Security Alert

registered · Worker Joined: Oct 06, 2003 Posts: 108

If you are being indexed by the following site, it may be in your best interest to ban the IPs from access. If you are uncertain, check your logs.

Only registered users can see links on this board! Get registered or login!

This URL resolves to a host in China and if you decide to visit the site, you will be met with a lot of requests to install language files.

Quote:

4 IPs and URLs to search variants of on your site.

218.102.90.9 pcd558009.netvigator.com 2003-10-25 08:11:07 124
219.76.64.4 imsbbcf08.netvigator.com 2003-10-25 08:10:20 16
219.76.64.1 imsbbcf05.netvigator.com 2003-10-25 08:10:12 30
219.76.64.2 imsbbcf06.netvigator.com 2003-10-25 08:08:26 22

Info obtained from their whois entry.

NS3.NETVIGATOR.COM 218.102.23.228
NS4.NETVIGATOR.COM 203.198.7.66

If you ban the IPs in the following manner you should be safe from further problems without banning legitimate users from those IP ranges.

203.198.7.0
218.102.23.0
219.76.64.0

Earlier, I spoke to Raven about this and told him the 219.xxx IP was the most active, but it is the opposite.

The 219.xxx and 203.xxx IPs act like normal bots in the way they index and the 218.xxx seems to compile the information into one string. When looking at it in my raw access logs, each IP indexes a single file and then the file indexed shows up as an extra line in the 218.XXX log.

I have a file containing the entries from these three IPs that is 753k in size to give you an idea of how many files were indexed at my primary site.

Before starting this post I checked my logs and an attempt was made to begin indexing again, but was unsuccessful, . . . thankfully.

Don't know if I am explaining it correctly in computerEZE, but hopefully I am being clear to you on what it's doing.

I'm waiting for a reply from the technical staff of their host in an effort to determine whether this is indeed malicious or a bug in their indexing software.

Presently it doesn't adhere to rules set in robot.txt or .htaccess as it indexed all files currently set as protected.

This bot will access administrative accounts and modules, so please take this seriously.

I would like to think it is a bug in an effort to give everyone a fair chance at enhancing the sites they build, and also to avoid any negative impact this could have on their business and/or site.

Hope you catch this before they get you.

Watch this topic, as I will post any response received from their host.

If anyone else has experienced indexing from them, let us know.

Client Joined: Jul 18, 2003 Posts: 977

I tried to do an IP ban on those three and I was told they were not a valid IP address....

Posted: Fri Oct 31, 2003 9:11 am

How did you attempt to ban them?

Did you use:

Code:

203.198.7.0 


218.102.23.0 


219.76.64.0

or the specific IPs for netvigator.com

Code:

218.102.90.9


219.76.64.4


219.76.64.1


219.76.64.2

Posted: Fri Oct 31, 2003 9:42 am

I used the first three but it was a copy and paste issue. Interesting. I can't copy and paste them into my IP ban but if I type them they are accepted. I should use the first three right? Thanks

Posted: Fri Oct 31, 2003 9:54 am

Yes, as that will prevent all of the netvigator bots from accessing your site.

I am monitoring them to be sure they are the only IPs being used.

Also, I contacted the host of netvigator. Their mail server is either in a loop or they have autoresponders to their autoresponders.... Shocked

I was receiving repeat emails from them stating they are all out of the office until 10/28.... DOH! wasn't that a few days ago.... Finally had to stop their email.

They must be permanently out of office. hee, heee...

Posted: Sun Nov 30, 2003 8:12 am

Is this still an issue Frogger?

Posted: Sun Nov 30, 2003 12:23 pm

After repeated attempts to contact the ISP/Host or reps at Netvigator, no response was ever received, so I have banned all netvigator IPs from my domains.

There have been a couple of attempts from them, but it seems to have stopped.

I'm not the pro here, but if it were a bot you'd think attempts would continue. It may be that they were running it manually?

You're everywhere, huh? Wink