Hello all, I have a question. In badip.txt, is there a way to block anything from .speedy.com.ar? I am getting hit a lot from there and they seem to be using many different IP every time. Thanks.

--- Mystic BBS v1.12 A35 (Windows/64)
* Origin: Necronomicon BBS - necrobbs.strangled.net (21:1/122)

Can't you do domain wilcards

On 08:20 22/11 , Necromaster wrote:

Hello all, I have a question. In badip.txt, is there a way to block anything >from .speedy.com.ar? I am getting hit a lot from there and they seem to be >using many different IP every time. Thanks.

--- Mystic BBS v1.12 A35 (Windows/64)
* Origin: Necronomicon BBS - necrobbs.strangled.net (21:1/122)

--
yrNews Usenet Reader for iOS
http://appstore.com/yrNewsUsenetReader

--- Mystic BBS/NNTP v1.12 A36 2017/11/21 (Linux/64)
* Origin: -=The ByteXchange BBS : bbs.thebytexchange.com=- (21:1/107)

Necromaster,

Hello all, I have a question. In badip.txt, is there a way to block anything from .speedy.com.ar? I am getting hit a lot from there and
they seem to be using many different IP every time. Thanks.

Got the exact same thing from the same host. Pesker attempted at least 20 times today while I was at work.

Sincerely,
Jon Justvig

--- Mystic BBS v1.12 A35 (Windows/32)
* Origin: Raiders Inc BBS -- vintagebbsing.com (21:1/154)

On 11/22/17, Jon Justvig said the following...

Necromaster,

Hello all, I have a question. In badip.txt, is there a way to block anything from .speedy.com.ar? I am getting hit a lot from there and they seem to be using many different IP every time. Thanks.

Got the exact same thing from the same host. Pesker attempted at least
20 times today while I was at work.

I'd consider blocking all of Argentina (.ar) in that case. Looks like it's an Argentina ISP .speedy.com.ar, so a large range of addresses.

--- Mystic BBS v1.12 A36 2017/11/20 (Linux/64)
* Origin: Mystic AlphaTest bcw142.zapto.org:2323 (21:1/145.2)

Necromaster,

Hello all, I have a question. In badip.txt, is there a way to block anything from .speedy.com.ar? I am getting hit a lot from there and they seem to be using many different IP every time. Thanks.

Got the exact same thing from the same host. Pesker attempted at least
20 times today while I was at work.

I had to block that country out completely, it was getting out of hand.

--- Mystic BBS v1.12 A35 (Windows/64)
* Origin: Necronomicon BBS - necrobbs.strangled.net (21:1/122)

bcw142,

On 11/23/17, bcw142 said the following...

I'd consider blocking all of Argentina (.ar) in that case. Looks like
it's an Argentina ISP .speedy.com.ar, so a large range of addresses.

It is a real shame that a whole country has to be blocked for people that abuse.

Sincerely,
Jon Justvig

--- Mystic BBS v1.12 A35 (Windows/32)
* Origin: Raiders Inc BBS -- vintagebbsing.com (21:1/154)

Necromaster,

On 11/24/17, Necromaster said the following...

I had to block that country out completely, it was getting out of hand.

I am considering doing the same thing, it is just too bad that has to happen
to a whole country. Consider the USA having a bad person abusing an IP and
the USA had something like .us and that country blocked .us. That is a big deal. I do not really want to, but if it does not stop, hands tied.

Sincerely,
Jon Justvig

--- Mystic BBS v1.12 A35 (Windows/32)
* Origin: Raiders Inc BBS -- vintagebbsing.com (21:1/154)

I'd consider blocking all of Argentina (.ar) in that case. Looks like it's an Argentina ISP .speedy.com.ar, so a large range of addresses.

that looks very familiar

--- Mystic BBS v1.12 A35 (Linux/64)
* Origin: tEMPLEoFsYRINX.info (21:1/167)

If you are running Linux and have ufw you can do even more creative blocking.

