The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

fuxking webhosting.info how to stop their resolve?

Discussion in 'General Discussion' started by promak, May 12, 2004.

  1. promak

    promak Well-Known Member

    Joined:
    Oct 6, 2001
    Messages:
    248
    Likes Received:
    0
    Trophy Points:
    16
    webhosting.info / whois.sc and some of other same website doing IP > resolve server domain.

    How can we stop this type of website ?

    Now i just block their ip in APF firewall.

    Any idea?
     
  2. web4india

    web4india Registered

    Joined:
    Jul 24, 2002
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    So How do you get those IPs

    Can someone list it here or put the PDF file somewhere so we can download it.

    Regards
    Webmaster
    Web4world
     
  3. easyhoster1

    easyhoster1 Well-Known Member

    Joined:
    Sep 25, 2003
    Messages:
    659
    Likes Received:
    0
    Trophy Points:
    16
    Here ya go;

    ping whois.sc

    Pinging web.nameintel.com [64.246.161.26] with 32 bytes of data:

    Reply from 64.246.161.26: bytes=32 time=153ms TTL=51
    Reply from 64.246.161.26: bytes=32 time=150ms TTL=51
    Reply from 64.246.161.26: bytes=32 time=145ms TTL=51
    Reply from 64.246.161.26: bytes=32 time=149ms TTL=51

    Ping statistics for 64.246.161.26:



    Pinging webhosting.info [66.98.228.74] with 32 bytes of data:

    Reply from 66.98.228.74: bytes=32 time=103ms TTL=50
    Reply from 66.98.228.74: bytes=32 time=98ms TTL=50
    Reply from 66.98.228.74: bytes=32 time=85ms TTL=50
    Reply from 66.98.228.74: bytes=32 time=101ms TTL=50

    Ping statistics for 66.98.228.74:
     
  4. tAzMaNiAc

    tAzMaNiAc Well-Known Member

    Joined:
    Feb 16, 2003
    Messages:
    559
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Sachse, TX
    wouldn't they use other IP's to search your sites.. We may need to find those.
     
  5. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    One way (can take a while):
    Code:
    grep "SurveyBot/2.3 (Whois Source)" /etc/httpd/domlogs/*
    That's the User Agent whois.sc uses - I guess you could just block it in httpd.conf
     
  6. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    OK,

    Just tested this out. Since whois.sc uses a specific User Agent, you can simply use this:

    edit /etc/httpd/conf/access.conf

    change this:
    Code:
    <Directory />
    
    Options Indexes FollowSymLinks ExecCGI Includes
    AllowOverride All
    
    order allow,deny
    allow from all
    
    </Directory>
    to this:
    Code:
    SetEnvIfNoCase User-Agent "^SurveyBot" bad_bot
    <Directory />
    
    Options Indexes FollowSymLinks ExecCGI Includes
    AllowOverride All
    
    order allow,deny
    allow from all
    Deny from env=bad_bot
    
    </Directory>
    
    Reload Apache:

    httpd graceful
     
  7. tAzMaNiAc

    tAzMaNiAc Well-Known Member

    Joined:
    Feb 16, 2003
    Messages:
    559
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Sachse, TX
    Both of my servers have:

    <Directory />
    Options All
    AllowOverride All
    </Directory>


    Are those options better in place than this default All Options?

    Brenden
     
  8. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    It's possible that you have them set elsewhere, if your users aren't having problems I wouldn't change the Options line. Odd that it's different.

    You can still add the other stuff though.
     
  9. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Since they're getting the information from whois which is in the public domain, then yes, they can.
     
  10. SarcNBit

    SarcNBit Well-Known Member

    Joined:
    Oct 14, 2003
    Messages:
    1,010
    Likes Received:
    3
    Trophy Points:
    38
    I have seen whois.sc traffic coming in from multiple IP ranges all owned by Compass Communications Inc..

    The ranges I have seen are:
    64.246.160.0/19
    216.145.0.0/19
    66.228.192.0/19

    It appears that Compass Communication is an ISP/DC, so you may very likely be blocking legitimate traffic if you filter out those ranges. I think following Chirpy's advice would be the way to go if you did not want to block legitimate traffic.

    Specific IPs I have seen in the July:
    64.246.161.42
    64.246.165.10
    64.246.165.190
    64.246.165.200
    64.246.165.210
    66.228.202.22
    66.228.202.122
    216.145.11.94
    216.145.14.142
    216.145.17.190
     
Loading...
Similar Threads - fuxking webhosting info
  1. Yves
    Replies:
    3
    Views:
    297

Share This Page