how can i trace this fucker? plz help!! - GoFuckYourself.com

Lane · 09-13-2001, 02:56 PM

someone is using hitbot on my site causing me to send fake hits to my traders

the proxy ips are these:

212.138.47.13
212.138.47.11
212.138.47.12

he or she uses all the same ips the whole time so my trades record to high repetetive hits from these ips. it even generates too many clicks when it goes to my trade partners.

i edited my script to find out who this is and the $HTTP_X_FORWARDED_FOR variable turns out to be this ip:

212.71.51.81

how can i find out who the fuck this is?
tracert in Dos prompt doesnt give too much info..

do you have any ideas how to find this fucker?

thanks,
Lane

jimmyf · 09-13-2001, 03:07 PM

Your not going to believe this but here's one
212.138.47.13

This is the RIPE Whois server.
% The objects are in RPSL format.
% Please visit http://www.ripe.net/rpsl for more information.
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-serv...copyright.html

inetnum: 212.138.47.0 - 212.138.47.255
netname: ISU-5
descr: Internet Service Unit ISU
country: SA
admin-c: KR6046-RIPE
tech-c: KR6046-RIPE
status: ASSIGNED PA
mnt-by: KACST-ISU-MNT
mnt-lower: KACST-ISU-MNT
remarks: ------------------------------------------------------
remarks: Part of this IP block has been used for proxy/cache
remarks: service at the National level in Saudi Arabia. All
remarks: Saudi Arabia web traffic will come from this IP block.
remarks:
remarks: NOTE: If you experience high volume of traffic from
remarks: IP in this block it is because your site is very
remarks: popular/famous of Saudi Arabia community.
remarks: ------------------------------------------------------
changed: [email protected] 19991005
changed: [email protected] 19991212
changed: [email protected] 20010707
source: RIPE

route: 212.138.0.0/16
descr: Saudi Arabia backbone and local registry address space
origin: AS8895
notify: [email protected]
mnt-by: ISU-NOC
changed: [email protected] 20000114
source: RIPE

role: KACST ROLE
address: Saudi Network Information Center, ISU
address: King Abdulaziz City for Science and Technology,
address: P.O.Box 6086, Riyadh 11442, Saudi Arabia.
phone: +9661 481 3932
fax-no: +9661 481 3254
e-mail: [email protected]
trouble: [email protected]
admin-c: ZOM1-RIPE
tech-c: RA705-RIPE
tech-c: ANAS1-RIPE
nic-hdl: KR6046-RIPE
remarks: This Role object is for handling and maintaining all
remarks: IP Blocks registered by SaudiNIC(LIR) in Saudi Arabia.
mnt-by: KACST-ISU-MNT
changed: [email protected] 20010701
source: RIPE

Lane · 09-13-2001, 03:20 PM

holy mutha fucka

Lane · 09-13-2001, 03:26 PM

Bin Laden must be surfing my site

muhahahaahha

[This message has been edited by Lane (edited 09-13-2001).]

jimmyf · 09-13-2001, 03:27 PM

inetnum: 212.138.47.0 - 212.138.47.255
netname: ISU-5
descr: Internet Service Unit ISU
country: SA
admin-c: KR6046-RIPE
tech-c: KR6046-RIPE
status: ASSIGNED PA
mnt-by: KACST-ISU-MNT
mnt-lower: KACST-ISU-MNT
remarks: ------------------------------------------------------
remarks: Part of this IP block has been used for proxy/cache
remarks: service at the National level in Saudi Arabia. All
remarks: Saudi Arabia web traffic will come from this IP block.
remarks:
remarks: NOTE: If you experience high volume of traffic from
remarks: IP in this block it is because your site is very
remarks: popular/famous of Saudi Arabia community.
remarks: ------------------------------------------------------
changed: [email protected] 19991005
changed: [email protected] 19991212
changed: [email protected] 20010707
source: RIPE

route: 212.138.0.0/16
descr: Saudi Arabia backbone and local registry address space
origin: AS8895
notify: [email protected]
mnt-by: ISU-NOC
changed: [email protected] 20000114
source: RIPE

