Open a can of spam on 194.8.75.149

Posted by Tom Schultz on February 25, 2009 Leave a comment (2) Go to comments

So I’ve been getting a lot of visits from the IP 194.8.75.149 for the last week or so.
All the visits are to my ppc-6800 post about sprint adding picture mail to the mogul.

In any case, it’s annoying me and I really wish they would stop.  Here is a whois and google search for the offending IP.

http://www.google.com/search?q=194.8.75.149

So I’ve been getting a lot of visits from the IP 194.8.75.149 for the last week or so.
All the visits are to my ppc-6800 post about sprint adding picture mail to the mogul.

In any case, it’s annoying me and I really wish they would stop. Here is a whois and google search for the offending IP.

http://www.google.com/search?q=194.8.75.149

Whois…

% This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag

% Information related to '194.8.74.0 - 194.8.75.255'

inetnum:        194.8.74.0 - 194.8.75.255
netname:        DRAGONARA-NET
descr:          Dragonara Alliance Ltd
country:        GB
org:            ORG-DRAG1-RIPE
admin-c:        AGAV2-RIPE
tech-c:         AGAV2-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-HM-PI-MNT
mnt-by:         DRAGONARA-MNT
mnt-lower:      RIPE-NCC-HM-PI-MNT
mnt-routes:     DRAGONARA-MNT
mnt-domains:    DRAGONARA-MNT
source:         RIPE # Filtered

organisation:   ORG-DRAG1-RIPE
org-name:       Dragonara Alliance Ltd
org-type:       OTHER
address:        Geneva Place, Waterfront Drive,
P. O. Box 3469, Road Town, Tortola,
British Virgin Islands
mnt-ref:        DRAGONARA-MNT
mnt-by:         DRAGONARA-MNT
source:         RIPE # Filtered

person:         Andrey Gavrilog
address:        Geneva Place, Waterfront Drive,
P. O. Box 3469, Road Town, Tortola,
British Virgin Islands
mnt-by:         DRAGONARA-MNT
abuse-mailbox:  abuse@dragonara.net
phone:          +41 435.001.009
nic-hdl:        AGAV2-RIPE
source:         RIPE # Filtered

% Information related to '194.8.74.0/23AS44557'

route:          194.8.74.0/23
descr:          Dragonara Alliance
origin:         AS44557
mnt-by:         DRAGONARA-MNT
source:         RIPE # Filtered

If I keep getting spam visits or comments from this IP I'm going to send a report to abuse@dragonara.net, and if you're getting spammed by this IP I suggest you do the same!
Whois...

% This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag

% Information related to '194.8.74.0 - 194.8.75.255'

inetnum:        194.8.74.0 - 194.8.75.255
netname:        DRAGONARA-NET
descr:          Dragonara Alliance Ltd
country:        GB
org:            ORG-DRAG1-RIPE
admin-c:        AGAV2-RIPE
tech-c:         AGAV2-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-HM-PI-MNT
mnt-by:         DRAGONARA-MNT
mnt-lower:      RIPE-NCC-HM-PI-MNT
mnt-routes:     DRAGONARA-MNT
mnt-domains:    DRAGONARA-MNT
source:         RIPE # Filtered

organisation:   ORG-DRAG1-RIPE
org-name:       Dragonara Alliance Ltd
org-type:       OTHER
address:        Geneva Place, Waterfront Drive,
P. O. Box 3469, Road Town, Tortola,
British Virgin Islands
mnt-ref:        DRAGONARA-MNT
mnt-by:         DRAGONARA-MNT
source:         RIPE # Filtered

person:         Andrey Gavrilog
address:        Geneva Place, Waterfront Drive,
P. O. Box 3469, Road Town, Tortola,
British Virgin Islands
mnt-by:         DRAGONARA-MNT
abuse-mailbox:  abuse@dragonara.net
phone:          +41 435.001.009
nic-hdl:        AGAV2-RIPE
source:         RIPE # Filtered

% Information related to '194.8.74.0/23AS44557'

route:          194.8.74.0/23
descr:          Dragonara Alliance
origin:         AS44557
mnt-by:         DRAGONARA-MNT
source:         RIPE # Filtered

If I keep getting spam visits or comments from this IP I’m going to send a report to abuse@dragonara.net, and if you’re getting spammed by this IP I suggest you do the same!

Blog Post, ,
  • http://www.gray.me.uk/uncategorized/how-to-rickroll-wordpress-spammers Karl

    Add these lines to your .htaccess to stop the spam

    RewriteCond %{REMOTE_ADDR} ^194\.8\.74\.[0-9]{1,3}$
    RewriteRule .* http://127.0.0.1 [R,L]
    RewriteCond %{REMOTE_ADDR} ^194\.8\.75\.[0-9]{1,3}$
    RewriteRule .* http://127.0.0.1 [R,L]

    Please note you have put this within the rewrite section that wordpress creates.

  • http://blog.josephsniderman.org Joe

    I have been having a similar problem with that range of IP’s.

    While Akismet caught most of it, it still bothered me. I tried using reCaptcha and similar services without success at stopping these jerks.

    I did not send an email to their abuse dept., simply because I suspect that they themselves may be involved.

    If you are on a shared server then Karl’s advice is best. If you have root access, then you are most likely better off blocking them using iptables or something similar. The following command using iptables keeps them out:

    iptables -I INPUT -s 194.8.74.0/23 -j DROP

    What that does is any incoming packet from that whole range of IP’s gets dropped. Doesn’t redirect. Doesn’t ‘refuse connection.’ Just drops the packet. This way also they are blocked not just from apache, but from the whole server.