TWiki.org's Black List Log

It happens rarely, but we do get occasional graffiti and other deterrents. The best measure against graffiti is to remove it quickly. See also WikiSpammersOnTWikiSites.

This list is a log of what happened, kind of a record why some folks are on BlackListPlugin's BLACKLIST.

Who (if known)	IP addresses used	What	Date	Action taken
AmitBaheti, amitbaheti2004 @yahoo.com	61.1.112.118, 61.1.112.178, 61.1.112.183, 61.1.112.194, 61.1.112.196, 61.1.113.49, 202.41.121.132	Replaced Main.WebHome with text hi its amit	2004/09/29	Warned user once, he did it again, so unsubscribed user, put on BLACKLIST, and informed nib_abuse@sancharnetPLEASENOSPAM.in and ranjan@eisPLEASENOSPAM.ernet.in
TWikiGuest	205.194.74.10	Deleted content of PeterThoeny's home page	2004/10/18	Put on BLACKLIST, and informed abuse@gcPLEASENOSPAM.ca and hostmaster@gcPLEASENOSPAM.ca
TWikiGuest	129.176.151.21	Deleted content of ItemToDo	2004/11/12	Put on BLACKLIST -- and removed on 2005/0405 since there are 50K users behind this mayo.edu
TWikiGuest	210.214.190.45	Deleted content of Main.WebHome	2004/11/28	Put on BLACKLIST
TWikiGuest	80.146.126.46	Wiki SPAM to adult websites on ItemToDo	2004/12/21	Rolled back rev, put IP address on BLACKLIST
AaTaoCai and TomJhon	222.50.120.148	Added Wikispam to Sandbox web and Oregon Wiki	2004/12/31	Removed spam, added to BLACKLIST
AsDasdasd	61.149.245.150	Added Wikispam to 15 Sandbox topics	2005/01/20	Removed spam, added to BLACKLIST
RellufGerg, gjfuller2k @yahoo.com	198.232.129.38	Removed content on WelcomeGuest	2005/01/28	Removed account (fictitious name and e-mail address), added to BLACKLIST
several KellerFs* accounts, cqstudy @yahoo.com.cn, lixu84 @126.com	222.183.118.77	Created several accounts with WikiSpam	2005/01/31	Removed accounts, added to BLACKLIST
TWikiGuest	38.144.36.19	Hammering TWiki.org at high rate for whole Jan, 26K times	2005/01/31	Was on BANLIST, added permanently to BLACKLIST
TWikiGuest	80.146.121.129	WikiSpam on Sandbox.ItemToDo	2005/02/04	Rolled back topic revison, added IP address to BLACKLIST
CoCo, MiMi	221.217.48.121	Fake user accounts with WikiSpam	2005/03/23	Removed accounts, added to BLACKLIST
ChinaTour	221.237.5.169, 221.237.3.67	2 fake user accounts with WikiSpam	2005/03/28, 2005/03/29	Removed accounts, added to BLACKLIST
ChinaBaby, JiangYonghui	218.87.222.56, 218.87.226.118	Accounts with WikiSpam	2005/03/29, 2005/04/02	Removed accounts, added to BLACKLIST and WikiSpammersOnTWikiSites
ShujuhuifuLee	222.248.40.21	2 times accounts with WikiSpam	2005/03/24, 2005/04/04	Removed accounts, added to BLACKLIST and WikiSpammersOnTWikiSites
ViewCgi, WiewCgi	221.237.4.138	2 times accounts with WikiSpam	2005/04/04	Removed accounts, added 221.237. to BLACKLIST (third time from this subnet) and WikiSpammersOnTWikiSites
ChineseAuction, AustraliaRealEstate	218.19.101.185	2 accounts with WikiSpam	2005/04/06	Removed accounts, added to BLACKLIST and WikiSpammersOnTWikiSites
AkaLa	218.109.195.176	Account with WikiSpam on home page, left bar, and Codev topic	2005/04/17	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
YaDoo	222.212.24.100	Account with 232 WikiSpam links on home page	2005/06/07	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
YadooDoo	211.162.162.33	Account with many WikiSpam links on home page	2005/06/07	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
DaaaaGeeeee	222.183.28.21	Account with WikiSpam on home page	2005/07/06	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
StenVens	222.183.31.175	Account with WikiSpam on home page	2005/07/25	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
BobFriskin	70.85.190.46	Added this to TWiki.WebHome: <div style="overflow:auto; height: 1px;"> http://first.myZ.info </div>	2005/08/08	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
DaveParker	70.85.190.46	Added this to Main.WebHome: <div style="overflow:auto; height: 1px;"> [http://accupril-line. allforyourlife.com/accupril] </div>	2005/08/12	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
