Real IP Adresses for EveKnows.com and XXGasm.com?
 

We need to block them at IP4 level is possible.

Help would be appreciated. From illegal content to CP these guys got it all...
EveKnows.com and XXGasm.com

Thanks for any help.

Who do you pay for that info, and how much?

Well, the owner is fucking over so many people by site scraping then adding pop up hell that usually someone out there who knows gives it for free. Those are poison sites.
I'm not making money from the info but its nice to get bad sites taken down.

If more people post in this thread that are known here I will work for free for the community, as I have before.

I'm sorry but I don't know who you are, your properties, history, etc. I'm all about supporting the community or paid work from unknowns. Best of luck to you 👍

Sure. No problem. Thanks anyway.

This is another bad site. jpg4.info

They are creating back links to our sites and their back links have cp in them.

Here is a page from xxgasm....

xxgasm.com/gokkun-idol/]Gokkun Idol

All stolen content from many programs being used for other purposes.

What are ALL of YOUR sites they are creating backlinks to?

Sent you a PM.

Here is the grandaddy of blackhat sites

jjgirls.com - To block them would be great.

On my phone can't get your PM but yeah I C U BH boy. Carry on 🍆💦

Someone in our Slack Team might be able to help.

They could be lazy and use something that sticks out like a sore thumb (it's obvious from the headers that it's not a real browser) but chances are that they've been blocked before based on this, and so they're now doing something more sophisticated.

IP level blocks won't work very well either, since they can just use proxies.

When I was checking these guys before they often show up in mobile networks out of Hong Kong.

What does that tell you?

Well, I know one of them lives there. That is certain. There are more than 1 persons running their op.
But IPs bounce around, websites bounce around, IPs bounce around.

Bumpin the Pumpkin.

use $ dig :helpme

and $ipcalc ip/CIDR

104.143.10.70 looks fishy I'd redirect it to a Tumblr. I wouldn't let Versaweb or Leaseweb near my sites if I was you.

unillusionedmethodizing.xyz
weeran.xyz
nibpau.xyz

89.163.217.5 = weeran.xyz
104.143.10.68 = nibpau.xyz
104.143.10.69 = siddpp.xyz
104.143.10.70 unillusionedmethodizing.xyz & XXGasm.com
89.163.217.5. Not good

Webtropia.com is connected to these you can contact this guy:

Christoph Herrnkind
[email protected]
+49.21117165977

You guys, Blade and Barry are awesome. Thank you.

Building on that: there's probably companies which sell lists, or more likely, access to an API, which will help you determine whether a particular IP is consumer facing, or more likely to be a server in a data centre. That should help quickly narrow down suspicious IPs. Just remember it won't be 100% accurate.

Another possibility may be to analyse logs and look for patterns that suggest it's not a human using the site interactively. For example, on a forum I run, I found a large number of spammers were "filling in" and submitting the registration form less than one second after loading it.

We block Hong Kong and China...

Before blocking them $xx,xxx per month
After blocking them $xx,xxx per month

They don't buy shit.

Blocking is too obvious, always send to a honeypot is my way :2 cents: