Not overly annoying, secureserver.net is a regular content spammer on my site. I thought it would be good to track them down. Their host names lookup properly and they seem to ban properly, so there seems to not be anything tricky or suspicious.
Observations:
Research:
Permanent link to this post (90 words, 0 images, estimated 22 secs reading time)
bot , Tech ban , ban IP , bot , content scraper , internet security , ip address , pattern , referrer spam , research , secureserver.net , spam , strategy
The whole concept of tor is a sound one, allowing those in repressive or privacy-optional countries (Canada, US) to anonymously use the internet. Unfortunately this anonymity has been hijacked by the spamming community, taking a benevolent tool and using it for ill. Any IP or hostname used for spamming is game for being banned, tor or not.
tor.exit.babylon.network has a network of tor servers that are content spamming me. Normally tor server IPs are stable, so once you ban them they stay banned. These guys move around a bit, and there are a number of them. If you ban a tor server, or any other hostname, and they return to spam again, then you know they evaded your security efforts. You need to do more research.
bot , Tech ban , ban IP , bot , content scraper , internet security , ip address , pattern , referrer spam , research , spam , strategy , tor.exit.babylon.network
as51430.net spammed me, so here is the research for tracking and banning. as51430.net is out of Luxembourg. I did not get spammed by its three sister host names, lux-net-ip.as51430.net, nld-net-ip.as51430.net, and swe-net-ip.as51430.net.
Observation:
91.214.44.48
Research:
bot , Tech ban , ban IP , bot , content scraper , internet security , ip address , lu-customer-ip.as51430.net , lux-net-ip.as51430.net , nld-net-ip.as51430.net , pattern , referrer spam , research , spam , strategy , swe-net-ip.as51430.net
a228.sub72.net78.udm.net passed me a porn referrer address. I do not tolerate referrer spam on my site, so I looked them up.
Observation:
Pattern:
Research:
bot , Tech ban , ban IP , bot , content scraper , internet security , ip address , pattern , referrer spam , research , spam , strategy , udm.net
22110.s.t4vps.eu spammed me. Though they resolved a host name to 194.135.93.53, there was scant info on this host name, so I researched them. I do not see a pattern.
Observation:
Research:
20951.s.t4vps.eu 109.235.64.29
14223.s.t4vps.eu 185.5.52.22
91j.f.t4vps.eu 194.135.82.223
21238.s.t4vps.eu 212.24.99.167
Permanent link to this post (91 words, 0 images, estimated 22 secs reading time)
bot , Tech ban , ban IP , bot , content scraper , internet security , ip address , pattern , research , spam , strategy , t4vps.eu
no.rdns.ukservers.com content spammed me, so I researched them. They have a sister host name, no.rdns-yet.ukservers.com, with very much the same ip ranges. See for yourself. They are industrious in their use of IPs.
no.rdns.ukservers.com
31.132.3.176 31.132.3.0/24
37.9.62.107 37.9.62.0/24
54.213.200.95
77.74.192.190 77.74.192.0 – 77.74.199.255 77.74.192.0/21
77.75.122.146
78.110.160.140 78.110.160.0 – 78.110.175.255 78.110.160.0/20
78.157.192.57 78.157.192.0/24
94.229.65.56 94.229.64.0 – 94.229.81.255 94.229.64.0/20
bot , Tech ban , ban IP , bot , content scraper , internet security , ip address , no.rdns-yet.ukservers.com , no.rdns.ukservers.com , pattern , research , spam , strategy , ukservers.com
bezeqint.net content spammed me, so naturally I researched them. They are very smart, these Israelis, and employ a variety of anti-bot software techniques, in order to evade identification. Hats off to them for deploying these tactics. I hope they keep up the good work.
Observation:
Pattern:
red: reverse first 3 octets, add 4th
red, static.dcenter: straight 4 octets
cablep, red: host name has 3 octets, special number for first octet
Research:
bot , Tech ban , ban IP , bezeqint.net , bot , cablep , content scraper , cust , dcenter , internet security , ip address , pattern , red , research , spam , static , static.dcenter , strategy
reverse.completel.fr gave me some error 404s, so I thought to look them up. This research excludes reverse.completel.net. Be careful here because though you could ban the whole /16 range you would exclude a whole bunch of French people, and that would be bad.
46.218.12.177 46.218.0.0 – 46.218.255.255 46.218.0.0/16
Permanent link to this post (90 words, 0 images, estimated 22 secs reading time)
bot , Tech ban , ban IP , bot , completel.fr , content scraper , internet security , ip address , research , reverse.completel.fr , spam , strategy
ioflood.com piqueted my interest in their novel hostname: we.love.servers.at.ioflood.com. This turned out to be a barrage of IP addresses, something I did not expect.
Observations:
Research:
Permanent link to this post (93 words, 0 images, estimated 22 secs reading time)
bot , Tech ban , ban IP , bot , content scraper , internet security , ioflood.com , ip address , research , spam , strategy , we.love.servers.at.ioflood.com
Voxility has been scraping me for a while and I’ve banned their hostnames, but I could not look up lh27033.voxility.net, so this started the research.
Observation:
Research:
lh17088.voxility.net 39.41.114.93
bot , Tech ban , ban IP , blazingfast.io , bot , content scraper , internet security , ip address , research , spam , strategy , voxility.net
