A user blocked and I am not sure why... thank you.

Client Joined: Jul 18, 2003 Posts: 977

I have RavenNuke, latest, and I recently received a blocked abuse email. Can someone tell me what the person did to get this? Thank you.

Code:

Date &amp; Time: 2006-04-17 17:45:01 EDT GMT -0400 Blocked IP: **.***.***.*** User ID: Anonymous (1)


Reason: Abuse-Referer


String Match: xxxx:


--------------------


User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 1.1.4322) 


Query String: www.oblivionfiles.com/index.php


Get String: www.oblivionfiles.com/index.php 


Post String: www.oblivionfiles.com/index.php 


Forwarded For: none 


Client IP: none 


Remote Address: **.***.***.*** 


Remote Port: 3742 


Request Method: GET

Posted: Tue Apr 18, 2006 8:06 am

It sounds like they are listed in your Referrer Blocker in Sentinel

Posted: Tue Apr 18, 2006 8:16 am

Yeah I see the reason but... the IP info I got in the email looks normal. So I am hoping those with Sentinel experience can let me know.

Posted: Tue Apr 18, 2006 8:24 am

I may still be misunderstanding you so please forgive me. You are asking what they did to get banned, correct? If that is indeed the question (and once again forgive me if it isn't) they were banned because they came to your site from a site that you have listed under referrer blocker in Sentinel.

In other words, any time someone clinks a link for your site on one that you have listed in referrer blocker they will get blocked and if you have it set to notify you via email you will of course be notified.

Look in the Sentinel Referrer Blocker list and see if the site you mentioned in your initial post is listed.

If I am misunderstanding your question, would you mind expanding on it just a bit more. Smile

Posted: Tue Apr 18, 2006 8:27 am

It does not list a site that they came from that I can see... and I am using the stock referer list that came from the install...

Posted: Tue Apr 18, 2006 8:41 am

I did misunderstand. Apologies. I just realized that the referring address is your domain. Laughing

The string match that triggered the ban appears to be the xxx which is also listed as the client ip address. Probably the reason for the ban, no logical IP - IP spoofing or masking involved possibly, but since I am uncertain I will quit loading the post with possibilities. Sorry I couldn't help you better. Smile

registered · Posted: Tue Apr 18, 2006 9:04 am

I assume that the poster blocked out the actual IP address

Certain firewalls are designed to surpress referral URLs, thus instead of "http://www.mysite.com" they replace with "xxxx://xxxxxxxxxxx"
My guess is that they are an innocent user - in which case you can remove that specific referral block

Posted: Tue Apr 18, 2006 10:09 am

They could have linked to my site from somewhere and were blocked due to the firewall suppressing the URL to something that is on the referral list? Thank you. And thank you CurtisH for your interest.

Posted: Tue Apr 18, 2006 11:42 am

Yes, your understanding is correct. I know of no abuses through the referral string "xxxx:"

Posted: Tue Apr 18, 2006 11:51 am

I was wondering why it is in the list of blocked referrers?

Posted: Tue Apr 18, 2006 11:57 am

It is a commonly used prefix of spam sites I believe.

Posted: Tue Apr 18, 2006 2:20 pm

"xxx" is usually porn, "xxxx:" though?

Posted: Tue Apr 18, 2006 3:36 pm

evaders99 wrote:

"xxx" is usually porn, "xxxx:" though?

It is in the list as xxxx: