Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
This forum is locked: you cannot post, reply to, or edit topics.   This topic is locked: you cannot edit posts or make replies.    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel™ v2.5.x
Author Message
kolla
Hangin' Around


Joined: Apr 20, 2008
Posts: 29

PostPosted: Fri Apr 25, 2008 5:56 pm Reply with quote

hmmm... I've been watching this useragent for the last sevaral hours
and amazingly this guys keeps changing the IDs (I know the're all his)
every couple of mins and browse forums, post one (I delete immediatly
now that I see his movements) and change id or simply watch the site..
it's nonstop...
but always the SAME useragent... I don't see anyone else but him under
this...

I'm tempted to block the useragent now..but montego seems to think it
maybe a bad idea right ?
 
View user's profile Send private message
kolla
PostPosted: Fri Apr 25, 2008 6:12 pm Reply with quote

When I click the "Block" icon on the Agent... nothing seems to happen.. Surprised
It takes me back to the same page.. with no indication it's blocked...
Any ideas ?
 
slackervaara
Worker
Worker


Joined: Aug 26, 2007
Posts: 236

PostPosted: Fri Apr 25, 2008 10:51 pm Reply with quote

These lines in .htaccess blocks most people that are behind a proxy. I use this in Sweden and it works very well. Might block some ISP:s from US though that uses proxies like aol.com.

RewriteEngine On

RewriteCond %{HTTP:VIA} !^$ [OR]
RewriteCond %{HTTP:FORWARDED} !^$ [OR]
RewriteCond %{HTTP:USERAGENT_VIA} !^$ [OR]
RewriteCond %{HTTP:X_FORWARDED_FOR} !^$ [OR]
RewriteCond %{HTTP:PROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:XROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]
RewriteCond %{HTTP:HTTP_CLIENT_IP} !^$
RewriteRule ^.* - [F]
 
View user's profile Send private message
Susann
Moderator


Joined: Dec 19, 2004
Posts: 3191
Location: Germany:Moderator German NukeSentinel Support

PostPosted: Sat Apr 26, 2008 7:01 am Reply with quote

Kolla check in NukeSentinel admin.php?op=ABConfigHarvester if its blocked.

and here you ´ll find also an interesting list:
Only registered users can see links on this board! Get registered or login!
 
View user's profile Send private message
kolla
PostPosted: Sun Apr 27, 2008 3:27 pm Reply with quote

Thanks Susann & slackervaara !
Susan, I see that my harvester block is turned off still and that's why it didn't block.
It was added to the list however when I clicked the block icon.
I'll turn this on and also explore the .htaccess options now..
 
kolla
PostPosted: Mon Apr 28, 2008 4:23 pm Reply with quote

Hi guys, when you use Agent blocking, is there a way to
make an exception say allow a particular IP address to
come in thru the blocked agent ?
 
Guardian2003
Site Admin


Joined: Aug 28, 2003
Posts: 6793
Location: Ha Noi, Viet Nam

PostPosted: Mon Apr 28, 2008 4:26 pm Reply with quote

I think you could maybe add it to the 'excluded' range Smile
 
View user's profile Send private message Send e-mail
kolla
PostPosted: Mon Apr 28, 2008 4:40 pm Reply with quote

ahh.. Guardian thanks for the tip Dance-Y
 
kolla
PostPosted: Mon Apr 28, 2008 4:52 pm Reply with quote

Well... looks like I danced too soon... I added the IP to the excluded range..
but it's still getting added to the blocked IP list..

As explained this is coming from the Agent block I have in place.
Why is the excluded range setting not working ? Bang Head
 
guidyy
Worker
Worker


Joined: Nov 22, 2004
Posts: 208
Location: Italy

PostPosted: Mon Apr 28, 2008 10:42 pm Reply with quote

You gonna put it into the protected range, not excluded.....
Excluded ranges are simply not tracked but they get trapped.
 
View user's profile Send private message Visit poster's website MSN Messenger
kolla
PostPosted: Fri May 02, 2008 4:58 pm Reply with quote

Thanks Guidyy.. it worked !

BTW, I have good news. I caught the guy.. thanks to NukeSentinel & you guys !!
The lead came from Susann's original idea of Useragent. We knew he was showing
so many IPs from all over the world, and after Susann's suggestion
when I checked I found they're all coming from a unique useragent. We got
lucky there.. coz I didn't see any other member activity on this agent.
I followed his activity for a whole day.. and saw all the user IDs he was
using and posting on the forum etc. I think I mentioned briefly before...
that this guy was posting bad comments about the site and also targeting
another regular member of the site asking her to leave the place etc.

I didn't block the Agent but kept monitoring. Then suddenly to my surprise
the same member who was targeted by this guy showed up on the same
useragent, almost immediately after the other guy logged out.
Anyway.. to make a long story short, it turned out that this was done by
her husband for some personal reasons. He admitted he was using a special
script/device to generate IP #s and apologized to us. (He is an IT guy)

All is well now.. many thanks to all of you for educating me.
I'll be better prepared next time. Very Happy
 
montego
Site Admin


Joined: Aug 29, 2004
Posts: 9456
Location: Arizona

PostPosted: Sat May 03, 2008 3:50 pm Reply with quote

Domestic "violence"... the worst kind... Sad

_________________
Only registered users can see links on this board! Get registered or login!
Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
Raven
Site Admin/Owner


Joined: Aug 27, 2002
Posts: 17086

PostPosted: Sat May 03, 2008 9:52 pm Reply with quote

Unbelievable and so very sad. Glad to hear that you have been able to help her!
 
View user's profile Send private message
Display posts from previous:       
This forum is locked: you cannot post, reply to, or edit topics.   This topic is locked: you cannot edit posts or make replies.    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel™ v2.5.x

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©