[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com

To: tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>
Subject: Re: [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com
From: Markus Koch <niftybunny@xxxxxxxxxxxxxx>
Date: Fri, 28 Oct 2016 06:08:25 +0200
Delivered-to: archiver@xxxxxxxx
Delivery-date: Fri, 28 Oct 2016 00:08:45 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=p0tzTsviPIrQQ4nv5mNxdwlX7drCRFSA2KK6QvJ40s4=; b=XA+FZ42Ir5Io41xiQN/fFmRmWG0PK9pNRrQU0gT4gmSPahsMmwbYPexejpdBoezDKL BC4ruo5h1ItQLRzVTRf7Ir69jzUFr8OhhO6iW+1aT9T3kWnQL0r87z9LIndnCGqiCXWZ /QaFeQYIEHUDqwFixtgKDS60qKjTaGgLart3lcVbr56PNIfPCXBfwXhJ05NzHM9cErBF n2IN7WFujniYPdQD6uU9RZqhl0i1MmZYhHiJH5rxlMewqaUkMIMbF6+LWBSNmFtogVzD aTKmAjHPFxmig+phTBhS8ycy7BybcJ8YzlF/XhGLqQn+hBWbKVwwbuSuRAJtGuNQvX65 BgEA==
In-reply-to: <CA38EF87-5864-4E5F-A182-8A844EA0B3A2@quintex.com>
List-archive: <http://lists.torproject.org/pipermail/tor-relays/>
List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>
List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>
List-post: <mailto:tor-relays@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>
References: <CALsPhAFWCKoZRh-WvFhOoyjvXQk06wmFYQPTO1MboSEZ4dh6rw@mail.gmail.com> <CA38EF87-5864-4E5F-A182-8A844EA0B3A2@quintex.com>
Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

You cant, Tor will give out a error msg:

Oct 28 07:07:32.653 [warn] Malformed mask on address range
"184.107.0.0/16*"; rejecting.
Oct 28 07:07:32.654 [warn] Couldn't parse line "184.107.0.0/16*". Dropping
Oct 28 07:07:32.654 [warn] Malformed policy 'reject 184.107.0.0/16*'.
Discarding entire policy list.
Oct 28 07:07:32.654 [warn] Failed to parse/validate config: Error in
ExitPolicy entry.
Oct 28 07:07:32.654 [err] Reading config failed--see warnings above.

WTF?


