Email da Sentinell

[proterin]

Da alcuni giorni ricevo delle email da sentinell che mi stanno preoccupando secondo voi cosa vogliono dire?

Testo
Date & Time: 2006-08-03 10:05:07 ora legale Europa occidentale GMT +0200
Blocked IP: 142.46.151.2
User ID: Ospite (1)
Reason: Abuse-Script
--------------------
User Agent: none
Query String: www.proterin.it/html/modules.php?name=News&file=comments
Get String: www.proterin.it/html/modules.php?name=News&file=comments
Post String: www.proterin.it/html/modules.php?subject=home equity loan&comment=<a href="http://forpokerbumperpooltable.blogspot.com/">poker bumper pool table</a> - poker bumper pool table<a href="http://forbackgammontiphow.blogspot.com/">backgammon tip</a> - backgammon tip<a href="http://ist68iringtonesund.blogspot.com/">t68i ringtones</a> - t68i ringtones<a href="http://howbuyambienor.blogspot.com/">buy ambien</a> - buy ambien<a href="http://orbackgammonboardgamewhen.blogspot.com/">backgammon board game</a> - backgammon board game<a href="http://arenasacorten.blogspot.com/">nasacort</a> - nasacort<a href="http://orbodyfata.blogspot.com/">body fat</a> - body fat<a href="http://asreversemortgagean.blogspot.com/">reverse mortgage</a> - reverse mortgage<a href="http://inprilosecon.blogspot.com/">prilosec</a> - prilosec<a href="http://andogstep.blogspot.com/">dog step</a> - dog step<a href="http://thisarcheshoes.blogspot.com/">arche shoes</a> - arche shoes<a href="http://byshakira.blogspot.com/">shakira</a> - shakira<a href="http://withnokiaringtones.blogspot.com/">nokia ringtones</a> - nokia ringtones<a href="http://undbonuscasinosignup.blogspot.com/">bonus casino signup</a> - bonus casino signup<a href="http://ofplayfreepoker.blogspot.com/">play free poker</a> - play free poker<a href="http://ontraderjoeslaborday.blogspot.com/">trader joes labor day</a> - trader joes labor day<a href="http://averizonwirelessringtones.blogspot.com/">verizon wireless ringtones</a> - verizon wireless ringtones<a href="http://wherevisualbasic.blogspot.com/">visual basic</a> - visual basic<a href="http://toviagrade.blogspot.com/">viagra</a> - viagra<a href="http://areviagrabe.blogspot.com/">viagra</a> - viagra<a href="http://areviagraat.blogspot.com/">viagra</a> - viagra<a href="http://willdoggystepscomthe.blogspot.com/">doggysteps com</a> - doggysteps com<a href="http://whenbornshoesund.blogspot.com/">born shoes</a> - born shoes<a href="http://undrenovaby.blogspot.com/">renova</a> - renova<a href="http://lahomeequityloanwill.blogspot.com/">home equity loan</a> - home equity loan
Water, taken in moderation cannot hurt anybody.
-- Mark Twain
&sid=0&op=Ok!
Forwarded For: none
Client IP: none
Remote Address: 142.46.151.2
Remote Port: none
Request Method: POST
--------------------
Who-Is for IP
OrgName: Ontario Hydro - Telecom
OrgID: OHYD
Address: 483 Bay Street, 8th floor
City: Toronto
StateProv: ON
PostalCode: M5G-2P5
Country: CA

NetRange: 142.45.0.0 - 142.50.255.255
CIDR: 142.45.0.0/16, 142.46.0.0/15, 142.48.0.0/15, 142.50.0.0/16
NetName: ONTARIO-HYDRO
NetHandle: NET-142-45-0-0-1
Parent: NET-142-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.HYDROONETELECOM.COM
NameServer: NS2.HYDROONETELECOM.COM
Comment:
RegDate: 1990-03-26
Updated: 2002-09-25

RTechHandle: SH497-ARIN
RTechName: HSU, Sheng
RTechPhone: +1-416-240-6688
RTechEmail: hotsls@hydroone.com

[rino]

Niente di grave , stanno cercando di spammare sui commenti del modulo News. Cmq dai una guardatina alle news se per caso sono riusciti a farlo, ma sicuramente no...
_________________

[proterin]

Allora funziona tutto bene? Non mi devo preoccupare? Come farebbero a spammare se sono anonimi visto che gli è inibito?

[rino]

Poichè sono anonimi e non possono farlo dal link lo fanno tramite iniezione di stringa maliziosa(così viene chiamata) attraverso la barra url del browser ossia quella stringa che vedi nella mail la mettono nella barra url e se non avessi Sentiunel prenderebbero possesso del modulo e, forse, di tutta l'amministrazione del sito.
_________________