Tag: internet security

tanyadokterkeluarga.blogspot Referrer Spam: Research, Ban

tanyadokterkeluarga.blogspot is a persistent referrer spammer. They use a huge amount of Ip addresses that do not repeat the third octet. It has similar strategies to kosmetik-freaks.blogspot, in fact sharing identical IP ranges. They are sister referrer spammers. Both are not banned by the HTTP_REFERER in htaccess. If you kill one you kill the other, a nice double prize. As with the sister, this spammer runs out of Indonesia.

These are the referrers:
tanyadokterkeluarga.blogspot.ca
tanyadokterkeluarga.blogspot.co.id
tanyadokterkeluarga.blogspot.com
tanyadokterkeluarga.blogspot.in
tanyadokterkeluarga.blogspot.my
tanyadokterkeluarga.blogspot.sg

hvvc.us Content Scraper: Research, Ban

There are some scrapers and there are others that are ridiculous. I just got scraped hard by 209.133.216.182, 209-133-216-182.static.hvvc.us, with 105 server entries and 7 unique user agent names. Excessive, to say the least.

Here are the UA’s used:

Mozilla/5.0 (BlackBerry; U; BlackBerry 9900; en) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.346 Mobile Safari/534.11+
Mozilla/5.0 (compatible; heritrix/3.3.0-SNAPSHOT-20160721-2308 +http://www.exif-search.com)
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Opera/12.02 (Android 4.1; Linux; Opera Mobi/ADR-1111101157; U; en-US) Presto/2.9.201 Version/12.02
UniversalFeedParser/3.3 +http://feedparser.org/
Windows-Media-Player/11.0.5721.5145

209.133.192.0 – 209.133.223.255 209.133.192.0/19
NOC4Hosts, HIvelocity Network

I have sent an email to their ISP, abuse@hivelocity.net.

kosmetik-freaks.blogspot Referrer Spam: Research, Ban

This kosmetik-freaks.blogspot is a referrer spammer that has been harassing me for quite a long time. I have tried to ban them with an HTTP_REFERER ban but this does not work. My ISP, Site5, will not help me. They are predominantly out of Indonesia. They are pret103.47.135.43
103.47.135.50
103.47.135.7
103.47.135.72
too sophisticated to evade my detection for so long.

The sister referrer spammer is tanyadokterkeluarga.blogspot, which uses the identical method and largely shares the same IP ranges. When you kill one you kill the other. Almost all these UAs are mobile devices, leading me to believe these are mobile customers that have downloaded the same spam app.

kwpublisher.com Referrer Spam: Research, Ban

kwpublisher.com is a long-time referrer spammer that I would like to remove. I have tried to ban them with an HTTP_REFERER ban but this does not work. My ISP, Site5, will not help me. This guy seems to have a similar method to kosmetik-freaks.blogspot. They seem to be out of Pakistan mostly, but have gone to Indonesia and China. I am now tracking them closely.

Conclusion: Tracked down the code hotlinking to my site. Complained to their domain names provider. Them they disappeared. Goodbye.

39.42.52.98 x 4 39.32.0.0 – 39.63.255.255 Pakistan Tel

45.32.48.27
45.32.48.27
45.32.48.27

Host Name 0 Zero or localhost in your Raw Access Log

Does your raw access log display a host name of “0”, or zero? Very odd, is it not? I have been struggling with this for a couple of months, and my ISP Site5 had no answers. It turns out that one of my spammers, NFORCE_ENTERTAINMENT, puts an unprintable character into their host table, so that when my ISP looks them up, they display the unprintable character in my log as “0”.

Trying to control your site’s spam can be challenging. If you try to ban an IP that is simply 0, or a host name of “0” you will fail, because there is no zero in their host name, but an unprintable character. Ban these guys instead.

no-ptr.as20860.net Comment Spammer: Research, Ban

no-ptr.as20860.net is a dual Ip spammer with a twist. The originating IP hostname lookup returns three IPs! You’ll need to ban all three, but there’s a lot more. They use IOMart, GB as their ISP.

It seems like this hostname also morphs to numerous IP addresses, making them difficult to track down.

Observation:
no-ptr.as20860.net hostname lookup 62.128.193.135 84.22.161.172 50.97.43.3

Method:
no-ptr.as20860.net not only uses the dual ip spammer strategy, but also changes its host name through many ip addresses, making it double difficult to ban.

fvds.ru Content Spammer: Research, Ban

fvds.ru spammed me, so I researched them. A good portion of their IPs are in the range of 62.109.24.0/24 but there are others. They use a wide variety of names.

Observation:
t-testing.fvds.ru host lookup 62.109.2.78 is bogus. Research revealed 62.109.24.26 and 62.109.24.27.

