Gnutella Forums

Gnutella Forums (https://www.gnutellaforums.com/)
-   New Feature Requests (https://www.gnutellaforums.com/new-feature-requests/)
-   -   New Feature - Block IPs in the Monitor Incoming Searches (https://www.gnutellaforums.com/new-feature-requests/86812-new-feature-block-ips-monitor-incoming-searches.html)

Lord of the Rings March 1st, 2014 09:22 PM

No it doesn't. I know the type of bot you mean, the browse bots. All the ones I found are on the security hostiles blocklist. Countries they mostly come from are USA & Japan. Some will browse every 15 mins. Some will browse only but very soon after you start a new session. Birdy's also noted these kind of bots.
Unlike LW 4 which shows each time they browse you, LW 5 simply only lists them once. I used MacOSX's network console to discover how often they'd been browsing & how long apart.

Such bots have been around for a while. I recall hosts doing that last decade. I initially thought they crashed (due to my large shares) & returned & re-browsed. I eventually woke up to who/what they are.

Lord of the Rings March 2nd, 2014 06:04 AM

Quote:

Originally Posted by Lord of the Rings (Post 373615)
... the security hostiles blocklist. ...

A little off-topic but just thought I'd note this:

When I took over the BearShare hostiles list because it seemed it was not being updated any more, I then considered a similar list for LW. Once I found a way for LW to read it, I changed the format it uses so it uses less memory than the BearShare version.

It did cross my mind to start a list from scratch for LW because it had been suggested in years past the BS one was a little heavy handed. But seemed like a lot of work to do so stuck to a ready made list instead.

I also looked at other blocklists. Both Phex & GTK use the same list which is minimal. But noticed some small differences. For example a small ip sub-range was blocked on BS Hostiles but the Phex version had the opposite end of that range blocked instead. I chuckled. I saw that a few times. I combined that list with the LW one. I also compared to the LW built-in blacklist. I also looked at the Gnucleus blacklist which I think File_Girl put together. That one blocked many world police departments & also music & film production companies & related companies. That sounded appealing to me so I combined it also.
I also looked at the FrostWire hostiles, same format as the BS one. I noticed some differences & incorporated some of those.

As far as police departments go, I discovered one using Phex from USA (twice 9 days apart), a special criminal investigations unit which had a small portion of an ip sub-range allocated to it. Other police dept's I've found were from Melbourne, Sydney, Auckland & somewhere in Portugal. All these added to the LW blacklist. I find it difficult to believe someone working for a police dept. would be using the official connection for casual hobby use-age of the Gnutella network. I think it's best to play it safe when it comes to gnutella users & if they want some protection then this list will at least help.

There's been other suspicious sub-ranges I've blocked due to the multiple users on similar ip's (11-12) connecting to me on multiple occasions. Over 2 years ago, I was uncertain whether they were bots or an organised group of people from Australia & I think Malaysia. (I had snapshots of a couple of these occasions but posted privately.) Example with first number removed: x.98.133.1, x.98.133.2, x.98.133.5, x.98.133.7, x.98.133.16, x.98.133.17, x.98.133.18, x.98.133.21, x.98.133.31, x.98.133.49, x.98.133.50 using FW 4.21.5, MS Windows version. 72 browses or download attempts over 10 min period before I crashed. The LPE pseudo name for the first one listed was AggressiveQual-133.1
Each browsed & several of them downloaded from me (same material.) In retrospect, sounds like bots. ie: Brisbane two occasions, Sydney once, Malaysia once. I mention these ones because they were more local to you. Of course I've mentioned & given examples of other similar bot ranges from USA in the BearShare Hostiles thread & Europe elsewhere. Bots are run from many countries (not referring to proxies.)
[/waffle completed]

Lord of the Rings March 5th, 2014 10:04 PM

Again, a little off-topic. But seems I identified another bot from Europe. Same ip from Belgium. Problem is it's a dynamic address so probably won't add it to the hostiles. Host peers connecting to me with same ip, using LW Music 4.2.0 (multiples) & LimeZilla 2.3.0. No co-relation between ports used. So it could be a difficult one to stop. In general I find Belgium ip's are highly dynamic even when they're supposed to be static. This one via Belgacom Skynet & around late afternoon their time. My LPE was not connected that long, perhaps 2 hrs at most as UP.

sleepybear91 November 10th, 2014 12:50 AM

Still suffering with the Japanese hostiles here. Hoping when I load WS they will be less of a problem

Lord of the Rings January 13th, 2015 03:58 PM

Quote:

Originally Posted by runt66 (Post 373197)
Lemonwire is a clone of limewire ; but members using it should ban and block both ,

65.199.18.150 and 65.199.18.142 ;

they are robots downloading hundreds of songs every hour ; genuine members dont get a fair go ;

The above quoted from another thread in the LW Clone section of the forum.

I realise this has become an old topic but thought I'd give you a heads-up on some blocking in regards to port 7001 hosts. There's a particularly bad group that use the following ip's: 208.103.122.163, 208.103.122.164, 208.103.122.165, 208.103.122.167
If you're using LW 5.3.6, LPE or WireShare then the pseudo-names would be:
NiceReindeer-122-63 and NiceReindeer-122-65, etc.
You can block them individually or use 208.103.122.160/29
That range is in the Hostiles-security block updater for January for LimeWire and will be in the next WireShare version release.
The hosts I've seen were ShareAza but I suspect they probably use multiple different gnutella client programs such as like this.

As it is at present, still trying to prevent that port from being active with WireShare's uploads. At least that port will not be able to connect as a leaf or ultrapeer to WireShare.

runt66 January 15th, 2015 08:31 PM

http://i1186.photobucket.com/albums/...ps290c5dd4.jpg

runt66 January 15th, 2015 08:33 PM

http://i1186.photobucket.com/albums/...psdc55fd4b.jpg

runt66 January 15th, 2015 08:45 PM

This just confirms your last post ;

runt66 January 15th, 2015 08:49 PM

This is one ip address i will be blocking .

Lord of the Rings January 16th, 2015 02:19 AM

Oops yes. Thanks for the confirmation pictures and posts. :) Block all those hosts I listed. The others won't be far away I can assure you. Put 208.103.122.160/29 into your filter blocklist/blacklist will achieve the same thing (it will block a range of 8 sequential addresses starting from 160. Or put in both 208.103.122.163 and 208.103.122.164/30 which will block the next 4 addresses up to 167.)
I had 1.2 million hits from that range over a few days according to my ip blocker. This session it's been 398,479 hits over 16 hours and 48 minutes. I first noticed them whilst using BearShare on the 23rd of last month.
Perhaps this bunch is only using ShareAza.


All times are GMT -7. The time now is 07:26 AM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
SEO by vBSEO 3.6.0 ©2011, Crawlability, Inc.

Copyright © 2020 Gnutella Forums.
All Rights Reserved.