyadmin/js/functions.js?ts=1324454872 HTTP/1.1” 200 31563
49.49.107.56 - - [09/ก.ย./2555:16:34:03 +0700] “GET /phpmyadmin/js/jquery/jquery-1.4.4.js?ts=1324454872 HTTP/1.1” 200 78268
49.49.107.56 - - [09/ก.ย./2555:16:34:03 +0700] “GET /phpmyadmin/js/jquery/jquery.qtip-1.0.0.min.js?ts=1324454872 HTTP/1.1” 200 38434
49.49.107.56 - - [09/ก.ย./2555:16:34:03 +0700] “GET /phpmyadmin/phpmyadmin.css.php?server=1&lang=en&collation_connection=utf8_general_ci&token=7f90b7f558fd397e088d98c27f871e8c&js_frame=right&nocache=3977167596 HTTP/1.1” 200 41672
49.49.107.56 - - [09/ก.ย./2555:16:34:03 +0700] “GET /phpmyadmin/js/messages.php?lang=en&db=&collation_connection=utf8_general_ci&token=7f90b7f558fd397e088d98c27f871e8c HTTP/1.1” 200 4934
49.49.107.56 - - [09/ก.ย./2555:16:34:04 +0700] “GET /phpmyadmin/themes/pmahomme/img/logo_right.png HTTP/1.1” 200 4921
49.49.107.56 - - [09/ก.ย./2555:16:34:04 +0700] “GET /phpmyadmin/themes/pmahomme/img/input_bg.gif HTTP/1.1” 200 162
49.49.107.56 - - [09/ก.ย./2555:16:34:04 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_help.png HTTP/1.1” 200 1594
49.49.107.56 - - [09/ก.ย./2555:16:34:04 +0700] “GET /phpmyadmin/print.css HTTP/1.1” 200 1064
49.49.107.56 - - [09/ก.ย./2555:16:34:04 +0700] “GET /phpmyadmin/favicon.ico HTTP/1.1” 404 220
49.49.107.56 - - [09/ก.ย./2555:16:35:33 +0700] “POST /phpmyadmin/index.php HTTP/1.1” 302 0
49.49.107.56 - - [09/ก.ย./2555:16:35:33 +0700] “GET /phpmyadmin/index.php?token=7f90b7f558fd397e088d98c27f871e8c HTTP/1.1” 200 2602
49.49.107.56 - - [09/ก.ย./2555:16:35:34 +0700] “GET /phpmyadmin/js/common.js?ts=1324454872 HTTP/1.1” 200 5294
49.49.107.56 - - [09/ก.ย./2555:16:35:34 +0700] “GET /phpmyadmin/navigation.php?token=7f90b7f558fd397e088d98c27f871e8c HTTP/1.1” 200 1623
49.49.107.56 - - [09/ก.ย./2555:16:35:34 +0700] “GET /phpmyadmin/main.php?token=7f90b7f558fd397e088d98c27f871e8c HTTP/1.1” 200 6366
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/js/jquery/jquery-1.4.4.js HTTP/1.1” 200 78268
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/js/functions.js HTTP/1.1” 200 31563
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/js/navigation.js HTTP/1.1” 200 2521
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/phpmyadmin.css.php?token=7f90b7f558fd397e088d98c27f871e8c&js_frame=left&nocache=5324350930 HTTP/1.1” 200 5861
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/js/jquery/jquery.sprintf.js?ts=1324454872 HTTP/1.1” 200 987
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/js/config.js?ts=1324454872 HTTP/1.1” 200 9480
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/phpmyadmin.css.php?server=1&token=7f90b7f558fd397e088d98c27f871e8c&js_frame=right&nocache=5324350930 HTTP/1.1” 200 41672
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/js/messages.php?lang=en&db=&token=7f90b7f558fd397e088d98c27f871e8c HTTP/1.1” 200 4934
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/js/jquery/jquery-ui-1.8.custom.js?ts=1324454872 HTTP/1.1” 200 190765
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/themes/pmahomme/img/left_nav_bg.png HTTP/1.1” 200 215
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/themes/pmahomme/img/logo_left.png HTTP/1.1” 200 4970
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_loggoff.png HTTP/1.1” 200 688
49.49.107.56 - - [09/ก.ย./2555:16:35:35 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_home.png HTTP/1.1” 200 806
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_selboard.png HTTP/1.1” 200 698
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_docs.png HTTP/1.1” 200 786
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_sqlhelp.png HTTP/1.1” 200 579
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_reload.png HTTP/1.1” 200 608
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/database.png HTTP/1.1” 200 390
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_notice.png HTTP/1.1” 200 666
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_host.png HTTP/1.1” 200 667
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/tab_bg.png HTTP/1.1” 200 160
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_db.png HTTP/1.1” 200 390
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_sql.png HTTP/1.1” 200 748
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_status.png HTTP/1.1” 200 673
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_process.png HTTP/1.1” 200 512
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_rights.png HTTP/1.1” 200 533
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_export.png HTTP/1.1” 200 641
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_import.png HTTP/1.1” 200 629
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_vars.png HTTP/1.1” 200 603
