We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

Backdoor injection by baidu spider?

    • 54735
    • 12 Posts
    zhzhzh Reply #1, 5 years, 4 months ago
    Please read excerpt from the log files (see attachment).


    1. Can you tell me whether this was a backdoor injection trail?
    2. Should the http reply code not rather read 40x instead of 200?
    3. Was it successful?
    4. Was it really by baiduspider?

    BTW: it runs with MODx 2.6.5, PHP 7.0.x and apache 2. [ed. note: zhzhzh last edited this post 5 years, 4 months ago.]
    • sottwell Reply #2, 5 years, 4 months ago
      It's just a search engine; China's answer to Google. No exploits involved.
      https://www.sitepoint.com/community/t/anyone-dealt-with-the-baiduspider-bot/4767/13
        Studying MODX in the desert - http://sottwell.com
        Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
        Join the Slack Community - http://modx.org
        • 54163
        • 24 Posts
        Hans Svensson Reply #3, 5 years, 4 months ago
        4) A whois on 27.209.95.64 tells it's from China. I doubt a company the size of Baidu doesn't have own IP blocks. A quick duckduckgo for "baidu bots ip numbers" suggests Baidu is not involved. HTTP_USER_AGENT is probably spoofed (if the term applies). 

        % [whois.apnic.net]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

% Information related to '27.192.0.0 - 27.223.255.255'

% Abuse contact for '27.192.0.0 - 27.223.255.255' is '[email protected]'

inetnum:        27.192.0.0 - 27.223.255.255
netname:        UNICOM-SD
descr:          China Unicom Shandong province network
descr:          China Unicom
country:        CN
admin-c:        CH1302-AP
tech-c:         XZ14-AP
mnt-by:         APNIC-HM
mnt-lower:      MAINT-CNCGROUP
mnt-lower:      MAINT-CNCGROUP-SD
mnt-routes:     MAINT-CNCGROUP-RR
status:         ALLOCATED PORTABLE
remarks:        --------------------------------------------------------
remarks:        To report network abuse, please contact mnt-irt
remarks:        For troubleshooting, please contact tech-c and admin-c
remarks:        Report invalid contact via www.apnic.net/invalidcontact
remarks:        --------------------------------------------------------
mnt-irt:        IRT-CU-CN
last-modified:  2016-05-04T00:22:59Z
source:         APNIC

          Fake News is powered by MODX — https://fakenews.com/
          • 54735
          • 12 Posts
          zhzhzh Reply #4, 5 years, 4 months ago
          @scott: thanks, I know about Baidu.

          I agree with Hans that this was probably not by Baidu, but a malign access trial nevertheless.

          And I am still puzzled about the http response code 200! So I am not yet sure about the answers for 2. and 3. .