Comments on: Quick RFI Analysis

By: Michael Mol

Michael Mol — Sun, 04 Oct 2009 06:59:25 +0000

I noticed a pattern to the request URLs, at least for the 0sirys probes to my server (They all appear to use the same pattern for the file name they try to pull a PHP script from). I was thinking of setting a rewrite or redirect rule for them, feeding back garbage data, or blocking them entirely. Care for some traffic? (Reply via email preferred)

By: hafiz

hafiz — Fri, 20 Feb 2009 21:38:25 +0000

hi,
I’ve been collecting rfi stuff from november last year and have around 5k uniq malicous code.
We are happy to share stuff for the interest of making internet better place :)
See you in Putrajaya

By: Nart

Nart — Mon, 02 Feb 2009 02:12:54 +0000

the scanner:
hxxp://pastebin.com/pastebin.php?dl=f3f6eac52
hxxp://darkc0de.com/c0de/perl/v6ircscan.txt

By: Lukas

Lukas — Wed, 28 Jan 2009 23:50:13 +0000

Hi Jose, I’ve written a Python script, to attract the RFI scanner. After answering the echos they send the bot which could be analyzed. Your findings are very common.
Greetings, Lukas