Tag: strategy

vivawebhost.com: Research, Ban

vivawebhost.com visited me with a “-” user agent, suspicious at best and certainly a bot. Please, identify yourself.

Observation:
lucky.vivawebhost.com h 78.142.63.208

Research:
wanted.vivawebhost.com 72.249.68.129
core.vivawebhost.com 78.128.60.1
lucky.vivawebhost.com 78.142.63.208
gate.vivawebhost.com 78.142.63.244
europe.vivawebhost.com 78.142.63.38
passat.vivawebhost.com 78.142.63.61
passat.vivawebhost.com 78.142.63.63
tesla.vivawebhost.com 78.142.63.64
lion.vivawebhost.com 91.148.168.30
guard.vivawebhost.com 91.148.168.34
Colonel.vivawebhost.com 173.237.189.70
vivawebhost.com 173.237.190.141
fastest.vivawebhost.com 174.136.29.112
junior.vivawebhost.com 174.136.57.185
general.vivawebhost.com 174.136.57.228
dragon.vivawebhost.com 174.136.57.60
fireblade.vivawebhost.com 217.174.148.86

extendcp.co.uk: Research, Ban

extendcp.co.uk had a user agent name of “-” so I thought to look them up and prepare if they attack me.

Observation:
web232.extendcp.co.uk 79.170.40.232

Pattern:
They use the last octet in their host name, but the first three can vary. Three or 4 ip ranges should do for banning.

Research:
web32.extendcp.co.uk 79.170.40.32 79.170.40.0 – 79.170.47.255 Heart Internet
web55.extendcp.co.uk 79.170.40.55
mail158.extendcp.co.uk 79.170.40.158
web227.extendcp.co.uk 79.170.40.227
web38.extendcp.co.uk 79.170.40.38
web95.extendcp.co.uk 79.170.44.95
mail39.extendcp.co.uk 79.170.44.39
web214.extendcp.co.uk 79.170.44.214
web170.extendcp.co.uk 79.170.40.170
web202.extendcp.co.uk 79.170.44.202
web75.extendcp.co.uk 79.170.44.75
mail42.extendcp.co.uk 79.170.44.42
Web93.extendcp.co.uk 79.170.44.93
web127.extendcp.co.uk 79.170.44.127

web26.extendcp.co.uk 176.32.230.26
web252.extendcp.co.uk 176.32.230.252

web62.extendcp.co.uk 217.199.187.62
web58.extendcp.co.uk 217.199.187.58
web59.extendcp.co.uk 217.199.187.59

secureserver.net: Research, Ban

Not overly annoying, secureserver.net is a regular content spammer on my site. I thought it would be good to track them down. Their host names lookup properly and they seem to ban properly, so there seems to not be anything tricky or suspicious.

Observations:
n1plcpnl0063.prod.ams1.secureserver.net 46.252.205.189
p3plcpnl0342.prod.phx3.secureserver.net 50.62.161.109
p3nlhg1196.shr.prod.phx3.secureserver.net 50.63.196.77
p3slh164.shr.phx3.secureserver.net 72.167.131.53
p3nlhg189.shr.prod.phx3.secureserver.net 97.74.24.189
smtpout16-01.prod.mesa1.secureserver.net 97.74.104.208
Sg2plpkivs-v03.any.prod.sin2.secureserver.net 97.74.104.222
p3nlwpweb375.prod.phx3.secureserver.net 104.238.120.3
N1nlhg336c1336.shr.prod.ams1.secureserver.net 146.255.36.1
p3plgemwbe11-v01.prod.phx3.secureserver.net 173.201.192
sg2plwbeout19-1.prod.sin2.secureserver.net 182.50.144.34
sg2plcpnl0020.prod.sin2.secureserver.net 182.50.132.87
p3nw8shg390.shr.prod.phx3.secureserver.net 184.168.27.206
a2plcpnl0191.prod.iad2.secureserver.net 198.71.228.16

