WXforum.net

Miscellaneous Debris => Tech Corner => Topic started by: Axelvold on September 18, 2009, 05:02:45 PM

Title: 92.62.43.77:6667
Post by: Axelvold on September 18, 2009, 05:02:45 PM

I have a lot of these in my weblog, 92.62.43.77:6667 is there any way to prevent those visitors?

Title: Re: 92.62.43.77:6667
Post by: saratogaWX on September 18, 2009, 08:37:13 PM

According to the RIPE Whois at www.ripe.net

Quote

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '92.62.43.0 - 92.62.43.255'

inetnum:         92.62.43.0 - 92.62.43.255
netname:         NO-UNDERWORLD
descr:           Underworld IRC services Trondheim, Norway
descr:           IRC Infrastructure
country:         NO
admin-c:         UWIR-RIPE
tech-c:          UWIR-RIPE
status:          ASSIGNED PA "status:" definitions
mnt-by:          ITSJEFEN-LIR
source:          RIPE # Filtered

role:            Underworld Incident Response Team
address:         PB 1275 Pirsenteret
address:         NO-7462 Trondheim
address:         Norway
remarks:         92.62.43.77 runs the PROXYSCANNER for the Quakenet IRC Network.
remarks:         It will only scan you if you connect to the IRC network.
remarks:         For More Information see: http://www.quakenet.org/openproxies.html
remarks:         If you were scanned by that IP and believe you do not connect to QuakeNet
remarks:         - We suggest you get your system checked by a Virus/Trojan Scanner.
remarks:         trouble: Our preferred contact method is e-mail!
remarks:         trouble: hostmaster@underworld.no - for technical questions.
remarks:         trouble: abuse@underworld.no - for abuse notifications.
abuse-mailbox:   abuse@underworld.no
admin-c:         HRDY-RIPE
tech-c:          AKAI-RIPE
nic-hdl:         UWIR-RIPE
mnt-by:          ITSJEFEN-LIR
source:          RIPE # Filtered

% Information related to '92.62.32.0/20AS44381'

route:           92.62.32.0/20
descr:           ITsjefen networks
origin:          AS44381
mnt-by:          ITSJEFEN-LIR
source:          RIPE # Filtered

so whoever they are, they're in Norway.

You can use your cPanel to put a block on that IP address, but it would show up in the error log (I think) instead of the access log.   Are you offering any content (like a webcam) using the 6667 port?

Port 6667 UDP is used mostly by Internet Relay Chat and it's also used by Zombie PCs to communicate with a bot-master system.  Not a good thing.  You aren't hosting your site on your own PC are you?

Title: Re: 92.62.43.77:6667
Post by: sam2004gp on September 18, 2009, 08:43:05 PM

I think he is hosting it on his own box.

Title: Re: 92.62.43.77:6667
Post by: Axelvold on September 19, 2009, 02:33:58 AM

Quote from: sam2004gp on September 18, 2009, 08:43:05 PM

I think he is hosting it on his own box.

Thats correct Sam, i'm running my own webserver

I conna check with my son if he is using IRC.