Slight Harvester Issue , apple-pubsub/65.11

kenno · Posted: Sun Nov 08, 2009 1:26 pm

Hi Guys

I am hoping some of you may be able to assist me. I am getting quite a few legit members who are getting banned from my site. They all seem to get banned with the reference to this harvest apple-pubsub/65.11

Code:

Created By: NukeSentinel(tm) 2.6.02
Date & Time: 2009-11-08 13:07:44 CST GMT -0600
Blocked IP: 81.86.131.246
User ID: frankstubbs (116)
Reason: Abuse-Harvest
String Match: apple-pubsub/65.11
--------------------
Referer: none
User Agent: Apple-PubSub/65.11
HTTP Host:

Only registered users can see links on this board!
Get registered or login to the forums!

Script Name: /modules.php
Query String: name=Feeds&fid=1&type=RSS20
Get String: name=Feeds&fid=1&type=RSS20
Post String: Not Available
Forwarded For: none
Client IP: none
Remote Address: 81.86.131.246
Remote Port: 54707
Request Method: GET
--------------------
Who-Is for IP

As far as I can make out this is some sort of apple feed which sentinel thinks is a hacking attempt.
This particular member accesses my site from his apple i-phone, but I have other members access from there apple macs.

Has anyone else come across this problem before and what can I do about it.
My concern is if I remove this from the harvest list then it will allow this all the time, so there must of been a reason why it was in there in the first place

Thanks for any help in advance

Kenno

evaders99 · Posted: Mon Nov 09, 2009 11:20 pm

You can few the texts being blocked in Nuke Sentinel - Harvester Blocker Settings
You should find one that is blocking a part of "apple-pubsub/65.11"

kenno · Posted: Wed Nov 11, 2009 4:25 pm

evaders99 wrote:

You can few the texts being blocked in Nuke Sentinel - Harvester Blocker Settings
You should find one that is blocking a part of "apple-pubsub/65.11"

Sorry how is this done, I can find the Harvester Blocker Settings in sentinel but it does not have anything specific to what is blocking apple-pubsub/65.11

Do you actually know what this harvest is, can it just be removed from the harvester list

Cheers

montego · Posted: Fri Nov 13, 2009 6:31 am

You find the User Agent strings under Harvester Menu --> Display Harvesters and then search for the string or component of the string. You may simple delete that string from the list once you find it.

I cannot find one to match, so I am wondering if you may have banned this User Agent yourself at some point. Regardless, though, it should show up in the list somewhere.

Susann · Posted: Fri Nov 13, 2009 6:14 pm

UA Apple-PubSub/65.11 is identified as dictionary attacker by Project Honeypot.

evaders99 · Posted: Fri Nov 13, 2009 7:55 pm

Google says its just an RSS reader for Mac OSX. I don't think its an attacker unless the UA is spoofed

Susann · Posted: Sat Nov 14, 2009 8:06 am

I believe I would always check the IP too. Here are a few with this UA:

Only registered users can see links on this board!
Get registered or login to the forums!