What are they up to ?

New Member Joined: Jan 16, 2005 Posts: 9

I noticed that a few commercial site were listed as referrers in groups of a dozen+ of them listing the same site.

What are they up to? Are they attempting to hack my site? Have they hacked the sites I end up blocking?

I am using Nuke Sentinel 2.4.2 and PHP-Nuke 7.6 + patched 3.1

I added these sites to the Blocked Referers list and received multiple IP blocks per URL, a dosen or more blocks in less than 4 minutes from the same URL but different IPs. The IPs blocked appear to be unconnected to the URL listed as referred.

Examples of URLs that are doing this:
phentermine-diet-pills.hawaiicity.com
phentermine-1-online.move.to
ddeb.com
texas-poker.islandmix.com
cheap-phentermine-directory.edj.pl
guestbooks.pathfinder.gr/read/diet-pills
online-casino.anyticketusa.com

A detalied listing from one of them:
Blocked IP String Match Date Time

212.78.76.199 ddeb.com 10/9/2005 13:59:56
82.116.145.28 ddeb.com 10/9/2005 13:59:45
82.99.145.226 ddeb.com 10/9/2005 13:59:24
193.230.219.12 ddeb.com 10/9/2005 13:58:59
210.135.97.6 ddeb.com 10/9/2005 13:58:49
210.0.216.227 ddeb.com 10/9/2005 13:58:37
80.25.13.51 ddeb.com 10/9/2005 13:58:01
203.131.80.158 ddeb.com 10/9/2005 13:57:52
217.117.65.20 ddeb.com 10/9/2005 13:57:35
205.238.131.169 ddeb.com 10/9/2005 13:57:25
203.139.135.114 ddeb.com 10/9/2005 13:57:09
24.18.158.154 ddeb.com 10/9/2005 13:56:57
82.233.83.67 ddeb.com 10/9/2005 13:56:58
212.227.60.85 ddeb.com 10/9/2005 13:56:49
200.222.68.39 ddeb.com 10/9/2005 13:56:41

Sells PC To Pay For Divorce Joined: Posts: 5661

no...

The block ..

phentermine-diet-pills.hawaiicity.com
phentermine-1-online.move.to
ddeb.com
texas-poker.islandmix.com
cheap-phentermine-directory.edj.pl
guestbooks.pathfinder.gr/read/diet-pills
online-casino.anyticketusa.com

i do recoqnise them as the same that normaly flooded the blogs by attacking guestbooks.
The meaning of it all is that they try to leave a fake message in your guestbook and put a but of pills and casino website links in it...

no worries...
just block them...

Posted: Mon Oct 10, 2005 12:14 pm

If you have also a blog try Bad Behavior it´s a great tool against spam. Smile

http://www.ioerror.us/software/bad-behavior/

registered · Site Admin Joined: Jun 04, 2004 Posts: 6437

Danke, Susann. Bad Behaviour looks very interesting - have you discussed this with the NukeSentinel team for possible integration or cross-pollenation?

Posted: Mon Oct 10, 2005 6:55 pm

Hallo,

I found Bad Behavior 15 days before and its integrated in my blog.My first thought was it´s similar with Nuke Sentinel and the author said on his website that it works with other CMS too. It´s really a very interesting tool.Of course you can discuss this.

Posted: Tue Oct 11, 2005 9:47 am

Indeed, it would be interesting if someone would port this to PHP-Nuke. I personally am sick and tired of having to constantly add new referrer bans due to the jerks that are trying to improve their search rank by riding my referrer list etc....

Posted: Tue Oct 11, 2005 11:01 am

Constantly new referrers is indeed the big problem. I´m also tired about this.
My referer block is full with casinos,pills and other sh** websites. We have 3 languages. This means we get a lot of international (referrer-)spam. Ever heard about "Hi, from Maria" ?It´s email-spam. If I ever met with her, I would kill "M".