Interesting Problem with a Guest

[Visionray]

This may be a stupid question...and not really a big deal but I'll ask anyways.....

OK so there is this guest that has been lurking on my forums. I know its the same guest because he has a static IP address and I see him on "Who's Online". He is on my boards at least 30 times a day.

Anyways..this guest is ALWAYS trying to do some shady stuff, like trying to edit posts, move threads, close threads, delete threads, create threads, report posts, view "unknown locations", and attempting other moderator duties etc.... Obviously its not working because he isnt registered or a moderator.

At first I assumed this person was just a little lost and didnt know that he had to register. But this has been going on for weeks now - Same person.

I tried doing a search for his IP to see if it was just a regular member who wasnt logged on...but there is nobody on my forums with a similar static IP. So now Im starting to really wonder. Is this guy trying to hack my forums or something? Is there any way I can find out who this is? Should I be worried?

As I type right now, he is once again trying to edit a post.

Thanks guys.

[Mac Users Group]

It could be a search engine robot like Google. Do a lookup on the IP address.

[John Mac]

YOu may want to visit this thread also.

http://www.vbulletin.com/forum/showthread.php?s=&threadid=42780

This person is having similar problems with a guest from Poland.

[Visionray]

Thanks guys..Yea this is strange. Now im worried that this is a hacker. I could ban his IP, but doesnt banning an IP only prevent that person from posting? Since he is only a guest, he cant post anyways.

I have his number...how exactly do I find out who his ISP is?

Thanks guys

[Mac Users Group]

http://www.nic.com/nic_info/whois.htm

Paste the IP address into the textbox and press enter. It should give you some information about who owns the IP address block. It is most likely a search engine.

[Visionray]

ok thanks I'll give it a shot

[Visionray]

cool this is what I got... I think its the same as the other guy in the other forum who said that this guy was from Poland. So you think this is a search engine or a real person?

---------------------------------------------

% This is the RIPE Whois server.
% The objects are in RPSL format.
% Please visit http://www.ripe.net/rpsl for more information.
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-serv...copyright.html

inetnum: 194.181.35.0 - 194.181.35.255
netname: PROSZYNSKI
descr: Proszynski i S-ka
descr: Garazowa 7
descr: 02-651 Warszawa
country: PL
admin-c: PL545-RIPE
tech-c: AJ247-RIPE
status: ASSIGNED PA
notify: [email protected]
mnt-by: AS8308-MNT
changed: [email protected] 19970926
changed: [email protected] 19991228
source: RIPE

route: 194.181.0.0/16
descr: NASK (PL)
descr: Provider Local Registry
origin: AS8308
notify: [email protected]
mnt-by: AS8308-MNT
changed: [email protected] 19990105
source: RIPE



--------------------------------


EDIT - Just realized I posted personal information....so I deleted that....but basically you get the idea from this info above. It gave this persons address, email, and phone number.

It looks like a person...not a search engine.

[Mac Users Group]

I'm not sure. I went to the site, and it doesn't tell me anything. You should probably just ban the IP.

If it is a robot, it may follow the robots.txt protocol.

Example (in robots.txt file)

User-agent: *
Disallow: /forums

Most well-known robots (e.g. Google) follow this protocol.

Visit http://www.robotstxt.org/wc/exclusion.html for more information.

[Visionray]

ok thanks Mac. But if I ban his IP, that only prevents him from registering and posting. Since hes doing this stuff now, and hes not a registered member, banning him wont do anything will it? He will still be able to view the forums and do what he is doing now...he just wont be able to post.

Well, Ive banned his IP anyways, but I dont know if thats going to do anything. Thanks for the help though

[kippesp]

If you're running Apache, .htaccess will allow you to keep IPs off your entire website.....

How are you able to determine this person is attempting to user higher priviledge functions? Is this a hack? (If it is public, could I have what it is? I've been considering writing such a hack.)

[Visionray]

Hey mac turns out you were right!! The other user here having the problem emailed them and got this response below.

Kippesp: No its not a hack. If you just click whos online, you can see what the guests are doing. This one kept trying to do weird things like edit posts etc... but it looks like it wasnt a person, just a robot.

Thanks Mac! Sorry I doubted you


---------------------------------------------------------------
V-ray - - FYI. Looks OK - just got this:

Bramka.proszynski.pl is our gateway.

What you probably experience is our crawler Szukacz which at the moment crawls all the websites listed in the Open Directory (the dmoz.org directory).

Our search engine works at http://www.szukacz.pl/ (with the user interface in Polish only, unfortunately).

I apologize if our crawler made some problems to your website.
Certainly it is not our intention to cause problems. As far as we have
test it, our crawler follows all the robots.txt and the robot metatag rules.

There is a small chance, however, that it does something wrong.

If you let me know the name of your website, I will include it on the list of sites forbidden to be crawled.

And let me know what is the exact problem you experience.

Sincerely your
Mieczyslaw Proszynski

http://www.szukacz.pl/