1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

what's the ip?38.99.82.xxx

Discussion in 'Black Hat SEO' started by rsperider, Oct 30, 2014.

  1. rsperider

    rsperider Newbie

    Joined:
    Apr 19, 2013
    Messages:
    25
    Likes Received:
    2
    Occupation:
    Slovakia
    Location:
    Korea North
    Home Page:
    Hi,guys

    I found that some group of IP addresses is trying to hack my site,i got tons of traffic from these ip,and i try to
    block them(iptables -I INPUT -s 38.99.82.245 -j DROP),but it can not work,it was still crawling all my pages.

    anyone can help me please?
     
  2. Conor

    Conor Jr. VIP Jr. VIP

    Joined:
    Nov 7, 2012
    Messages:
    3,372
    Likes Received:
    5,432
    Gender:
    Male
    Location:
    South Africa
    Home Page:
  3. tony_d

    tony_d Elite Member

    Joined:
    Jun 22, 2013
    Messages:
    2,581
    Likes Received:
    3,164
    Location:
    1600 Amphitheatre Parkway, Mountain View CA
    Cloudflare... it's free.

    EDIT: my bad. I just re-read, and you wrote 'hack'. Cloudflare wont help you.
     
  4. phil7346

    phil7346 Registered Member

    Joined:
    Jun 19, 2011
    Messages:
    75
    Likes Received:
    26
    If your site is on wordpress you could put free version of wordfence on. It shows which ips are accessing the site and will allow blocking of a range ips (it just writes it into htaccess), it will autoblock to frequent and login attempts etc.
     
    • Thanks Thanks x 1
  5. JustUs

    JustUs Power Member

    Joined:
    May 6, 2012
    Messages:
    609
    Likes Received:
    452
    use whois from Linux or find a version for Windows:

    Whois 38.99.82.245

    WHOIS Source: ARIN
    IP Address: 38.99.82.245
    Country: USA - District Of Columbia
    Network Name: COGENT-A
    Owner Name: PSINet, Inc.
    From IP: 38.0.0.0
    To IP: 38.255.255.255
    Allocated: Yes
    Contact Name: PSINet, Inc.
    Address: 1015 31st St NW, Washington
    Email: ipalloc@cogentco.com
    Abuse Email: abuse@cogentco.com
    Phone: +1-877-875-4311
    Fax:
    -------------
    See: http://www.cogentco.com/about-cogent

    htaccess:
    Order Allow,Deny
    Deny from 38.0.0.0/8
    Allow from all
    -----------

    You have a data miner/aggregator crawling you. No one trying to hack you.

    Do bear in mind that if you forbid the entire range you will probably lose potential customers.
     
    Last edited: Oct 30, 2014
  6. rsperider

    rsperider Newbie

    Joined:
    Apr 19, 2013
    Messages:
    25
    Likes Received:
    2
    Occupation:
    Slovakia
    Location:
    Korea North
    Home Page:
    Thanks,i try to add to htaccess,but it is still crawling.i can not block it totally.
     
  7. JustUs

    JustUs Power Member

    Joined:
    May 6, 2012
    Messages:
    609
    Likes Received:
    452
    The
    Order Allow,Deny
    Deny from 38.0.0.0/8
    Allow from all
    must be at the very top of the Htaccess file, before any redirection. Htaccess is read, and the rules applied, from the top down.
     
  8. rsperider

    rsperider Newbie

    Joined:
    Apr 19, 2013
    Messages:
    25
    Likes Received:
    2
    Occupation:
    Slovakia
    Location:
    Korea North
    Home Page:
    yes,guy,i added to the top of the Htaccess file,but it still can not work.It was still crawling,i hate this ip.
     
  9. xandreas

    xandreas Newbie

    Joined:
    Jul 10, 2014
    Messages:
    15
    Likes Received:
    10
    If iptables is not working for some reason you can always nullroute the address:

    This will block it no matter what.
     
  10. JustUs

    JustUs Power Member

    Joined:
    May 6, 2012
    Messages:
    609
    Likes Received:
    452
    Cogent is a transport layer ISP. In addition they also sell hosting services. If you are hosted with one of their many services, then you would not be able to block them. However, you must also consider that the IP is spoofed.
     
  11. srb888

    srb888 Elite Member

    Joined:
    Jul 30, 2008
    Messages:
    3,260
    Likes Received:
    5,067
    Gender:
    Male
    Occupation:
    WebzSurfer
    Location:
    Sun, Mon, Tue, WTF, Sat!!! :)
    Is your site a e-com site (new or old, doesn't matter)?

    Try to block the 38.99.82.* range only... initially at least.

    P.S.:
    Those bots seem to ignore the robots.txt and they bypass it with ease. May be only your hosting service can block the range. Ask the customer/technical support to help you block the range..
     
    Last edited: Nov 1, 2014
  12. rsperider

    rsperider Newbie

    Joined:
    Apr 19, 2013
    Messages:
    25
    Likes Received:
    2
    Occupation:
    Slovakia
    Location:
    Korea North
    Home Page:
    thank you for you reply
     
  13. rsperider

    rsperider Newbie

    Joined:
    Apr 19, 2013
    Messages:
    25
    Likes Received:
    2
    Occupation:
    Slovakia
    Location:
    Korea North
    Home Page:
    OK,i will try,thank you very much