|
I've recently installed ELMAH on a small .NET MVC site and I keep receiving error reports This is obviously an attempt to access a page that doesn't exist. But why are there attempts to access this page? Is this an attack or is it simply a bot scanning to see if I've been infected? What exactly is 'muieblackcat' and why is there an attempt to access this URL? | |||
feedback
|
|
muieblackcat is script/bot, supposedly of Ukrainian origin, that attempts to exploit PHP vulnerabilities or misconfigurations. See SUC027: Muieblackcat setup.php Web Scanner/Robot for more detail. If you are not using PHP and have deactivated mod_php, you're safe. However, a request for /muieblackcat may mean that the bot has already, maybe successfully, visited your site. I suggest you carefully check your configuration and web content (if possible, erase all and reinstall from a trusted source set). On the other hand, the originating IP address is likely to be useless. Most attacks come from unaware infected Windows users. | ||||
|
feedback
|
|
According to Daily Update Summary 6/24/2011 (Emerging Threat Pro blog), it's a scanner which is looking for some breaches in your server; it's definitely an intruder that you should block. Look for your access logs, you should get its IP address. | ||||
|
feedback
|
