China is a sovereign country, the same as any other independent and the world must respect this. What is unique about China is their willingness to use any means to exert their influence far beyond Chinese jurisdiction. I see that here in Canada, but there are reports of the same tactics being used in Australia and New Zealand.
Tactics include: Funding education programs that have a pro-Chinese viewpoint
There is great concern here in Canada about their funding tactics. While it is great to encourage the study of Mandarin language, China is using this platform to teach a pro-Chinese viewpoint to very young kids. More than worrisome, this is meddling in the internal affairs of Canada. The Toronto District School Board had signed an agreement with this group, but the decision was reversed.
I can only label this a Russian referrer bot because it uses predominantly Russian referrers, used for referrer spam. In fact I have no evidence of its origin. The list of 46 unique requesting IPs are from around the world, seemingly random. While it is easy to ban these 43, there is no way to find the originator of this bot.
Referrer spam is unique in that the originating IP does not care about returned data. All the IP request wishes to do is insert their referrer info into the request. This request goes back to and therefore affects and pollutes your Google Analytics. The requesting IPs, not wanting any information in return, could be from anywhere and could well be faked.
Ad fraud software in action. Target website, randomized referrers, browser agents and proxy IP addresses. That is enough to spoof anti-bot software.
It is no secret that I battle and ban bad bots on my site. If a bot is not a well known search engine or provides me some type of service then I usually ban it. Sure it can visit my site, but it will receive a blank page. But why do they visit? Who is paying them? Welcome to the world of Online Ad Fraud.
Henan police Academy 河南公安学院, Zhengzhou, China, left me some comment spam today.
Today the Henan Police Academy 河南公安学院 from Zhengzhou, Henan, visited my site and left comment spam. I thought it very odd, because Chinese government organizations, including Chinese police, are usually quite discreet and don’t present themselves in such an open way.
183.169.128.30 Henan Police Academy Henan Gongan Xueyuan 河南公安学院 HNGAZK-CN at http://hnp.edu.cn/. Their IP range is 183.169.128.0 – 183.169.159.255. There are a couple of abuse postings from them such as 1, 2
Yep, very popular hacking tools! Metasploit
Took the install from Rapid7’s site. It all went very well.
To start they had the command “./msfconsole”, which did not work for me. It started with “msfconsole”. The initial run created the initial database. The “db_status” command also worked.
I did not seem to need to do the “service postgresql start” command. I did a search and received a message: Module database cache not built yet, using slow search. To build the cache do “db_rebuild_cache”. This worked, link. Now my searches work.
Playing, I am, with the Nikto web server scanning package. I scanned my own site, just for fun. While it does take some time, it did finish. I wondered how it would look from my site’s raw access log viewpoint. In summary, Nikto is not stealthy at all. It is also easily detected and banned mid-scan, as it takes a long time to complete.
Essentially you start a Terminal, and type “nikto -h “. There are lots of options, such as output to a log. The Nikto output highlights web site vulnerabilities and cross references these with a database of known hacks. Using this tool you can highlight the site’s weaknesses and then strengthen your site from hackers.
For the longest time my site has been tracked and spammed by 163data.com.cn. I, and others, have wondered about the story behind the number 163. Was it a Chinese Army unit number similar to 解放军 61398部隊? Alas, there seems to be nothing so exciting. There are only a few links about the history of 163.
It looks like in the ’90s when you had to dial a telephone number to a modem and reach the internet, 163 was appended to a local number. Thus 163 was commonly used and therefore memorable. After this time NetEase started 163.com and used 163 to start China’s largest free email service, the Chinese equivalent to gmail. 163.com remains very popular in China today.
This Bell Canada IP address is unusual and came up when I did a host command. It hosts 12 sites. I did not find anything else suspicious about it on X-Force Exchange.
City of Toronto internet scraper bot scrapes my site a couple of times per month. Why? Toronto, Canada
I live in the City of Toronto, and write about Toronto-related subjects. What is surprising is that the City of Toronto has an internet bot that randomly scrapes content from my site a couple of times each month. The bot started scraping me near the end of January 2017.
What is interesting was that I, concerned citizen, actually emailed them because I thought they had a Zombie PC taken over by a bot, or some other security issue. I sent the City a log of the relevant entries related to their IP address. Was I naive. Here is their reply (isg@toronto.ca):
