Yesterday at 3AM our Fail2ban blocked an IP, not tremendously uncommon, however it appears to relate back to a Microsoft address. This could perhaps be an Azure server being used for the abuse.
My main concern is exactly what it was attempting to do and if I should be concerned. Please see the below excerpts:
13.67.210.80 - - [08/Jun/2016:03:03:25 +0100] "GET /event/-1;select%20pg_sleep(6);%20--%20/admin/profile/ href= HTTP/1.1" 200 139
13.67.210.80 - - [08/Jun/2016:03:03:27 +0100] "GET /-1'%20OR%202%2b395-395-1%3d0%2b0%2b0%2b1%20--%20/edit HTTP/1.1" 200 139 "
13.67.210.80 - - [08/Jun/2016:03:03:23 +0100] "GET /(select(0)from(select(sleep(6)))v)/*'%2b(select(0)from(select(sleep(6)))v)%2b'%22%2b(select(0)from(select(sleep(6)))v)%2b%22*//
13.67.210.80 - - [08/Jun/2016:03:03:27 +0100] "GET /if(now()%3dsysdate()%2csleep(12)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(12)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(12)%2c0))OR%22*//
There are of course, many many other requests, most of which are 'normal' i.e not trying to inject any type of code, just attempting to edit sections of the site (with no results)
I have noticed several references to the web vulnerability company Acunetix, such as requests for:
/acunetix-wvs-test-for-some-inexistent-file
So I can only assume, somebody is using their services to try and poke holes in our system.
My question is, what were they trying to do?, what can I do about this and should I even care?
Should I contact one of the above companies, or is this common occurrences?