iN8sWoRld.net » SiteNews

Site updates for 2008

Nate — Mon, 31 Dec 2007 05:00:46 +0000

Having had some time to play again on the site, I made several changes to the way the site functions, and what you can do here including:

Anonymous posting re-enabled - you don’t have to be a logged in member of the site to post. If you want to ‘claim’ your identity you can still register, but if you just stumbled upon the site, you can now fill in a Nickname, and email address, and answer a challenge question to post a comment.
I upgraded and integrated my Photo Gallery into the blog. The theme is the same color, and a little block of three random images from the gallery appears in the sidebar. (update 1/4 - I have removed this block because it makes the main page take almost 9 seconds to load!). This is what I removed:
[?php print g2_sidebarimageblock(); ?]
Clicking an image will take you to the gallery. You can click on the in8sworld logo to return or navigate through the gallery using the ‘breadcrumbs’ at upper right. This integration also will allow me to easily include images posted in the gallery in the blog, and automatically link back to the full version (and more notes). This will hopefully drive me to post more images in those gallerys than I have been doing of late.
[Removed because it slowed the site to a crawl] Added a new ratings feature so that readers can select between 1 and 5 skulls (1 is bad, 5 is good) for each story. I don’t know if anyone will use this feature, but it might help me decide what people like to read about, or what I am doing well or not so well. Only visible when you’re reading the full story.
in8sworld.net now redirects to the blog subdirectory. One year ago, an index.html file that was placed there to thwart some spammers, and because that was the last time I had a lot of time to update stuff
Each story now has 5 ‘Related Topics’ listed at the bottom of the story which are other stories I have posted that contain key words that relate to the current story. Making connections to these older archived stories is important to me because otherwise the bulk of the body of work that is my idiotic rambling online journal will be essentially visible to new readers.
Modified the layout a bit so that there is no space between the header and meta data of a post and the text of the post. This makes it clearer what is related to what.
Removed the in8 links from along the top (leaving only a contact and a flickr link because they are integrated into the blog now), and put them in the right sidebar with other external links.
Categories are now listed with a category feed, in case someone wants to follow only one of the several topics on which i post regularly. This feed is accessed by clicking the small orange RSS icon associated with each category.
Moved flashback block down a bit in sidebar (but didn’t remove it!)
Moved search to bottom of sidebar (then moved it back)
Created syndicate logo images and linked at bottom of sidbar. More to come!
Added a popular tags block - still need to tag all the posts!
Added External Links indication with small images.

Chinese Spam Mafia?

Nate — Sun, 07 Jan 2007 04:19:54 +0000

When I decided to change over my website recently, I installed the new blog ‘engine’ into a subdirectory (you can see that this is so by looking in the address bar of the browser). All of my stories have been archived over the years in various search engines, and to route requests for these stories to their new locations would have taken me some time to code, so I blew it off. Instead, I decided to put up a custom 404 error page, so people who don’t get where they thought they were going at least end up on my site with a nice message and search box instead of just the unfriendly white default server page. As a side effect of the custom page, I get emailed whenever a person hits this page with the address *from which* they were coming so I can attempt to fix the problem. As it turns out, this little change led me right to the Chinese Spam Mafia.

The emails I get look like this:

A user tried to go to http://www.in8sworld.net/blog/article.php?story=20040403163653898 and received a 404 (page not found) error. It wasn’t their fault, so try fixing it.
They came from http://209.8.22.250/tools/proxer/proxy.txt

As it turns out, I kept a copy of the old Geeklog site running on my powerbook, so I can tell that the story above is the one about when I went to the Hubble Deep Field lecture in 2004. It might well be indexed someplace in a search engine because it has a lot of popular terms in it, and it also has a lot of links to other popular sites in it. But something was strange about the referring page. Why was it an IP number instead of a human readable domain name? Why was the referring page a .txt (text) file? This looked like a spammer using a proxy tool to automatically go out and hit stories on blogs and attempt to comment some spam on them.