Research:
198.71.225.127
a2plcpnl0047.prod.iad2.secureserver.net 198.71.225.140
a2plcpnl0054.prod.iad2.secureserver.net 198.71.226.42
a2plcpnl0123.prod.iad2.secureserver.net 198.71.227.48
a2plcpnl0157.prod.iad2.secureserver.net 198.71.228.51
a2plcpnl0226.prod.iad2.secureserver.net 198.71.228.65
a2plcpnl0240.prod.iad2.secureserver.net 198.71.228.73
a2plcpnl0399.prod.iad2.secureserver.net 198.71.231.45
a2plcpnl0365.prod.iad2.secureserver.net

tor.exit.babylon.network: Research, Ban

The whole concept of tor is a sound one, allowing those in repressive or privacy-optional countries (Canada, US) to anonymously use the internet. Unfortunately this anonymity has been hijacked by the spamming community, taking a benevolent tool and using it for ill. Any IP or hostname used for spamming is game for being banned, tor or not.

tor.exit.babylon.network has a network of tor servers that are content spamming me. Normally tor server IPs are stable, so once you ban them they stay banned. These guys move around a bit, and there are a number of them. If you ban a tor server, or any other hostname, and they return to spam again, then you know they evaded your security efforts. You need to do more research.

as51430.net Content Spammer: Research, Ban

as51430.net spammed me, so here is the research for tracking and banning. as51430.net is out of Luxembourg. I did not get spammed by its three sister host names, lux-net-ip.as51430.net, nld-net-ip.as51430.net, and swe-net-ip.as51430.net.

Observation:
lu-customer-ip.as51430.net found the following IPs:

91.214.44.48
91.214.45.104
91.214.46.167
79.142.78.169

Research:
Further research found the following host names that change often: lux-net-ip.as51430.net, nld-net-ip.as51430.net, and swe-net-ip.as51430.net. Maybe they stand for Luxembourg, Netherlands, Sweden? Here is the complete list by ip address, so you can ban all three.

udm.net: Research, Ban

a228.sub72.net78.udm.net passed me a porn referrer address. I do not tolerate referrer spam on my site, so I looked them up.

Observation:
a228.sub72.net78.udm.net 78.85.72.228

Pattern:
Fourth, 85, third, then first octet from the host name. It is essentially a reversed ip, except they omit the second octet, the 85.

Research:
sub182.net71.udm.net 62.109.26.122
sub214.net71.udm.net 62.109.27.150
blago.Udm.net 78.85.0.6
Security.udm.net 78.85.0.25

t4vps.eu Content Spammer: Research, Ban

22110.s.t4vps.eu spammed me. Though they resolved a host name to 194.135.93.53, there was scant info on this host name, so I researched them. I do not see a pattern.

Observation:
22110.s.t4vps.eu host 194.135.93.53

Research:
12927.s.t4vps.eu 79.98.27.251

20951.s.t4vps.eu 109.235.64.29
13769.s.t4vps.eu 109.235.67.32
2857.s.t4vps.eu 109.235.69.177
20895.s.t4vps.eu 109.235.69.253

14223.s.t4vps.eu 185.5.52.22
13060.s.t4vps.eu 185.5.54.228
2993.s.t4vps.eu 185.5.55.83
14913.s.t4vps.eu 185.69.53.149
3955.s.t4vps.eu 185.69.55.222
13924.s.t4vps.eu 185.69.55.62
6v3.f.t4vps.eu 185.81.164.166

91j.f.t4vps.eu 194.135.82.223
11464.s.t4vps.eu 194.135.89.184
16367.s.t4vps.eu 194.135.89.238
6625.s.t4vps.eu 194.135.90.109
12542.s.t4vps.eu 194.135.90.130
10115.s.t4vps.eu 194.135.91.215
5kq.f.t4vps.eu 194.135.92.5
5710.s.t4vps.eu 194.135.92.115
22110.s.t4vps.eu 194.135.93.53
8982.s.t4vps.eu 194.135.93.227
5260.s.t4vps.eu 194.135.94.0

