GET and blocking

Posted: Thu Jun 24, 2004 4:46 am

i was blocked from my own site earlier. it's google-tapped, and i was testing another tap. it said: "u r now blocked -> get command". how can i stop it catching the get command? cos it seems to block LOADS of people just browsin the site.

thanks in advance,

Prism128

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

That is NOT a Sentinel™ message. You are probably using some other "protector" system that is displaying that message.

Posted: Thu Jun 24, 2004 8:52 am

i only have one installed, and it is sentinel; it says that on the block, and in admin.

it doesn't matter now tho; i disabled that part of the google-tap, so it doesn't catch it any more...

Posted: Thu Jun 24, 2004 8:55 am

There is no text like this at all in Sentinel™

u r now blocked

I would suggest that you re-enable it and comment out the Sentinel™ include statement in mainfile.php to demonstrate that it is NOT Sentinel™.

Posted: Thu Jun 24, 2004 10:04 am

it didnt say it like that; i just typed it quickly.

i re-put the googletap thing in, and the actual error it gives is:

Quote:

This IP has been blocked from My Site!

Your IP: my.ip.add.res
Your Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MyIE2; .NET CLR 1.1.4322)

If you think it was blocked by mistake, please contact
my.site.email.address

i also get the email from my site saying:

Quote:

Date & Time: 2004-06-24 11:03:10
Blocked IP: my.ip.add.res
User ID: Me (3)
Reason: Abuse - SCRIPT
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MyIE2; .NET CLR 1.1.4322)
Query String: the.address.of.the.page
Forwarded For: none
Client IP: none
Remote Address: my.ip.add.res
Remote Port: 34842
Request Method: GET
--------------------
Who-Is for IP
my.ip.add.res

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: Singel 258
Address: 1016 AB
City: Amsterdam
StateProv:
PostalCode:
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: 81.0.0.0 - 81.255.255.255
CIDR: 81.0.0.0/8
NetName: 81-RIPE
NetHandle: NET-81-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: NS3.NIC.FR
NameServer: SUNIC.SUNET.SE
NameServer: AUTH62.NS.UU.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate:
Updated: 2004-03-16

Posted: Thu Jun 24, 2004 10:07 am

Please post the email that you received, masking your home directory. Place it inbetween either the code blocks or quote blocks. Thanks.

Posted: Thu Jun 24, 2004 10:09 am

this is the email:

Quote:

Date & Time: 2004-06-24 11:03:10
Blocked IP: my.ip.add.res
User ID: Me (3)
Reason: Abuse - SCRIPT
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MyIE2; .NET CLR 1.1.4322)
Query String: the.address.of.the.page
Forwarded For: none
Client IP: none
Remote Address: my.ip.add.res
Remote Port: 34842
Request Method: GET
--------------------
Who-Is for IP
my.ip.add.res

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: Singel 258
Address: 1016 AB
City: Amsterdam
StateProv:
PostalCode:
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: 81.0.0.0 - 81.255.255.255
CIDR: 81.0.0.0/8
NetName: 81-RIPE
NetHandle: NET-81-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: NS3.NIC.FR
NameServer: SUNIC.SUNET.SE
NameServer: AUTH62.NS.UU.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate:
Updated: 2004-03-16

Posted: Thu Jun 24, 2004 10:11 am

- I need to see the query string. Your url is ok, just not the realpath on your server.

Posted: Thu Jun 24, 2004 10:13 am

ok. here:

Quote:

Query String: modules--.php?--name=Forums--&act=SF&f=([0-9]*)

note: the 3 sets of double dashes (-) i put in are to stop your modrewirte for googletap changing the address

Posted: Thu Jun 24, 2004 10:16 am

It's the (). This has been discussed in several other posts. Nuke blocks these even if Sentinel™ doesn't. You could just modify the action that Sentinel™ performs when the SCRIPT function is use to just email you instead of blocking.

Posted: Thu Jun 24, 2004 10:22 am

so, in the config, does the "block" option mean put it in the sidebar block, or block that person from the site?

Posted: Thu Jun 24, 2004 10:26 am

block equals banning.

Posted: Thu Jun 24, 2004 10:26 am

Block them from the site/server.

Posted: Thu Jun 24, 2004 10:27 am

thanks chatserv Very Happy

thought it was "put info in the sidebar block" lol. obviously i didnt read the readme or summin...