Protection against muieblackcat BOT [closed]

Question

This morning I noticed some odd records in our IIS logs coming from;

• 193.169.40.39 - associated with PHP pages (2012-12-15 05:34:24 EST)

• 121.14.73.8 - associated with PHP pages (2012-12-15 23:11:42 EST)

• 167.206.74.237 - associated with wordpress pages (2012-12-16 22:38:37 EST)

• 178.15.152.69 - associated with wordpress pages (2012-12-17 12:11:00 EST)

This is alarming because we do not host PHP / wordpress pages.

A Google search would lead me to believe that muieblackcat is a web-bot which tries to exploit PHP vulnerabilities.

Am I safe since we do not host a PHP environment? I had thought of blocking the IP, but then again the bot more then likely uses some sort of proxy to do it's dirty work.

Are the word-press PHP files requests more than likely the same bot? Perhaps someone who has run into the muieblackcat recognizes the word-press requests. Please see IIS records below.

Are there any defense mechanisms / precautions the more experienced could shine some light on, regarding ASP.NET IIS 7 Hosting?

Example:

Odd PHP entries

2012-12-15 05:34:24 /muieblackcat - 193.169.40.39 - 1424 140 224
2012-12-15 05:34:24 /index.php - 193.169.40.39 - 1424 138 5
2012-12-15 05:34:24 /admin/index.php - 193.169.40.39 - 1424 144 5
2012-12-15 05:34:24 /admin/pma/index.php - 193.169.40.39 - 1424 148 3
2012-12-15 05:34:24 /admin/phpmyadmin/index.php - 193.169.40.39 - 1424 155 4 . . .

Odd WP entries

2012-12-16 22:38:37 /wp-login.php - 167.206.74.237 - 1405 219 281
2012-12-16 22:38:37 /blog/wp-login.php - 167.206.74.237 - 1405 224 60
2012-12-16 22:38:37 /wordpress/wp-login.php - 167.206.74.237 - 1405 229 60

2012-12-16 22:38:37 /wp/wp-login.php - 167.206.74.237 - 1405 222 59

Answer 1

It looks like the cat is trying to guess where the WP and PhpMyAdmin locate, if it gets response, I guess the next step is checking whether it can exploit the vulnerability.

Basically, it works like port scanning. If you do not have WP and PhpMyAdmin installed, you should be ok.

Usually, these kind of scanner will scan once, if did not find anything useful to them, they will leave.

Answer 2

Yes, you are safe. My server sees things like this all the time, they're harmless if you don't have those applications installed.