hack attempt found - anything of use in this?

Worker Joined: Aug 28, 2003 Posts: 227

200.232.241.15

OrgName: Latin American and Caribbean IP address Regional Registry
OrgID: LACNIC
Address: Potosi 1517
City: Montevideo
StateProv:
PostalCode: 11500
Country: UY

ReferralServer: whois://whois.lacnic.net

NetRange: 200.0.0.0 - 200.255.255.255
CIDR: 200.0.0.0/8
NetName: LACNIC-200
NetHandle: NET-200-0-0-0-1
Parent:
NetType: Allocated to LACNIC
NameServer: NS.LACNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS-SEC.RIPE.NET
NameServer: SEC3.APNIC.NET
NameServer: NS2.DNS.BR
Comment: This IP address range is under LACNIC responsibility for
further
Comment: allocations to users in LACNIC region.
Comment: Please see http://www.lacnic.net/ for further details, or
check the
Comment: WHOIS server located at whois.lacnic.net
RegDate: 2002-07-27
Updated: 2004-03-18

TechHandle: LACNIC-ARIN
TechName: LACNIC Hostmaster
TechPhone: (+55) 11 5509-3522
TechEmail: abuse@lacnic.net

OrgTechHandle: LACNIC-ARIN
OrgTechName: LACNIC Hostmaster
OrgTechPhone: (+55) 11 5509-3522
OrgTechEmail: abuse@lacnic.net

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

I edited your post as it revealed private server info Shocked

. The hack that was attempted was the admin.php hack which is an old exploit and has a fix posted in this site.

Posted: Sat May 08, 2004 4:57 pm

oops. mucho gracias on taking that out.

Hangin' Around Joined: Mar 22, 2004 Posts: 49

I'm not only one being hit from that range of IP's then Razz

I publish IP's on the front of my site of those that have or have attempted to hack me and I use Flash headers and footers to stop them inserting adverts into the site if they do manage to hack me, which has happened before.

Worker Joined: Mar 11, 2004 Posts: 209

ballymuntrev wrote:

I publish IP's on the front of my site

hello trev
i saw a ban list block and tho may be you like it Razz

visit http://protector.warcenter.se/ and check the second rightside block

Posted: Mon May 10, 2004 5:25 am

Thanks for that. Can't actually see that block itself but I'll register and look into it more.

If can find that old Xoops one somewhere I might convert it over to work with phpnuke also as it was fairly good.

Posted: Mon May 10, 2004 11:19 am

oh i thought u alredy use protecter and member of site Cool

Posted: Mon May 10, 2004 7:18 pm

I'm debating if I should be using protector or just stick with raven's hackalert script. Any thoughts on that peace?

Posted: Tue May 11, 2004 11:13 am

why not using two of them Cool

Posted: Tue May 11, 2004 11:47 am

true. I was thinking keeping it simple though.

Posted: Wed May 12, 2004 10:20 am

well i believe security is number1 important think at php nuke and using more security wont hurt you more then if you hacked Rolling Eyes

Posted: Wed May 12, 2004 2:19 pm

I flip flop on this one. Its a nice program but it contributes substancial server load and its really a matter of which is best for the individual site. If your site is on a busy server you might be doing more harm then good. I'd say if your running it you shouldn't bother with any other tracking programs because it will just compound the resource issue.

On the other hand if your servers heckofa fast and there is no competition for the resources go for it.

registered · Regular Joined: May 03, 2004 Posts: 62 Location: USA

That's the same IP range that's been trying to hack my site.

I blocked the whole range Wink

Posted: Thu May 13, 2004 7:05 pm

That's a big list of numbers!

Posted: Thu May 13, 2004 7:08 pm

Yeah,

But I've had it up to ... well, PAST there Wink

LOL

Take care!