Tag: strategy

XFone 018.net.il: Research and Banning

My site has been getting content and image scraped by bb-81-107.018.net.il and bb-153-46.018.net.il, but these two host names do not resolve. Furthermore there is very little on the internet on them. My next step is to ban their complete IP range.

Observation:
cust-68.196.102.5.018.net.il 5.102.196.68
CUST-89.242.102.5.018.net.il 5.102.242.89 2017-jan-23
cust-186.224.102.5.018.net.il 5.102.224.186
cust-140.227.102.5.018.net.il 5.102.227.140
cust-151.241.102.5.018.net.il 5.102.241.151
cust-132.255.102.5.018.net.il 5.102.255.132
bb-81-107.018.net.il 94.230.81.107
bb-84-30.018.net.il 94.230.84.30
bb-132-134.018.net.il 188.120.132.134
bb-134-60.018.net.il 188.120.134.60
BB-151-179.018.net.il 188.120.151.179 2017-jan-18
bb-153-46.018.net.il 188.120.153.46
BB-154-107.018.net.il 188.120.154.107 2016-oct-08
141.226.151.47 2016-oct-14

Pattern:
If there are 4 octets in the host name, then reverse the octets. If there are only 2 octets then these are the last 2 of the IP. You will need to use the host command and try the first 2 octets of their common ranges.

IPVNow.com Will Fool Anti-Bot Software

Fool, it would, an automated anti-bot system, because humans are more intelligent than bots. They are innovative, in their evil genius way. Computer security is all about the arms race. The better the methods, the better the counter measures, and then it repeats. No security measure is foolproof for very long.

IPVNow.com has a slew of host names that when you look them up, resolve successfully and all point to the same IP address, 103.224.182.241. This misdirection is what would fool the anti-bot software, because this IP is real and it points to a valid company, Trellian, which owns IPVNow.com. But banning this single IP does not stop the content scraping. Each host name has its own IP address that uses ISPs Ubiquity and Nobis. These are the IPs you need to ban.

customer.worldstream.nl: Banning Content Scraper

This host name is constantly scraping my site, but when I look it up it does not resolve. Searches on Google reveal that they seem to change their IP address very often. Many other sites are getting spammed and content scraped by this host. I have no alternative than to ban the whole IP range of customer.worldstream.nl.

I read my raw access log and the first column provides me with an IP address or host name. This first column is usually enough to target the specific IP that is errant, and I ban the last IP octet of 256 addresses.

Host Names I have Researched, Flummoxed

intra.cea.fr content scraped me, so I researched them.

is005045.intra.cea.fr 10.0.5.45
archie6420.intra.cea.fr 32.166.1.28

napsaci011.intra.cea.fr 132.166.177.50
napsaci012.intra.cea.fr 132.166.177.51
is151991.intra.cea.fr 132.166.118.1

kalahari.intra.cea.fr 132.167.4.137
aster.intra.cea.fr 132.167.197.147

gre018941.intra.cea.fr 132.168.11.11
gre019465.intra.cea.fr 132.168.11.112
gre045998.intra.cea.fr 132.168.11.183
grecfnimon01.intra.cea.fr 132.168.16.105
gre058496-24.intra.cea.fr 132.168.24.180
gre047417.intra.cea.fr 132.168.28.194
gre033069.intra.cea.fr 132.168.30.141
moises.intra.cea.fr 132.168.37.241
gre022491.intra.cea.fr 132.168.65.0
gre035045-160.intra.cea.fr 132.168.160.31

altairnew.intra.cea.fr 132.169.8.1
717rccair5235b.intra.cea.fr 132.169.13.1
aurel.intra.cea.fr 132.169.33.1
celaeno.intra.cea.fr 132.169.11.129

0x667.crypt.gy came back with a host lookup of 94.23.147.30, OVH. I cannot verify this IP address. Research is inconclusive. This guy uses a Microsoft server error code “1639 (0x667). Invalid command line argument” in his hostname.
server.crypt.gy 188.165.211.48

Canadian Tire Weekly Food Specials = Epic Fail

After an epic fail in selling food, will Canadian Tire now sell lingerie? Say it isn't so...

After an epic fail in selling food, will Canadian Tire now sell lingerie? Say it isn't so...

As a long time Canadian I consider it a tradition to shop at Canadian Tire. Unlike Walfart, Crappy Tire is, after all, Canadian. When I need a tool or something for the house I think of Canadian Tire first. This year, I am finding that the products I need are no longer advertised in the CT weekly flyer, and all the stuff I don’t need has taken its place. This has the result of me not visiting the local Crappy Tire as much as I used to, and therefore I am not spending the family’s cash in their stores. Going to the epitome of insanity, CT’s weekly food specials now gets attached to the weekly flyer. As my daughter often says, this is an EPIC FAIL.

Motorcycle Riding Strategy: Aggressive Cautious

Make no mistake that riding a motorcycle here in Toronto is dangerous. Intentionally or not cages (cars) do dangerous things, endangering the life of the motorcyclist. Talking on the phone is especially hazardous to riders. When anyone makes a mistake and there is contact, the motorcyclist will take a trip to the hospital. An interesting motorcycle strategy that is new to me is called aggressive but cautious. Central to this strategy is to ride 20-30kph over the speed limit.

Increasing Efficiency of Drupal 6’s Feed Aggregator

Drupal 6's Feed Aggregator works well

Drupal 6's Feed Aggregator works well


I really love Drupal 6’s feed aggregator. It has the ability to aggregate numerous RSS (Really Simple Sybndication) news or blog feeds, categorize them, and keep them current, all in the effort to save you the trouble of going to each news source and hunting for relevant news. All you have to do is chose a category, read the summary and click the link for the article you what you want.