[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com

To: tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>
Subject: [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com
From: Markus Koch <niftybunny@xxxxxxxxxxxxxx>
Date: Fri, 28 Oct 2016 05:57:27 +0200
Delivered-to: archiver@xxxxxxxx
Delivery-date: Thu, 27 Oct 2016 23:57:50 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=k3/X7AF+OKJuMs0SsoCsIoLyvJCfJuqRQp0lc1D/2Ug=; b=zr/kpdkK6DPU7E7MX2NXA28aoGDsqUTbXQGFUYeB6mUxNXEPgSIfMxmUl7xq10AdRj 4VVNueAri2Gw1OEc/RZs38+S+M3wwD4A5Mb1RBH3/YgJfdyROPdBNbzlb3cy0lG9F3ZL k2F3zQk6UcY8HaHUdvNkRy4R2NX1AErMun354NgefMR9qQLIPTVDV+XP2v3bdn87FOqU KFdJxs6AT7JP+e1hWF0dxmlLzXckz762GcPQoRIlejIDvjkFgKhKhBKcFd67Qe56Y4LM ZDYoEX4ysrfiL7EbqvweqtnEBiMBZ9rvwdTwUlRdaUlRYIl21nE0Qn0CudCPvtef8FMW hLtw==
List-archive: <http://lists.torproject.org/pipermail/tor-relays/>
List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>
List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>
List-post: <mailto:tor-relays@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>
Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

Getting abuse mass mails on nearly all exist in the last hours:

The following intrusion attempts were detected:

./pilipia/pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:35 -0400]
"GET / HTTP/1.1" 200 5734 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1)
Gecko/20100101 Firefox/7.0.1"
./pilipia/pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:36 -0400]
"GET /?subscribe-email=dlcw87%40hotmail.com&subscribe-submit=Informez-moi&
HTTP/1.1" 200 5734 "http://pilipiak.com/"; "Mozilla/5.0 (Windows NT
5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
./autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:30
-0400] "GET / HTTP/1.1" 200 26737 "-" "Mozilla/5.0 (Windows NT 5.1;
rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
./autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:31
-0400] "GET /search-listing.php?list_search_box=&subscribe=Search&
HTTP/1.1" 200 9280 "http://autoparcs.com/"; "Mozilla/5.0 (Windows NT
5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
./pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:35 -0400] "GET /
HTTP/1.1" 200 5734 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1)
Gecko/20100101 Firefox/7.0.1"
./pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:36 -0400] "GET
/?subscribe-email=dlcw87%40hotmail.com&subscribe-submit=Informez-moi&
HTTP/1.1" 200 5734 "http://pilipiak.com/"; "Mozilla/5.0 (Windows NT
5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
./promoaf/autoparcs.promoafrik.com:188.166.63.113 - -
[27/Oct/2016:00:30:30 -0400] "GET / HTTP/1.1" 200 26737 "-"
"Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
./promoaf/autoparcs.promoafrik.com:188.166.63.113 - -
[27/Oct/2016:00:30:31 -0400] "GET
/search-listing.php?list_search_box=&subscribe=Search& HTTP/1.1" 200
9280 "http://autoparcs.com/"; "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1)
Gecko/20100101 Firefox/7.0.1"
./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
[26/Oct/2016:23:41:12 -0400] "GET
/index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
"-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
Firefox/38.0"
./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
[26/Oct/2016:23:41:16 -0400] "POST
/index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116
"-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36"
./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:00:02:49 -0400] "GET
/index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
"-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
Firefox/38.0"
./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:00:02:51 -0400] "POST
/index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116
"-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36"
./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:10:32:33 -0400] "GET
/index.php?option=com_user&task=activate&activation=e36afd6ab6a066e3485fcd4aedbc74ac
HTTP/1.1" 200 11230 "-" ""
./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:10:32:34 -0400] "GET
/index.php?option=com_user&view=login HTTP/1.1" 200 12349 "-"
"Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/38.0.2125.104 Safari/537.36"
./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:10:32:36 -0400] "POST
/index.php?option=com_user&view=login HTTP/1.1" 200 116
"http://hq-hospitality.com/index.php?option=com_user&view=login";
"Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/38.0.2125.104 Safari/537.36"
./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:10:32:38 -0400] "GET
/index.php?option=com_user&view=user&task=edit HTTP/1.1" 200 25720 "-"
"Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/38.0.2125.104 Safari/537.36"
./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:12:55:40 -0400] "GET
/index.php?option=com_user&task=activate&activation=72ca806c4be186be71e7a5e0316e8681
HTTP/1.1" 200 11230 "-" ""
./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:19:28:56 -0400] "GET
/index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
"-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
Firefox/38.0"
./hqhospitality.hansen-quao.com:188.166.63.113 - -
[26/Oct/2016:23:41:12 -0400] "GET
/index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
"-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
Firefox/38.0"
./hqhospitality.hansen-quao.com:188.166.63.113 - -
[26/Oct/2016:23:41:16 -0400] "POST
/index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116
"-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36"
./hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:00:02:49 -0400] "GET
/index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
"-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
Firefox/38.0"
./hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:00:02:51 -0400] "POST
/index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116
"-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36"
./hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:10:32:33 -0400] "GET
/index.php?option=com_user&task=activate&activation=e36afd6ab6a066e3485fcd4aedbc74ac
HTTP/1.1" 200 11230 "-" ""
./hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:10:32:34 -0400] "GET
/index.php?option=com_user&view=login HTTP/1.1" 200 12349 "-"
"Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/38.0.2125.104 Safari/537.36"
./hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:10:32:36 -0400] "POST
/index.php?option=com_user&view=login HTTP/1.1" 200 116
"http://hq-hospitality.com/index.php?option=com_user&view=login";
"Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/38.0.2125.104 Safari/537.36"
./hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:10:32:38 -0400] "GET
/index.php?option=com_user&view=user&task=edit HTTP/1.1" 200 25720 "-"
"Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/38.0.2125.104 Safari/537.36"
./hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:12:55:40 -0400] "GET
/index.php?option=com_user&task=activate&activation=72ca806c4be186be71e7a5e0316e8681
HTTP/1.1" 200 11230 "-" ""
./hqhospitality.hansen-quao.com:188.166.63.113 - -
[27/Oct/2016:19:28:56 -0400] "GET
/index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
"-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
Firefox/38.0"

Abuse Department
Funio


to stop the mass flood of abuse bot mails I tried to reject the IP
space of funio but Tor is telling me its not allowed. Why?

Markus
_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

Follow-Ups:
- Re: [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com
  - From: Geoff Down
- Re: [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com
  - From: grarpamp
- Re: [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com
  - From: John Ricketts

Prev by Author: Re: [tor-relays] ISP, Abuses , Intrusion Prevention etc.
Next by Author: Re: [tor-relays] Intrusion Prevention System Software - Snort or Suricata
Previous by thread: Re: [tor-relays] Abuses: Suspicious botnet ramnit attack
Next by thread: Re: [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com
Index(es):
- Author
- Thread