download harvester

Client Joined: Jan 21, 2006 Posts: 87 Location: Arizona

Can anyone explain to me, what does this mean:

Recently, NS keeps blocking IP's from my site for this reason:

Code:




Reason: Abuse-Script


--------------------


User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; cs; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1


Query String: www.mysite.com/modules.php?name=Downloads&d_op=viewdownloaddetails&lid=3&title=Blah blah blah">Blah


Get String: www.mysite.com/modules.php?name=Downloads&d_op=viewdownloaddetails&lid=3&title=Blah blah blah\">Blah


Post String: www.mysite.com/modules.php


Forwarded For: none


Client IP: none


Remote Address: 87.197.210.126


Remote Port: 3024


Request Method: GET

I actually got an email from one guy, saying it was a mistake (a bad link from a forum entry). I ran this through the agent inspector module on RN, and it told me it is trapped by this Harvester entry: download.

This happened 4 times, different IP's/Day. My question is, is this really a mistake, or could they be trying to accomplish something. If so, what?
Also when I check the banned IP section, none of these IP's are listed, but if I run a NS search on that IP, it shows up in the tracked IP section but is not listed as anything else. This is the 4 IP's I got the blocked email: '87.197.xxx.xxx', '68.6.xxx.xxx', '64.124.xx.xx', '24.116.xx.xx'
So next I checked my blocked IP. It only shows 2 IP's, and its none of those 4. '64.246.165.200, 216.145.17.190'

Then I checked my .htacces file NS deny area. It shows 7 IP's, only 2 of those are listed as being blocked in the banned IP section. Also these are not the IP's of the 4 blocked for the download harvestor.

Code:




deny from 64.246.165.200





deny from 64.246.161.190


deny from 67.49.10.48


deny from 70.33.111.91


deny from 71.53.22.210





deny from 216.145.17.190


deny from 64.246.165.210

Posted: Tue Jun 20, 2006 8:46 pm

check ur cnfiguration and im assuming it has somethin to do with the blah blah blah part...if thats the correct string..it may also be a spaceing issue in the url..but im not sure

Posted: Tue Jun 20, 2006 9:02 pm

I'm still clueless. Really, this script hacking is new to me, now I see the debate over why some want to know about it, and why some want to not talk about it.

What about these IP's not showing up in the blocked IP list, but are listed in the tracked IP section.
Is there a manual for Nuke Sentinel?

Posted: Wed Jun 21, 2006 3:36 am

Check your Sentinel Blocker Settings for 'Harvester' to see if it says 'block and....'

registered · Posted: Wed Jun 21, 2006 6:21 am

Quote:

Is there a manual for Nuke Sentinel?

Yes. Check this site's "Site Navigation" menu at the top left of the home page. You will find it there...

Posted: Wed Jun 21, 2006 8:03 am

Thank You.

Mine is set to:
Email, Block & Default Page
Write to .htaccess: Yes
Block Full IP
Block Duration: Permanent

Posted: Wed Jun 21, 2006 8:17 am

Is it possible the titles of those downloads have apostrophes in them?
The actual url up to where you posted 'blah blah blah' seems quite legitimate to me.