Linux-Noob Forums

Quote:znx, you are the script king. :)

 

:)

znx

 

thanks mate

 

i've made the changes and will keep an eye on things

 

well done on this suggestion

 

cheers

anyweb

Quote:thanks mate 

i've made the changes and will keep an eye on things

 

well done on this suggestion

 

yeah well, lets see how this handles, as im sure you are more than aware they could just spam from other names but lets hope that this gives them a kick in the teeth in the meantime....

 

i suppose we should add another ! not referer in case its internal to internal?

 







 

though its not critical... and i doubt it will cause any significant performance gain

i've added 'netcathost.com' to my 'drop packets' rule on smoothwall

 

look here

 

Quote:Top 10 of 15137 Total Sites# Hits Files KBytes Visits Hostname

1 33775 6.91% 33775 8.03% 199524 1.58% 5 0.02% 67-14-171-98.colodns.com

2 33775 6.91% 33775 8.03% 199524 1.58% 5 0.02% colodns.com

3 28972 5.93% 25283 6.01% 828452 6.58% 136 0.50% googlebot.com

4 26927 5.51% 26927 6.40% 0 0.00% 4 0.01% ip177-131.netcathost.com

5 26927 5.51% 26927 6.40% 0 0.00% 4 0.01% netcathost.com

 

yup, that netcathost is the spammer (originator) and not only that, it manged to give me 26000 hits with zero visits registered

 

i'll continue monitoring....

 

cheers

anyweb

unfortunately the actions i have taken so far have not helped (see january's stats listed here... [/url][url=http://linux-noob.com/usage/usage_200601.html#TOPREFS]http://linux-noob.com/usage/usage_200601.html#TOPREFS )

 

so i'm dropping the ips of the spammers directly using iptables on linux-noob.com

 

here are the dropped hosts so far from my rc.firewall

 







 

hopefully this will work...

Quote:

Code:

# Dropped Hosts
iptables -A INPUT -s 66.250.107.0/24 -j DROP # netcathost.com spammers
iptables -A INPUT -s 216.255.181.107 -j DROP # wgostonemantel.com
iptables -A INPUT -s 69.50.188.11 -j DROP # charlestyrrell-ins.com
iptables -A INPUT -s 66.232.101.120 -j DROP # clickobras.com
iptables -A INPUT -s 66.232.101.121 -j DROP # northeastmetrotec.com
iptables -A INPUT -s 216.255.181.110 -j DROP # syperopts.com
iptables -A INPUT -s 216.255.181.109 -j DROP # isdwebstore.com
iptables -A INPUT -s 69.50.188.11 -j DROP # nativealaaskan.net
iptables -A INPUT -s 216.255.181.107 -j DROP # reesehardin.com
iptables -A INPUT -s 69.50.188.13 -j DROP # skateinstrutor.com
iptables -A INPUT -s 66.232.101.122 -j DROP # vicotriajohnson.com

<div>


 

hopefully this will work...

</div>

 

this will not stop referer hits im afraid, i suggested it to stop the user accessing us, referers can be provided by ANY ip....

 

see the access_bad.log this will tell you the IP that the referer hits come from.. drop those instead...

 

;)

bit of discussion in the chan (#linux-noob : efnet) and im wrong..

 

[/url][url=http://linux-noob.com/usage/usage_200601.html#TOPSITES]http://linux-noob.com/usage/usage_200601.html#TOPSITES

 

anyweb is correctly blocking the offending accessing IP not the referer :)

ok now i'm REALLY annoyed

 

these god dam asswipes are at it again

 

see here

 

[/url]http://linux-noob.com/usage/usage_200601.html#TOPREFS

 

Quote:Top 100 of 1257 Total Referrers# Hits Referrer

1 42673 24.42% - (Direct Request)

2 1649 0.94% http:// heraldry2001 com/

3 1649 0.94% http:// mapsforexcellence com

4 1147 0.66% http:// underland-rosow com/

5 1020 0.58% http:// compbiogen com/

6 911 0.52% [url=http://www.google.com/search]http://www.google.com/search

7 735 0.42% http:// charlestyrrell-ins com/

8 728 0.42% http:// wgostonemantel com/

9 721 0.41% http:// clickobras com/

10 721 0.41% http:// northeastmetrotec com/

11 721 0.41% http:// syperopts com/

12 714 0.41% http:// isdwebstore com/

13 714 0.41% http:// nativealaaskan net/

14 714 0.41% http:// reesehardin com/

15 714 0.41% http:// skateinstrutor com/

16 714 0.41% http:// vicotriajohnson com/

17 688 0.39% http:// datascan-inc com/

18 688 0.39% http:// ebayslist com/

19 688 0.39% http:// ibelievejfk com/

20 688 0.39% http:// studisource com/

edit by znx: breaking the urls

 

those DIRTY LOWLIFES are spamming me so much that only two links in the top 20 referrers are REAL

 

that SUCKS. I hate them !!!!!!!!

 

ok, how do i fix it ???????????

 

helppppppppppppppppppppppppppppppppppppppp

 

it seems that 'dropping' the netcathost.com ip in rc.firewall did NOT help !@!

 







 

and based on this

 

Quote:Top 10 of 5614 Total Sites# Hits Files KBytes Visits Hostname

1 15413 8.82% 15413 10.19% 0 0.00% 8 0.09% ip177-131.netcathost.com

2 15413 8.82% 15413 10.19% 0 0.00% 8 0.09% netcathost.com

 

they MUST be the spamming LOOSERS that are causing me this pain.

 

znx, please help, if anyone else has some bright ideas please help

 

this really annoys me....

 

:(

analysis of access_log shows me

 

lots of this

 







 

so i guess that 195.225 ip is the offender ????

 

cheers

 

anyweb

Rev2 !

 







 

nasty referer's be GONE!!!! :)

 

 

Minimal (which might do it)