Hack attempt.... What next?

Regular Joined: Dec 28, 2004 Posts: 94

'ello all.

I've definately had my very first attempted author hack today. (Trubador comes of age Smile

)

the real question is .... What next? Can any one direct me to a FAQ or post on this question?

And if anyone wants to add to your banned IP list here's the Email.

Code:

Date & Time: 2005-03-15 15:29:53


Blocked IP: 81.213.198.55


User ID: Anonymous (1)


Reason: Abuse-Author


--------------------


User Agent: Mozilla 4.0 (Linux)


Query String: (site address removed)/admin.php?op=AddAuthor&add_aid=kiegera&add_name=Goda&add_pwd=playboya&add_email=r00t_System@hush.com&add_radminsuper=1&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox


Forwarded For: none


Client IP: none


Remote Address: 81.213.198.55


Remote Port: 1259


Request Method: POST

Cheers all and definately cheers Raven and Sentinel !!!!

Trub

registered · Posted: Tue Mar 15, 2005 4:19 pm

They have been banned from your site. I'd say Sentinel has done its job and you can go in using your site normally.

Posted: Tue Mar 15, 2005 6:29 pm

Thank you for posting that information!!!

Guess who I had today? The exact same guy! Smile

He has tried hitting my site twice now (or at least since I have gotten sentinel). His ip changed since last time. I might suggest doing 81.213.*.* instead of 81.213.198.55. (That is the correct way to block him, right?)

Client Joined: Jan 29, 2004 Posts: 624

Sure you could. Do you have the .htaccess write-to by Sentinel enabled?

Posted: Wed Mar 16, 2005 8:15 pm

Yes, I do. I have even tested it (by accident). Very Happy

Posted: Wed Mar 16, 2005 8:44 pm

Well, you could always ban him manually in Sentinel or type it into .htaccess:
deny from 81.213

Hangin' Around Joined: May 13, 2005 Posts: 26

ok...

got 7.6 running with the 3.0 patch and sentinel... how do i set it up to block this screw ball..

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Chances are that IP is not allocated to the same user now. If you have set the various blockers in your NS Configuration panel then anyone who attempts that attack will be automatically blocked.