pr0gr4mm3r — Wed, 03 Oct 2007 13:40:16 +0000

Ya, it doesn't look like anything good. I'm going to leave that htaccess code in my file and keep them out. Any bots should have official user agents anyway.

greg — Wed, 03 Oct 2007 01:33:13 +0000

Ouch

I'm doing some more digging but it certainly looks like a hack code

http://www.yugatech.com/blog/the-internet/hack-attack-in-progress/

search google for - echo "mic22" - it might come to nothing, but I suppose it depends on your site set up
you should do a full read of all your server logs

pr0gr4mm3r — Wed, 03 Oct 2007 00:47:22 +0000

I actually just got another hit, this one pointing to http://71.102.93.10/WTS/bin/hak/idpitbull.txt. The code doesn't look to do anything harmful in itself. It seems to output some information of the server that it's on. Don't know what that information can be used for, but I'm pretty sure it's not anything good.

greg — Wed, 03 Oct 2007 00:23:38 +0000

Do you have people able to post links on your site?
if so then it may just have been someone providing a link to their site as 110mb is free hosting site
and the "ilegais" is obviously the standard freebie subdomain given by 110mb

as the site has been removed foul play may have been happening,
but not much can be done from a link meerly to a .txt file

send 110mb an email and ask if the site was removed from their servers for dodgy activity

JeevesBond — Tue, 02 Oct 2007 19:41:50 +0000

I'm sure libwww-perl would be quite widely used, it's a Perl library. Although if you haven't seen any other instance of it in your logs then it probably wont hurt to block it (just remember that in a few years time when a bot is trying to crawl your site or something!)

That looks like a bot designed to use a security exploit in some application. Maybe a cross-site scripting vulnerability, or perhaps whatever file is passed to the 'content' variable is eval()'d. You've probably not got the software installed, but that wont stop the bot from trying. It's probably trawling a number of sites.

pr0gr4mm3r — Tue, 02 Oct 2007 16:34:17 +0000

Quote: blocking libwww-perl is blocking a lot of people/bots, you'd be better off blocking the IP's but would still be blocking a few

Do you have any examples? I checked my logs before I did this, and I did not find any other instance of this user agent...in bots or regular visits.

Busy — Tue, 02 Oct 2007 09:51:45 +0000

if you go to ilegais.110mb.com it shows not found

blocking libwww-perl is blocking a lot of people/bots, you'd be better off blocking the IP's but would still be blocking a few

if you get these, report the site to the host, in this case would be 110mb.com