Category: bot

Furanet.com: Research and Banning

There is not much for this, and it seems they like to be unknown. There is no web site for furanet.com. Let me try to tease their pattern.

93.93.68.0/24
COMVIVE SERVIDORES S.L.
Sevilla, Spain
email@comvive.es

My content scraper host name was 98-68.furanet.com. It looks like their pattern or strategy is a reverse order domain name with the first 2 octets missing. Looking at their IP range I would guess 93.93.64.0/21, which covers the 68 of 98-68.furanet.com. From my Google search I’ve added 91.192.108.0/22 which they also commonly use.

Ban these most commonly used IPs:
91.192.108.0/22
93.93.64.0/21

XFone 018.net.il: Research and Banning

My site has been getting content and image scraped by bb-81-107.018.net.il and bb-153-46.018.net.il, but these two host names do not resolve. Furthermore there is very little on the internet on them. My next step is to ban their complete IP range.

Observation:
cust-68.196.102.5.018.net.il 5.102.196.68
CUST-89.242.102.5.018.net.il 5.102.242.89 2017-jan-23
cust-186.224.102.5.018.net.il 5.102.224.186
cust-140.227.102.5.018.net.il 5.102.227.140
cust-151.241.102.5.018.net.il 5.102.241.151
cust-132.255.102.5.018.net.il 5.102.255.132
bb-81-107.018.net.il 94.230.81.107
bb-84-30.018.net.il 94.230.84.30
bb-132-134.018.net.il 188.120.132.134
bb-134-60.018.net.il 188.120.134.60
BB-151-179.018.net.il 188.120.151.179 2017-jan-18
bb-153-46.018.net.il 188.120.153.46
BB-154-107.018.net.il 188.120.154.107 2016-oct-08
141.226.151.47 2016-oct-14

Pattern:
If there are 4 octets in the host name, then reverse the octets. If there are only 2 octets then these are the last 2 of the IP. You will need to use the host command and try the first 2 octets of their common ranges.

454a986e.cst.lightpath.net: Research, Ban

454a986e.cst.lightpath.net is a content scraper bot that has been visiting my site, so I would like to remove the welcome mat.

lightpath.net seems to change their front extent many times, as a search on Google did not yield an exact match, but many variants.

Pattern:
Take the numbers before “.cst.lightpath.net” and convert them from hex to decimal, giving you 4 octets.

lightpath.net resolves to 216.2.192.141, Optimum Online or Cablevision Systems, XO Communications (ISP), but they have no website. cablevisionlightpath.org also resolves to the same ip address.

454a986e.cst.lightpath.net Their hex converts to 69.74.152.110, Cablevision Systems.

IPVNow.com Will Fool Anti-Bot Software

Fool, it would, an automated anti-bot system, because humans are more intelligent than bots. They are innovative, in their evil genius way. Computer security is all about the arms race. The better the methods, the better the counter measures, and then it repeats. No security measure is foolproof for very long.

IPVNow.com has a slew of host names that when you look them up, resolve successfully and all point to the same IP address, 103.224.182.241. This misdirection is what would fool the anti-bot software, because this IP is real and it points to a valid company, Trellian, which owns IPVNow.com. But banning this single IP does not stop the content scraping. Each host name has its own IP address that uses ISPs Ubiquity and Nobis. These are the IPs you need to ban.

customer.worldstream.nl: Banning Content Scraper

This host name is constantly scraping my site, but when I look it up it does not resolve. Searches on Google reveal that they seem to change their IP address very often. Many other sites are getting spammed and content scraped by this host. I have no alternative than to ban the whole IP range of customer.worldstream.nl.

I read my raw access log and the first column provides me with an IP address or host name. This first column is usually enough to target the specific IP that is errant, and I ban the last IP octet of 256 addresses.

Strange Host Names that I Cracked

These host names try hard to evade detection of their IP addresses, in order to scrape content and sometimes break into from web sites. They have specifically scraped mine and so I hunted them down and banished them. Often times the unix host command returns nothing, so research is required. This usually works.

Host Names I have Researched, Flummoxed

intra.cea.fr content scraped me, so I researched them.

is005045.intra.cea.fr 10.0.5.45
archie6420.intra.cea.fr 32.166.1.28

napsaci011.intra.cea.fr 132.166.177.50
napsaci012.intra.cea.fr 132.166.177.51
is151991.intra.cea.fr 132.166.118.1

kalahari.intra.cea.fr 132.167.4.137
aster.intra.cea.fr 132.167.197.147

gre018941.intra.cea.fr 132.168.11.11
gre019465.intra.cea.fr 132.168.11.112
gre045998.intra.cea.fr 132.168.11.183
grecfnimon01.intra.cea.fr 132.168.16.105
gre058496-24.intra.cea.fr 132.168.24.180
gre047417.intra.cea.fr 132.168.28.194
gre033069.intra.cea.fr 132.168.30.141
moises.intra.cea.fr 132.168.37.241
gre022491.intra.cea.fr 132.168.65.0
gre035045-160.intra.cea.fr 132.168.160.31

altairnew.intra.cea.fr 132.169.8.1
717rccair5235b.intra.cea.fr 132.169.13.1
aurel.intra.cea.fr 132.169.33.1
celaeno.intra.cea.fr 132.169.11.129

0x667.crypt.gy came back with a host lookup of 94.23.147.30, OVH. I cannot verify this IP address. Research is inconclusive. This guy uses a Microsoft server error code “1639 (0x667). Invalid command line argument” in his hostname.
server.crypt.gy 188.165.211.48

SeoOptimizedRankings SEORankingLinks Spam: How to Ban it

Pain in the butt, no doubt, is this spammer. He’s been spamming my blog for the last 6 months and whatever I did in my ban manager, it would not ban. I got mad enough to track him down, figure out how he does it, and hopefully ban him. Take a look at the audit trail he left me in my WordPress Akismet anti-spam filter. I am very thankful that Akismet stopped him from wrecking my blog, and I’ll be more careful and vigilant from now on.

seo plugin
SeoOptimizedRankings.com
ekmyds@gmail.com
107.172.198.171

SEORankingLinks.com
awssjhevf@gmail.com
107.172.206.7

SEORankingLinks.com
eyaqiuylmr@gmail.com
107.172.219.82