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_asci.png HTTP/1.1” 200 209
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_engine.png HTTP/1.1” 200 468
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_replication.png HTTP/1.1” 200 447
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_sync.png HTTP/1.1” 200 551
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_passwd.png HTTP/1.1” 200 435
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_tblops.png HTTP/1.1” 200 610
49.49.107.56 - - [09/ก.ย./2555:16:35:36 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_lang.png HTTP/1.1” 200 743
49.49.107.56 - - [09/ก.ย./2555:16:35:37 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_theme.png HTTP/1.1” 200 856
49.49.107.56 - - [09/ก.ย./2555:16:35:37 +0700] “GET /phpmyadmin/themes/pmahomme/img/window-new.png HTTP/1.1” 200 583
49.49.107.56 - - [09/ก.ย./2555:16:35:37 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_more.png HTTP/1.1” 200 1002
49.49.107.56 - - [09/ก.ย./2555:16:35:37 +0700] “GET /phpmyadmin/favicon.ico HTTP/1.1” 404 220
49.49.107.56 - - [09/ก.ย./2555:16:36:19 +0700] “GET /phpmyadmin/index.php?db=libcon&token=7f90b7f558fd397e088d98c27f871e8c HTTP/1.1” 200 2644
49.49.107.56 - - [09/ก.ย./2555:16:36:20 +0700] “GET /phpmyadmin/navigation.php?token=7f90b7f558fd397e088d98c27f871e8c&db=libcon HTTP/1.1” 200 2591
49.49.107.56 - - [09/ก.ย./2555:16:36:20 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_sbrowse.png HTTP/1.1” 200 566
49.49.107.56 - - [09/ก.ย./2555:16:36:20 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_snewtbl.png HTTP/1.1” 200 733
49.49.107.56 - - [09/ก.ย./2555:16:36:20 +0700] “GET /phpmyadmin/db_structure.php?token=7f90b7f558fd397e088d98c27f871e8c&db=libcon HTTP/1.1” 200 5524
49.49.107.56 - - [09/ก.ย./2555:16:36:20 +0700] “GET /phpmyadmin/js/db_structure.js?ts=1324454872 HTTP/1.1” 200 3178
49.49.107.56 - - [09/ก.ย./2555:16:36:20 +0700] “GET /phpmyadmin/js/messages.php?lang=en&db=libcon&token=7f90b7f558fd397e088d98c27f871e8c HTTP/1.1” 200 4940
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/item_ltr.png HTTP/1.1” 200 162
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_props.png HTTP/1.1” 200 663
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_search.png HTTP/1.1” 200 615
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/s_asc.png HTTP/1.1” 200 201
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_browse.png HTTP/1.1” 200 566
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_select.png HTTP/1.1” 200 680
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_insrow.png HTTP/1.1” 200 228
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_empty.png HTTP/1.1” 200 363
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_drop.png HTTP/1.1” 200 715
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_print.png HTTP/1.1” 200 731
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/arrow_ltr.png HTTP/1.1” 200 184
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_tblanalyse.png HTTP/1.1” 200 234
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/themes/pmahomme/img/b_newtbl.png HTTP/1.1” 200 325
49.49.107.56 - - [09/ก.ย./2555:16:36:21 +0700] “GET /phpmyadmin/favicon.ico HTTP/1.1” 404 220
49.49.107.56 - - [09/ก.ย./2555:16:36:58 +0700] “GET /phpmyadmin/themes/pmahomme/img/marked_bg.png HTTP/1.1” 200 977
49.49.107.56 - - [09/ก.ย./2555:16:36:58 +0700] “GET /phpmyadmin/themes/pmahomme/img/tab_hover_bg.png HTTP/1.1” 200 1278
49.49.107.56 - - [09/ก.ย./2555:16:37:00 +0700] “GET /phpmyadmin/db_export.php?db=libcon&server=1&token=7f90b7f558fd397e088d98c27f871e8c HTTP/1.1” 200 7320
49.49.107.56 - - [09/ก.ย./2555:16:37:01 +0700] “GET /phpmyadmin/js/export.js?ts=1324454872 HTTP/1.1” 200 5475
49.49.107.56 - - [09/ก.ย./2555:16:37:01 +0700] “GET /phpmyadmin/favicon.ico HTTP/1.1” 404 220
49.49.107.56 - - [09/ก.ย./2555:16:42:45 +0700] “POST /phpmyadmin/export.php HTTP/1.1” 200 108079
49.49.107.56 - - [09/ก.ย./2555:16:42:46 +0700] “GET /phpmyadmin/favicon.ico HTTP/1.1” 404 220
49.49.107.56 - - [09/ก.ย./2555:16:46:19 +0700] “GET /phpmyadmin/index.php?token=7f90b7f558fd397e088d98c27f871e8c&old_usr=root HTTP/1.1” 200 7078
49.49.107.56 - - [09/ก.ย./2555:16:46:19 +0700] “GET /phpmyadmin/phpmyadmin.css.php?server=1&token=4f6fb027f360263ac0555724de3078d7&js_frame=right&nocache=3977167596 HTTP/1.1” 200 41672
49.49.107.56 - - [09/ก.ย./2555:16:46:19 +0700] “GET /phpmyadmin/js/messages.php?lang=en&db=&token=4f6fb027f360263ac0555724de3078d7 HTTP/1.1” 200 4934
49.49.107.56 - - [09/ก.ย./2555:16:46:20 +0700] “GET /phpmyadmin/favicon.ico HTTP/1.1” 404 220
ซึ่งเว็บไซต์ผมทำงานปกติ แต่เริ่มไม่ค่อยแน่ใจว่ามันปลอดภัยจริงหรือเปล่าครับ
รบกวนพี่ๆช่วยชี้แนะด้วยครับ
ขอบคุณครับ
