Tags:
create new tag
, view all tags
NOTE: This topic is not part of the official TWiki distribution

TWiki.org's Black List Log

It happens rarely, but we do get occasional graffiti and other deterrents. The best measure against graffiti is to remove it quickly. See also WikiSpammersOnTWikiSites.

This list is a log of what happened, kind of a record why some folks are on BlackListPlugin's BLACKLIST.

Who (if known) IP addresses used What Date Action taken
AmitBaheti, amitbaheti2004 @yahoo.com 61.1.112.118, 61.1.112.178, 61.1.112.183, 61.1.112.194, 61.1.112.196, 61.1.113.49, 202.41.121.132 Replaced Main.WebHome with text hi its amit 2004/09/29 Warned user once, he did it again, so unsubscribed user, put on BLACKLIST, and informed nib_abuse@sancharnetPLEASENOSPAM.in and ranjan@eisPLEASENOSPAM.ernet.in
TWikiGuest 205.194.74.10 Deleted content of PeterThoeny's home page 2004/10/18 Put on BLACKLIST, and informed abuse@gcPLEASENOSPAM.ca and hostmaster@gcPLEASENOSPAM.ca
TWikiGuest 129.176.151.21 Deleted content of ItemToDo 2004/11/12 Put on BLACKLIST -- and removed on 2005/0405 since there are 50K users behind this mayo.edu
TWikiGuest 210.214.190.45 Deleted content of Main.WebHome 2004/11/28 Put on BLACKLIST
TWikiGuest 80.146.126.46 Wiki SPAM to adult websites on ItemToDo 2004/12/21 Rolled back rev, put IP address on BLACKLIST
AaTaoCai and TomJhon 222.50.120.148 Added Wikispam to Sandbox web and Oregon Wiki 2004/12/31 Removed spam, added to BLACKLIST
AsDasdasd 61.149.245.150 Added Wikispam to 15 Sandbox topics 2005/01/20 Removed spam, added to BLACKLIST
RellufGerg, gjfuller2k @yahoo.com 198.232.129.38 Removed content on WelcomeGuest 2005/01/28 Removed account (fictitious name and e-mail address), added to BLACKLIST
several KellerFs* accounts, cqstudy @yahoo.com.cn, lixu84 @126.com 222.183.118.77 Created several accounts with WikiSpam 2005/01/31 Removed accounts, added to BLACKLIST
TWikiGuest 38.144.36.19 Hammering TWiki.org at high rate for whole Jan, 26K times 2005/01/31 Was on BANLIST, added permanently to BLACKLIST
TWikiGuest 80.146.121.129 WikiSpam on Sandbox.ItemToDo 2005/02/04 Rolled back topic revison, added IP address to BLACKLIST
CoCo, MiMi 221.217.48.121 Fake user accounts with WikiSpam 2005/03/23 Removed accounts, added to BLACKLIST
ChinaTour 221.237.5.169, 221.237.3.67 2 fake user accounts with WikiSpam 2005/03/28, 2005/03/29 Removed accounts, added to BLACKLIST
ChinaBaby, JiangYonghui 218.87.222.56, 218.87.226.118 Accounts with WikiSpam 2005/03/29, 2005/04/02 Removed accounts, added to BLACKLIST and WikiSpammersOnTWikiSites
ShujuhuifuLee 222.248.40.21 2 times accounts with WikiSpam 2005/03/24, 2005/04/04 Removed accounts, added to BLACKLIST and WikiSpammersOnTWikiSites
ViewCgi, WiewCgi 221.237.4.138 2 times accounts with WikiSpam 2005/04/04 Removed accounts, added 221.237. to BLACKLIST (third time from this subnet) and WikiSpammersOnTWikiSites
ChineseAuction, AustraliaRealEstate 218.19.101.185 2 accounts with WikiSpam 2005/04/06 Removed accounts, added to BLACKLIST and WikiSpammersOnTWikiSites
AkaLa 218.109.195.176 Account with WikiSpam on home page, left bar, and Codev topic 2005/04/17 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
YaDoo 222.212.24.100 Account with 232 WikiSpam links on home page 2005/06/07 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
YadooDoo 211.162.162.33 Account with many WikiSpam links on home page 2005/06/07 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
DaaaaGeeeee 222.183.28.21 Account with WikiSpam on home page 2005/07/06 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
StenVens 222.183.31.175 Account with WikiSpam on home page 2005/07/25 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
BobFriskin 70.85.190.46 Added this to TWiki.WebHome: <div style="overflow:auto; height: 1px;"> http://first.myZ.info </div> 2005/08/08 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
DaveParker 70.85.190.46 Added this to Main.WebHome: <div style="overflow:auto; height: 1px;"> [http://accupril-line. allforyourlife.com/accupril] </div> 2005/08/12 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
