Page 1 of 1
Downtime
Posted: Mon Apr 24, 2006 9:15 am
by snoopdog
Sorry if the board was down this morning, doing our updates we were three behind. Also still trying to get rid of these registration bots. I had 8 to delete this Monday.
Posted: Tue Apr 25, 2006 10:57 am
by Guardfather
Mine was down briefly too about lunch time ... I just thought it was a Lunarpages issue.
Posted: Tue Apr 25, 2006 11:55 am
by snoopdog
Early in the morning it was "us", later in the day Lunar did have a routing issue with AT&T.
Posted: Fri May 19, 2006 10:29 am
by snoopdog
Getting to be a dialy chore deleting these bot guys from our site. I then ban there domains since most of them are not from around here anyway. I just wonder if there is any end.
Here is a list of banned domains to date.
*@online.com
whistleblower_257@hotmail.com
*@online-drugs.com
*@*.ru
*@lavat.info
*@bluebottle.com
*@horseonline.com
*@drugsonline.com
*@gawab.com
*@drugstores.com
*@pharmacy.com
*@temet-nosce.info
*@moyareklama.info
*@pharmacy-xanax.com
*@drugs-online.com
*@buy-plasma-tv.com
*@drugs-pharm-online.com
*@jogox.org
Gunatdorf@gmail.com
*@viagra-drug.com
*@diazepams.com
*@tempori-parce.info
*@horse-racing.com
NEW
*@zolam.com
Posted: Fri May 19, 2006 12:49 pm
by Guardfather
Thanks for all your hard work, I updated mine now.
Posted: Fri May 19, 2006 2:45 pm
by donkeyclubmember
You forgot one
Sickoldfarts.com (gurardbitch)
Posted: Fri May 19, 2006 10:24 pm
by snoopdog
I will just keep this list updated. Also Keith if you edit the database directly you can put the whole batch in at one time.
Posted: Mon May 22, 2006 12:43 pm
by Guardfather
I did ... I put the list in Word® and placed the commas, then dumped the whole thing into the editor. Then I added
www.shortdonkeypenis.com at the bottom, right under
www.tatervillepussies.gov.
Posted: Mon May 22, 2006 3:06 pm
by snoopdog
Two more today, hurray.
Posted: Wed Jun 07, 2006 2:17 pm
by snoopdog
I finally caught the sucker in action today.
Search results for: 84.252.148.8
OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL
ReferralServer: whois://whois.ripe.net:43
NetRange: 84.0.0.0 - 84.255.255.255
CIDR: 84.0.0.0/8
NetName: 84-RIPE
NetHandle: NET-84-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: SUNIC.SUNET.SE
NameServer: TINNIE.ARIN.NET
NameServer: NS3.NIC.FR
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at
http://www.ripe.net/whois
RegDate: 2003-11-17
Updated: 2004-03-16
And you can see in our raw logs his ip address where he skipped the agreed button.
84.252.148.8 - - [07/Jun/2006:00:05:03 -0700] "POST /viewforum.php?f=17&sid=1ca9e1a3b27fb6c71f97b6291512c3<wbr/profile.php?mode=register&agreed=true HTTP/1.1" 200 86898 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en)"
84.252.148.8 - - [07/Jun/2006:00:05:04 -0700] "POST /viewforum.php?f=17&sid=1ca9e1a3b27fb6c71f97b6291512c3<wbr/profile.php?mode=register&agreed=true HTTP/1.1" 411 364 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en)"
Well I banned the I.P. Address Range.
Posted: Wed Jun 07, 2006 4:26 pm
by snoopdog
Oh and look another one.
IP address: 200.47.161.116
Reverse DNS: 200-47-161-116.comsat.net.ar.
Reverse DNS authenticity: [Could be forged: hostname 200-47-161-116.comsat.net.ar. does not exist]
ASN: 7908
ASN Name: LACNIC-7908
IP range connectivity: 1
Registrar (per ASN): ARIN
Country (per IP registrar): AR [Argentina]
Country Currency: ARS [Argentina Pesos]
Country IP Range: 200.47.0.0 to 200.47.255.255
Country fraud profile: Normal
City (per outside source): Unknown
Private (internal) IP? No
IP address registrar: whois.lacnic.net
Known Proxy? No
Link for WHOIS: 200.47.161.116
Posted: Thu Jun 08, 2006 12:09 pm
by Guardfather
Couldn't you just ban the entire range of IPs?
Posted: Thu Jun 08, 2006 4:41 pm
by snoopdog
Yeah but who knows, they could very well be spoofed. Every attempt to stop this has been futile. I am about to the point to tell everyone to deal with the idiots since they do no harm at all. But it is the idea of how low these bottom dwellers are that pisses me off. There is another PHPBB release as of today that may help, just finding time to patch the board is the problem.