gilbau
 486 
|  Posté : 30-10-2012 10:48
Je ne sais pas si ça été évoqué, mais ça ne m'était pas arrivé sur mon npds sable évolution 10.08
Et maintenant que je suis en revolution 11w
mon forum vient d'etre "attaqué" par un spam sur la table posts
L'origine un ip chinoise 112.111.185.231
Du coup j'ai bloqué quelques pays entiers en mettant dans mon .htaccess
SetEnvIf GEOIP_COUNTRY_CODE SN BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE NE BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE NG BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE KR BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE CG BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE RU BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE CI BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE BJ BlockCountry
# ... place more countries here
Deny from env=BlockCountry
Mais il serait utile de supprimer la faille
detail du spam heure = 30-10-2012 04:07
message :
I loved as much as you'll receive performed proper here [url=http://cheapuggbootss.moonfruit.com]cheap ugg boots uk[/url] [url=http://cheap-uggbootsuk.moonfruit.com]ugg boots sale[/url] [url=http://northfaceoutlet.moonfruit.com]north face jackets[/url] . The sketch is tasteful, your authored subject matter stylish [url=http://pandoraonlin.yolasite.com]pandora online[/url] [url=http://ukuggbootsclearance.moonfruit.com]ugg boots[/url] [url=http://northfacefleece.moonfruit.com]north face denali[/url] . nevertheless, you command get got an impatience over that you would like be delivering the following [url=http://pandorasuk.yolasite.com]Cheap Pandora Charms[/url] [url=http://evareynolds.wix.com/pandoracharms]pandora charms uk[/url] [url=http://burberryscarf.moonfruit.com]cheap burberry[/url] . sick definitely come further until now again as precisely the same nearly a lot incessantly within case you protect this hike [url=http://cheapuggbootss.moonfruit.com]cheap ugg boots uk[/url] [url=http://pandoracharms-uk.yolasite.com]pandora jewelry charms[/url] [url=http://louisvuittonoutlets.moonfruit.com]Louis Vuitton Outlet[/url] . [url=http://mulberry-handbags.dinstudio.co.uk]cheap mulberry handbags[/url]
Les lignes de logs concernant cette IP :
112.111.185.231 www.vivrenu.com - [30/Oct/2012:03:41:07 +0100] "GET /viewtopic.php?topic=795&forum=42 HTTP/1.0" 200 119842 "http://www.vivrenu.com/viewtopic.php?topic=795&forum=42" "Mozilla/5.0 (Windows NT 5.1; rv:10.0.2) Gecko/20100101 Firefox/10.0.2"
112.111.185.231 www.vivrenu.com - [30/Oct/2012:03:41:24 +0100] "GET /viewforum.php?forum=31 HTTP/1.0" 200 165197 "http://www.vivrenu.com/viewforum.php?forum=31" "Mozilla/5.0 (Windows NT 5.1; rv:10.0.2) Gecko/20100101 Firefox/10.0.2"
112.111.185.231 www.vivrenu.com - [30/Oct/2012:03:41:45 +0100] "GET /newtopic.php?forum=31 HTTP/1.0" 200 55463 "http://www.vivrenu.com/newtopic.php?forum=31" "Mozilla/5.0 (Windows NT 5.1; rv:10.0.2) Gecko/20100101 Firefox/10.0.2"
112.111.185.231 www.vivrenu.com - [30/Oct/2012:03:41:55 +0100] "POST /newtopic.php HTTP/1.0" 200 39822 "http://www.vivrenu.com/newtopic.php?forum=31" "Mozilla/5.0 (Windows NT 5.1; rv:10.0.2) Gecko/20100101 Firefox/10.0.2"
et
112.111.185.231 www.vivrenu.com - [30/Oct/2012:04:07:21 +0100] "GET /viewtopic.php?topic=12914&forum=69 HTTP/1.0" 200 120710 "http://www.vivrenu.com/viewtopic.php?topic=12914&forum=69" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11"
112.111.185.231 www.vivrenu.com - [30/Oct/2012:04:07:40 +0100] "GET /newtopic.php?forum=69 HTTP/1.0" 200 56133 "http://www.vivrenu.com/newtopic.php?forum=69" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11"
112.111.185.231 www.vivrenu.com - [30/Oct/2012:04:07:44 +0100] "POST /newtopic.php HTTP/1.0" 200 40849 "http://www.vivrenu.com/newtopic.php?forum=69" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11"
J'ai tout mon log dispo pour dev et l'equipe au besoin
http://fichiersgb20.free.fr/npds/vivrenu.com-30-10-2012.zip
(j'ai changé l'autre log qui était effectivement de 2011)
Message édité par : gilbau / 30-10-2012 18:44 |