So I started doing some investigation. First thing i did wasn’t very wise - I typed that IP into my address bar and loaded it up. I really didn’t expect to get anything back, but I got a phpinfo page! I usually hide any page with this php function on it behind some password, because I don’t want the world to know the details of my server. I suspected immediately that this wasn’t a real phpinfo page, but rather a faked one designed to either lure in hackers or just obfusticate things. It claimed the server was running

FreeBSD MC101180 5.4-RELEASE-p5 FreeBSD 5.4-RELEASE-p5 #4: Tue Jul 26 12:58:02 UTC 2005 root@ah9.realitychecknetork.com:/usr/src/sys/i386/compile/Z i386

realitychecknetork.com is not registered to anyone at this time.

and that the page on which it ran supposedly gave away the username (zacjesus105):

/home/zacjesus105/209.8.22.250.com/index.php

It also had this listed in sendmail settings:

/usr/sbin/sendmail -t -i -f xzac@prytv.com

The prytv.com site was an html page with every possible combination of sex related words on it, so our spammer is not out to stimulate just good conversation.

-=[ Voyeur PORN paginas voyeur - web, dorm sex and videos voyer project, cams, porn, private

A Whois on that domain IP (206.161.192.13) gives

PryTV
Russia Moscow
4, Zubovsky Boulevard
Moscow, NA 119021
RU

and is located on the Beyond The Network America Inc network based in the US, not Russia.

A trip to http://209.8.22.250/tools/proxer/proxy.txt returned a 403 error (forbidden).
This IP is probably the proxy server itself. It may be a hacked machine. In fact, running nmap against it returned an error saying that the machine is NOT really running FreeBSD, but it might just be that my version of nmap is rather old and unable to determine it properly.

A Whois on the IP returned this possibly bogus information:

IP Location: United States - New Jersey - Egg Harbor Township - Axxa Commerce Llc
Reverse DNS: 209-8-22-250.pccwglobal.net.22.8.209.in-addr.arpa
OrgTechName: Kim, Joon

Who could this Joon Kim of Axxa Commerce LLC character be? Is this the guy responsible, or has his machine been hacked by someone upstream?
It seems Hidden Mysteries has him pegged this IP as being in the range of IPs which are organized crime spammers out of China and he calls for the US government to block the entire IP set of ranges, as they seem to be the ultimate source of most of the spam we are dealing with day to day (I’ve gotten 5 more spambot attempt emails since I started writing).

All I can do is try to track down all the possible leads.
Axxa Commerce seems to have a legitimate website e-commerce business.

Registrant Contact: AxxaCommerce LLC
3 Canale Drive, Suite 6
Egg Harbor Township, NJ 08234 US
Administrative Contact: Cyber-Services L.L.C. Kelly Grillo

The Map of the Internet lists the 209 portion of the IP as being in the US, but is is right next to 210 which is the start of the Asian-Pacific IP ranges. I searched the APNIC database, but that IP was not in Asia. I searched the ARIN database, and there it was. The IP is indeed in the US.

The Better Business Bureau lists Cyber-Services as an Internet Shopping Services company and having one complaint against them in November which had been resolved. So we have a connection to a real world company. The IP address for Axxa (198.107.176.35) is not in the same range as my sneaky character’s, they’re using a server in Colorado (running IIS!) some Cyber-Services company, using Windows :p

I was starting to think that what must be going on is poor Mr Kim’s legitimate business had been hacked by someone in China and one of his PCs was automatically spamming my sites. But a traceroute to the suspect IP revealed that the IP just upstream is 63.218.44.125

OrgName: Beyond The Network America, Inc.
OrgID: BNA-42
Address: 520 Herndon Parkway
Address: Suite E
City: Herndon
StateProv: VA
PostalCode: 20170
Country: US
OrgTechEmail: jkim@pccwglobal.com
OrgNOCEmail: supportamerica@btnaccess.com

There’s our Mr. Kim again! Looks like he’s involved in a bunch of businesses, all internet related and connected to a big Chinese ISP. Seems like the company is based in Virginia, but may be owned by a Chinese broadband company PCCW Global. You can download a nice PDF of their cable lines here. Now why wouldn’t an internet shopping company, and a ‘Cyber Services’ company that is directly connected to a giant, global ISP not run their websites on their own network?
And why would a machine supposedly in the US be attempting to access stories on my blog every 15 minutes or so? Even if it’s not dear Mr. Kim who wants to post comments on my blog about penis enlargement and Viagra pills, I’ll hold him responsible since his name is on the domains from which I am receiving this crap. Something tells me he’s not really interested in what I have to say. Whoever the piece of crap is, when he notices that his spambot is getting 404 errors repeatedly on my domain he’ll either move on or tweak his scripts to work more effectively against my new blog engine. Then we’ll have to shift into higher gear.

