You are not logged in.
- Topics: Active | Unanswered
Pages: 1
#1 2008-04-29 8:40 am
- rbhatia
- Member
- Registered: 2008-04-29
- Posts: 2
82.177.193.25
we see forumspam originating from the ip: 82.177.193.25 to different
boards hosted by our company.
since putting a blocking rule in place on saturday, we blocked
144 8640 DROP 0 -- * * 82.177.193.25 0.0.0.0/0
requests from this ip.
cheers,
raoul
ps. i tried to sign up for an api key but failed. 
Offline
#2 2008-04-29 9:31 am
- rbhatia
- Member
- Registered: 2008-04-29
- Posts: 2
Re: 82.177.193.25
additional information: they never managed to register a valid user as i guess the link they used was somehow invalid for this forum installation:
e.g.
82.177.193.25 - - [26/Apr/2008:12:53:39 +0200] "GET /forum/ HTTP/1.1" 200 23821 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
82.177.193.25 - - [26/Apr/2008:12:53:39 +0200] "POST /forum/profile.php?mode=register&sid=8af94974d11e69abd5a1ef05a0feb3c5&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true HTTP/1.1" 200 15874 "http://hundekult.at/forum/profile.php?mode=register&sid=8af94974d11e69abd5a1ef05a0feb3c5&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
82.177.193.25 - - [26/Apr/2008:12:53:40 +0200] "GET /forum/profile.php?mode=confirm&id=ef37c7fe11e3d667d8daeaa14546ba08 HTTP/1.1" 200 14930 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
82.177.193.25 - - [26/Apr/2008:12:53:40 +0200] "POST /forum/profile.php&agreed=true&CONFIRM=CONFIRM&acceptterms=true&greed=true&YesIAgree=Accept&Yes_I_agree=true&tobeagreed=true&AgrEEmENT=true&aGReED=true HTTP/1.1" 404 384 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"Offline
Pages: 1