StenVenrss 222.183.22.32 Account with WikiSpam on home page 2005/08/15 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
SeoCool seocool@126.com 222.183.21.173 Account with WikiSpam on home page 2005/08/23 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
CqhuoGuo 222.183.16.214 Account with WikiSpam on home page 2005/09/01 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
GogoUnitaz and PhantomLord 148.244.150.58 Account with WikiSpam on home page 2005/09/09 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
SeoCoolhuoquo seocool@126.com 222.183.27.175 Account with WikiSpam on home page 2005/09/09 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
SeoCoolhuoquom seocool@126.com 211.158.135.87 Account with WikiSpam on home page 2005/09/26 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
SeoCoolhuoquoz seocool@126.com 211.158.135.87 Account with WikiSpam on home page 2005/09/29 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
WikiAbc abc5460@126.com 221.193.71.116 Spammed 30 user home pages with WikiSpam 2005/09/30 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
Yahoo Slurp 202.160.180. Totally maxing out twiki.org grabbing user topics at 1 hit/sec 2005/10/3 Added to blacklist, with no warning. Removed again after robots.txt fix
5 accounts with ...@dont-explode.com 80.77.80.253 Created 5 accounts with fake user names 2005/10/06 Removed 5 accounts, added to BLACKLIST and WikiSpammersOnTWikiSites
SinerAram dor2@ moguntia.kiev.ua 85.202.135.13 Spammed WebHome and TWikiDocumentation 2005/10/07 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites, rolled back spammed topics
AiroYang 222.183.20.82 Spammed WelcomeGuest and user home 2005/10/08 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites, rolled back spammed topic
CnRambler rambler @meritstore.com 218.2.157.115 Account with WikiSpam on home page 2005/10/20 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
MusaDic nata67@dell.com, PetaGum bila65@dell.com many Created two accounts and spammed over 60 topics using many unique IP addresses 2005/10/21 Removed account, added to WikiSpammersOnTWikiSites
MaxSel h0mini@mailPLEASENOSPAM.ru 85.95.169.158 Spammed Main.WebHome with hidden div 2005/10/24 Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites, rolled back spammed topic
StuartEbeling Stuart @gregorian-c.com 195.175.37.8 Account with WikiSpam gregorian-c.com on home page 2005/11/01 Removed account, added to BLACKLIST and SPAMLIST
BrodyGardner Brody @lines-and-dots.org 163.17.64.66 Account with WikiSpam lines-and-dots.org on home page 2005/11/01 Removed account, added to BLACKLIST and SPAMLIST (subsequent IsaiahPair 220.65.209.106 registration attempt with lines-and-dots.org was prevented by SPAMLIST rule smile as was 83.146.17.60, 202.54.51.5, 24.166.233.179, 202.56.253.183, 203.172.179.61, 200.216.61.154, 200.245.65.25, 193.225.206.221, 195.113.86.130, 211.11.207.66, 209.91.207.161, 62.2.219.18, 195.175.37.38, 207.19.167.21, 193.251.169.170, 61.233.144.118, 200.201.178.58)
AlonsoSandel Alonso @gregorian-c.com 216.249.32.17 Account with WikiSpam to gregorian-c.com on home page 2005/11/01 Removed account, added to BLACKLIST and SPAMLIST
JustusHouseholder Justus @tea-traditions many 20 accounts with WikiSpam to tea-traditions.org on home page, time 12:47-13:44 GMT 2005/11/03 Removed accounts, added to SPAMLIST
many many 12 accounts with spam to johan-gauss.org 2005/11/03 Removed accounts, added to SPAMLIST
many many 5 accounts with benign URL to yahoo.com, dell.com, hotmail.com, apache.org trying to spam 100 topics with coolhost.biz 2005/11/04 Removed accounts
SunilChoubey 202.54.41.230 Vanadalized some topics 2006/01/19 Removed account, added to BLACKLIST
JosefStalin Pyromaniac999 @gmail.com 205.204.242.23 Vanadalized many topics in Codev, TWiki, Sandbox webs 2006/01/20 Removed account, added to BLACKLIST
TWikiGuest 60.248.35.77 Added hidden div spam to 40 topics in Support web 2006/02/24 Reverted topic revs, added to BLACKLIST, added www.yp.com, www.pr.com to Local SPAMLIST
         

