Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel™ v2.6.x
Author Message
kenno
Worker
Worker


Joined: Jul 26, 2009
Posts: 117
Location: Scunthorpe, UK

PostPosted: Sun Nov 08, 2009 1:26 pm Reply with quote

Hi Guys

I am hoping some of you may be able to assist me. I am getting quite a few legit members who are getting banned from my site. They all seem to get banned with the reference to this harvest apple-pubsub/65.11

Code:
Created By: NukeSentinel(tm) 2.6.02

Date & Time: 2009-11-08 13:07:44 CST GMT -0600
Blocked IP: 81.86.131.246
User ID: frankstubbs (116)
Reason: Abuse-Harvest
String Match: apple-pubsub/65.11
--------------------
Referer: none
User Agent: Apple-PubSub/65.11
HTTP Host: Only registered users can see links on this board! Get registered or login!
Script Name: /modules.php
Query String: name=Feeds&fid=1&type=RSS20
Get String: name=Feeds&fid=1&type=RSS20
Post String: Not Available
Forwarded For: none
Client IP: none
Remote Address: 81.86.131.246
Remote Port: 54707
Request Method: GET
--------------------
Who-Is for IP


As far as I can make out this is some sort of apple feed which sentinel thinks is a hacking attempt.
This particular member accesses my site from his apple i-phone, but I have other members access from there apple macs.

Has anyone else come across this problem before and what can I do about it.
My concern is if I remove this from the harvest list then it will allow this all the time, so there must of been a reason why it was in there in the first place

Thanks for any help in advance

Kenno
 
View user's profile Send private message
evaders99
Former Moderator in Good Standing


Joined: Apr 30, 2004
Posts: 3221

PostPosted: Mon Nov 09, 2009 11:20 pm Reply with quote

You can few the texts being blocked in Nuke Sentinel - Harvester Blocker Settings
You should find one that is blocking a part of "apple-pubsub/65.11"

_________________
- Only registered users can see links on this board! Get registered or login! -

Need help? Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
kenno
PostPosted: Wed Nov 11, 2009 4:25 pm Reply with quote

evaders99 wrote:
You can few the texts being blocked in Nuke Sentinel - Harvester Blocker Settings
You should find one that is blocking a part of "apple-pubsub/65.11"


Sorry how is this done, I can find the Harvester Blocker Settings in sentinel but it does not have anything specific to what is blocking apple-pubsub/65.11

Do you actually know what this harvest is, can it just be removed from the harvester list

Cheers
 
montego
Site Admin


Joined: Aug 29, 2004
Posts: 9449
Location: Arizona

PostPosted: Fri Nov 13, 2009 6:31 am Reply with quote

You find the User Agent strings under Harvester Menu --> Display Harvesters and then search for the string or component of the string. You may simple delete that string from the list once you find it.

I cannot find one to match, so I am wondering if you may have banned this User Agent yourself at some point. Regardless, though, it should show up in the list somewhere.

_________________
Only registered users can see links on this board! Get registered or login!
Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
Susann
Moderator


Joined: Dec 19, 2004
Posts: 3191
Location: Germany:Moderator German NukeSentinel Support

PostPosted: Fri Nov 13, 2009 6:14 pm Reply with quote

UA Apple-PubSub/65.11 is identified as dictionary attacker by Project Honeypot.


Last edited by Susann on Sat Nov 14, 2009 7:53 am; edited 1 time in total 
View user's profile Send private message
evaders99
PostPosted: Fri Nov 13, 2009 7:55 pm Reply with quote

Google says its just an RSS reader for Mac OSX. I don't think its an attacker unless the UA is spoofed
 
Susann
PostPosted: Sat Nov 14, 2009 8:06 am Reply with quote

I believe I would always check the IP too. Here are a few with this UA:
Only registered users can see links on this board! Get registered or login!
 
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel™ v2.6.x

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©