TWiki.org's Black List Log

It happens rarely, but we do get occasional graffiti and other deterrents. The best measure against graffiti is to remove it quickly. See also WikiSpammersOnTWikiSites.

This list is a log of what happened, kind of a record why some folks are on BlackListPlugin's BLACKLIST.

Who (if known) IP addresses used What Date Action taken AmitBaheti, amitbaheti2004 @yahoo.com 61.1.112.118, 61.1.112.178, 61.1.112.183, 61.1.112.194, 61.1.112.196, 61.1.113.49, 202.41.121.132 Replaced Main.WebHome with text hi its amit 2004/09/29 Warned user once, he did it again, so unsubscribed user, put on BLACKLIST, and informed nib_abuse@sancharnetPLEASENOSPAM.in and ranjan@eisPLEASENOSPAM.ernet.in TWikiGuest 205.194.74.10 Deleted content of PeterThoeny's home page 2004/10/18 Put on BLACKLIST, and informed abuse@gcPLEASENOSPAM.ca and hostmaster@gcPLEASENOSPAM.ca TWikiGuest 129.176.151.21 Deleted content of ItemToDo 2004/11/12 Put on BLACKLIST -- and removed on 2005/0405 since there are 50K users behind this mayo.edu TWikiGuest 210.214.190.45 Deleted content of Main.WebHome 2004/11/28 Put on BLACKLIST TWikiGuest 80.146.126.46 Wiki SPAM to adult websites on ItemToDo 2004/12/21 Rolled back rev, put IP address on BLACKLIST AaTaoCai and TomJhon 222.50.120.148 Added Wikispam to Sandbox web and Oregon Wiki 2004/12/31 Removed spam, added to BLACKLIST AsDasdasd 61.149.245.150 Added Wikispam to 15 Sandbox topics 2005/01/20 Removed spam, added to BLACKLIST RellufGerg, gjfuller2k @yahoo.com 198.232.129.38 Removed content on WelcomeGuest 2005/01/28 Removed account (fictitious name and e-mail address), added to BLACKLIST several KellerFs* accounts, cqstudy @yahoo.com.cn, lixu84 @126.com 222.183.118.77 Created several accounts with WikiSpam 2005/01/31 Removed accounts, added to BLACKLIST TWikiGuest 38.144.36.19 Hammering TWiki.org at high rate for whole Jan, 26K times 2005/01/31 Was on BANLIST, added permanently to BLACKLIST TWikiGuest 80.146.121.129 WikiSpam on Sandbox.ItemToDo 2005/02/04 Rolled back topic revison, added IP address to BLACKLIST CoCo, MiMi 221.217.48.121 Fake user accounts with WikiSpam 2005/03/23 Removed accounts, added to BLACKLIST ChinaTour 221.237.5.169, 221.237.3.67 2 fake user accounts with WikiSpam 2005/03/28, 2005/03/29 Removed accounts, added to BLACKLIST ChinaBaby, JiangYonghui 218.87.222.56, 218.87.226.118 Accounts with WikiSpam 2005/03/29, 2005/04/02 Removed accounts, added to BLACKLIST and WikiSpammersOnTWikiSites ShujuhuifuLee 222.248.40.21 2 times accounts with WikiSpam 2005/03/24, 2005/04/04 Removed accounts, added to BLACKLIST and WikiSpammersOnTWikiSites ViewCgi, WiewCgi 221.237.4.138 2 times accounts with WikiSpam 2005/04/04 Removed accounts, added 221.237. to BLACKLIST (third time from this subnet) and WikiSpammersOnTWikiSites ChineseAuction, AustraliaRealEstate 218.19.101.185 2 accounts with WikiSpam 2005/04/06 Removed accounts, added to BLACKLIST and WikiSpammersOnTWikiSites AkaLa 218.109.195.176 Account with WikiSpam on home page, left bar, and Codev topic 2005/04/17 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites YaDoo 222.212.24.100 Account with 232 WikiSpam links on home page 2005/06/07 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites YadooDoo 211.162.162.33 Account with many WikiSpam links on home page 2005/06/07 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites DaaaaGeeeee 222.183.28.21 Account with WikiSpam on home page 2005/07/06 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites StenVens 222.183.31.175 Account with WikiSpam on home page 2005/07/25 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites BobFriskin 70.85.190.46 Added this to TWiki.WebHome: <div style="overflow:auto; height: 1px;"> http://first.myZ.info </div> 2005/08/08 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites DaveParker 70.85.190.46 Added this to Main.WebHome: <div style="overflow:auto; height: 1px;"> [http://accupril-line. allforyourlife.com/accupril] </div> 2005/08/12 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites StenVenrss 