I just have the issue as everyone with the ghost nodes and nodes stuck due to bot hacking attempts to routers and such.

On 02:57 25/11 , syrinxcultist wrote:

I'd consider blocking all of Argentina (.ar) in that case. Looks

like

it's an Argentina ISP .speedy.com.ar, so a large range of addresses.

that looks very familiar

--- Mystic BBS v1.12 A35 (Linux/64)
* Origin: tEMPLEoFsYRINX.info (21:1/167)

--
yrNews Usenet Reader for iOS
http://appstore.com/yrNewsUsenetReader

--- Mystic BBS/NNTP v1.12 A36 2017/11/21 (Linux/64)
* Origin: -=The ByteXchange BBS : bbs.thebytexchange.com=- (21:1/107)

On 11/24/17, Necromaster said the following...

Got the exact same thing from the same host. Pesker attempted at lea 20 times today while I was at work.

I had to block that country out completely, it was getting out of hand.

speedy.com.ar is a broadband provider in Argentina, probably the most popular one. Unfortunately it is a reality, I get pounded by them all the time...

----
Regards from Nighthawk - AKA Flavio Bessa
Sysop of Saturn's Orbit BBS - Rio de Janeiro, Brazil
fcbessa@gmail.com - saturnsorbit.hopto.org

--- Mystic BBS v1.12 A35 (macOS/64)
* Origin: Chiron, orbiting Saturn - Brazil (21:1/146.1)

On 11/24/17, Jon Justvig said the following...

It is a real shame that a whole country has to be blocked for people that abuse.

Argentina, Chile, Uruguay, Paraguay, Brazil... Filled with people with a lot of time and little to do. ;(

I have these countries open here for obvious reasons, but I had to block India, China, Turkey...

----
Regards from Nighthawk - AKA Flavio Bessa
Sysop of Saturn's Orbit BBS - Rio de Janeiro, Brazil
fcbessa@gmail.com - saturnsorbit.hopto.org

--- Mystic BBS v1.12 A35 (macOS/64)
* Origin: Chiron, orbiting Saturn - Brazil (21:1/146.1)

Nighthawk,

On 11/25/17, Nighthawk said the following...

speedy.com.ar is a broadband provider in Argentina, probably the most popular one. Unfortunately it is a reality, I get pounded by them all the time...

What is popular for one is a misery for another. Time to get some cutting done!

Sincerely,
Jon Justvig

--- Mystic BBS v1.12 A36 2017/11/25 (Windows/32)
* Origin: Raiders Inc BBS -- vintagebbsing.com (21:1/154)

Nighthawk,

On 11/25/17, Nighthawk said the following...

Argentina, Chile, Uruguay, Paraguay, Brazil... Filled with people
with a lot of time and little to do. ;(

Time to get the whip out! :)

I have these countries open here for obvious reasons, but I had to block India, China, Turkey...

Yeah, abusers all over. One bad spoil many unfortunately.

Sincerely,
Jon Justvig

--- Mystic BBS v1.12 A36 2017/11/25 (Windows/32)
* Origin: Raiders Inc BBS -- vintagebbsing.com (21:1/154)

Hi G00r00,

Can you foresee any problems with automatically deleting the blacklist.txt file, say monthly, to keep it from growing too big? Can this cause Mystic to slow down having to scan such a large file as it gets bigger? Would it help to manually sort the file occasionally as well?

All of this would be done from a Windows script/batch file :) with MIS down.


