Today I checked my server's user.log file and it's full of the following Suhoshin messages
suhosin: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'page' (attacker '..... suhosin: ALERT - configured GET variable value length limit exceeded - dropped variable...
I see similar messages in user.log file almost every day, but never so many.
My question: Do you have any idea what is the aim of the atacker to send identical post and get requests from many different IP addresses if all such requests are being blocked by Suhoshin?
Requests are coming from ~50 IP addresses (Maxmind says all IPs are Anonymous proxies):
/file.php?fid=%60cat%20/etc/passwd%60 /file.php?fid=................windowswin.ini /file.php?fid=../../../../../../../../../../boot.ini