222.183.22.32 Account with WikiSpam on home page 2005/08/15 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites SeoCool seocool@126.com 222.183.21.173 Account with WikiSpam on home page 2005/08/23 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites CqhuoGuo 222.183.16.214 Account with WikiSpam on home page 2005/09/01 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites GogoUnitaz and PhantomLord 148.244.150.58 Account with WikiSpam on home page 2005/09/09 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites SeoCoolhuoquo seocool@126.com 222.183.27.175 Account with WikiSpam on home page 2005/09/09 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites SeoCoolhuoquom seocool@126.com 211.158.135.87 Account with WikiSpam on home page 2005/09/26 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites SeoCoolhuoquoz seocool@126.com 211.158.135.87 Account with WikiSpam on home page 2005/09/29 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites WikiAbc abc5460@126.com 221.193.71.116 Spammed 30 user home pages with WikiSpam 2005/09/30 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites Yahoo Slurp 202.160.180. Totally maxing out twiki.org grabbing user topics at 1 hit/sec 2005/10/3 Added to blacklist, with no warning. Removed again after robots.txt fix 5 accounts with ...@dont-explode.com 80.77.80.253 Created 5 accounts with fake user names 2005/10/06 Removed 5 accounts, added to BLACKLIST and WikiSpammersOnTWikiSites SinerAram dor2@ moguntia.kiev.ua 85.202.135.13 Spammed WebHome and TWikiDocumentation 2005/10/07 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites, rolled back spammed topics AiroYang 222.183.20.82 Spammed WelcomeGuest and user home 2005/10/08 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites, rolled back spammed topic CnRambler rambler @meritstore.com 218.2.157.115 Account with WikiSpam on home page 2005/10/20 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites MusaDic nata67@dell.com, PetaGum bila65@dell.com many Created two accounts and spammed over 60 topics using many unique IP addresses 2005/10/21 Removed account, added to WikiSpammersOnTWikiSites MaxSel h0mini@mailPLEASENOSPAM.ru 85.95.169.158 Spammed Main.WebHome with hidden div 2005/10/24 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites, rolled back spammed topic StuartEbeling Stuart @gregorian-c.com 195.175.37.8 Account with WikiSpam gregorian-c.com on home page 2005/11/01 Removed account, added to BLACKLIST and SPAMLIST BrodyGardner Brody @lines-and-dots.org 163.17.64.66 Account with WikiSpam lines-and-dots.org on home page 2005/11/01 Removed account, added to BLACKLIST and SPAMLIST (subsequent IsaiahPair 220.65.209.106 registration attempt with lines-and-dots.org was prevented by SPAMLIST rule as was 83.146.17.60, 202.54.51.5, 24.166.233.179, 202.56.253.183, 203.172.179.61, 200.216.61.154, 200.245.65.25, 193.225.206.221, 195.113.86.130, 211.11.207.66, 209.91.207.161, 62.2.219.18, 195.175.37.38, 207.19.167.21, 193.251.169.170, 61.233.144.118, 200.201.178.58) AlonsoSandel Alonso @gregorian-c.com 216.249.32.17 Account with WikiSpam to gregorian-c.com on home page 2005/11/01 Removed account, added to BLACKLIST and SPAMLIST JustusHouseholder Justus @tea-traditions many 20 accounts with WikiSpam to tea-traditions.org on home page, time 12:47-13:44 GMT 2005/11/03 Removed accounts, added to SPAMLIST many many 12 accounts with spam to johan-gauss.org 2005/11/03 Removed accounts, added to SPAMLIST many many 5 accounts with benign URL to yahoo.com, dell.com, hotmail.com, apache.org trying to spam 100 topics with coolhost.biz 2005/11/04 Removed accounts SunilChoubey 202.54.41.230 Vanadalized some topics 2006/01/19 Removed account, added to BLACKLIST JosefStalin Pyromaniac999 @gmail.com 205.204.242.23 Vanadalized many topics in Codev, TWiki, Sandbox webs 2006/01/20 Removed account, added to BLACKLIST TWikiGuest 60.248.35.77 Added hidden div spam to 40 topics in Support web 2006/02/24 Reverted topic revs, added to BLACKLIST, added www.yp.com, www.pr.com to Local SPAMLIST

