|
Register | FAQ | The Twelve Commandments | Members List | Calendar | Arcade | Find the Best VPN | Today's Posts | Search |
New Feature Requests Your idea for a cool new feature. Or, a LimeWire annoyance that has to get changed. |
| LinkBack | Thread Tools | Display Modes |
| ||||
A little off-topic but just thought I'd note this: When I took over the BearShare hostiles list because it seemed it was not being updated any more, I then considered a similar list for LW. Once I found a way for LW to read it, I changed the format it uses so it uses less memory than the BearShare version. It did cross my mind to start a list from scratch for LW because it had been suggested in years past the BS one was a little heavy handed. But seemed like a lot of work to do so stuck to a ready made list instead. I also looked at other blocklists. Both Phex & GTK use the same list which is minimal. But noticed some small differences. For example a small ip sub-range was blocked on BS Hostiles but the Phex version had the opposite end of that range blocked instead. I chuckled. I saw that a few times. I combined that list with the LW one. I also compared to the LW built-in blacklist. I also looked at the Gnucleus blacklist which I think File_Girl put together. That one blocked many world police departments & also music & film production companies & related companies. That sounded appealing to me so I combined it also. I also looked at the FrostWire hostiles, same format as the BS one. I noticed some differences & incorporated some of those. As far as police departments go, I discovered one using Phex from USA (twice 9 days apart), a special criminal investigations unit which had a small portion of an ip sub-range allocated to it. Other police dept's I've found were from Melbourne, Sydney, Auckland & somewhere in Portugal. All these added to the LW blacklist. I find it difficult to believe someone working for a police dept. would be using the official connection for casual hobby use-age of the Gnutella network. I think it's best to play it safe when it comes to gnutella users & if they want some protection then this list will at least help. There's been other suspicious sub-ranges I've blocked due to the multiple users on similar ip's (11-12) connecting to me on multiple occasions. Over 2 years ago, I was uncertain whether they were bots or an organised group of people from Australia & I think Malaysia. (I had snapshots of a couple of these occasions but posted privately.) Example with first number removed: x.98.133.1, x.98.133.2, x.98.133.5, x.98.133.7, x.98.133.16, x.98.133.17, x.98.133.18, x.98.133.21, x.98.133.31, x.98.133.49, x.98.133.50 using FW 4.21.5, MS Windows version. 72 browses or download attempts over 10 min period before I crashed. The LPE pseudo name for the first one listed was AggressiveQual-133.1 Each browsed & several of them downloaded from me (same material.) In retrospect, sounds like bots. ie: Brisbane two occasions, Sydney once, Malaysia once. I mention these ones because they were more local to you. Of course I've mentioned & given examples of other similar bot ranges from USA in the BearShare Hostiles thread & Europe elsewhere. Bots are run from many countries (not referring to proxies.) [/waffle completed] |
| ||||
Again, a little off-topic. But seems I identified another bot from Europe. Same ip from Belgium. Problem is it's a dynamic address so probably won't add it to the hostiles. Host peers connecting to me with same ip, using LW Music 4.2.0 (multiples) & LimeZilla 2.3.0. No co-relation between ports used. So it could be a difficult one to stop. In general I find Belgium ip's are highly dynamic even when they're supposed to be static. This one via Belgacom Skynet & around late afternoon their time. My LPE was not connected that long, perhaps 2 hrs at most as UP. |
| ||||
Quote:
I realise this has become an old topic but thought I'd give you a heads-up on some blocking in regards to port 7001 hosts. There's a particularly bad group that use the following ip's: 208.103.122.163, 208.103.122.164, 208.103.122.165, 208.103.122.167 If you're using LW 5.3.6, LPE or WireShare then the pseudo-names would be: NiceReindeer-122-63 and NiceReindeer-122-65, etc. You can block them individually or use 208.103.122.160/29 That range is in the Hostiles-security block updater for January for LimeWire and will be in the next WireShare version release. The hosts I've seen were ShareAza but I suspect they probably use multiple different gnutella client programs such as like this. As it is at present, still trying to prevent that port from being active with WireShare's uploads. At least that port will not be able to connect as a leaf or ultrapeer to WireShare. |
| ||||
Oops yes. Thanks for the confirmation pictures and posts. Block all those hosts I listed. The others won't be far away I can assure you. Put 208.103.122.160/29 into your filter blocklist/blacklist will achieve the same thing (it will block a range of 8 sequential addresses starting from 160. Or put in both 208.103.122.163 and 208.103.122.164/30 which will block the next 4 addresses up to 167.) I had 1.2 million hits from that range over a few days according to my ip blocker. This session it's been 398,479 hits over 16 hours and 48 minutes. I first noticed them whilst using BearShare on the 23rd of last month. Perhaps this bunch is only using ShareAza. |
| |