Mrb arkadaşlar, ara ara sunucumun loglarına göz atarım. Dün yine Çin'den 2 ip ile saldırı gerçekleşmiş :) saldırılar genellikle brute force atakları şeklinde gerçekleşmekte. Kesinlikle firewallarınızı ram'den kazanmak için kapatmayın.

Ayrıca adamlar phpmyadmine bile saldırıyor :) yani sadece ssh ve ftp'de değil.
Phpmyadmine atak yoluda şu şekilde: www.site.com/phpMyAdmin/index.php?pma_username=KullanıcıAdı&pma_password=şifre

Sayelerinde phpmyadmine get metodu yolunuda öğrendik :) :D


Saldırı logları:
75.146.43.164 - - [26/Jul/2017:17:26:16 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=opt HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:16 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=order HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:17 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=orders HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:17 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=ovh HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:17 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=owner HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:18 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=p00lamea HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:18 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=p455w0rd HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:18 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=pain HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:18 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=panelroot HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:19 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=pass HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:19 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=passwd HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:19 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=password HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"
75.146.43.164 - - [26/Jul/2017:17:26:20 +0200] "GET /phpMyAdmin/index.php?pma_username=root&pma_password=password1 HTTP/1.0" 200 14862 "-" "Mozilla/5.0 Jorgee"