First Hit

Posted: Thu Jun 03, 2004 6:49 am

I received my first hit with Sentinel™. It was an Inktomi crawler and the reason given was SCRIPT. Can someone tell me exactly one happened? Thank you, Steve

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Without revealing your path info, post the email you received.

Posted: Thu Jun 03, 2004 7:10 am

It was sent to Rebecca, I will post it as soon as she forwards it. Thank you.

Posted: Thu Jun 03, 2004 1:20 pm

Here is the email:

Quote:

----- Original Message -----
Sent: Thursday, June 03, 2004 12:47 AM
Subject: Abuse Blocked on xxxxx

>
> Date & Time: 2004-06-03 02:47:28
> Blocked IP: 66.196.90.7
> User ID: Anonymous (1)
> Reason: Abuse - SCRIPT
> --------------------
> User Agent: Mozilla/5.0 (compatible; Yahoo! Slurp;
http://help.yahoo.com/help/us/ysearch/slurp)
> Query String:
www.com/modules.php?op=modload&name=Web_Links&file=i
ndex&l_op=ratelink&lid=6&ttitle=GRC_(Steve_Gibson_Research_Corporation)
> Forwarded For: none
> Client IP: none
> Remote Address: 66.196.90.7
> Remote Port: 54792
> Request Method: GET
> --------------------
> Who-Is for IP
> 66.196.90.7
>
>
>
>
> OrgName: Inktomi Corporation
> OrgID: INKT
> Address: 4100 East Third Avenue
> City: Foster City
> StateProv: CA
> PostalCode: 94404
> Country: US
>
> NetRange: 66.196.64.0 - 66.196.127.255
> CIDR: 66.196.64.0/18
> NetName: INKTOMI-BLK-3
> NetHandle: NET-66-196-64-0-1
> Parent: NET-66-0-0-0-0
> NetType: Direct Allocation
> NameServer: NS1.YAHOO.COM
> NameServer: NS2.YAHOO.COM
> NameServer: NS3.YAHOO.COM
> NameServer: NS4.YAHOO.COM
> NameServer: NS5.YAHOO.COM
> Comment: This netblock contains Web Crawlers. Please
> Comment: contact slurp@inktomi.com for questions or concerns.
> RegDate: 2001-10-30
> Updated: 2003-09-26
>
> AbuseHandle: ZI107-ARIN
> AbuseName: Inktomi Corporation
> AbusePhone: +1-650-653-2800
> AbuseEmail: slurp@inktomi.com
>
> TechHandle: ZI35-ARIN
> TechName: Inktomi Corporation
> TechPhone: +1-650-653-2800
> TechEmail: l3-ops@inktomi.com
>
> OrgTechHandle: ZI35-ARIN
> OrgTechName: Inktomi Corporation
> OrgTechPhone: +1-650-653-2800
> OrgTechEmail: l3-ops@inktomi.com
>
>
>

Posted: Thu Jun 03, 2004 1:47 pm

It's the () in the url. Just for curiosity, try that same url but filter out this part

Code:

&ttitle=GRC_(Steve_Gibson_Research_Corporation)

Posted: Thu Jun 03, 2004 4:16 pm

The link works with or without the (). I removed them. Should I consider this a false positive and remove the ban?

registered · Posted: Thu Jun 03, 2004 4:24 pm

This is a false positive Smile

In the "Script" blocker there is a regex check that has the ( and ) in it. This is also in the native nuke script checkers. We are looking for a way to prevent it from triggering the blocker but at the same it would then trigger the native script protection.

Posted: Thu Jun 03, 2004 4:30 pm

Thank you, Bob. I will remove the block.