StenVenrss	222.183.22.32	Account with WikiSpam on home page	2005/08/15	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
SeoCool seocool@126.com	222.183.21.173	Account with WikiSpam on home page	2005/08/23	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
CqhuoGuo	222.183.16.214	Account with WikiSpam on home page	2005/09/01	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
GogoUnitaz and PhantomLord	148.244.150.58	Account with WikiSpam on home page	2005/09/09	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
SeoCoolhuoquo seocool@126.com	222.183.27.175	Account with WikiSpam on home page	2005/09/09	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
SeoCoolhuoquom seocool@126.com	211.158.135.87	Account with WikiSpam on home page	2005/09/26	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
SeoCoolhuoquoz seocool@126.com	211.158.135.87	Account with WikiSpam on home page	2005/09/29	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
WikiAbc abc5460@126.com	221.193.71.116	Spammed 30 user home pages with WikiSpam	2005/09/30	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
Yahoo Slurp	202.160.180.	Totally maxing out twiki.org grabbing user topics at 1 hit/sec	2005/10/3	Added to blacklist, with no warning. Removed again after robots.txt fix
5 accounts with ...@dont-explode.com	80.77.80.253	Created 5 accounts with fake user names	2005/10/06	Removed 5 accounts, added to BLACKLIST and WikiSpammersOnTWikiSites
SinerAram dor2@ moguntia.kiev.ua	85.202.135.13	Spammed WebHome and TWikiDocumentation	2005/10/07	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites, rolled back spammed topics
AiroYang	222.183.20.82	Spammed WelcomeGuest and user home	2005/10/08	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites, rolled back spammed topic
CnRambler rambler @meritstore.com	218.2.157.115	Account with WikiSpam on home page	2005/10/20	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites
MusaDic nata67@dell.com, PetaGum bila65@dell.com	many	Created two accounts and spammed over 60 topics using many unique IP addresses	2005/10/21	Removed account, added to WikiSpammersOnTWikiSites
MaxSel h0mini@mailPLEASENOSPAM.ru	85.95.169.158	Spammed Main.WebHome with hidden div	2005/10/24	Removed account, added to BLACKLIST and WikiSpammersOnTWikiSites, rolled back spammed topic
StuartEbeling Stuart @gregorian-c.com	195.175.37.8	Account with WikiSpam gregorian-c.com on home page	2005/11/01	Removed account, added to BLACKLIST and SPAMLIST
BrodyGardner Brody @lines-and-dots.org	163.17.64.66	Account with WikiSpam lines-and-dots.org on home page	2005/11/01	Removed account, added to BLACKLIST and SPAMLIST (subsequent IsaiahPair 220.65.209.106 registration attempt with lines-and-dots.org was prevented by SPAMLIST rule as was 83.146.17.60, 202.54.51.5, 24.166.233.179, 202.56.253.183, 203.172.179.61, 200.216.61.154, 200.245.65.25, 193.225.206.221, 195.113.86.130, 211.11.207.66, 209.91.207.161, 62.2.219.18, 195.175.37.38, 207.19.167.21, 193.251.169.170, 61.233.144.118, 200.201.178.58)
AlonsoSandel Alonso @gregorian-c.com	216.249.32.17	Account with WikiSpam to gregorian-c.com on home page	2005/11/01	Removed account, added to BLACKLIST and SPAMLIST
JustusHouseholder Justus @tea-traditions	many	20 accounts with WikiSpam to tea-traditions.org on home page, time 12:47-13:44 GMT	2005/11/03	Removed accounts, added to SPAMLIST
many	many	12 accounts with spam to johan-gauss.org	2005/11/03	Removed accounts, added to SPAMLIST
many	many	5 accounts with benign URL to yahoo.com, dell.com, hotmail.com, apache.org trying to spam 100 topics with coolhost.biz	2005/11/04	Removed accounts
SunilChoubey	202.54.41.230	Vanadalized some topics	2006/01/19	Removed account, added to BLACKLIST
JosefStalin Pyromaniac999 @gmail.com	205.204.242.23	Vanadalized many topics in Codev, TWiki, Sandbox webs	2006/01/20	Removed account, added to BLACKLIST
TWikiGuest	60.248.35.77	Added hidden div spam to 40 topics in Support web	2006/02/24	Reverted topic revs, added to BLACKLIST, added www.yp.com, www.pr.com to Local SPAMLIST