Others in the blogosphere have encountered Mr. Kim as well. Spacequad, another geeklog user was pretty fed up with Mr. Kim as well in his post about Proxy Referrer Spam. It seems to be a Geeklog-specific comment spam script, here’s a page where Dirk (the guy who co-develops Geeklog) battles with the bastard.

Move to Wordpress

Nate — Thu, 28 Dec 2006 03:42:24 +0000

Even though I’ve used Geeklog for over three and a half years, and use it for other sites as well, I decided to convert my personal blog over to Wordpress this past week. I’ve been playing around with Drupal as well (which I quite like), but really what I do on this personal site doesn’t really call for something with that kind of horsepower. This site is not about a community sharing information and creating content, this is about my ranting and raving about stuff that goes on day to day. It’s more of an online journal than anything else.

One of the reasons that I decided to change platforms had nothing to do with what the software could or could not do at all. It had to do with frustration, plain and simple. I was sick, and not able to do much more than sit on the couch and tap the keys. I had sinus troubles and I would get dizzy when I stood up, so I didn’t do that very often. Having the computer on my lap most of the day I was struck by how persistent some spammer had gotten too. I was getting two or three spams an hour! But these weren’t just mass emailed spam, this was some ‘bot hammering my registration script - automatically trying to get registered to the site so it could post it’s payload of links back to some porn site all over the place. Since I had long ago set the registration to approved only, of course this didn’t get the bot anywhere, but it was annoying me.

One of the reasons it annoyed me so much was that it was freaking stupid: instead of registrations coming in with names like ‘John Smith’ and a boring email address, the hundreds of registrations were all like this:

Edit gautama2192 gautama2192@realitypornhouse.com
Edit raffia9545 raffia9545@onlygaybutts.com
Edit smalley1310 smalley1310@webcam-home.com
Edit holmes5752 holmes5752@onlygaybutts.com
Edit VintageSlots Dave@IBuyOldSlots.com
Edit decapod2236 decapod2236@orgy-reality.com
Edit tristan_kael dkxbde@oasisproductions.net
Edit showmen4688 showmen4688@orgy-reality.com
Edit kalki_kelly xpoacn@wsscsw.com
Edit ingersoll1220 ingersoll1220@orgy-reality.com
Edit jennings9290 jennings9290@topasianporn.com
Edit toilsome1725 toilsome1725@realitypornhouse.com
Edit infertile8222 infertile8222@topasianporn.com
Edit anything6470 anything6470@realitypornhouse.com

It doesn’t take much effort to realize that someone with an email address from orgy-reality.com is probably not interested in serious discourse on your blog, but I imagine most sites are set up to handle the registration process automatically so there’s no human eyeballing these submissions. An offensive and suggestive email address is much like any other to the machine. I could have chosen to blacklist the various domains (there were a lot submissions from only a few domains), but it seemed like I was playing whack-a-mole when I attempted to do that. The blacklist would work for a while, but then they’d come up with a new domain (domain names are cheap) and you’d be doing it all over again.

I decided to implement CAPTCHA on the registration form. CAPTCHA is method of displaying a little graphic with letters like the one’s you’d see in ransom notes in the movies, hard for a program to decode but easy for a human to decipher and type in to confirm that they were really a person. This immediately eliminated the spam of that type, but I couldn’t (in my debilitated state) for the life of me figure out how to implement this on my ‘contact’ form. I had a link on my old site which allowed a websurfer to email me through the site. It didn’t reveal my actual email address, it just presented a form for them to use. Somehow another ‘bot was using that form and sending me another two or three emails a day using that too.