• Allow only regular TWiki.org community members to change this log:
  • Set ALLOWTOPICCHANGE = TWikiCommunityGroup

-- PeterThoeny - 30 Sep 2004

I've been looking over the log a bit and I noticed this:

| 05 Feb 2005 - 04:12 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:13 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:13 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:13 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:14 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:14 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:15 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Support.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Support.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | blacklist | Support.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:21 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:21 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:21 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:22 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:22 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |

does that mean that some requests are being honoured whilst others are blacklisted or do they all ultimatly get blacklisted?

• No, one on the banlist, all requests are blocked. For each topic view, the Plugin outputs first the 'blacklist' log entry, makes view sleep for 60 seconds, then outputs the blacklist message and the 'view' log entry. 'blacklist' and 'view log entry are out of sync because of that. -- PTh

-- SamHasler - 05 Feb 2005

Did a google search for "38.144.36.19" (with the quotes) and hit the jackpot. It appears to be a bot that's been hitting RSS feeds of many many blogs and news sites. The company appears to be particularly uncooperative, and most sites ended up doing something like this:

RewriteEngine On
RewriteCond %{REMOTE_ADDR} ^38\.144\.36
RewriteRule (.*) - [F,L]

(note that is supposed to block the subnet; they were changing the IP if they got blocked)

Time we did the same?

-- SamHasler - 06 Feb 2005

Would the rewrite work on SF if put into the cgi-bin's .htaccess?

-- PeterThoeny - 06 Feb 2005

Well I've managed to block everyone (sorry to anyone who saw a forbidden message)

For some reason putting the above into cgi-bin/.htaccess denys access to everyone. I've managed to create a subdirectory under htdocs and denied myself or someone else access so I'm not sure why it didn't work in cgi-bin. Any apache guru's out there know why?

-- SamHasler - 08 Feb 2005

128.172.144.78 has been requesting topics all day, making the site sluggish, looks like it's trying to view every topic.

I've added some deny rules to .htaccess:

<Files "*">
#      allow from all
#      order allow,deny
#      allow from all
# deny badly behaved robots: (example)
#     deny from 123.456.789.0 123.456.789.1 32.102.109.26
      deny from 38.144.36.19 128.172.144.78
      #128.172.144.78    VCU - remove in a couple of days and see if they behave
      #38.144.36.19      AllResearch - see TWiki.BlackListLog
</Files>

That seems to have blocked them because I'm not seeing any more access in twiki's log.

I don't know how much of Virginia Commonwealth University shares that IP so I'll reinstate it tomorrow and see if they behave.

-- SamHasler - 15 Feb 2005

I've let VCU back in. It was nicely behaved bot after all. It was obeying the rules (robots.txt) and only accessing the view script. It doesn't appear to have come back yet though, after an hour of being let back.

-- SamHasler - 15 Feb 2005