Someone got banned.. How did this happen?

Worker Joined: Apr 30, 2005 Posts: 170

I got an e-mail from my site this morning. I'm not sure if Nuke did this or if it was NukeSentinel. Let me know..

This is what the e-mail said:

Quote:

Date & Time: 2005-09-19 14:31:31 EDT GMT -0400
Blocked IP: 85.185.59.163
User ID: Anonymous (1)
Reason: Abuse-Union
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.02
Query String: thestaffroom.spacemonkey.net.au/modules.php?name=Top&querylang= WHERE 1=2 UNION ALL SELECT 1,pwd,1,1 FROM nuke_authors/*
Get String: thestaffroom.spacemonkey.net.au/modules.php?name=Top&querylang= WHERE 1=2 UNION ALL SELECT 1,pwd,1,1 FROM nuke_authors/*
Post String: thestaffroom.spacemonkey.net.au/modules.php
Forwarded For: 85.185.59.163
Client IP: none
Remote Address: 85.185.59.6
Remote Port: 62482
Request Method: GET

What's that all about? Can I e-mail this guys ISP? I tried a whois and it didn't work...

TIA

Posted: Mon Sep 19, 2005 4:26 pm

[ Only registered users can see links on this board! Get registered or login! ]

Reveals

% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Note: the default output of the RIPE Whois server
% is changed. Your tools may need to be adjusted. See
% [ Only registered users can see links on this board! Get registered or login! ]
% for more details.
%
% Rights restricted by copyright.
% See [ Only registered users can see links on this board! Get registered or login! ]

% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '85.185.59.0 - 85.185.59.255'

inetnum: 85.185.59.0 - 85.185.59.255
netname: Respina
descr: Respina Networks & Beyond ,Internet Service Provider
country: IR
admin-c: PM6548-RIPE
tech-c: PM6548-RIPE
status: ASSIGNED PA "status:" definitions
mnt-by: AS12880-MNT
source: RIPE # Filtered

person: Pooyaun Masoumi
address: No. 19, Arak St., Gharani Ave., Tehran, Iran, Zip Code: 15989
phone: +98 21 8892 4363
e-mail: [ Only registered users can see links on this board! Get registered or login! ]
nic-hdl: PM6548-RIPE
source: RIPE # Filtered

% Information related to '85.185.0.0/16AS12880'

route: 85.185.0.0/16
descr: DCI-Route
origin: AS12880
mnt-by: AS12880-MNT
source: RIPE # Filtered

Posted: Mon Sep 19, 2005 4:39 pm

So this guy is from Iran??

Must be something to do wtih that Al Hekma school news I have..

Can anyone answer those other questions I had?

Posted: Mon Sep 19, 2005 5:29 pm

You can try to send a copy to the abuse email listed there. Reason: Abuse-Union is a direct attempt to alter your database. It was stopped.