[Labs-l] Tools admins, please check, Fwd: [Fail2Ban] apache-bots: banned 208.80.153.167

Sat Sep 7 07:19:29 UTC 2013

Has someone in the tools project (tools project is the owner of .167) been
misbehaving?  Or is this a totally false alarm?

---------- Forwarded message ----------
From: DC <caudilldk at gmail.com>
Date: Fri, Sep 6, 2013 at 10:53 PM
Subject: Fwd: [Fail2Ban] apache-bots: banned 208.80.153.167
To: abuse at wikimedia.org

Greetings,

Please read the forwarded email for a log snippet of an attack coming from
your network against our website, soldierx.com.  Please let us know as soon
as possible what you can do about these attacks.  You can reach one of our
technicians, Shawn Burrell, at 817-287-8705.

We can provide detailed logs if needed.

Failure to reply may result in legal action as these attacks have been
disrupting our business.  At this point in time, we are trying to work with
companies in order to get them to cease.

Respectfully,

 David Caudill
Network Security and Operations, soldierx.com

---------- Forwarded message ----------
From: Fail2Ban <fail2ban at shinra.soldierx.com>
Date: Fri, Sep 6, 2013 at 6:19 AM
Subject: [Fail2Ban] apache-bots: banned 208.80.153.167
To: caudilldk at gmail.com

Hi,

The IP 208.80.153.167 has just been banned by Fail2Ban after
1 attempts against apache-bots.

Here are more information about 208.80.153.167:

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

#
# The following results may also be obtained via:
#
http://whois.arin.net/rest/nets;q=208.80.153.167?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       208.80.152.0 - 208.80.155.255
CIDR:           208.80.152.0/22
OriginAS:       AS14907
NetName:        WIKIMEDIA
NetHandle:      NET-208-80-152-0-1
Parent:         NET-208-0-0-0-0
NetType:        Direct Assignment
Comment:        http://www.wikimediafoundation.org
RegDate:        2007-07-23
Updated:        2013-07-23
Ref:            http://whois.arin.net/rest/net/NET-208-80-152-0-1

OrgName:        Wikimedia Foundation Inc.
OrgId:          WIKIM
Address:        149 New Montgomery Street
Address:        3rd Floor
City:           San Francisco
StateProv:      CA
PostalCode:     94105
Country:        US
RegDate:        2006-05-30
Updated:        2012-02-15
Ref:            http://whois.arin.net/rest/org/WIKIM

OrgAbuseHandle: MBE96-ARIN
OrgAbuseName:   Bergsma, Mark
OrgAbusePhone:  +1-415-839-6885
OrgAbuseEmail:  mark at wikimedia.org
OrgAbuseRef:    http://whois.arin.net/rest/poc/MBE96-ARIN

OrgTechHandle: MBE96-ARIN
OrgTechName:   Bergsma, Mark
OrgTechPhone:  +1-415-839-6885
OrgTechEmail:  mark at wikimedia.org
OrgTechRef:    http://whois.arin.net/rest/poc/MBE96-ARIN

OrgAbuseHandle: CARRL-ARIN
OrgAbuseName:   Carr, Leslie
OrgAbusePhone:  +1-415-839-6885
OrgAbuseEmail:  lcarr at wikimedia.org
OrgAbuseRef:    http://whois.arin.net/rest/poc/CARRL-ARIN

OrgTechHandle: CARRL-ARIN
OrgTechName:   Carr, Leslie
OrgTechPhone:  +1-415-839-6885
OrgTechEmail:  lcarr at wikimedia.org
OrgTechRef:    http://whois.arin.net/rest/poc/CARRL-ARIN

RTechHandle: MBE96-ARIN
RTechName:   Bergsma, Mark
RTechPhone:  +1-415-839-6885
RTechEmail:  mark at wikimedia.org
RTechRef:    http://whois.arin.net/rest/poc/MBE96-ARIN

RAbuseHandle: MBE96-ARIN
RAbuseName:   Bergsma, Mark
RAbusePhone:  +1-415-839-6885
RAbuseEmail:  mark at wikimedia.org
RAbuseRef:    http://whois.arin.net/rest/poc/MBE96-ARIN

RNOCHandle: MBE96-ARIN
RNOCName:   Bergsma, Mark
RNOCPhone:  +1-415-839-6885
RNOCEmail:  mark at wikimedia.org
RNOCRef:    http://whois.arin.net/rest/poc/MBE96-ARIN

RNOCHandle: CARRL-ARIN
RNOCName:   Carr, Leslie
RNOCPhone:  +1-415-839-6885
RNOCEmail:  lcarr at wikimedia.org
RNOCRef:    http://whois.arin.net/rest/poc/CARRL-ARIN

RAbuseHandle: CARRL-ARIN
RAbuseName:   Carr, Leslie
RAbusePhone:  +1-415-839-6885
RAbuseEmail:  lcarr at wikimedia.org
RAbuseRef:    http://whois.arin.net/rest/poc/CARRL-ARIN

RTechHandle: CARRL-ARIN
RTechName:   Carr, Leslie
RTechPhone:  +1-415-839-6885
RTechEmail:  lcarr at wikimedia.org
RTechRef:    http://whois.arin.net/rest/poc/CARRL-ARIN

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

Lines containing IP:208.80.153.167 in /var/log/apache*/*access.log

/var/log/apache2/soldierx-access.log:208.80.153.167 - -
[06/Sep/2013:06:19:42 -0400] "GET /hdb/Mafia-Boy HTTP/1.1" 200 18709 "-"
"LinkSaver/2.0"
/var/log/apache2/soldierx-access.log:208.80.153.167 - -
[06/Sep/2013:06:19:45 -0400] "HEAD /hdb/Mafia-Boy HTTP/1.1" 200 5168 "-"
"LinkParser/2.0"
/var/log/apache2/soldierx-access.log:208.80.153.167 - -
[06/Sep/2013:06:19:49 -0400] "GET / HTTP/1.1" 200 30281 "-" "LinkSaver/2.0"
/var/log/apache2/soldierx-access.log:208.80.153.167 - -
[06/Sep/2013:06:19:53 -0400] "HEAD / HTTP/1.1" 200 5200 "-" "LinkParser/2.0"

Regards,

Fail2Ban

-- 
Leslie Carr
Wikimedia Foundation
AS 14907, 43821
http://as14907.peeringdb.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.wikimedia.org/pipermail/labs-l/attachments/20130907/5b6fbd39/attachment-0001.html>