Help catch this spammer

Hangin' Around Joined: Apr 20, 2008 Posts: 29

hmmm... I've been watching this useragent for the last sevaral hours
and amazingly this guys keeps changing the IDs (I know the're all his)
every couple of mins and browse forums, post one (I delete immediatly
now that I see his movements) and change id or simply watch the site..
it's nonstop...
but always the SAME useragent... I don't see anyone else but him under
this...

I'm tempted to block the useragent now..but montego seems to think it
maybe a bad idea right ?

Posted: Fri Apr 25, 2008 6:12 pm

When I click the "Block" icon on the Agent... nothing seems to happen.. Surprised

It takes me back to the same page.. with no indication it's blocked...
Any ideas ?

Worker Joined: Aug 26, 2007 Posts: 236

These lines in .htaccess blocks most people that are behind a proxy. I use this in Sweden and it works very well. Might block some ISP:s from US though that uses proxies like aol.com.

RewriteEngine On

RewriteCond %{HTTP:VIA} !^$ [OR]
RewriteCond %{HTTP:FORWARDED} !^$ [OR]
RewriteCond %{HTTP:USERAGENT_VIA} !^$ [OR]
RewriteCond %{HTTP:X_FORWARDED_FOR} !^$ [OR]
RewriteCond %{HTTP:PROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:XROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]
RewriteCond %{HTTP:HTTP_CLIENT_IP} !^$
RewriteRule ^.* - [F]

Posted: Sat Apr 26, 2008 7:01 am

Kolla check in NukeSentinel admin.php?op=ABConfigHarvester if its blocked.

and here you ´ll find also an interesting list:

http://www.projecthoneypot.org/harvester_useragents.php

Posted: Sun Apr 27, 2008 3:27 pm

Thanks Susann & slackervaara !
Susan, I see that my harvester block is turned off still and that's why it didn't block.
It was added to the list however when I clicked the block icon.
I'll turn this on and also explore the .htaccess options now..

Posted: Mon Apr 28, 2008 4:23 pm

Hi guys, when you use Agent blocking, is there a way to
make an exception say allow a particular IP address to
come in thru the blocked agent ?

Posted: Mon Apr 28, 2008 4:26 pm

I think you could maybe add it to the 'excluded' range Smile

Posted: Mon Apr 28, 2008 4:40 pm

ahh.. Guardian thanks for the tip Dance-Y

Posted: Mon Apr 28, 2008 4:52 pm

Well... looks like I danced too soon... I added the IP to the excluded range..
but it's still getting added to the blocked IP list..

As explained this is coming from the Agent block I have in place.
Why is the excluded range setting not working ? Bang Head

Worker Joined: Nov 22, 2004 Posts: 208 Location: Italy

You gonna put it into the protected range, not excluded.....
Excluded ranges are simply not tracked but they get trapped.

Posted: Fri May 02, 2008 4:58 pm

Thanks Guidyy.. it worked !

BTW, I have good news. I caught the guy.. thanks to NukeSentinel & you guys !!
The lead came from Susann's original idea of Useragent. We knew he was showing
so many IPs from all over the world, and after Susann's suggestion
when I checked I found they're all coming from a unique useragent. We got
lucky there.. coz I didn't see any other member activity on this agent.
I followed his activity for a whole day.. and saw all the user IDs he was
using and posting on the forum etc. I think I mentioned briefly before...
that this guy was posting bad comments about the site and also targeting
another regular member of the site asking her to leave the place etc.

I didn't block the Agent but kept monitoring. Then suddenly to my surprise
the same member who was targeted by this guy showed up on the same
useragent, almost immediately after the other guy logged out.
Anyway.. to make a long story short, it turned out that this was done by
her husband for some personal reasons. He admitted he was using a special
script/device to generate IP #s and apologized to us. (He is an IT guy)

All is well now.. many thanks to all of you for educating me.
I'll be better prepared next time. Very Happy

registered · Posted: Sat May 03, 2008 3:50 pm

Domestic "violence"... the worst kind... Sad

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Unbelievable and so very sad. Glad to hear that you have been able to help her!