Tag: strategy

unassigned.psychz.net Comment Spammer: Research, Ban

unassigned.psychz.net spammed me, so I tracked them down. They use a lot of various IP ranges.

They have a hostname lookup of host 199.15.112.8 199.15.112.0 – 199.15.119.255 199.15.112.0/21 but this hostname has been used for so many more IPs.

Research:
23.91.13.35
23.228.228.142

45.35.1.10 45.34.0.0 – 45.35.255.255 45.34.0.0/15
45.34.0.0 – 45.35.105.255 45.35.0.0/18 45.35.64.0/19 45.35.96.0/21 45.35.104.0/23
45.35.71.119
45.35.75.57
45.35.90.36
45.35.90.36
45.35.105.172

66.249.75.140
66.249.75.231

74.117.56.250 74.117.56.0 – 74.117.63.255 74.117.56.0/21
74.117.58.193
74.117.62.54
74.117.62.54

107.160.192.167

108.171.240.170 108.171.240.0 – 108.171.255.255 108.171.240.0/20
108.171.240.86
108.171.240.86
108.171.255.189

173.224.209.59 173.224.208.0 – 173.224.223.255 173.224.208.0/20
173.224.211.52
173.224.218.223
173.224.218.223
173.224.218.83

174.132.240.146

192.168.10.202 192.168.0.0 – 192.168.255.255 192.168.0.0/16

hosted-by.leaseweb.com: Research, Ban

I have had a couple encounters with this spammer, but only one where they left an actual IP for me to ban. The rest I have only the host name, much more difficult to track down.

Research them and you will know they are a formidable entity to track and ban. There is a lot of IP ranges to cover.

Observation:
hosted-by.leaseweb.com confirmed because they spammed me, so I have their IP address
Leaseweb Deutschland
46.165.250.0 – 46.165.251.255
46.165.251.153
hosted-by.leaseweb.com 108.59.8.80
162.210.196.130 hosted-by.leaseweb.com

Leaseweb is scraping with an anon bot called “Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)” and a bot “-”
91.109.16.0 – 91.109.23.255
95.211.142.0 – 95.211.144.255

setaptr.net Content Spammer: Research, Ban

d15f328d.setaptr.net content spammed me, so I thought to look them up and ban them.

Observation:
d15f328d.setaptr.net 209.95.50.141

Pattern:
Convert hex to the IP 4 octets.

Research:
d15f2929.Setaptr.net 209.95.41.41 209.95.32.0 – 209.95.63.255 209.95.32.0/19 Hosting Services
d15f2997.setaptr.net 209.95.41.151
d15f29a4.setaptr.net 209.95.41.164
d15f328d.setaptr.net 209.95.50.141
d15f3237.setaptr.net 209.95.50.55
d15f32af.setaptr.net 209.95.50.175
d15f323c.setaptr.net 209.95.50.60
d15f328e.setaptr.net 209.95.50.142
d15f32a4.setaptr.net 209.95.50.164
d15f3277.setaptr.net 209.95.50.119
d15f326b.setaptr.net 209.95.50.107
d15f325f.setaptr.net 209.95.50.95
d15f3263.setaptr.net 209.95.50.99
d15f325b.setaptr.net 209.95.50.91
d15f325d.setaptr.net 209.95.50.93
d15f320d.setaptr.net 209.95.50.13
d15f33db.setaptr.net 209.95.51.219
d15f33eb.setaptr.net 209.95.51.235

6bb6e4cd.setaptr.net 107.182.228.205 107.182.224.0 – 107.182.239.255 107.182.224.0/20 Hosting Services
6bb6e6c8.setaptr.net 107.182.230.200
6bb6e664.setaptr.net 107.182.230.100
6bb6e60a.setaptr.net 107.182.230.10
6bb6e932.setaptr.net 107.182.233.50

6d7b651c.setaptr.net 109.123.101.28 109.123.101.0 – 109.123.101.255 UK2
6d7b65ab.setaptr.net 109.123.101.171
6d7b65b4.setaptr.net 109.123.101.180
6d7b65e2.setaptr.net 109.123.101.226

static.cmcti.vn: Research, Ban

static.cmcti.vn tried to do some security funny business and was testing my security. I was curious so did research.

static.cmcti.vn is anything but static. In fact there is a lot of research on this host name. It seems this guy has been very active and has changed IPs on a very regular basis.

As Viet Nam is an emerging country I’m unsure about banning large swaths of IP ranges.

Observation:
static.cmcti.vn 183.91.3.182 comment spammed me and I now have a positive IP to ban.
static.cmcti.vn 101.99.23.217 2016-sept-23
101.99.52.242 static.cmcti.vn 2016-oct-19
101.99.11.18 static.cmcti.vn 2016-nov-04
113.20.116.83 static.cmcti.vn 2017-feb-13

best-hosting.simplexhost.net Content Spammer: Research, Ban

best-hosting.simplexhost.net is a prolific content spammer, and a true chameleon, as it changes IP addresses very often. Look up its hostname and you will get 62.210.24.146, but ban this ip or even range and best-hosting.simplexhost.net spamming simply will not stop. This is good for fooling anti-bot engines.

Observed:
62.210.24.146 62.210.0.0 – 62.210.127.255 Iliad is a spoof and has nothing to do with best-hosting.simplexhost.net

Research:
185.89.100.0 185.89.100.0/24 EUNet USA Trusov Ilya Igorevych
185.89.100.7
185.89.100.48
185.89.100.56
185.89.100.56
185.89.100.134
185.89.100.160
185.89.100.181
185.89.100.221
185.89.100.223
185.89.100.231
185.89.100.236
185.89.100.239
185.89.100.248

185.89.101.0 185.89.101.0/24 Moscow Net Trusov Ilya Igorevych
185.89.101.15
185.89.101.27
185.89.101.30
185.89.101.31
185.89.101.43
185.89.101.56
185.89.101.62
185.89.101.80
185.89.101.119
185.89.101.160
185.89.101.163
185.89.101.175
185.89.101.218
185.89.101.218

contabo.host: Research, Ban

contabo.host is a consistent content scraper from Germany. I’ve been banning IPs for a while, so thought it best to go for larger ranges. They are a hosting company, not an ISP. kontrollprozesse.contabo.host, a content spammer, was added 2016 Jul 27, and includes a larger ban range.

Observation:
vmi60316.contabo.host 5.189.137.81
vmi74707.contabo.host 5.189.142.153
vmi76252.contabo.host 5.189.162.103
vmi10785.contabo.host 79.143.180.67
vmi32368.contabo.host 213.136.84.244
m1131.contabo.host 178.238.239.246
kontrollprozesse.contabo.host host command maxed out and returned over 256 entries (2016 Jul 27)

Research:
Vmi37520.contabo.host 5.189.138.84 5.189.128.0 – 5.189.143.255 5.189.128.0/20 CONTABO 5.189.128.0 – 5.189.191.255 5.189.128.0.18
vmi55222.contabo.host 5.189.138.110
vmi53481.contabo.host 5.189.139.214
vmi38740.Contabo.host 5.189.142.182
vmi60944.contabo.host 5.189.153.59 5.189.144.0 – 5.189.159.255 5.189.144.0/20
M3124.contabo.host 5.189.144.124
M3124.contabo.host 5.189.144.124
vmi46878.contabo.host 5.189.155.137
vmi60164.contabo.host 5.189.168.169 5.189.160.0 – 5.189.175.255 5.189.160.0/20
m3506.contabo.host 5.189.173.106
Vmi57182.contabo.host 5.189.177.179 5.189.176.0 – 5.189.191.255 5.189.176.0/20
m0848.contabo.host 5.189.191.40

100tb.com: Research, Ban

92b9149c.lon.100tb.com has content spammed me, so I tracked them down.

Observation:
92b9149c.lon.100tb.com 146.185.20.156

Research:
053f90f5.rdns.100tb.com 5.63.144.245
053f90e4.rdns.100tb.com 5.63.144.228
053f93b4.rdns.100tb.com 5.63.147.180
053f9304.rdns.100tb.com 5.63.147.4
053f95dc.rdns.100tb.com 5.63.149.220
053f96be.rdns.100tb.com 5.63.150.190
053f97cc.rdns.100tb.com 5.63.151.204

2582e0ca.rdns.100tb.com 37.130.224.202
2582e016.rdns.100tb.com 37.130.224.22
2582e3dc.rdns.100tb.com 37.130.227.220
2582e595.rdns.100tb.com 37.130.229.149
2582e595.rdns.100tb.com 37.130.229.149