  • Allow only regular TWiki.org community members to change this log:

-- PeterThoeny - 30 Sep 2004

I've been looking over the log a bit and I noticed this:

| 05 Feb 2005 - 04:12 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:13 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:13 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:13 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:14 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:14 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:15 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Support.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Support.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | blacklist | Support.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:21 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:21 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:21 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:22 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:22 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |

does that mean that some requests are being honoured whilst others are blacklisted or do they all ultimatly get blacklisted?

  • No, one on the banlist, all requests are blocked. For each topic view, the Plugin outputs first the 'blacklist' log entry, makes view sleep for 60 seconds, then outputs the blacklist message and the 'view' log entry. 'blacklist' and 'view log entry are out of sync because of that. -- PTh

-- SamHasler - 05 Feb 2005

Did a google search for "38.144.36.19" (with the quotes) and hit the jackpot. It appears to be a bot that's been hitting RSS feeds of many many blogs and news sites. The company appears to be particularly uncooperative, and most sites ended up doing something like this:

RewriteEngine On
RewriteCond %{REMOTE_ADDR} ^38\.144\.36
RewriteRule (.*) - [F,L]

(note that is supposed to block the subnet; they were changing the IP if they got blocked)

Time we did the same?

-- SamHasler - 06 Feb 2005

Would the rewrite work on SF if put into the cgi-bin's .htaccess?

-- PeterThoeny - 06 Feb 2005

Well I've managed to block everyone smile (sorry to anyone who saw a forbidden message)

For some reason putting the above into cgi-bin/.htaccess denys access to everyone. I've managed to create a subdirectory under htdocs and denied myself or someone else access so I'm not sure why it didn't work in cgi-bin. Any apache guru's out there know why?

-- SamHasler - 08 Feb 2005

128.172.144.78 has been requesting topics all day, making the site sluggish, looks like it's trying to view every topic.

I've added some deny rules to .htaccess:

<Files "*">
#      allow from all
#      order allow,deny
#      allow from all
# deny badly behaved robots: (example)
#     deny from 123.456.789.0 123.456.789.1 32.102.109.26
      deny from 38.144.36.19 128.172.144.78
      #128.172.144.78    VCU - remove in a couple of days and see if they behave
      #38.144.36.19      AllResearch - see TWiki.BlackListLog
</Files>

That seems to have blocked them because I'm not seeing any more access in twiki's log.

I don't know how much of Virginia Commonwealth University shares that IP so I'll reinstate it tomorrow and see if they behave.

-- SamHasler - 15 Feb 2005

I've let VCU back in. It was nicely behaved bot after all. It was obeying the rules (robots.txt) and only accessing the view script. It doesn't appear to have come back yet though, after an hour of being let back.

-- SamHasler - 15 Feb 2005

Please use the Support forum if you have questions about TWiki features. This comment section is about the documentation of this topic.
Edit | Attach | Watch | Print version | History: r54 < r53 < r52 < r51 < r50 | Backlinks | Raw View | Raw edit | More topic actions
Topic revision: r54 - 2006-02-25 - PeterThoeny
 
  • Learn about TWiki  
  • Download TWiki
This site is powered by the TWiki collaboration platform Powered by Perl Hosted by OICcam.com Ideas, requests, problems regarding TWiki? Send feedback. Ask community in the support forum.
Copyright © 1999-2017 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.