[DJ Maze]

If one of the following IP addresses is yours, please contact security at cpgnuke dot com

iptables -A INPUT -s 72.55.137.180 -j DROP
iptables -A INPUT -s 77.221.130.16 -j DROP
iptables -A INPUT -s 88.198.12.6 -j DROP

IP's are hammering any url to exploit: admin/editeur/spaw_control.class.php


iptables -A INPUT -s 82.79.231.103 -j DROP
IP's is hammering any url to: modules/coppermine/include/init.inc.php

[DJ Maze]

iptables -A INPUT -s 203.130.242.121 -j DROP
iptables -A INPUT -s 209.168.245.227 -j DROP
iptables -A INPUT -s 212.34.174.106 -j DROP
Trying to exploit /themes/default/index.php

[DJ Maze]

if you use apf instead of iptables:

Code:

apf -d 61.100.7.111
apf -d 61.139.72.158
apf -d 72.55.137.180
apf -d 77.221.130.8
apf -d 77.221.130.16
apf -d 82.79.231.103
apf -d 88.198.12.6
apf -d 94.75.214.3
apf -d 121.254.170.200
apf -d 203.130.242.121
apf -d 209.168.245.227
apf -d 212.34.174.106

When you reboot this IP ban will be removed, meaning the IP will no longer be banned anymore.
If you have APF you can get around this by opening the deny hosts file.

pico /etc/apf/deny_hosts.rules

[bernardy25]

I never faced any IP-banned problem but I think it is good to have such problem for future reference.

[Dizfunkshunal]

what kind of exploit are they trying to use?

[unilibrium]

where in the cms does one insert these ip addresses?