Socks - Someone saw this before ?

Susann · Posted: Thu Aug 28, 2008 8:02 am

Quote:

Query-String: name=Your_Account&op=new_user+Result:+%D0%B8%D1%81%D0%BF%D0%BE%D0%BB%D1%8C%D0%B7%D1%83%D0%B5%D0%BC+SOCKS+118.232.20.172:1080;%D0%B8%D1%81%D0%BF%D0%BE%D0%BB%D1%8C%D0%B7%D0%BE%D0%B2%D0%B0%D0%BD+%D0%BD%D0%B8%D0%BA%D0%BD%D0%B5%D0%B9%D0%BC+"Seessedearp";%D0%B7%D0%B0%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BB%D0%B8%D1%81%D1%8C+(%D0%B2%D0%BA%D0%BB%D1%8E%D1%87%D0%B5%D0%BD+%D1%80%D0%B5%D0%B6%D0%B8%D0%BC+%D1%82%D0%BE%D0%BB%D1%8C%D0%BA%D0%BE+%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B0%D1%86%D0%B8%D0%B Cool

;
Get String: name=Your_Account&op=new_user Result: ÐžÑ�Ð¿ÐŸÐ»Ñ�Ð·Ñ�ÐµÐŒ SOCKS 118.232.20.172:1080;ÐžÑ�Ð¿ÐŸÐ»Ñ�Ð·ÐŸÐ²Ð°Ðœ ÐœÐžÐºÐœÐµÐ¹ÐŒ "Seessedearp";Ð·Ð°Ñ�ÐµÐ³ÐžÑ�Ñ�Ñ�ÐžÑ�ÐŸÐ²Ð°Ð»ÐžÑ�Ñ� (Ð²ÐºÐ»Ñ�Ñ�ÐµÐœ Ñ�ÐµÐ¶ÐžÐŒ Ñ�ÐŸÐ»Ñ�ÐºÐŸ Ñ�ÐµÐ³ÐžÑ�Ñ�Ñ�Ð°Ñ�ÐžÐž);

Banned IP: Mostly a Proxy

What does it exactly if NukeSentinel didn´t block this ?

evaders99 · Posted: Thu Aug 28, 2008 8:15 am

urldecode doesn't give any meaningful data. Nor that IP address. So I'm at a loss what it is doing

Susann · Posted: Thu Aug 28, 2008 11:30 am

I suppose he is trying to create a new user with the name "Seessedearp" and implent data from IP 118.232.20.172 witch is an IP fromTaiwan.

NetRange: 118.0.0.0 - 118.255.255.255
CIDR: 118.0.0.0/8

Banning: 118.0.0.0/8 via htaccess would stop this also.

NukeSentinel does a great job. So I don´t look into this deeper. Wink

Susann · Posted: Fri Aug 29, 2008 4:08 pm

The name of the "user" changed and the socks IP. Anyone saw this also ?
I already turned the proxy blocker on. I wonder if this is something autmatically or maybe they just bookmarked my site. Twisted Evil