Need some info

Posted: Sun Apr 02, 2006 7:04 pm

I was checking my server logs in cpanel and I got this ip addy that is into everything The addy is 81.215.10.100 I checked My tracked ip's in sentinel and it shows as a Turkish range. Problem is I blocked all those ranges or so I thought.. I checked the ip and its listed to some telecom thing any ideas what this is.. I have them blocked for now..

Sells PC To Pay For Divorce Joined: Posts: 5661

well Serafim ,nice choice...keep it blocked..
turkish hacking group is making overtime lately...
just keep whole country blocked..

registered · Site Admin Joined: Jun 04, 2004 Posts: 6437

Pretty common, that is. Quite a few attacks appear to be launched from that company / range. Unless you block them at the server level (i.e. via htaccess), they can still attack and appear in your logs. But, even if they attempt to view a legitimate page, they'll see the block page.

Posted: Sun Apr 02, 2006 7:22 pm

It could also be the IP address of an anonymous proxy - used to disguise the attackers true IP address. Still, if it can be used to launch attacks, it's good to block it.

Posted: Sun Apr 02, 2006 7:27 pm

Well I thought i blocked the entire range can someone link me to the tut on how to block the entire range and I added then manually to .htaccess whan I blocked them

Posted: Sun Apr 02, 2006 7:36 pm

you mean how to block whole range in htaccess or sentinel?

Posted: Sun Apr 02, 2006 7:37 pm

Did you have htaccess updates turned on when you blocked the range?

Posted: Sun Apr 02, 2006 7:37 pm

Sentinel Like I said I thought when I did the ip2 county import that was all I needed to do.. See newbie assumptions lol

Posted: Sun Apr 02, 2006 7:42 pm

ok ,

first go to sentinel administration.
then click on Blocked Range Menu
Then (menu right) on Add Blocked Range
Then you see the areas where you can add the ip's ..

Posted: Sun Apr 02, 2006 7:51 pm

Ok I did like you suggested.. I also imported to blocked Range Turkey.. Viewed the ranges in display and they appear to be there.. There are 214 pages total in my blocked ranges.. Quiet a few I think.. What I believe may have happened here was I didn't add that range before I restored my site from back up.. I do that religiously to test that the backup works correctly.. Thanks for all your guidance..

Posted: Sun Apr 02, 2006 8:41 pm

One more thing now that I have added all those ranges lets say that I added some poor country like The bahamas do you have to manually delete each of those ranges or is there a better way...

Posted: Mon Apr 03, 2006 3:59 am

well i never had such a situation,but in these cases when that happens i just act on any mails i get.
people start to mail you that they cant visit your site because of the block.
if that happens i ask for their ip and then i take out their range.