Malicious bots

[BlueprintMarketing]

I was looking at some recommended keywords and felt sick to my stomach when I saw ilovevitaly.com search shell, resellerclub scam and a few more.

| 2. | | 28(2.29%)ilovevitaly.com search shell | 0.00% | 0(0.00%) | 42.86% | 1.75 | 00:10:13 | 0.00% | 0(0.00%) | $0.00(0.00%) |
| | 3. | resellerclub scam |

I believe I have found the multiple IP addresses in which they're coming from and when I say many I mean I found 200 or so. There from different C blocks so they're very difficult to block easily without blocking legitimate traffic.

I'm using a couple of different web application firewalls with the ability to block it pretty much anything. Does anyone have any device on doing this in a manner that might be more efficient than what I'm doing.I definitely do not want Google to think this is something that I did and penalize somebody this would be horrible. The site is going through Sucuri.net to be cleaned of any possible infection right now I do not know how this happened but zero day attacks are unfortunately a very real reality and unfortunately it could've been 1 million things.

Thanks a million guys. I appreciate your help,
Tom

[kookabara]

Hi,

I have just been hit by the situation. I will be happy to know what could be the reason and how it could be resolved. Appreciate if someone can help on this!

Thanks

Jason

[BlueprintMarketing]

I  Moved the domain to FireHost I am using their WAF & ADC ($3,672.03) the combination is keeping me safe right now. If you want to be able to block these things

https://www.firehost.com/secure-cloud/application-delivery-controller-web-application-firewall

I strongly recommend using a WAF

https://sucuri.net/website-firewall/ probably the best deal on the planet. ($9-$350)

Sucuri at nine dollars to give you DDos seven protection and three and four with everything the other guys offer on their top-of-the-line models it's pretty easy to make a wise decision and spend nine bucks.

http://www.incapsula.com/  enterprise version or personal version excellent WAF (free to 350)

http://www.distilnetworks.com/ ( awesome bot control) 30 days free $100

or

I'm not going to recommend this tool below because I don't know that it will do the job I know the ones above will. Still at 20 bucks it's worth a look

https://www.cloudflare.com/ ( the free version of cloud flare is hundred percent worthless)

I will update this continuously and can't wait to hear more from other people that are dealing with this.

All the best,

Tom

firehost-advanced-adc-waf.pdf

[BlueprintMarketing]

Update if you use WordPress

• **Joshua Strebel - Pagely CEO **Today at 02:12

  Hey Thomas,

  The site is not hacked, if what you are referring to is what is shown here:http://www.incapsula.com/blog/semalt-botnet-spam.html then it is referrer spam. We'll take a look and see what we can do at the network edge. We'll also look over your site as well.

  Check the FAQ at https://support.pagely.com for Answers to commonly asked questions.

• **Joshua Strebel - Pagely CEO **Today at 03:09

  This should help in the meantime: https://pagely.com/blog/2015/01/use-spamreferrerblock-fend-spam-referrer-attacks-website/

  Check the FAQ at https://support.pagely.com for Answers to commonly asked questions.

• Blacklist

  /!\ Unfortunately, this plugin can't remove ALL spam referral traffic. Some domains are massively hijacking Google Analytics ID to push false traffic directly to Google's servers.
  As they do not interfere with your blog or server, the plugin obviously can't do anything against them ; you have to block them in your Analytics account. Click here to view how : https://support.google.com/analytics/answer/2795830?hl=en.

  Blacklist last download date : 2015-01-27 23:48:35

  | Domain | Status |
  | .darodar.com | Can't block |
  | bestsub.com | Blocked |
  | blackhatworth.com | Unknown |
  | buttons-for-website.com | Blocked |
  | casinobonustips.com | Blocked |
  | cenoval.ru | Unknown |
  | civilwartheater.com | Blocked |
  | co.lumb.co | Blocked |
  | cukwiki.com | Blocked |
  | econom.co | Blocked |
  | entourank.com | Blocked |
  | hulfingtonpost.com | Blocked |
  | ilovevitaly.co | Blocked |
  | ilovevitaly.com | Blocked |
  | make-money-online.7makemoneyonline.com | Blocked |
  | priceg.com | Unknown |
  | semalt.semalt.com | Blocked |
  | seoairport.com | Blocked |
  | seokicks.de | Blocked |
  | serw.clicksor.com | Blocked |
  | similarpages.com | Blocked |
  | webstatsdomain.org | Blocked |
  | ymlp.co |

[BlueprintMarketing]

Hi Jason,

You can request the hosting company you're using block the hostnames below. You can also look for their IP addresses however note this is probably a waste of time because they are so easily changed. This is a tool that you can use if you do want to block by IP

http://www.whatsmyip.org/whois-dns-lookup/

In many cases it shows me the hostname has more than one IP address.

Better to block the host name itself then to deal with the IP's.

Adding a web application firewalls that give you control will make a world of difference to your clients and yourself.

Remember you can check if your site is infected for free by using the tools below. Simply put your domain in and run them to make sure you are not infected.

http://sitecheck.sucuri.net/

http://www.unmaskparasites.com/security-report/

https://support.google.com/analytics/answer/2795830?hl=en

I definitely recommend adding one of the WAF's You Can

http://www.incapsula.com/pricing-and-plans.html (free plan will help)

https://sucuri.net/website-firewall/ ( Probably Best Value)

or

http://www.distilnetworks.com/ ( Incredible Bot Protection)

• darodar.com
• bestsub.com
• blackhatworth.com
• buttons-for-website.com
• casinobonustips.com
• cenoval.ru
• civilwartheater.com
• co.lumb.co
• cukwiki.com
• econom.co
• entourank.com
• hulfingtonpost.com
• ilovevitaly.co
• ilovevitaly.com
• make-money-online.7makemoneyonline.com
• priceg.com
• semalt.semalt.com
• seoairport.com
• seokicks.de
• serw.clicksor.com
• similarpages.com
• webstatsdomain.org
• ymlp.co

Here is a list that will allow you to add multiple bad host names to a block list via using a comma in between the host names. I did this just make it easier not to be redundant.

darodar.com,bestsub.com,blackhatworth.com,cenoval.ru,buttons-for-website.com,casinobonustips.com,co.lumb.co,civilwartheater.com,entourank.com,econom.co,cukwiki.com,hulfingtonpost.com,ilovevitaly.co,ilovevitaly.com,make-money-online.7makemoneyonline.com,priceg.com,semalt.semalt.com,seoairport.com,seokicks.de,similarpages.com,serw.clicksor.com,webstatsdomain.org,ymlp.co

Here is a list that will allow you to add multiple bad host names to a block list via using a, in between the host names. I did this just make it easier not to be redundant.

I think you can do some amazing things for very little money with the Sucuri , incapsula (paid) & Distil Networks WAF Allow You to Separate Human, Good Bot, & Bad Bot Page Requests Simply By Changing Your DNS

Why CloudFlare Is Not The Best Fit

https://twitter.com/cloudflare/status/484755523175063552

Tom

YutmSJY.png 1yrz9LU.png rXVGX9z.png F8IrYH1.png