Warning about Username best

[PowerHosting123]

If you've an account signup using the username best this is a warning for this person he/she will upload a c99shell.php as phpnuke.php or best.php

Time: Sat Aug 29 19:50:08 2009 -0500
Failures: 1 (mod_security)
Interval: 300 seconds
Blocked: Yes

Log entries:

[Sat Aug 29 19:50:04 2009] [error] ModSecurity: Access denied with code 406 (phase 2). Pattern match "/c99shell\\.php" at REQUEST_URI. [file "/usr/local/apache/conf/modsec2.user.conf"] [line "126"] [hostname "best.hosting-shack.com"] [uri "/phpnuke.php"] [unique_id "SmkFVEt-ZgIAAA4pY50AAAAM"]

Email address used when registering danial_azari@live.com


Proxies / Used
65.49.2.27 - ISP Hurricane Electric - Leads back to hostmaster

Might be user main IP
91.184.67.217 - ISP DATAK Internet Engineering, Inc - leads back to datak-telecom.net

He/She seems like they stay sniffing around FWS alot.

 

[simmaster]

Also, if you are using SMF 1.1.8 or earlier and have a member with any of these attributes:
>> Name krisbarteo
>> IP is 94.142.129.147
>> Email krisbarteo@gmail.com
Ban the user or create an account with the name and ban it. It will also upload a C99Shell via the avatar.

 

[labyrinth]

I'm familiar this username best before and right he's an abuser I've seen him somewhere free host before. He plan to run warez downloads distribution. All his sites are Arabics.

 

[Tiger-Matt]

ive had him two times signup to mine suspended him both time, also uses the domain novinproxy.co.tv

 

[Schmarvin]

He may signup with the subdomain "dani.yourdomain.com"

Or "danni.yourdomain.com"

So be aware.

 

[jphilipson]

And he's even too stupid to change the name of the c99 shell file... no worries anyway if you are using suPHP.

 

[Erizo]

I had him a good while ago with subdomain best.mysite.com o.o And was suspended, of course.

 

[sander k]

I have hosted him, if it is the same "best" for over 6 months without problems.
Then he decided to move because he could get a better plan elsewhere.

 

[TSO]

What exactly does his file do?

 

[Dynash]

What exactly does his file do?

http://justin.madirish.net/node/322
http://www.hirednetwork.com/?p=138

 

[TSO]

Yeesh! I've dealt with that in the past, didn't realize that's what it was called though. ----ty stuff, that's for sure.

 

[Mwzaf]

you are free host right
so you have protect from shell
no worries anyway
if any one upload c99 shell or any another shell it well not working with him
beacuse i have a protect from shell

 

[dannyang]

Thanks for the heads up, hopefully I catch him if he signs up with me before he can do any damage.

 

[daniel_1993]

This information is in error
iam daniel my mail danial_azari@live.com

 

[CS Squad]

erm... this thread is already dead so long already, why u bring it up back again?
this will only cause ppl to refuse to provide u service

 

[eSupun]

You are so true, CS Squad.

@daniel_1993
You won't get hosting accounts from them again. But surely -rep for the support you've given. lol