WMW Blocklist

[Blitzen]

What are all the "Temp"  ips being added to the wmw blocklist recently ?

[Bluey_412]

What are all the "Temp"  ips being added to the wmw blocklist recently ?

IP Adresses, of course...

[Blitzen]

Prat ..........

Asking what is being blocked from your winmx via the wmw patch is not an unreasonable question, whereas some blocked ips clearly state who they belong to i.e media defender, there now appears several ips being blocked being identified only as being "Temp" ?

[']['affy]

due to the recent activity we've had to block certain ip's on a temporary basis reason it showing as "temp" untill we investigate this more fully, we can't disclose any further info.

and blitzen please refrain from name calling on the site.

[Blitzen]

Thankyou Taffy,
so the temp ips are being blocked before being investigated as to who they belong to, so innocent users could be being blocked ?   it only takes a second to put an ip into whois  domain name lookup............. but i guess the blocking wmw team can see enough going on to warrant adding these temp isp to the blocklist.

[']['affy]

no innocent ppl are being blocked yet bud and yes the team behind the blocking is doing a terrific job once there is more info i'm sure there will be another post made blitzen.

[GhostShip]

To clarify this matter the IP's or IP ranges being blocked are in use by or have been in use recently by attackers, as you can guess they like to try to bypass our detection system and find new ways to attack the network and the blocking teams job is to foil them, in some cases the attackers have access to consumer range addresses and we cant block those either as a range or permanently so its a game of cat and mouse to block temporarily the IPs they use and we simply have to be faster than them to win.

Have some faith Blitzen, there is no malicious blocking going on only cold clinical countermeasures to halt any detected attacks, unlike some organisations we dont claim to block attackers before they attack, such claims are I think usually put forward by those who want to block 1.0.0.0 - 255.255.255.255 just in case aliens attack 

[Pri]

Yeah it is doubtful that these "temp" IP's are innocent users. What likely happened was these IP Addresses were seen making unusually high (automated) search queries on the network and were suspected of data mining and thus blocked.

The ones in the blocklist are as follows

Temp          :220.100.115.30-220.100.115.30
Temp          :113.197.195.241-113.197.195.241
Temp          :193.197.192.68-193.197.192.68
Temp          :220.210.177.126-220.210.177.126
Temp          :113.197.209.190-113.197.209.190
Temp          :219.111.118.66-219.111.118.66
Temp 13/07/10       :121.102.0.0-121.102.255.255
Temp 13/07/10       :220.100.0.0-220.100.255.255

The last two are dated obviously.

The first IP looks to be in Japan, it is not listed in any of the common blocking lists and Google comes up with no listings for it either. I haven't checked the other IP's as I'm a little busy right now but there they are for others to check out

[Blitzen]

I wasnt suspecting anything malicious ghostie me ole mukka i was more curious as to what the "temp" blocked ips were and now it has been explained i can appreciate that if they team see them doing obscure things on the network then blocking them is a good course of action

[Max™]

Yeah it is doubtful that these "temp" IP's are innocent users. What likely happened was these IP Addresses were seen making unusually high (automated) search queries on the network and were suspected of data mining and thus blocked.

The ones in the blocklist are as follows

Temp          :220.100.115.30-220.100.115.30
Temp          :113.197.195.241-113.197.195.241
Temp          :193.197.192.68-193.197.192.68
Temp          :220.210.177.126-220.210.177.126
Temp          :113.197.209.190-113.197.209.190
Temp          :219.111.118.66-219.111.118.66
Temp 13/07/10       :121.102.0.0-121.102.255.255
Temp 13/07/10       :220.100.0.0-220.100.255.255

The last two are dated obviously.

The first IP looks to be in Japan, it is not listed in any of the common blocking lists and Google comes up with no listings for it either. I haven't checked the other IP's as I'm a little busy right now but there they are for others to check out

Temp          :220.100.115.30-220.100.115.30 - Japan
Temp          :113.197.195.241-113.197.195.241 - japan
Temp          :193.197.192.68-193.197.192.68 - Germany
Temp          :220.210.177.126-220.210.177.126 - Japan
Temp          :113.197.209.190-113.197.209.190 - Japan
Temp          :219.111.118.66-219.111.118.66 - Japan
Temp 13/07/10       :121.102.0.0-121.102.255.255 - Japan
Temp 13/07/10       :220.100.0.0-220.100.255.255 - Japan

as you can see, only 1 is in fact not Japan, the rest are.

[White Stripes]

* Silver Stripes wonders if it would be feesable to turn the .txt file into a cgi script... (grabbing .txt file grabs from cache server so everything is always in sync)

[Joshua203]

i hope you guys realise that right at this moment the network is being flooded, probably quu.me is the cause 

[GhostShip]

It wouldnt surprise me Joshua, that was the reason why we stopped making the list too public, we have seen before when the blocked IPs are publicised they are then dropped and new ones fire up, I,ll get on the case right now and see what my logs show , cheers for the heads up 

[Joshua203]

i just happened to notice as i fired up winmx and as usual i immediately do my "weird" test search method i noticed ...checking the peers after that ..qme gave me connection errors on the list and sec connections after checking ...both on your patch and "mine" my search was filled with fakes, your welcome GS

EDIT: small edit to make it a bit more readable

[GhostShip]

Can you PM me with the IP or IPs you believe are filling up your slots as I cant see any flooding at two "honeypot" locations we operate, use a tcp Viewer to see what the addresses are and also let me know the name of the flooded search term so I can see if its specific to one attacker.

Cheers again.

[Joshua203]

at this moment i ve no tcp view installed ..i must have forgotten that one when i bought the new system ..lol

i hope the search term will help you see the same result ...

dutch agogo

this will show an awfull lot of micheal jackson mp3's atm and their not mine  ...please don t blame me their using my old file tags to immitate a files list heheheheh (even usernames look fammillar but i m sure those are not the ones i know)

[Joshua203]

PS...i can check a few of those user id's if you like

[Joshua203]

funny one minute i have a modify button and the next it s gone ...lol

anyway i ll send you four user's info i selected randomly out of this big list

[Max™]

Hi guys,
you mantioned tcp view, theres another one i like as well, it shows what tcp view does and has a few more options like custom filters to filter out stuff you dont want to see, like for your tests possibly non winmx related,
its called Currports And Its Here

[Blitzen]

It maybe an idea to have in the hosts section ( or some section out of public view) on this site an area where people could report suspicious ip activity they notice and what they was doing or searching when it occured as surely the more eyes the better and i do not mean reporting ips of activities within chat rooms.