{"action":"created","issue":{"url":"https://api.github.com/repos/PrestaShop/cronjobs/issues/7","labels_url":"https://api.github.com/repos/PrestaShop/cronjobs/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/PrestaShop/cronjobs/issues/7/comments","events_url":"https://api.github.com/repos/PrestaShop/cronjobs/issues/7/events","html_url":"https://github.com/PrestaShop/cronjobs/issues/7","id":51440394,"number":7,"title":"Abnormal HTTP traffic from 91.240.109.1 address for AdminCronJobs controller","user":{"login":"rodolfojcj","id":458749,"avatar_url":"https://avatars.githubusercontent.com/u/458749?v=3","gravatar_id":"","url":"https://api.github.com/users/rodolfojcj","html_url":"https://github.com/rodolfojcj","followers_url":"https://api.github.com/users/rodolfojcj/followers","following_url":"https://api.github.com/users/rodolfojcj/following{/other_user}","gists_url":"https://api.github.com/users/rodolfojcj/gists{/gist_id}","starred_url":"https://api.github.com/users/rodolfojcj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rodolfojcj/subscriptions","organizations_url":"https://api.github.com/users/rodolfojcj/orgs","repos_url":"https://api.github.com/users/rodolfojcj/repos","events_url":"https://api.github.com/users/rodolfojcj/events{/privacy}","received_events_url":"https://api.github.com/users/rodolfojcj/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2014-12-09T15:27:52Z","updated_at":"2015-02-20T17:28:24Z","closed_at":"2014-12-15T16:26:45Z","body":"Hi!\r\n\r\nThe 91.240.109.1 IP address, appears many times in the access log of the web server that runs an e-commerce web site based on Prestashop.\r\n\r\nIt seems the 91.240.109.1 is related to the organization that develops the Prestashop software and is located somewhere in France. Several times per hour the access log register entries like these:\r\n\r\n91.240.109.1 - - [08/Dec/2014:15:14:11 +0100] \"GET /usr/local/admin/index.php?controller=AdminCronJobs&token=9dd34a8852149c560099c0b7710d85b1 HTTP/1.0\" 404 14799 \"-\" \"-\"\r\n91.240.109.1 - - [08/Dec/2014:15:16:11 +0100] \"GET /admin/index.php?controller=AdminCronJobs&token=1b4ecd4c090670f1a827966bb38c7800 HTTP/1.0\" 404 14799 \"-\" \"-\"\r\n91.240.109.1 - - [08/Dec/2014:15:18:25 +0100] \"GET /admin/index.php?controller=AdminCronJobs&token=11a0bc9e25358a0234b432aad3b4be69 HTTP/1.0\" 404 14799 \"-\" \"-\"\r\n91.240.109.1 - - [08/Dec/2014:15:18:32 +0100] \"GET /admin/index.php?controller=AdminCronJobs&token=33ce5b2fbe7eaf48a1c06cefcdc38a38 HTTP/1.0\" 404 14799 \"-\" \"-\"\r\n91.240.109.1 - - [08/Dec/2014:15:18:36 +0100] \"GET /usr/local/admin/index.php?controller=AdminCronJobs&token=96a8bca58f94c8a411decfdadc70c93b HTTP/1.0\" 404 14799 \"-\" \"-\"\r\n\r\nThe requested resources do not exist on the server (404 HTTP response code is returned), so I wonder what the Prestashop organization is trying to access, and for what purpose, in the backend of our web site.\r\n\r\nIs it some kind of bot inside the Prestashop network in France?\r\n\r\nI've also noticed some times that access is successful (200 HTTP response code is returned) like the following sample evidences:\r\n\r\n91.240.109.1 - - [08/Dec/2014:16:11:14 +0100] \"GET /admin9317/index.php?controller=AdminCronJobs&token=a2b003be8a99cf5af55df024e23670af HTTP/1.0\" 200 19 \"-\" \"-\"\r\n\r\nThis behaviour has happened from several days ago, and the site is using Prestashop version 1.6.0.9.\r\n\r\nIs it related to the CronJobs module? If so, why, for what and how to stop it? If not, who should I report this issue to?\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/PrestaShop/cronjobs/issues/comments/75281403","html_url":"https://github.com/PrestaShop/cronjobs/issues/7#issuecomment-75281403","issue_url":"https://api.github.com/repos/PrestaShop/cronjobs/issues/7","id":75281403,"user":{"login":"Heliopolis","id":11094129,"avatar_url":"https://avatars.githubusercontent.com/u/11094129?v=3","gravatar_id":"","url":"https://api.github.com/users/Heliopolis","html_url":"https://github.com/Heliopolis","followers_url":"https://api.github.com/users/Heliopolis/followers","following_url":"https://api.github.com/users/Heliopolis/following{/other_user}","gists_url":"https://api.github.com/users/Heliopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/Heliopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Heliopolis/subscriptions","organizations_url":"https://api.github.com/users/Heliopolis/orgs","repos_url":"https://api.github.com/users/Heliopolis/repos","events_url":"https://api.github.com/users/Heliopolis/events{/privacy}","received_events_url":"https://api.github.com/users/Heliopolis/received_events","type":"User","site_admin":false},"created_at":"2015-02-20T17:28:24Z","updated_at":"2015-02-20T17:28:24Z","body":"This ticket needs to be reopened as the issue is not fixed.\r\nMy site is getting bombarded daily with requests from 91.240.109.1, of which the whois lookup has no registered email to report abuse.\r\n\r\n91.240.109.1 - - [20/Feb/2015:05:36:16 -0600] \"GET /***/index.php?controller=AdminCronJobs&token=j9b2bmwoqit1ovo2wzpkkmkf1tdkaukn HTTP/1.0\" 302 - \"-\" \"-\"\r\n\r\n91.240.109.1 - - [20/Feb/2015:05:46:00 -0600] \"GET /***/index.php?controller=AdminCronJobs&token=tfcdgwru6wmvbjbkrsjesdfoppgj1zit HTTP/1.0\" 302 - \"-\" \"-\"\r\n\r\nPrestashop, turn off your ping to our server immediately."}}