Slight Harvester Issue , apple-pubsub/65.11

Posted: Sun Nov 08, 2009 1:26 pm

Hi Guys

I am hoping some of you may be able to assist me. I am getting quite a few legit members who are getting banned from my site. They all seem to get banned with the reference to this harvest apple-pubsub/65.11

Code:

Created By: NukeSentinel(tm) 2.6.02


Date &amp; Time: 2009-11-08 13:07:44 CST GMT -0600


Blocked IP: 81.86.131.246


User ID: frankstubbs (116)


Reason: Abuse-Harvest


String Match: apple-pubsub/65.11


--------------------


Referer: none


User Agent: Apple-PubSub/65.11


HTTP Host: [ Only registered users can see links on this board! Get registered or login! ]


Script Name: /modules.php


Query String: name=Feeds&fid=1&type=RSS20


Get String: name=Feeds&fid=1&type=RSS20


Post String: Not Available


Forwarded For: none


Client IP: none


Remote Address: 81.86.131.246


Remote Port: 54707


Request Method: GET


--------------------


Who-Is for IP

As far as I can make out this is some sort of apple feed which sentinel thinks is a hacking attempt.
This particular member accesses my site from his apple i-phone, but I have other members access from there apple macs.

Has anyone else come across this problem before and what can I do about it.
My concern is if I remove this from the harvest list then it will allow this all the time, so there must of been a reason why it was in there in the first place

Thanks for any help in advance

Kenno

Posted: Mon Nov 09, 2009 11:20 pm

You can few the texts being blocked in Nuke Sentinel - Harvester Blocker Settings
You should find one that is blocking a part of "apple-pubsub/65.11"

Posted: Wed Nov 11, 2009 4:25 pm

evaders99 wrote:

You can few the texts being blocked in Nuke Sentinel - Harvester Blocker Settings
You should find one that is blocking a part of "apple-pubsub/65.11"

Sorry how is this done, I can find the Harvester Blocker Settings in sentinel but it does not have anything specific to what is blocking apple-pubsub/65.11

Do you actually know what this harvest is, can it just be removed from the harvester list

Cheers

Posted: Fri Nov 13, 2009 6:31 am

You find the User Agent strings under Harvester Menu --> Display Harvesters and then search for the string or component of the string. You may simple delete that string from the list once you find it.

I cannot find one to match, so I am wondering if you may have banned this User Agent yourself at some point. Regardless, though, it should show up in the list somewhere.

Posted: Fri Nov 13, 2009 6:14 pm

UA Apple-PubSub/65.11 is identified as dictionary attacker by Project Honeypot.

Posted: Fri Nov 13, 2009 7:55 pm

Google says its just an RSS reader for Mac OSX. I don't think its an attacker unless the UA is spoofed

Posted: Sat Nov 14, 2009 8:06 am

I believe I would always check the IP too. Here are a few with this UA:
[ Only registered users can see links on this board! Get registered or login! ]