2016-10-28 5:59 GMT+02:00 John Ricketts <john@xxxxxxxxxxx>:
> I am getting them as well.  I haven't blocked yet, are you suggesting we should?
>
>> On Oct 27, 2016, at 22:58, Markus Koch <niftybunny@xxxxxxxxxxxxxx> wrote:
>>
>> Getting abuse mass mails on nearly all exist in the last hours:
>>
>> The following intrusion attempts were detected:
>>
>> ./pilipia/pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:35 -0400]
>> "GET / HTTP/1.1" 200 5734 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1)
>> Gecko/20100101 Firefox/7.0.1"
>> ./pilipia/pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:36 -0400]
>> "GET /?subscribe-email=dlcw87%40hotmail.com&subscribe-submit=Informez-moi&
>> HTTP/1.1" 200 5734 "http://pilipiak.com/"; "Mozilla/5.0 (Windows NT
>> 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
>> ./autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:30
>> -0400] "GET / HTTP/1.1" 200 26737 "-" "Mozilla/5.0 (Windows NT 5.1;
>> rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
>> ./autoparcs.promoafrik.com:188.166.63.113 - - [27/Oct/2016:00:30:31
>> -0400] "GET /search-listing.php?list_search_box=&subscribe=Search&
>> HTTP/1.1" 200 9280 "http://autoparcs.com/"; "Mozilla/5.0 (Windows NT
>> 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
>> ./pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:35 -0400] "GET /
>> HTTP/1.1" 200 5734 "-" "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1)
>> Gecko/20100101 Firefox/7.0.1"
>> ./pilipiak.com:188.166.63.113 - - [27/Oct/2016:18:06:36 -0400] "GET
>> /?subscribe-email=dlcw87%40hotmail.com&subscribe-submit=Informez-moi&
>> HTTP/1.1" 200 5734 "http://pilipiak.com/"; "Mozilla/5.0 (Windows NT
>> 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
>> ./promoaf/autoparcs.promoafrik.com:188.166.63.113 - -
>> [27/Oct/2016:00:30:30 -0400] "GET / HTTP/1.1" 200 26737 "-"
>> "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
>> ./promoaf/autoparcs.promoafrik.com:188.166.63.113 - -
>> [27/Oct/2016:00:30:31 -0400] "GET
>> /search-listing.php?list_search_box=&subscribe=Search& HTTP/1.1" 200
>> 9280 "http://autoparcs.com/"; "Mozilla/5.0 (Windows NT 5.1; rv:7.0.1)
>> Gecko/20100101 Firefox/7.0.1"
>> ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [26/Oct/2016:23:41:12 -0400] "GET
>> /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
>> "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
>> Firefox/38.0"
>> ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [26/Oct/2016:23:41:16 -0400] "POST
>> /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116
>> "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36
>> (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36"
>> ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:00:02:49 -0400] "GET
>> /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
>> "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
>> Firefox/38.0"
>> ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:00:02:51 -0400] "POST
>> /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116
>> "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36
>> (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36"
>> ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:10:32:33 -0400] "GET
>> /index.php?option=com_user&task=activate&activation=e36afd6ab6a066e3485fcd4aedbc74ac
>> HTTP/1.1" 200 11230 "-" ""
>> ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:10:32:34 -0400] "GET
>> /index.php?option=com_user&view=login HTTP/1.1" 200 12349 "-"
>> "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
>> like Gecko) Chrome/38.0.2125.104 Safari/537.36"
>> ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:10:32:36 -0400] "POST
>> /index.php?option=com_user&view=login HTTP/1.1" 200 116
>> "http://hq-hospitality.com/index.php?option=com_user&view=login";
>> "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
>> like Gecko) Chrome/38.0.2125.104 Safari/537.36"
>> ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:10:32:38 -0400] "GET
>> /index.php?option=com_user&view=user&task=edit HTTP/1.1" 200 25720 "-"
>> "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
>> like Gecko) Chrome/38.0.2125.104 Safari/537.36"
>> ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:12:55:40 -0400] "GET
>> /index.php?option=com_user&task=activate&activation=72ca806c4be186be71e7a5e0316e8681
>> HTTP/1.1" 200 11230 "-" ""
>> ./hansenq/hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:19:28:56 -0400] "GET
>> /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
>> "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
>> Firefox/38.0"
>> ./hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [26/Oct/2016:23:41:12 -0400] "GET
>> /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
>> "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
>> Firefox/38.0"
>> ./hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [26/Oct/2016:23:41:16 -0400] "POST
>> /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116
>> "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36
>> (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36"
>> ./hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:00:02:49 -0400] "GET
>> /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
>> "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
>> Firefox/38.0"
>> ./hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:00:02:51 -0400] "POST
>> /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 116
>> "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36
>> (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36"
>> ./hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:10:32:33 -0400] "GET
>> /index.php?option=com_user&task=activate&activation=e36afd6ab6a066e3485fcd4aedbc74ac
>> HTTP/1.1" 200 11230 "-" ""
>> ./hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:10:32:34 -0400] "GET
>> /index.php?option=com_user&view=login HTTP/1.1" 200 12349 "-"
>> "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
>> like Gecko) Chrome/38.0.2125.104 Safari/537.36"
>> ./hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:10:32:36 -0400] "POST
>> /index.php?option=com_user&view=login HTTP/1.1" 200 116
>> "http://hq-hospitality.com/index.php?option=com_user&view=login";
>> "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
>> like Gecko) Chrome/38.0.2125.104 Safari/537.36"
>> ./hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:10:32:38 -0400] "GET
>> /index.php?option=com_user&view=user&task=edit HTTP/1.1" 200 25720 "-"
>> "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML,
>> like Gecko) Chrome/38.0.2125.104 Safari/537.36"
>> ./hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:12:55:40 -0400] "GET
>> /index.php?option=com_user&task=activate&activation=72ca806c4be186be71e7a5e0316e8681
>> HTTP/1.1" 200 11230 "-" ""
>> ./hqhospitality.hansen-quao.com:188.166.63.113 - -
>> [27/Oct/2016:19:28:56 -0400] "GET
>> /index.php?option=com_user&view=register&Itemid=2 HTTP/1.1" 200 17902
>> "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
>> Firefox/38.0"
>>
>> Abuse Department
>> Funio
>>
>>
>> to stop the mass flood of abuse bot mails I tried to reject the IP
>> space of funio but Tor is telling me its not allowed. Why?
>>
>> Markus
>> _______________________________________________
>> tor-relays mailing list
>> tor-relays@xxxxxxxxxxxxxxxxxxxx
>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
> _______________________________________________
> tor-relays mailing list
> tor-relays@xxxxxxxxxxxxxxxxxxxx
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

References:
- [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com
  - From: Markus Koch
- Re: [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com
  - From: John Ricketts

Prev by Author: Re: [tor-relays] You dont love me anymore :(
Next by Author: Re: [tor-relays] Intrusion Prevention System Software - Snort or Suricata
Previous by thread: Re: [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com
Next by thread: Re: [tor-relays] ExitPolicy reject 184.107.0.0/16* funio.com
Index(es):
- Author
- Thread