One of those utterly disgusting hackers that abound on my website since Xmas last. I've reported most of them (and have got to know some rather nice sys admins in the process); but I do not think reporting this one will help. Their provider, iWeb Technologies Inc., from Canada, ("Fast, secure, iWeb!") does not have an abuse address, and it's a fact that this IP has been misbehaving for at least a month, without any measures taken; so its only fair to assume the provider is turning a blind eye. My advice would be: block the whole CIDR range! (There's a new hack around, which is extremely bulky and meticulous, and can slow down your traffic even if it's not successful. Each time one of those scripts hits my websites -- and hammers away for half an hour, at a speed of five requests per second -- my log files swell by at least 400 KB. Sorry I don't describe the script in detail -- but, believe ma, should they come after you, some day, you'll recognize them by their sheer bulk, and by the fact that every single line of their request ends in "www.google.com/humans.txt?") Let me repeat my advice: block the whole CIDR range.
Followup: A Google search confirmed that the website which is run under this IP was hacked. According to xatrix.org, "kreationet.com was hacked and defaced on Mon, 13 Jan 2014 16:57:31 +0100. Following a submitted report from a group or an individual called ./cyb3r killer, our robots made a screenshot of the website." Well, but this was in January. One might expect that they could have come up with a solution during the last two months. Instead, the IP is still running wild ... or have they been hacked again?
Please help us keep Internet safer and cleaner by leaving a descriptive comment about 184.107.210.42 IP address
- Hacked Gmail accounts
- WordPress Hacking Attempts
- SSH Hacking Attempts
- Why Can't I See The Exact Address?
DNSBL* - is a list of IP addresses published through the Internet Domain Name Service (DNS) either as a zone file that can be used by DNS server software, or as a live DNS zone that can be queried in real-time. DNSBLs are most often used to publish the addresses of computers or networks linked to spamming; most mail server software can be configured to reject or flag messages which have been sent from a site listed on one or more such lists.
WHOIS** - is a query/response protocol that is widely used for querying databases in order to determine the registrant or assignee of Internet resources, such as a domain name, an IP address block, or an autonomous system number. WHOIS lookups were traditionally performed with a command line interface application, and network administrators predominantly still use this method, but many simplified web-based tools exist. WHOIS services are typically communicated using the Transmission Control Protocol (TCP). Servers listen to requests on the well-known port number 43.
** Approximate Geographic Location - This is NOT the exact geographical location of the person/organization with the given IP address. However, this should still give you a good idea about the area/region where this person/orgranization is located.