role: KACST ROLE
address: Saudi Network Information Center, ISU
address: King Abdulaziz City for Science and Technology,
address: P.O.Box 6086, Riyadh 11442, Saudi Arabia.
phone: +9661 481 3932
fax-no: +9661 481 3254
e-mail: [email protected]
trouble: [email protected]
admin-c: ZOM1-RIPE
tech-c: RA705-RIPE
tech-c: ANAS1-RIPE
nic-hdl: KR6046-RIPE
remarks: This Role object is for handling and maintaining all
remarks: IP Blocks registered by SaudiNIC(LIR) in Saudi Arabia.
mnt-by: KACST-ISU-MNT
changed: [email protected] 20010701
source: RIPE

212.138.47.12

inetnum: 212.138.47.0 - 212.138.47.255
netname: ISU-5
descr: Internet Service Unit ISU
country: SA
admin-c: KR6046-RIPE
tech-c: KR6046-RIPE
status: ASSIGNED PA
mnt-by: KACST-ISU-MNT
mnt-lower: KACST-ISU-MNT
remarks: ------------------------------------------------------
remarks: Part of this IP block has been used for proxy/cache
remarks: service at the National level in Saudi Arabia. All
remarks: Saudi Arabia web traffic will come from this IP block.
remarks:
remarks: NOTE: If you experience high volume of traffic from
remarks: IP in this block it is because your site is very
remarks: popular/famous of Saudi Arabia community.
remarks: ------------------------------------------------------
changed: [email protected] 19991005
changed: [email protected] 19991212
changed: [email protected] 20010707
source: RIPE

route: 212.138.0.0/16
descr: Saudi Arabia backbone and local registry address space
origin: AS8895
notify: [email protected]
mnt-by: ISU-NOC
changed: [email protected] 20000114
source: RIPE

role: KACST ROLE
address: Saudi Network Information Center, ISU
address: King Abdulaziz City for Science and Technology,
address: P.O.Box 6086, Riyadh 11442, Saudi Arabia.
phone: +9661 481 3932
fax-no: +9661 481 3254
e-mail: [email protected]
trouble: [email protected]
admin-c: ZOM1-RIPE
tech-c: RA705-RIPE
tech-c: ANAS1-RIPE
nic-hdl: KR6046-RIPE
remarks: This Role object is for handling and maintaining all
remarks: IP Blocks registered by SaudiNIC(LIR) in Saudi Arabia.
mnt-by: KACST-ISU-MNT
changed: [email protected] 20010701
source: RIPE

and the last one on your list
212.138.47.12
AT&T ITS (NET-ATT)
200 Laurel Avenue South
Middletown, NJ 07748
US

Netname: ATT
Netblock: 12.0.0.0 - 12.255.255.255
Maintainer: ATTW

Coordinator:
Kostick, Deirdre (DK71-ARIN) [email protected]
(888)613-6330

Domain System inverse mapping provided by:

DBRU.BR.NS.ELS-GMS.ATT.NET 199.191.128.106
DMTU.MT.NS.ELS-GMS.ATT.NET 12.127.16.70
CBRU.BR.NS.ELS-GMS.ATT.NET 199.191.128.105
CMTU.MT.NS.ELS-GMS.ATT.NET 12.127.16.69

Record last updated on 06-Nov-2000.
Database last updated on 10-Sep-2001 23:16:26 EDT.

jimmyf · 09-13-2001, 03:32 PM

Lane, I think you've got to read between the lines.

I think it's the CIA monitoring your site looking for Bin Laden.

Shit they should be knocking on your door any time now.

You sure you don't know this guy Bin Laden?

Jim

Lane · 09-13-2001, 03:44 PM

hehehehe

what about this ip?

212.71.51.81

and can you give me the url where you trace it like this?