I was tired. All I really wanted was to write some stuff and hit ’save’. I didn’t want to play this stupid game anymore with Mr. porn hustler bot. Instead of hobbling my now almost totally closed down CMS system (I had been turning off one feature after another over the years due to spam), I figured I would just try Wordpress. I installed it on my laptop in under 5 minutes, it has a really simple plugin interface, it uses php which I had become familiar with through playing with Geeklog over the years, and the themes administration was awesome. Wordpress doesn’t do everything Geeklog could do, I could never replace my work intranet system with Wordpress, for instance - but for a personal blog system it was more than adequate.

If you haven’t been around here in a while, please try out the new site - maybe you’ll like interacting here better now that some of the basic functions you expect from a blog are present - like being able to see the post you are replying to while replying! It took Geeklog years to get on the stick with that one.

Server Move complete?

Nate — Wed, 06 Dec 2006 21:29:18 +0000

Hopefully now that the server move is complete and the DNS propagation is done with we can get on with the business of blogging again. Things that went missing for several days included my link page (I didn’t realize how much I used that), the photo gallery , the Book of Song (and at an inconvenient time) the podcast, not to mention my notes page and this blog as well as email (though I was able to continue to communicate on the various forums of which I am a member, and through gmail). Welcome back!

Site upgrade

Nate — Sun, 21 May 2006 04:08:18 +0000

in8sworld was offline for several hours tonight while I upgraded the site to use the latest version of the CMS (Content management software) that runs all this. There are several new features, not the least of which is support for ‘trackbacks’. I have been running Geeklog for almost three years now since this site was launched and I’ve learned a lot of php and mysql using it. Unfortunately, one feature of the site is still not back online - the ‘Quotation Corner’ is offline until I can figure out what’s up.A new logo has been posted in honor of the upgrade based on Prof. Guilbert’s submission #3 in 2004.

Why I deleted your account.

Nate — Mon, 15 May 2006 02:17:57 +0000

I don’t run my websites to make money or to get famous. It *costs* me money to keep them going, and it takes time to maintain them and post stuff that might interest my friends and family. I certainly don’t do all this work just to provide dirtbags selling fake penis enlargement schemes free links back to their worthless waste of web space. A simple Google search brought back over 263 hits of penis related posts for the email address you used to sign up to this site. Please be a little more creative next time.

I find it hard (no pun intended) to believe that you can actually make any money running such a site, but I’m sure it’s only one of several such ventures. I don’t begrudge you whatever cash you can swindle out of them suckers, but don’t try to use my site to further your illicit aims again - unless you want to start wasting your own precious time cleaning up after ME.

Website upgrade - Song Book

Nate — Sun, 22 Jan 2006 21:50:57 +0000

Although Comyn’s Book of Song is not technically part of this website, it does reside in a subdomain on the same server. For years I’ve maintained an Irish songbook of sorts based on a friend’s collection which was passed to me when he moved away. Upkeep on the site was always a pain. It was one of the earlier websites I had done, and it didn’t have any scripting built in to ease the administrative burden. I bit the bullet today and rolled those pages into Blosxom.

I’ve been using Blosxom for many months to drive my notes site, in8snotes. It takes plain old text files stuffed in a directory (or a series of directories) and arranges them programatically into a cohesive, RSS enabled website. I had a slightly different need when it came to the song book: I wanted to have all the song titles listed so you could scan down and click on what you wanted. I don’t think I’ll want to separate them into directories, although that’s still an option… perhaps by genre? There was a little configuration that needed to be done, and then I had to deal with the fact that the Book is really sitting in a subdomain, not just a subdirectory. I wasn’t able to get the rewriterule in my .htaccess file to hide the URL, so you’ll see the ugly path and cgi filename, but it’s working.

I’ve always kept a ton of lyrics on the hard drive, but formatting it for the web was too bothersome. Now adding a new song to the site is as simple as dropping the text file into the right directory. I have no excuse not to add more stuff, or to update the existing files.

Although the main audience for the site is the membership of
Clan Tuatha de Bhriain, the site gets far too many hits to be just those folk. It was because of the heavy traffic to that site that I wanted to make sure I handled 404 errors (page not found) properly. The site is well indexed in Google and other search engines and I wanted to make sure people didn’t just get an ugly error page. A 404 page integrated into the main in8sworld site was setup (I had to modify the htaccess file to allow a php error page). You can see an example of the page by clicking on this fake url.