Issue with referrers logs and what it is showing is strange...

Discussion of non-phpBB related topics with other phpBB.com users.
Forum rules
General Discussion is a bonus forum for discussion of non-phpBB related topics with other phpBB.com users. All site rules apply.
Post Reply
User avatar
«THÖMÅS®©»
Registered User
Posts: 542
Joined: Sun Feb 27, 2011 5:38 pm
Location: UK
Contact:

Issue with referrers logs and what it is showing is strange...

Post by «THÖMÅS®©» »

Good morning...

I have recently checked my referrers logs this morning and I have discovered something really strange.

I can see that a number of referrers have come from Google and some from Bing... A number from Russian domains as well.

What I have found is that there have been a number of entries from what look like really random characters or are something else, and I am unsure what they are. My first thought is perhaps a hacking attempt, but I cannot say for certain. This is why I have come here for clarification on what I am seeing. I will upload one screenshot, that will give a small sample of what is there. I have at least 9 FULL pages of only these entries, they are all similar and are all from the EXACT same IP address. One that appears to be a "yourserver.de" IP located in the general area of Frankfurt. For the time being, I have placed a "hard ban" on the IP in question so it cannot even load anything on my website, and instead just gets our own "403 - Permission Denied" page instead.

Image

This image above may explain why I am baffled as to what is going on... This all happened in a single day, 25th July 2021.

Over the course of roughly 12 minutes 16:09 to 16:21, I have around 220 entries that are very similar to the ones in the above screenshot...

Can anyone clarify this please, as I am rather baffled.
“No, this trick won't work... How on earth are you ever going to explain in terms of chemistry and physics so important a biological phenomenon as first love?” - Albert Einstein
"For every action has an equal and opposite reaction". - Sir Isaac Newton
"In honor there is hope" - Alaska State Troopers

Owner & President @ =DN= Dark Nexus Multi-Gaming Clan
User avatar
3Di
I've Been Banned!
Posts: 17538
Joined: Mon Apr 04, 2005 11:09 pm
Location: I'm with Ukraine 🇺🇦
Name: Marco
Contact:

Re: Issue with referrers logs and what it is showing is strange...

Post by 3Di »

Refereeer logs are not a part of phpBB.
You should seek support where you got the extension from.
🆓 Free support for our extensions also provided here: phpBB Studio
🚀 Looking for a specific feature or alternative option? We will rock you!
Please PM me only to request paid works. Thx. Buy me a coffee -> Image
My development's activity º PhpStorm's proud user º Extensions, Scripts, MOD porting, Update/Upgrades
User avatar
david63
Registered User
Posts: 20646
Joined: Thu Dec 19, 2002 8:08 am

Re: Issue with referrers logs and what it is showing is strange...

Post by david63 »

I cannot read that image (it is too small) but I would hazard a guess that it is one of the not uncommon bot attacks that we all get on a regular basis.
David
Remember: You only know what you know and - you don't know what you don't know!

I now no longer support any of my extensions but they will start to become available here
User avatar
«THÖMÅS®©»
Registered User
Posts: 542
Joined: Sun Feb 27, 2011 5:38 pm
Location: UK
Contact:

Re: Issue with referrers logs and what it is showing is strange...

Post by «THÖMÅS®©» »

If you right click, you can open it in a new tab and it will load in full size...
“No, this trick won't work... How on earth are you ever going to explain in terms of chemistry and physics so important a biological phenomenon as first love?” - Albert Einstein
"For every action has an equal and opposite reaction". - Sir Isaac Newton
"In honor there is hope" - Alaska State Troopers

Owner & President @ =DN= Dark Nexus Multi-Gaming Clan
User avatar
david63
Registered User
Posts: 20646
Joined: Thu Dec 19, 2002 8:08 am

Re: Issue with referrers logs and what it is showing is strange...

Post by david63 »

«THÖMÅS®©» wrote: Tue Jul 27, 2021 8:57 am If you right click, you can open it in a new tab and it will load in full size...
That was the first thing that I tried and all I get is a black screen
David
Remember: You only know what you know and - you don't know what you don't know!

I now no longer support any of my extensions but they will start to become available here
User avatar
«THÖMÅS®©»
Registered User
Posts: 542
Joined: Sun Feb 27, 2011 5:38 pm
Location: UK
Contact:

Re: Issue with referrers logs and what it is showing is strange...

Post by «THÖMÅS®©» »

I'll check it later if not I will attach it direct to the thread for you...
“No, this trick won't work... How on earth are you ever going to explain in terms of chemistry and physics so important a biological phenomenon as first love?” - Albert Einstein
"For every action has an equal and opposite reaction". - Sir Isaac Newton
"In honor there is hope" - Alaska State Troopers

Owner & President @ =DN= Dark Nexus Multi-Gaming Clan
User avatar
3Di
I've Been Banned!
Posts: 17538
Joined: Mon Apr 04, 2005 11:09 pm
Location: I'm with Ukraine 🇺🇦
Name: Marco
Contact:

Re: Issue with referrers logs and what it is showing is strange...

Post by 3Di »

david63 wrote: Tue Jul 27, 2021 9:14 am
«THÖMÅS®©» wrote: Tue Jul 27, 2021 8:57 am If you right click, you can open it in a new tab and it will load in full size...
That was the first thing that I tried and all I get is a black screen
Here you go
Attachments
fOrbzlL.png
🆓 Free support for our extensions also provided here: phpBB Studio
🚀 Looking for a specific feature or alternative option? We will rock you!
Please PM me only to request paid works. Thx. Buy me a coffee -> Image
My development's activity º PhpStorm's proud user º Extensions, Scripts, MOD porting, Update/Upgrades
User avatar
david63
Registered User
Posts: 20646
Joined: Thu Dec 19, 2002 8:08 am

Re: Issue with referrers logs and what it is showing is strange...

Post by david63 »

Still looks like a bot attack to me
David
Remember: You only know what you know and - you don't know what you don't know!

I now no longer support any of my extensions but they will start to become available here
User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 52768
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: Issue with referrers logs and what it is showing is strange...

Post by stevemaury »

3Di wrote: Tue Jul 27, 2021 3:48 am Refereeer logs are not a part of phpBB.
You should seek support where you got the extension from.
I can stop all your spam. I can upgrade or update your Board. PM or email me. (Paid support)
User avatar
«THÖMÅS®©»
Registered User
Posts: 542
Joined: Sun Feb 27, 2011 5:38 pm
Location: UK
Contact:

Re: Issue with referrers logs and what it is showing is strange...

Post by «THÖMÅS®©» »

I am not asking for support on the extension. This is why I posted my query in Support as it did not fit anywhere else.

I am trying to work out what the logs mean and since the software I am using was made by phpBB, I thought I could get an answer here, or perhaps a pointer in the right direction.

I have "hard banned" the IP address for the time being...
“No, this trick won't work... How on earth are you ever going to explain in terms of chemistry and physics so important a biological phenomenon as first love?” - Albert Einstein
"For every action has an equal and opposite reaction". - Sir Isaac Newton
"In honor there is hope" - Alaska State Troopers

Owner & President @ =DN= Dark Nexus Multi-Gaming Clan
User avatar
thecoalman
Community Team Member
Community Team Member
Posts: 5871
Joined: Wed Dec 22, 2004 3:52 am
Location: Pennsylvania, U.S.A.
Contact:

Re: Issue with referrers logs and what it is showing is strange...

Post by thecoalman »

Difficult to tell because it's incomplete but it would appear to be SQL injection attempt. Such things are common and would only be successful if something is exploitable which brings us to the extension. I would have very big concerns about an extension that is recording SQL queries to a database.

Check the server access and error logs for that time period instead of relying on the extension. Not sure what the usefulness of that extension would be, the raw access logs should be available in your hosting control panel. Most hosts will also have Awstats which is analytical tool that will process them.
“Results! Why, man, I have gotten a lot of results! I have found several thousand things that won’t work.”

Attributed - Thomas Edison
User avatar
«THÖMÅS®©»
Registered User
Posts: 542
Joined: Sun Feb 27, 2011 5:38 pm
Location: UK
Contact:

Re: Issue with referrers logs and what it is showing is strange...

Post by «THÖMÅS®©» »

I wonder if my hosts have them... I will contact them and ask. Thanks for the pointers.
1024KBUser
Registered User
Posts: 58
Joined: Mon Dec 23, 2013 1:18 pm

Re: Issue with referrers logs and what it is showing is strange...

Post by 1024KBUser »

btw, Whats that extension called (referrer logging) ?

Update: Its ok found it. its called "Referrer" .
Post Reply

Return to “General Discussion”