09-13-2001, 02:56 PM	#1
Lane Will code for food... Join Date: Apr 2001 Location: Buckeye, AZ Posts: 8,496	how can i trace this fucker? plz help!! someone is using hitbot on my site causing me to send fake hits to my traders the proxy ips are these: 212.138.47.13 212.138.47.11 212.138.47.12 he or she uses all the same ips the whole time so my trades record to high repetetive hits from these ips. it even generates too many clicks when it goes to my trade partners. i edited my script to find out who this is and the $HTTP_X_FORWARDED_FOR variable turns out to be this ip: 212.71.51.81 how can i find out who the fuck this is? tracert in Dos prompt doesnt give too much info.. do you have any ideas how to find this fucker? thanks, Lane

09-13-2001, 03:07 PM	#2
jimmyf OU812 Join Date: Feb 2001 Location: California Posts: 12,651	Your not going to believe this but here's one 212.138.47.13 This is the RIPE Whois server. % The objects are in RPSL format. % Please visit http://www.ripe.net/rpsl for more information. % Rights restricted by copyright. % See http://www.ripe.net/ripencc/pub-serv...copyright.html inetnum: 212.138.47.0 - 212.138.47.255 netname: ISU-5 descr: Internet Service Unit ISU country: SA admin-c: KR6046-RIPE tech-c: KR6046-RIPE status: ASSIGNED PA mnt-by: KACST-ISU-MNT mnt-lower: KACST-ISU-MNT remarks: ------------------------------------------------------ remarks: Part of this IP block has been used for proxy/cache remarks: service at the National level in Saudi Arabia. All remarks: Saudi Arabia web traffic will come from this IP block. remarks: remarks: NOTE: If you experience high volume of traffic from remarks: IP in this block it is because your site is very remarks: popular/famous of Saudi Arabia community. remarks: ------------------------------------------------------ changed: [email protected] 19991005 changed: [email protected] 19991212 changed: [email protected] 20010707 source: RIPE route: 212.138.0.0/16 descr: Saudi Arabia backbone and local registry address space origin: AS8895 notify: [email protected] mnt-by: ISU-NOC changed: [email protected] 20000114 source: RIPE role: KACST ROLE address: Saudi Network Information Center, ISU address: King Abdulaziz City for Science and Technology, address: P.O.Box 6086, Riyadh 11442, Saudi Arabia. phone: +9661 481 3932 fax-no: +9661 481 3254 e-mail: [email protected] trouble: [email protected] admin-c: ZOM1-RIPE tech-c: RA705-RIPE tech-c: ANAS1-RIPE nic-hdl: KR6046-RIPE remarks: This Role object is for handling and maintaining all remarks: IP Blocks registered by SaudiNIC(LIR) in Saudi Arabia. mnt-by: KACST-ISU-MNT changed: [email protected] 20010701 source: RIPE

09-13-2001, 03:20 PM	#3
Lane Will code for food... Join Date: Apr 2001 Location: Buckeye, AZ Posts: 8,496	holy mutha fucka

09-13-2001, 03:26 PM	#4
Lane Will code for food... Join Date: Apr 2001 Location: Buckeye, AZ Posts: 8,496	Bin Laden must be surfing my site muhahahaahha [This message has been edited by Lane (edited 09-13-2001).]

