Spamer 再次袭来！ ::-- ZoomQuiet [DateTime(2006-11-16T02:07:06Z)] TableOfContents

Include(CPUGnav)

1. Spamer第4次！

1.1. 还是那位吸JB的！

grep suckmyd1ck *
1092202528.98.61540.trail:suckmyd1ck
1162367389.46.63988:name=suckmyd1ck

1.1.1. 日志分析

{{{/var/log/apache> tail -n 22500 httpd-access.log | grep CPUGres | grep 16/Nov/2006 61.149.132.186 - - [16/Nov/2006:05:29:12 +0800] "GET /moin/CPUGres HTTP/1.1" 200 41697 "http://wiki.woodpecker.org.cn/moin/%E9%A6%96%E9%A1%B5" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" ... 61.149.132.186 - - [16/Nov/2006:05:29:18 +0800] "GET /moin/CPUGres?action=edit&editor=gui HTTP/1.1" 200 32929 "http://wiki.woodpecker.org.cn/moin/CPUGres" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" 61.149.132.186 - - [16/Nov/2006:05:29:40 +0800] "POST /moin/CPUGres HTTP/1.1" 200 11208 "http://wiki.woodpecker.org.cn/moin/CPUGres?action=edit&editor=gui" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" ... }}}

• 吻合 61 开头的IP记录，虽然丫使用了 Fire Fox 2.0 ，但是可怜的家伙只会使用 GUI 编辑器。。。

1.1.2. IP 追查

• http://www.ip138.com/ 询问

  • 查询结果1：北京市 网通(通州区)
  • 查询结果2：北京市大兴区 /通州区网通ADSL

• 果然还是上次地区的

  > traceroute 61.149.132.186
  traceroute to 61.149.132.186 (61.149.132.186), 64 hops max, 44 byte packets
   1  202.108.44.1 (202.108.44.1)  0.733 ms  0.747 ms  0.570 ms
   2  61.135.148.177 (61.135.148.177)  0.654 ms  0.593 ms  0.445 ms
   3  61.135.143.1 (61.135.143.1)  0.528 ms  0.477 ms  0.933 ms
   4  202.108.46.29 (202.108.46.29)  2.525 ms  1.104 ms  1.067 ms
   5  61.148.3.98 (61.148.3.98)  0.780 ms  0.952 ms  1.067 ms
   6  202.106.36.6 (202.106.36.6)  1.404 ms  1.321 ms  1.193 ms
   7  bt-204-010.bta.net.cn (202.106.204.10)  3.153 ms bt-204-014.bta.net.cn (202.106.204.14)  3.232 ms bt-204-010.bta.net.cn (202.106.204.10)  3.253 ms
   8  * * *

1.2. 下午再次

• ohyha{{{moin/data/user> grep ohyha *

1163676573.8.10440:name=ohyha moin/data/user> cat 1163676573.8.10440 # Data saved '2006-11-16 19:29:35' for id '1163676573.8.10440' aliasname= css_url= date_fmt= datetime_fmt= disabled=0 edit_on_doubleclick=0 edit_rows=20 editor_default=text editor_ui=freechoice email=[email protected] enc_password={SHA}3S7bh+qet6Mv1AVydtOh+rhhwdU= language= last_saved=1163676575.72 mailto_author=0 name=ohyha quicklinks= remember_last_visit=0 remember_me=1 show_fancy_diff=1 show_nonexist_qm=0 show_page_trail=1 show_toolbar=1 show_topbottom=0 subscribed_pages= theme_name=woodpecker tz_offset=0 want_trivial=0 wikiname_add_spaces=0 }}}

{{{/var/log/apache> tail -n 22500 httpd-access.log | grep PyCon2006 | grep 16/Nov/2006 221.223.182.136 - - [16/Nov/2006:20:09:43 +0800] "GET /moin/PyCon2006 HTTP/1.1" 200 17432 "http://wiki.woodpecker.org.cn/moin/FrontPage" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" 221.223.182.136 - - [16/Nov/2006:20:09:46 +0800] "GET /moin/PyCon2006?action=edit&editor=text HTTP/1.1" 200 10459 "http://wiki.woodpecker.org.cn/moin/PyCon2006" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" 221.223.182.136 - - [16/Nov/2006:20:09:46 +0800] "GET /moin/PyCon2006?action=edit&editor=text HTTP/1.1" 200 10459 "http://wiki.woodpecker.org.cn/moin/PyCon2006" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" 221.223.182.136 - - [16/Nov/2006:20:09:50 +0800] "POST /moin/PyCon2006 HTTP/1.1" 200 13825 "http://wiki.woodpecker.org.cn/moin/PyCon2006?action=edit&editor=text" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" }}}

1.3. 增强设置

1.3.1. SurgeProtection

• 增强汹涌编辑 ：

      surge_action_limits = {
          # allow max. <count> <action> requests per <dt> secs
          # action: (count, dt)
          'show': (250, 120),
          'raw': (30, 60),  # some people use this for css
          'AttachFile': (30, 60),
          'diff': (60, 60),
          'fullsearch': (3, 60),
          'edit': (20, 60),
          'rss_rc': (1, 60),
          'default': (50, 60),
      }

1.3.2. 取消删除

acl_rights_default = u"Trusted:read,write,delete,revert Known:read,write,revert All:read SpamAntiGroup:"
acl_rights_after = u"Known:read"

1.4. 反馈