.- Keep the faith, --------------------------------------------------.
| |
| Ben aka cMech Web: http|ftp|binkp|telnet|ssh://cmech.dynip.com |
| |
| vvvvvv Email: fido4cmechSPAM(at)lusfiberBLOCK.net |
| { O O } Home page: http://cmech.dynip.com/homepage/ |
| __m___oo___m__ |
`--| | | |-- -------------------------------------------------'

... There must be some kind of way outta here said the joker to the thief.
--- GoldED+/W32-MSVC v1.1.5-g20180902 +Mystic 1.12 pa43/W32 2019/02/10 14:58:40
* Origin: FSXNet - Positronium: telnet://cmech.dynip.com (21:2/117)

Can you foresee any problems with automatically deleting the
blacklist.txt file, say monthly, to keep it from growing too big? Can
this cause Mystic to slow down having to scan such a large file as it
gets bigger? Would it help to manually sort the file occasionally as
well?

There shouldn't be any problems with deleting the blacklist.txt file whenever you feel its needed. As far as sorting the list, I do not believe it would give any noticable benefit.

To answer the large file question: I did a little test out of curiosity:

On my laptop it takes Mystic an average of 70 milliseconds to compare an incoming IP against 1 million blacklisted IP addresses. My laptop has an SSD drive and has a high end 8750H processor as its my main computer (I don't own a desktop) so its pretty fast... significantly faster than a Pi thats for sure.

But 70ms per 1 million records is pretty fast, and when I dropped it down from 1 million records to a more realistic 1000 records it dropped all the way down to 0 milliseconds. It was so fast that I would need a nanosecond to measure!

On my hardware it doesn't slow down Mystic enough for our brains to even
notice it happening. Performance varies so greatly between hardware but it doesn't feel like it'd be something that noticably slows down your BBS.

--- Mystic BBS v1.12 A43 2019/02/08 (Linux/64)
* Origin: Sector 7 (21:1/108)

*
* On Thursday 14 Feb 2019 045 at 03:00 AM,
* g00r00 said to Cmech,
* about Re: Blocking ...
*

Cool, thanks for info :)


.- Keep the faith, --------------------------------------------------.
| |
| Ben aka cMech Web: http|ftp|binkp|telnet|ssh://cmech.dynip.com |
| |
| vvvvvv Email: fido4cmechSPAM(at)lusfiberBLOCK.net |
| { O O } Home page: http://cmech.dynip.com/homepage/ |
| __m___oo___m__ |
`--| | | |-- -------------------------------------------------'

... Caution: living too long may be fatal.
--- GoldED+/W32-MSVC v1.1.5-g20180902 +Mystic 1.12 pa43/W32 2019/02/10 14:58:40
* Origin: FSXNet - Positronium: telnet://cmech.dynip.com (21:2/117)

On 02-14-19 03:00, g00r00 wrote to Cmech <=-

There shouldn't be any problems with deleting the blacklist.txt file whenever you feel its needed. As far as sorting the list, I do not believe it would give any noticable benefit.

I can see only one benefit of occasionally deleting the blacklist.txt file, and that's to open access to users on dynamic IPs that were previously blocked. Looks like from a performance point of view, there's no reason to delete the file. :)


... Relax. It's only ones and zeroes.
=== MultiMail/Win v0.51
--- SBBSecho 3.03-Linux
* Origin: Freeway BBS Bendigo,Australia freeway.apana.org.au (21:1/109)

Can you foresee any problems with automatically deleting the
blacklist.txt file, say monthly, to keep it from growing too big? Can

To answer the large file question: I did a little test out of
curiosity:

On my laptop it takes Mystic an average of 70 milliseconds to compare
an incoming IP against 1 million blacklisted IP addresses. My laptop
has an SSD drive and has a high end 8750H processor as its my main computer (I don't own a desktop) so its pretty fast... significantly faster than a Pi thats for sure.

Thanks for doing that test. That was a topic that I had wondered about but I can put it to rest now.

... Internal Error: The system has been taken over by sheep at line 19960
___ MultiMail/Linux v0.51

--- Mystic BBS/QWK v1.12 A42 2018/12/27 (Raspberry Pi/32)
* Origin: searchbbs.fsxnet.nz:34123 / SSH 2222 (21:1/161)