• Allow only regular TWiki.org community members to change this log:
  • Set ALLOWTOPICCHANGE = TWikiCommunityGroup

-- PeterThoeny - 30 Sep 2004

I've been looking over the log a bit and I noticed this:

| 05 Feb 2005 - 04:12 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:13 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:13 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:13 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:14 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:14 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:15 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Support.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Support.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:16 | Main.TWikiGuest | blacklist | Codev.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | blacklist | Support.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:17 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:18 | Main.TWikiGuest | view | Codev.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | blacklist | Plugins.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Support.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:19 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | view | Plugins.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:20 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:21 | Main.TWikiGuest | blacklist | TWiki.WebRss | /cgi-bin/view | 38.144.36.19 |
| 05 Feb 2005 - 04:21 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:21 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:22 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |
| 05 Feb 2005 - 04:22 | Main.TWikiGuest | view | TWiki.WebRss |  | 38.144.36.19 |

does that mean that some requests are being honoured whilst others are blacklisted or do they all ultimatly get blacklisted?

• No, one on the banlist, all requests are blocked. For each topic view, the Plugin outputs first the 'blacklist' log entry, makes view sleep for 60 seconds, then outputs the blacklist message and the 'view' log entry. 'blacklist' and 'view log entry are out of sync because of that. -- PTh

-- SamHasler - 05 Feb 2005

Did a google search for "38.144.36.19" (with the quotes) and hit the jackpot. It appears to be a bot that's been hitting RSS feeds of many many blogs and news sites. The company appears to be particularly uncooperative, and most sites ended up doing something like this:

RewriteEngine On
RewriteCond %{REMOTE_ADDR} ^38\.144\.36
RewriteRule (.*) - [F,L]

(note that is supposed to block the subnet; they were changing the IP if they got blocked)

Time we did the same?

-- SamHasler - 06 Feb 2005

Would the rewrite work on SF if put into the cgi-bin's .htaccess?

-- PeterThoeny - 06 Feb 2005

Well I've managed to block everyone (sorry to anyone who saw a forbidden message)

For some reason putting the above into cgi-bin/.htaccess denys access to everyone. I've managed to create a subdirectory under htdocs and denied myself or someone else access so I'm not sure why it didn't work in cgi-bin. Any apache guru's out there know why?

-- SamHasler - 08 Feb 2005

128.172.144.78 has been requesting topics all day, making the site sluggish, looks like it's trying to view every topic.

I've added some deny rules to .htaccess:

<Files "*">
#      allow from all
#      order allow,deny
#      allow from all
# deny badly behaved robots: (example)
#     deny from 123.456.789.0 123.456.789.1 32.102.109.26
      deny from 38.144.36.19 128.172.144.78
      #128.172.144.78    VCU - remove in a couple of days and see if they behave
      #38.144.36.19      AllResearch - see TWiki.BlackListLog
</Files>

That seems to have blocked them because I'm not seeing any more access in twiki's log.

I don't know how much of Virginia Commonwealth University shares that IP so I'll reinstate it tomorrow and see if they behave.

-- SamHasler - 15 Feb 2005

I've let VCU back in. It was nicely behaved bot after all. It was obeying the rules (robots.txt) and only accessing the view script. It doesn't appear to have come back yet though, after an hour of being let back.

-- SamHasler - 15 Feb 2005