Why does the forum keep forgetting me recently?

[JamminR]

Didn't do real link in my previous post, only a (seemingly needing to be rewritten) whois lookup.
This one actually shows much more info across other forums - http://www.stopforumspam.com/search.php?q=66.230.230.230
Several blacklists links too - http://www.robtex.com/ip/66.230.230.230.html#blacklists

I'm doing research now. Seems the domain info I found lists to one company, that redirects to another company, that redirects to another company that just merged into.
No wonder stuff like this falls through the cracks. The IT staff rarely get transferred.
(They don't seem like false fronts for the web hosting, just lots of transfers.)

Primary contact for that ip is (supposedly) charles@city-guide.com

I'm working on an email. (Though I'd much rather be playing my addiction right now..I'm trying to avoid it)

[JamminR]

For those of you not part of the teamulysses@ulyssesmod.net distribution list -
Ok, so I did more research, found that the ip address 66.230.230.230 is, according to a few Tor users/proxy site reviewers, one of 'the' fastest Tor exit nodes on the internet run by an organization called 'Desync'. Wonderful. No wonder it's hit us the most.
Found an individual email of someone who runs/owns/is somehow important with that organization.
Emailed him, and abuse at desync.com.
I basically said blah blah Tor/anonymity to fight corruption/censorship = good, blah blah hackers = bad and can they help us stop it in any way.
His response.

from   ben wilber <ben@desync.com>
to   JamminR <jamminr@ulyssesmod.net>
cc   abuse@desync.com,
Team Ulysses <teamulysses@ulyssesmod.net>
date   Sun, Jan 23, 2011 at 7:40 PM
subject   Re: Hack attempts from 66.230.230.230
mailed-by   exodus.desync.com
   
hide details 7:40 PM (3 hours ago)
   
On Sun, Jan 23, 2011 at 07:05:02PM -0500, JamminR wrote:
> Is there a way you can assist in stopping the malicious use of your Tor node.

Unfortunately, it is neither prudent nor possible to filter or even
monitor the traffic from a Tor exit:

http://www.torproject.org/eff/tor-legal-faq.html.en#ExitSnooping

The best suggestion I can offer is to simply block or otherwise restrict
access from Tor.  Two good (though not perfect) blacklists for doing so
are available:

http://www.torproject.org/projects/tordnsel.html.en
https://www.dan.me.uk/dnsbl

We apologize for the inconvenience.

[Megiddo]

Thanks for doing that, JamminR. Also the answer I expected, but still good to check...

[JamminR]

As most of you have probably noticed, SMF is forgetting our logins the past two to three days. Though annoying, personally, I feel this is a good thing 'security' wise.
It makes sure sessions are secure by requiring a renewal.
I've added several new IP ranges to the ban list. If an IP has over 5 attempts of various accounts, I added it by x.x.x.*

However, I'm writing to let you all know... I banned 91.121.*.* ... a LARGE range, much of it based in France.
It has ~10+ errors among 5 different ip ranges of the *.* part in our error logs, most different password attempts for various accounts.
Though not all of the range is owned by a french data center, many are, and many seem owned by bots.
I used stopforumspam.com to search for 91.121.*.* and found 60+.
If we get any emails to team ulysses, we can adjust it to cover less.

[Megiddo]

Thanks for looking into that, JamminR.

[JamminR]

Heads up!
We're not alone! Security patches exist to help the forced logouts.
Guide exists for mods/recommendations from an SMF Dev overall.
http://www.simplemachines.org/community/index.php/topic,422954.0.html

[Megiddo]

Thanks JamminR! Will look into changing some stuff around later today. That Tor blocker looks especially juicy.

[MrPresident]

MmmMm... Tor blocker..

[Megiddo]

Upgraded to RC5 and installed the tor blocker.

Edit: I disabled (but kept) our custom IP block list. We should know somewhat quickly whether or not the tor blocker is working.

[JamminR]

Ok, So, bit confused.
This list - /TorExitNodesToBlock.txt - 'can' access us, or can not?
Header comment seems to indicate they can, name of file indicates they can not.
I'd be more than happy to copy/paste our ban list into a worksheet and compare it to that.
Many in that list look familiar.

Also, one big question... will we still get some type of log saying 'this ip tried, but we kicked its butt and denied'

[Megiddo]

That list contains Tor exit routers that are allowed to access our site (via Tor restrictions I guess). It's explained on the generator site better: https://check.torproject.org/cgi-bin/TorBulkExitList.py

Doesn't look like Tor blocks are logged at all, unfortunately.