6bb6e600.lon.100tb.com 107.182.230.54
6bb6ea00.lon.100tb.com 107.182.234.0
6bb6ee00.lon.100tb.com 107.182.238.38

6d7b6501.lon.100tb.com 109.123.101.1

92b91036.rdns.100tb.com 146.185.16.54
92b91a01.rdns.100tb.com 146.185.26.1
92b91b01.rdns.100tb.com 146.185.27.1
92b91b35.rdns.100tb.com 146.185.27.53
92b91b2d.rdns.100tb.com 146.185.27.45
92b91c01.rdns.100tb.com 146.185.28.1
92b91cb2.rdns.100tb.com 146.185.28.178
92b91d01.rdns.100tb.com 146.185.29.1
92b91fd6.rdns.100tb.com 146.185.31.214
92b91fd8.rdns.100tb.com 146.185.31.216
92b91fd8.rdns.100tb.com 146.185.31.216
92b91fda.rdns.100tb.com 146.185.31.218
92b91fd9.rdns.100tb.com 146.185.31.217

b9028b0c.lon.100tb.com 185.2.139.12
b950dc00.lon.100tb.com 185.80.220.0

163data.com.cn Spammer: Research, Ban

163data.com.cn is a very prolific content spammer. While they operate out of Chinanet Fujian Province most of the time, they will take IPs from all over China. You can see the province in their ip address. I get spam from them at least every week, and much more if they have a spam campaign.

I have tried banning their host name but this does not work. You need to ban by IP address, unfortunately.

mediaworksit.net: Research, Ban

free-109-108.mediaworksit.net has tried to crack my security so I thought it appropriate to track them down.

The host name only provides the third and fourth octet, leading one to gues the first two. As they have not repeated the third octet you will need to ban larger ranges.

Observation:
free-109-108.mediaworksit.net

Research:
free-112-5.mediaworksit.net 95.140.112.5 95.140.112.0 – 95.140.127.255 140.112.0/20
free-114-1.mediaworksit.net 95.140.114.0
free-124-110.mediaworksit.net 95.140.124.110
free-125-37.mediaworksit.net 95.140.125.37
free-125-62.mediaworksit.net 95.140.125.62

free-234-154.mediaworksit.net 109.111.234.154 109.111.234.0 – 109.111.237.255 109.111.234.0/22
free-235-194.mediaworksit.net 109.111.235.194

free-144-214.mediaworksit.net 178.254.144.214 178.254.128.0 – 178.254.191.255 178.254.128.0/18
free-148-194.mediaworksit.net 178.254.148.194
free-164-196.mediaworksit.net 178.254.164.196
free-167-14.mediaworksit.net 178.254.167.14
free-246-89.mediaworksit.net 178.253.246.89
free-249-30.mediaworksit.net 178.253.249.30

nullvpn.com: Research, Ban

hoor.nullvpn.com was trying to crack my security, so I thought it good to research and ban them. They are using a VPN, but there are not many IP addresses.

Observed:
hoor.nullvpn.com 128.199.170.45
paladin.nullvpn.com
kodi.nullvpn.com 128.199.103.2
hermod.nullvpn.com 188.166.188.219
cooper.nullvpn.com 128.199.127.59

Research:
Nullvpn.com 104.24.114.17

game.nullvpn.com 116.251.210.113

loki.nullvpn.com 128.199.80.0 128.199.0.0 – 128.199.255.255 DigitalOcean
necro.nullvpn.com 128.199.86.38
aegis.nullvpn.com 128.199.124.10
ra.nullvpn.com 128.199.176.180
tios.nullvpn.com 128.199.194.237
nyx.nullvpn.com 128.199.225.142
kodi.nullvpn.com 128.199.103.2

eros.nullvpn.com 139.59.234.213

free-02.nullvpn.com 149.202.60.72

poseidon.nullvpn.com 188.166.178.67 188.166.0.0 – 188.166.255.255 EU-DIGITALOCEAN
zeus.nullvpn.com 188.166.178.103
demeter.nullvpn.com 188.166.184.105
tyr.nullvpn.com 188.166.184.163
hermod.nullvpn.com 188.166.188.219
float.nullvpn.com 188.166.189.38
dev.nullvpn.com 188.166.190.144