Research:
tinchurin.fvds.ru 62.109.16.78
info2.fvds.ru 62.109.18.75
dap.fvds.ru 62.109.24.110
zwrk018.fvds.ru 62.109.24.115
esesovets.fvds.ru 62.109.24.132
ensore.fvds.ru 62.109.24.14
camedia.fvds.ru 62.109.24.145
a777825.fvds.ru 62.109.24.157
move.fvds.ru 62.109.24.20
izhirnoff.fvds.ru 62.109.24.215
pool-62.109.24.0.fvds.ru 62.109.24.218
app777.fvds.ru 62.109.24.236
darthspacker.fvds.ru 62.109.24.249
motorspb4.fvds.ru 62.109.24.30
admin15.fvds.ru 62.109.24.35
cyberilya32.fvds.ru 62.109.24.53
merchdist.fvds.ru 62.109.24.61
aachibilyaevyandex.ru.fvds.ru 62.109.24.82
realmyst1.fvds.ru 62.109.24.95
nkryptor.fvds.ru 62.109.29.208
dimys12373.fvds.ru 62.109.31.36
frederick.fvds.ru 62.109.31.91

Mgi.fvds.ru 78.24.219.148
Fvds.ru 78.24.219.165
fakeyoudeadxtv.fvds.ru 78.24.221.1
MMM5.FVDS.RU 82.146.33.242
alosvlad.fvds.ru 82.146.34.229
voloshenko.ilya.fvds.ru 82.146.36.96
exiex.fvds.ru 82.146.38.254
leonid.fvds.ru 91.240.85.23
fdvcxvcxv.fvds.ru 92.63.98.50

static.vdc.vn: Research, Ban

static.vdc.vn is regular content scraper, but it did POST to me and left its IP address. I have been trying to track this one down for a while, but it uses such a wide variety of IP addresses that this is difficult. I could ban large ranges but this would also ban a wide swath of Vietnam, which I do not wish.

Observation:
static.vdc.vn 113.160.112.9 2017-feb-27
static.vdc.vn 113.160.141.120 2016-nov-03
static.vdc.vn 113.160.198.115 2017-jan-14
static.vdc.vn 113.160.248.143 2016-nov-22
static.vdc.vn 113.161.6.96 2016-oct-31
static.vdc.vn 113.161.71.3 2017-jan-18
static.vdc.vn 113.161.77.63
static.vdc.vn 113.161.90.11 2016-dec-27
static.vdc.vn 113.161.162.64 2017-feb-20
dynamic.vdc.vn 113.162.185.98 2016-dec-26
dynamic.vdc.vn 113.163.110.14 2017-jan-30
dynamic.vdc.vn 113.163.202.82
dynamic.vdc.vn 113.163.233.155 2017-jan-23
dynamic.vdc.vn 113.163.241.225 2016-dec-18
dynamic.vdc.com.vn 113.176.61.178 2017-jan-22
dynamic.vdc.vn 113.190.55.36 2016-oct-21
dynamic.vdc.vn 113.190.135.160 2017-feb-08
dynamic.vdc.vn 113.190.202.218 2017-jan-09
dynamic.vdc.vn 113.191.253.253 2016-nov-21
dynamic.vdc.vn 123.24.112.23 2016-nov-25
static.vdc.vn 123.30.238.16 2016-nov-03
static.vdc.vn 123.30.245.239 2016-dec-23
static.vdc.vn host name 203.162.0.78 actual 123.30.75.115

vivawebhost.com: Research, Ban

vivawebhost.com visited me with a “-” user agent, suspicious at best and certainly a bot. Please, identify yourself.

Observation:
lucky.vivawebhost.com h 78.142.63.208

Research:
wanted.vivawebhost.com 72.249.68.129
core.vivawebhost.com 78.128.60.1
lucky.vivawebhost.com 78.142.63.208
gate.vivawebhost.com 78.142.63.244
europe.vivawebhost.com 78.142.63.38
passat.vivawebhost.com 78.142.63.61
passat.vivawebhost.com 78.142.63.63
tesla.vivawebhost.com 78.142.63.64
lion.vivawebhost.com 91.148.168.30
guard.vivawebhost.com 91.148.168.34
Colonel.vivawebhost.com 173.237.189.70
vivawebhost.com 173.237.190.141
fastest.vivawebhost.com 174.136.29.112
junior.vivawebhost.com 174.136.57.185
general.vivawebhost.com 174.136.57.228
dragon.vivawebhost.com 174.136.57.60
fireblade.vivawebhost.com 217.174.148.86

extendcp.co.uk: Research, Ban

extendcp.co.uk had a user agent name of “-” so I thought to look them up and prepare if they attack me.

Observation:
web232.extendcp.co.uk 79.170.40.232

Pattern:
They use the last octet in their host name, but the first three can vary. Three or 4 ip ranges should do for banning.

Research:
web32.extendcp.co.uk 79.170.40.32 79.170.40.0 – 79.170.47.255 Heart Internet
web55.extendcp.co.uk 79.170.40.55
mail158.extendcp.co.uk 79.170.40.158
web227.extendcp.co.uk 79.170.40.227
web38.extendcp.co.uk 79.170.40.38
web95.extendcp.co.uk 79.170.44.95
mail39.extendcp.co.uk 79.170.44.39
web214.extendcp.co.uk 79.170.44.214
web170.extendcp.co.uk 79.170.40.170
web202.extendcp.co.uk 79.170.44.202
web75.extendcp.co.uk 79.170.44.75
mail42.extendcp.co.uk 79.170.44.42
Web93.extendcp.co.uk 79.170.44.93
web127.extendcp.co.uk 79.170.44.127

web26.extendcp.co.uk 176.32.230.26
web252.extendcp.co.uk 176.32.230.252

web62.extendcp.co.uk 217.199.187.62
web58.extendcp.co.uk 217.199.187.58
web59.extendcp.co.uk 217.199.187.59