09-13-2001, 03:27 PM	#5
jimmyf OU812 Join Date: Feb 2001 Location: California Posts: 12,651	inetnum: 212.138.47.0 - 212.138.47.255 netname: ISU-5 descr: Internet Service Unit ISU country: SA admin-c: KR6046-RIPE tech-c: KR6046-RIPE status: ASSIGNED PA mnt-by: KACST-ISU-MNT mnt-lower: KACST-ISU-MNT remarks: ------------------------------------------------------ remarks: Part of this IP block has been used for proxy/cache remarks: service at the National level in Saudi Arabia. All remarks: Saudi Arabia web traffic will come from this IP block. remarks: remarks: NOTE: If you experience high volume of traffic from remarks: IP in this block it is because your site is very remarks: popular/famous of Saudi Arabia community. remarks: ------------------------------------------------------ changed: [email protected] 19991005 changed: [email protected] 19991212 changed: [email protected] 20010707 source: RIPE route: 212.138.0.0/16 descr: Saudi Arabia backbone and local registry address space origin: AS8895 notify: [email protected] mnt-by: ISU-NOC changed: [email protected] 20000114 source: RIPE role: KACST ROLE address: Saudi Network Information Center, ISU address: King Abdulaziz City for Science and Technology, address: P.O.Box 6086, Riyadh 11442, Saudi Arabia. phone: +9661 481 3932 fax-no: +9661 481 3254 e-mail: [email protected] trouble: [email protected] admin-c: ZOM1-RIPE tech-c: RA705-RIPE tech-c: ANAS1-RIPE nic-hdl: KR6046-RIPE remarks: This Role object is for handling and maintaining all remarks: IP Blocks registered by SaudiNIC(LIR) in Saudi Arabia. mnt-by: KACST-ISU-MNT changed: [email protected] 20010701 source: RIPE 212.138.47.12 inetnum: 212.138.47.0 - 212.138.47.255 netname: ISU-5 descr: Internet Service Unit ISU country: SA admin-c: KR6046-RIPE tech-c: KR6046-RIPE status: ASSIGNED PA mnt-by: KACST-ISU-MNT mnt-lower: KACST-ISU-MNT remarks: ------------------------------------------------------ remarks: Part of this IP block has been used for proxy/cache remarks: service at the National level in Saudi Arabia. All remarks: Saudi Arabia web traffic will come from this IP block. remarks: remarks: NOTE: If you experience high volume of traffic from remarks: IP in this block it is because your site is very remarks: popular/famous of Saudi Arabia community. remarks: ------------------------------------------------------ changed: [email protected] 19991005 changed: [email protected] 19991212 changed: [email protected] 20010707 source: RIPE route: 212.138.0.0/16 descr: Saudi Arabia backbone and local registry address space origin: AS8895 notify: [email protected] mnt-by: ISU-NOC changed: [email protected] 20000114 source: RIPE role: KACST ROLE address: Saudi Network Information Center, ISU address: King Abdulaziz City for Science and Technology, address: P.O.Box 6086, Riyadh 11442, Saudi Arabia. phone: +9661 481 3932 fax-no: +9661 481 3254 e-mail: [email protected] trouble: [email protected] admin-c: ZOM1-RIPE tech-c: RA705-RIPE tech-c: ANAS1-RIPE nic-hdl: KR6046-RIPE remarks: This Role object is for handling and maintaining all remarks: IP Blocks registered by SaudiNIC(LIR) in Saudi Arabia. mnt-by: KACST-ISU-MNT changed: [email protected] 20010701 source: RIPE and the last one on your list 212.138.47.12 AT&T ITS (NET-ATT) 200 Laurel Avenue South Middletown, NJ 07748 US Netname: ATT Netblock: 12.0.0.0 - 12.255.255.255 Maintainer: ATTW Coordinator: Kostick, Deirdre (DK71-ARIN) [email protected] (888)613-6330 Domain System inverse mapping provided by: DBRU.BR.NS.ELS-GMS.ATT.NET 199.191.128.106 DMTU.MT.NS.ELS-GMS.ATT.NET 12.127.16.70 CBRU.BR.NS.ELS-GMS.ATT.NET 199.191.128.105 CMTU.MT.NS.ELS-GMS.ATT.NET 12.127.16.69 Record last updated on 06-Nov-2000. Database last updated on 10-Sep-2001 23:16:26 EDT.

09-13-2001, 03:32 PM	#6
jimmyf OU812 Join Date: Feb 2001 Location: California Posts: 12,651	Lane, I think you've got to read between the lines. I think it's the CIA monitoring your site looking for Bin Laden. Shit they should be knocking on your door any time now. You sure you don't know this guy Bin Laden? Jim

09-13-2001, 03:44 PM	#7
Lane Will code for food... Join Date: Apr 2001 Location: Buckeye, AZ Posts: 8,496	hehehehe what about this ip? 212.71.51.81 and can you give me the url where you trace it like this?