Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Hack Attempt Script
Author Message
Susann
Moderator


Joined: Dec 19, 2004
Posts: 3191
Location: Germany:Moderator German NukeSentinel Support

PostPosted: Thu Aug 28, 2008 8:02 am Reply with quote

Quote:
Query-String: name=Your_Account&op=new_user+Result:+%D0%B8%D1%81%D0%BF%D0%BE%D0%BB%D1%8C%D0%B7%D1%83%D0%B5%D0%BC+SOCKS+118.232.20.172:1080;%D0%B8%D1%81%D0%BF%D0%BE%D0%BB%D1%8C%D0%B7%D0%BE%D0%B2%D0%B0%D0%BD+%D0%BD%D0%B8%D0%BA%D0%BD%D0%B5%D0%B9%D0%BC+"Seessedearp";%D0%B7%D0%B0%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D0%B8%D1%81%D1%8C+(%D0%B2%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD+%D1%80%D0%B5%D0%B6%D0%B8%D0%BC+%D1%82%D0%BE%D0%BB%D1%8C%D0%BA%D0%BE+%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B0%D1%86%D0%B8%D0%BCool;
Get String: name=Your_Account&op=new_user Result: О�пПл�з�еЌ SOCKS 118.232.20.172:1080;О�пПл�зПваМ МОкМейЌ "Seessedearp";за�егО���О�ПвалО�� (вкл��еМ �ежОЌ �Пл�кП �егО���а�ОО);

Banned IP: Mostly a Proxy


What does it exactly if NukeSentinel didnt block this ?
 
View user's profile Send private message
evaders99
Former Moderator in Good Standing


Joined: Apr 30, 2004
Posts: 3221

PostPosted: Thu Aug 28, 2008 8:15 am Reply with quote

urldecode doesn't give any meaningful data. Nor that IP address. So I'm at a loss what it is doing

_________________
- Only registered users can see links on this board! Get registered or login! -

Need help? Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
Susann
PostPosted: Thu Aug 28, 2008 11:30 am Reply with quote

I suppose he is trying to create a new user with the name "Seessedearp" and implent data from IP 118.232.20.172 witch is an IP fromTaiwan.

NetRange: 118.0.0.0 - 118.255.255.255
CIDR: 118.0.0.0/8

Banning: 118.0.0.0/8 via htaccess would stop this also.

NukeSentinel does a great job. So I dont look into this deeper. Wink
 
Susann
PostPosted: Fri Aug 29, 2008 4:08 pm Reply with quote

The name of the "user" changed and the socks IP. Anyone saw this also ?
I already turned the proxy blocker on. I wonder if this is something autmatically or maybe they just bookmarked my site. Twisted Evil
 
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Hack Attempt Script

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©