Blocked abuse: Abuse-script

Client Joined: Jul 18, 2003 Posts: 977

Please tell me if this is bad?

Code:

Date &amp; Time: 2008-07-28 02:26:42 CDT GMT -0500 Blocked IP: 87.118.70.5 User ID: Anonymous (1)


Reason: Abuse-Script


--------------------


User Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.2b) Gecko/20021001 Phoenix/0.2 Query String: www.gamersroam.com/modules.php?name=Your_Account&op=new_user+Result:+registered+(registering+only+mode+is+ON);


Get String: www.gamersroam.com/modules.php?name=Your_Account&op=new_user Result: registered (registering only mode is ON); Post String: www.gamersroam.com/modules.php Forwarded For: none Client IP: none Remote Address: 87.118.70.5 Remote Port: 4991 Request Method: GET


--------------------


Who-Is for IP

registered · Posted: Tue Jul 29, 2008 11:12 am

Someone is running what looks like a malfunctioning probe/attack script against you. I get these all the time.

Posted: Tue Jul 29, 2008 12:19 pm

Gremmie wrote:

Someone is running what looks like a malfunctioning probe/attack script against you. I get these all the time.

Thank you. It is nice that Sentinel caught it! RavensScripts

My question is I do not have script blocking writing to htaccess like all the others. Should I be instantly and permabanning Abuse-Script?

Posted: Tue Jul 29, 2008 3:49 pm

Well, now I am kind of confused. After looking at this it almost seems as if people are trying to register. I just received another one:

Code:

User Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16 Query String: www.gamersroam.com/modules.php?name=Your_Account&op=new_user+Result:+registered+(registering+only+mode+is+ON);


Get String: www.gamersroam.com/modules.php?name=Your_Account&op=new_user Result: registered (registering only mode is ON); Post String: www.gamersroam.com/modules.php Forwarded For: none Client IP: none Remote Address: 12.201.65.188 Remote Port: 63457 Request Method: GET

Can it be that prevelant that people are trying to hack or ar they trying to register?

Posted: Tue Jul 29, 2008 4:40 pm

No one who was legitimately trying to register would concoct such a GET string. Anyone registering would do it via POST.

BTW, I accidently clicked on the above and got blocked/banned from your site. Smile

registered · Posted: Tue Jul 29, 2008 9:35 pm

Basically its a spam robot. They register an account, they spam your comments/forums for their junk. You should feel free to ban that IP

Posted: Wed Jul 30, 2008 7:21 am

Thank you both very much! I am at ease now.
Gremmie I will fix that in case I need you in the future Wink

Posted: Wed Jul 30, 2008 7:30 am

But evaders99, what's up with the op variable? Why would they include all that "Result: registered ..." crap in there? That makes me think their script is horked.

Posted: Wed Jul 30, 2008 8:01 am

Gremmie wrote:

BTW, I accidently clicked on the above and got blocked/banned from your site. Smile

Yep, roflll did the same yesterday Embarassed

(I have a dutch IP Wink

)

Posted: Wed Jul 30, 2008 11:48 am

Their script is "horked" Smile

Posted: Wed Jul 30, 2008 12:09 pm

evaders99 wrote:

Their script is "horked" Smile

They sure run the d*** thing a lot, judging by the amount of times I see it each week. Don't they notice it isn't working? Laughing

Oh well, have fun with that kiddies!