Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
This forum is locked: you cannot post, reply to, or edit topics.   This topic is locked: you cannot edit posts or make replies.    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel™ v2.4.x
Author Message
blith
Client


Joined: Jul 18, 2003
Posts: 977

PostPosted: Tue Apr 18, 2006 8:00 am Reply with quote

I have RavenNuke, latest, and I recently received a blocked abuse email. Can someone tell me what the person did to get this? Thank you.

Code:
Date & Time: 2006-04-17 17:45:01 EDT GMT -0400 Blocked IP: **.***.***.*** User ID: Anonymous (1)

Reason: Abuse-Referer
String Match: xxxx:
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)
Query String: Only registered users can see links on this board! Get registered or login!
Get String: Only registered users can see links on this board! Get registered or login!
Post String: Only registered users can see links on this board! Get registered or login!
Forwarded For: none
Client IP: none
Remote Address: **.***.***.***
Remote Port: 3742
Request Method: GET
 
View user's profile Send private message Visit poster's website
CurtisH
Life Cycles Becoming CPU Cycles


Joined: Mar 15, 2004
Posts: 638
Location: West Branch, MI

PostPosted: Tue Apr 18, 2006 8:06 am Reply with quote

It sounds like they are listed in your Referrer Blocker in Sentinel
 
View user's profile Send private message Visit poster's website Yahoo Messenger
blith
PostPosted: Tue Apr 18, 2006 8:16 am Reply with quote

Yeah I see the reason but... the IP info I got in the email looks normal. So I am hoping those with Sentinel experience can let me know.
 
CurtisH
PostPosted: Tue Apr 18, 2006 8:24 am Reply with quote

I may still be misunderstanding you so please forgive me. You are asking what they did to get banned, correct? If that is indeed the question (and once again forgive me if it isn't) they were banned because they came to your site from a site that you have listed under referrer blocker in Sentinel.

In other words, any time someone clinks a link for your site on one that you have listed in referrer blocker they will get blocked and if you have it set to notify you via email you will of course be notified.

Look in the Sentinel Referrer Blocker list and see if the site you mentioned in your initial post is listed.

If I am misunderstanding your question, would you mind expanding on it just a bit more. Smile
 
blith
PostPosted: Tue Apr 18, 2006 8:27 am Reply with quote

It does not list a site that they came from that I can see... and I am using the stock referer list that came from the install...
 
CurtisH
PostPosted: Tue Apr 18, 2006 8:41 am Reply with quote

I did misunderstand. Apologies. I just realized that the referring address is your domain. Laughing

The string match that triggered the ban appears to be the xxx which is also listed as the client ip address. Probably the reason for the ban, no logical IP - IP spoofing or masking involved possibly, but since I am uncertain I will quit loading the post with possibilities. Sorry I couldn't help you better. Smile
 
evaders99
Former Moderator in Good Standing


Joined: Apr 30, 2004
Posts: 3221

PostPosted: Tue Apr 18, 2006 9:04 am Reply with quote

I assume that the poster blocked out the actual IP address

Certain firewalls are designed to surpress referral URLs, thus instead of "http://www.mysite.com" they replace with "xxxx://xxxxxxxxxxx"
My guess is that they are an innocent user - in which case you can remove that specific referral block

_________________
- Only registered users can see links on this board! Get registered or login! -

Need help? Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
blith
PostPosted: Tue Apr 18, 2006 10:09 am Reply with quote

They could have linked to my site from somewhere and were blocked due to the firewall suppressing the URL to something that is on the referral list? Thank you. And thank you CurtisH for your interest.
 
evaders99
PostPosted: Tue Apr 18, 2006 11:42 am Reply with quote

Yes, your understanding is correct. I know of no abuses through the referral string "xxxx:"
 
blith
PostPosted: Tue Apr 18, 2006 11:51 am Reply with quote

I was wondering why it is in the list of blocked referrers?
 
CurtisH
PostPosted: Tue Apr 18, 2006 11:57 am Reply with quote

It is a commonly used prefix of spam sites I believe.
 
evaders99
PostPosted: Tue Apr 18, 2006 2:20 pm Reply with quote

"xxx" is usually porn, "xxxx:" though?
 
blith
PostPosted: Tue Apr 18, 2006 3:36 pm Reply with quote

evaders99 wrote:
"xxx" is usually porn, "xxxx:" though?

It is in the list as xxxx:
 
Display posts from previous:       
This forum is locked: you cannot post, reply to, or edit topics.   This topic is locked: you cannot edit posts or make replies.    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel™ v2.4.x

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©