21238.s.t4vps.eu 212.24.99.167
19231.s.t4vps.eu 212.24.105.218
18976.s.t4vps.eu 212.24.107.132
19514.s.t4vps.eu 212.24.110.13
21210.s.t4vps.eu 212.24.111.80

ukservers.com Content Spammer: Research, Ban

no.rdns.ukservers.com content spammed me, so I researched them. They have a sister host name, no.rdns-yet.ukservers.com, with very much the same ip ranges. See for yourself. They are industrious in their use of IPs.

no.rdns.ukservers.com
5.101.138.140 5.101.136.0 – 5.101.151.255 5.101.136.0/21
5.101.142.102
5.101.145.22
5.101.146.130

31.132.3.176 31.132.3.0/24
31.132.3.239

37.9.62.107 37.9.62.0/24
37.9.62.221
37.9.62.36
37.9.62.41
37.9.62.6
37.9.62.96

54.213.200.95

77.74.192.190 77.74.192.0 – 77.74.199.255 77.74.192.0/21
77.74.194.62
77.74.195.112
77.74.196.231

77.75.122.146

78.110.160.140 78.110.160.0 – 78.110.175.255 78.110.160.0/20
78.110.160.234
78.110.169.178
78.110.169.210
78.110.174.241
78.110.175.202

78.157.192.57 78.157.192.0/24
78.157.192.72
94.46.207.1

94.229.65.56 94.229.64.0 – 94.229.81.255 94.229.64.0/20
94.229.65.171
94.229.67.15
94.229.67.16
94.229.67.33
94.229.67.57
94.229.72.115
94.229.72.116
94.229.72.117
94.229.72.135
94.229.74.89
94.229.75.3
94.229.75.9
94.229.76.195
94.229.76.200
94.229.78.60
94.229.79.3

bezeqint.net Content Spammer: Research, Ban

bezeqint.net content spammed me, so naturally I researched them. They are very smart, these Israelis, and employ a variety of anti-bot software techniques, in order to evade identification. Hats off to them for deploying these tactics. I hope they keep up the good work.

Observation:
bzq-80-17-106.red.bezeqint.net 82.80.17.106

Pattern:
This ISP employs 3 patterns, inter-dispersed within their Ip ranges. You need to differentiate between these three or you will ban the incorrect IP range.

  1. red: reverse first 3 octets, add 4th
  2. red, static.dcenter: straight 4 octets
  3. cablep, red: host name has 3 octets, special number for first octet

Research:
bzq-112-168-31-210.red.bezeqint.net 31.168.112.210
bzq-137-168-31-233.red.bezeqint.net 31.168.137.233
bzq-200-168-31-84.red.bezeqint.net 31.168.200.84
bzq-208-168-31-96.red.bezeqint.net 31.168.208.96
bzq-224-168-31-106.red.bezeqint.net 31.168.224.106
bzq-230-168-31-194.red.bezeqint.net 31.168.230.194
bzq-236-168-31-236.red.bezeqint.net 31.168.236.236
bzq-241-168-31-208.red.bezeqint.net 31.168.241.208

reverse.completel.fr: Research, Ban

reverse.completel.fr gave me some error 404s, so I thought to look them up. This research excludes reverse.completel.net. Be careful here because though you could ban the whole /16 range you would exclude a whole bunch of French people, and that would be bad.

46.218.12.177 46.218.0.0 – 46.218.255.255 46.218.0.0/16
46.218.35.112
46.218.35.59
46.218.64.123
46.218.64.98
46.218.67.98
46.218.114.106
46.218.117.246
46.218.119.190
46.218.120.111
46.218.120.111
46.218.120.144
46.218.127.119
46.218.127.119
46.218.127.160
46.218.127.69
46.218.139.182
46.218.139.182
46.218.167.42
46.218.170.154
46.218.170.160
46.218.171.146
46.218.172.227
46.218.177.128
46.218.177.191
46.218.179.51
46.218.179.67
46.218.182.217
46.218.185.90
46.218.199.244
46.218.203.138
46.218.241.188
46.218.241.197
92.103.150.243 92.103.0.0/16
92.103.236.242
92.103.237.151
92.103.247.114
195.167.195.204
213.244.1.41 213.244.0.0/19
213.244.31.213