1. Spamer第4次！

1.1. 还是那位吸JB的！

grep suckmyd1ck *
1092202528.98.61540.trail:suckmyd1ck
1162367389.46.63988:name=suckmyd1ck

1.1.1. 日志分析

{{{/var/log/apache> tail -n 22500 httpd-access.log | grep CPUGres | grep 16/Nov/2006 61.149.132.186 - - [16/Nov/2006:05:29:12 +0800] "GET /moin/CPUGres HTTP/1.1" 200 41697 "http://wiki.woodpecker.org.cn/moin/%E9%A6%96%E9%A1%B5" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" ... 61.149.132.186 - - [16/Nov/2006:05:29:18 +0800] "GET /moin/CPUGres?action=edit&editor=gui HTTP/1.1" 200 32929 "http://wiki.woodpecker.org.cn/moin/CPUGres" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" 61.149.132.186 - - [16/Nov/2006:05:29:40 +0800] "POST /moin/CPUGres HTTP/1.1" 200 11208 "http://wiki.woodpecker.org.cn/moin/CPUGres?action=edit&editor=gui" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" ... }}}

吻合 61 开头的IP记录，虽然丫使用了 Fire Fox 2.0 ，但是可怜的家伙只会使用 GUI 编辑器。。。

1.1.2. IP 追查

http://www.ip138.com/ 询问
- 查询结果1：北京市网通(通州区)
- 查询结果2：北京市大兴区 /通州区网通ADSL

果然还是上次地区的

> traceroute 61.149.132.186
traceroute to 61.149.132.186 (61.149.132.186), 64 hops max, 44 byte packets
 1  202.108.44.1 (202.108.44.1)  0.733 ms  0.747 ms  0.570 ms
 2  61.135.148.177 (61.135.148.177)  0.654 ms  0.593 ms  0.445 ms
 3  61.135.143.1 (61.135.143.1)  0.528 ms  0.477 ms  0.933 ms
 4  202.108.46.29 (202.108.46.29)  2.525 ms  1.104 ms  1.067 ms
 5  61.148.3.98 (61.148.3.98)  0.780 ms  0.952 ms  1.067 ms
 6  202.106.36.6 (202.106.36.6)  1.404 ms  1.321 ms  1.193 ms
 7  bt-204-010.bta.net.cn (202.106.204.10)  3.153 ms bt-204-014.bta.net.cn (202.106.204.14)  3.232 ms bt-204-010.bta.net.cn (202.106.204.10)  3.253 ms
 8  * * *

1.2. 下午再次

ohyha and spamantiwhat

attachment:061116-spamer_582x226_scrot.png

attachment:061116-spamer-war_762x229_scrot.png

1.2.1. 海淀 IP

{{{/var/log/apache> tail -n 22500 httpd-access.log | grep PyCon2006 | grep 16/Nov/2006 221.223.182.136 - - [16/Nov/2006:20:09:43 +0800] "GET /moin/PyCon2006 HTTP/1.1" 200 17432 "http://wiki.woodpecker.org.cn/moin/FrontPage" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" 221.223.182.136 - - [16/Nov/2006:20:09:46 +0800] "GET /moin/PyCon2006?action=edit&editor=text HTTP/1.1" 200 10459 "http://wiki.woodpecker.org.cn/moin/PyCon2006" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" 221.223.182.136 - - [16/Nov/2006:20:09:46 +0800] "GET /moin/PyCon2006?action=edit&editor=text HTTP/1.1" 200 10459 "http://wiki.woodpecker.org.cn/moin/PyCon2006" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" 221.223.182.136 - - [16/Nov/2006:20:09:50 +0800] "POST /moin/PyCon2006 HTTP/1.1" 200 13825 "http://wiki.woodpecker.org.cn/moin/PyCon2006?action=edit&editor=text" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0" }}}

http://www.ip138.com/ 询问
- 查询结果1：北京市网通
- 查询结果2：北京市海淀区网通ADSL

1.3. 增强设置

1.3.1. SurgeProtection

增强汹涌编辑：

    surge_action_limits = {
        # allow max. <count> <action> requests per <dt> secs
        # action: (count, dt)
        'show': (250, 120),
        'raw': (30, 60),  # some people use this for css
        'AttachFile': (30, 60),
        'diff': (60, 60),
        'fullsearch': (3, 60),
        'edit': (20, 60),
        'rss_rc': (1, 60),
        'default': (50, 60),
    }

1.3.2. 取消删除

acl_rights_default = u"Trusted:read,write,delete,revert Known:read,write,revert All:read SpamAntiGroup:"
acl_rights_after = u"Known:read"

-  ⇤ ← Revision 16 as of 2006-11-16 12:24:24 → 
  Size: 4639
  Editor: ZoomQuiet
  Comment:
+   ← Revision 17 as of 2006-11-16 12:30:55 → ⇥
  Size: 4216
  Editor: ZoomQuiet
  Comment:
-Deletions are marked like this.
+Additions are marked like this.
 Line 46:
- * `ohyha`{{{moin/data/user> grep ohyha *
1163676573.8.10440:name=ohyha
moin/data/user> cat 1163676573.8.10440
# Data saved '2006-11-16 19:29:35' for id '1163676573.8.10440'
aliasname=
css_url=
date_fmt=
datetime_fmt=
disabled=0
edit_on_doubleclick=0
edit_rows=20
editor_default=text
editor_ui=freechoice
[email protected]
enc_password={SHA}3S7bh+qet6Mv1AVydtOh+rhhwdU=
language=
last_saved=1163676575.72
mailto_author=0
name=ohyha
quicklinks=
remember_last_visit=0
remember_me=1
show_fancy_diff=1
show_nonexist_qm=0
show_page_trail=1
show_toolbar=1
show_topbottom=0
subscribed_pages=
theme_name=woodpecker
tz_offset=0
want_trivial=0
wikiname_add_spaces=0
}}}
-Line 80:
+Line 47:
+ * `ohyha` and `spamantiwhat`
attachment:061116-spamer_582x226_scrot.png

attachment:061116-spamer-war_762x229_scrot.png

=== 海淀 IP ===
-Line 86:
+Line 59:
+ * http://www.ip138.com/ 询问
     * 查询结果1：北京市 网通
    * 查询结果2：北京市海淀区 网通ADSL

Diff for "woodpecker-log/2006-11-16"